Skip to content
OpenAdvisories

Archive

10 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /10 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.3
    CVE-2025-34100 Public exploit

    BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload

    An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upload plugin. The plugin fails to properly validate or restrict file types or locations during upload …

    BuilderEngine CMS
  • Critical 9.3
    CVE-2025-34102 Public exploit

    CryptoLog Unauthenticated RCE via SQL Injection and Command Injection

    A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploitation of SQL injection and command injection vulnerabilities. An unauthenticated attacker can gain shell access as the web server user by …

    Crypttech CryptoLog
  • Critical 9.3
    CVE-2025-34096 Public exploit

    Easy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghp

    A stack-based buffer overflow vulnerability exists in Easy File Sharing HTTP Server version 7.2. The flaw is triggered when a crafted POST request is sent to the /sendemail.ghp endpoint containing an overly long Email parameter. The application fails to prope…

    EFS Software Easy File Sharing HTTP Server
  • Critical 9.3
    CVE-2025-34095 Public exploit

    Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp

    An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.exe…

    Real Time Logic Mako Server
  • Critical 9.3
    CVE-2025-34101 Public exploit

    Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO Parameter

    An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed by the console component (default port 23423). The checkStreamUrl method accepts a VIDEO parameter …

    Serviio Media Server
  • Critical 9.3
    CVE-2025-34099 Public exploit

    VICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth Password

    An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HT…

    VICIdial VICIdial
  • Critical 9.1
    CVE-2025-23048 Public exploit

    Apache HTTP Server: mod_ssl access control bypass with session resumption

    In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with ea…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  • Critical 10.0
    CVE-2025-47812 Exploited Public exploit Scanner template EPSS 94%

    In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection …

    Wftpserver Wing FTP Server
    KEV Jul 14, 2025