Skip to content
OpenAdvisories

Archive

25 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /25 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 10.0
    CVE-2014-125115 Public exploit

    Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE

    An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash_data parameter, allowing attackers to extract administrator credentials or a…

    Artica ST Pandora FMS
  • Critical 9.3
    CVE-2014-125116 Public exploit

    HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection

    A remote code execution vulnerability exists in HybridAuth versions 2.0.9 through 2.2.2 due to insecure use of the install.php installation script. The script remains accessible after deployment and fails to sanitize input before writing to the application’s …

    HybridAuth HybridAuth
  • Critical 9.4
    CVE-2014-125118 Public exploit

    eScan 5.5-2 Web Management Console Command Injection

    A command injection vulnerability exists in the eScan Web Management Console version 5.5-2. The application fails to properly sanitize the 'pass' parameter when processing login requests to login.php, allowing an authenticated attacker with a valid username t…

    MicroWorld eScan Web Management Console
  • Critical 9.3
    CVE-2014-125117 Public exploit

    D-Link info.cgi POST Request Stack-Based Buffer Overflow RCE

    A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, including the DSP-W215 version 1.02, can be exploited via a specially crafted HTTP POST request to the /common/info.cgi endpoint. This flaw enables an unauthent…

    D-Link DSP-W215 Network devices
  • Critical 9.8
    CVE-2015-10143 Public exploit

    Platform < 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options Update

    The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the *_ajax_save_options() function in all versions up to 1.4.4 (exclusive). This makes it possible f…

    PageLines Platform Web / CMS
  • Critical 9.8
    CVE-2019-25224 Public exploit EPSS 22%

    WP Database Backup < 5.2 - Unauthenticated OS Command Injection

    The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.

    databasebackup WP Database Backup – Unlimited Database & Files Backup by Backup for WP Web / CMS
  • Critical 9.4
    CVE-2025-29628 Public exploit

    A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware bef…

    Gardyn Home Kit Firmware