Skip to content
OpenAdvisories

Archive

3 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /3 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 8.4
    CVE-2025-53367 Public exploit

    DjVuLibre OOB-Write Vulnerability in MMRDecoder

    DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays with…

    DjvuNet DjVuLibre djvulibre djvulibre Debian Ubuntu
  • Critical 9.3
    CVE-2025-34089 Public exploit

    Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injection

    An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disabled (i.e., the "Allo…

    Aexol Studio Remote for Mac
  • Critical 9.0
    CVE-2025-34087 Public exploit

    Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution

    An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string…

    pi-hole web
  • High 8.6
    CVE-2025-34088 Public exploit

    Pandora FMS Authenticated Remote Code Execution via Ping Module

    An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operat…

    Artica ST Pandora FMS
  • Critical 9.3
    CVE-2025-34082 Public exploit

    IGEL OS Secure Terminal and Secure Shadow Remote Code Execution

    A command injection vulnerability exists in IGEL OS versions prior to 11.04.270 within the Secure Terminal and Secure Shadow services. The flaw arises due to improper input sanitization in the handling of specially crafted PROXYCMD commands on TCP ports 30022…

    IGEL OS
  • High 7.5
    CVE-2025-34086 Public exploit

    Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename

    Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, whic…

    bolt CMS bolt/bolt bolt Azure Linux Packagist
  • Critical 9.3
    CVE-2025-34061 Public exploit

    PHPStudy 2016-2018 Backdoor Remote Code Execution Vulnerability

    A backdoor in PHPStudy versions 2016 through 2018 allows unauthenticated remote attackers to execute arbitrary PHP code on affected installations. The backdoor listens for base64-encoded PHP payloads in the Accept-Charset HTTP header of incoming requests, dec…

    Henan Xiaopi Security Technology PHPStudy
  • Critical 9.1
    CVE-2025-23968 Public exploit

    WordPress AiBud WP plugin <= 1.9 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in WebFactory AiBud WP aibuddy-openai-chatgpt allows Upload a Web Shell to a Web Server.This issue affects AiBud WP: from n/a through <= 1.9.

    webfactory AiBud WP
  • High 7.2
    CVE-2025-5961 Public exploit Scanner template EPSS 55%

    Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload

    The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This make…

    wpvividplugins WPvivid — Backup, Migration & Staging Web / CMS
  • Medium 4.8
    CVE-2025-6563 Public exploit

    Cross-site scripting via dst parameter in RouterOS WiFi hotspot

    A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes…

    MikroTik RouterOS Network devices
  • Medium 5.4
    CVE-2025-45809 Public exploit

    SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key…