Archive
28 May 2025
Vulnerabilities first published on this day (UTC), newest first.
69 results · Feed
-
Low 3.4
A buffer over-read in Fortinet FortiOS versions 7.4.0 through 7.4.3, versions 7.2.0 through 7.2.7, and versions 7.0.0 t…
-
High 7.4
An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 t…
-
Medium 6.1
WP Attachments <= 5.0.12 - Reflected Cross-Site Scripting via attachment_id Parameter
The WP Attachments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attachment_id’ parameter in all versions up to, and including, 5.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unaut…
-
Critical 9.3
Unauthenticated Arbitrary Command Injection in Evertz SDVN
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network …
-
Medium 4.8CVE-2025-5025 Public exploit
No QUIC certificate pinning with wolfSSL
libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, faili…
-
Medium 6.5
QUIC certificate check skip with wolfSSL
libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.
-
High 8.8
MasterStudy LMS Pro <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload
The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm_lms_add_assignment_attachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated …
-
Medium 4.9
IBM Security Guardium information disclosure
IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of input.
-
Medium 4.3
IBM Security Guardium information disclosure
IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check.
-
Medium 4.3
IBM Security Guardium information disclosure
IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
-
Medium 6.5
Incorrect access control in M2Soft CROWNIX Report & ERS affected v7.x to v7.4.3.599 and v8.x to v8.0.3.79 allows unauth…
-
Medium 6.5
An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1…
-
Medium 6.5
An arbitrary file upload vulnerability in M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.…
-
High 7.2
Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.
-
High 7.2
Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink.
-
Medium 5.3
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /hea…
KEV Jul 1, 2025 -
Medium 5.0
Netwrix Directory Manager (formerly Imanami GroupID) before and including v.11.0.0.0 and after v.11.1.25134.03 has Inco…
-
Low 3.2
The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilit…
-
Medium 4.3
The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and the…
-
Medium 4.0
The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token…
-
Low 2.8
The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content m…
-
Critical 9.1
Netwrix Directory Manager (formerly Imanami GroupID) v11.0.0.0 and before & after v.11.1.25134.03 inserts Sensitive Inf…
-
Medium 4.3
The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses,…
-
Medium 4.0CVE-2025-48928 Exploited
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalen…
KEV Jul 1, 2025 -
Medium 6.5
Netwrix Directory Manager (formerly Imanami GroupID) v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Auth…
-
Critical 9.8
An issue in Tenda W18E v.2.0 v.16.01.0.11 allows an attacker to execute arbitrary code via the editing functionality of…
-
High 8.6
Sourcecodester Web-based Pharmacy Product Management System v.1.0 has a file upload vulnerability. An attacker can uplo…
-
High 7.2
Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted paramet…
-
Medium 5.3
Netwrix Directory Manager v.11.0.0.0 and before & after v.11.1.25134.03 contains a hardcoded password.