Skip to content
OpenAdvisories

Archive

25 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /25 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 8.4
    CVE-2014-125119 Public exploit

    WinRAR < 5.00 Filename Spoofing RCE

    A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Cen…

    RARLAB WinRAR
  • Critical 10.0
    CVE-2014-125115 Public exploit

    Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE

    An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash_data parameter, allowing attackers to extract administrator credentials or a…

    Artica ST Pandora FMS
  • High 8.4
    CVE-2014-125114 Public exploit

    i-Ftp 2.20 Schedule.xml Stack-Based Buffer Overflow

    A stack-based buffer overflow vulnerability exists in i-Ftp version 2.20 due to improper handling of the Time attribute within Schedule.xml. By placing a specially crafted Schedule.xml file in the i-Ftp application directory, a remote attacker can trigger a b…

    i-Ftp i-Ftp
  • Critical 9.3
    CVE-2014-125116 Public exploit

    HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection

    A remote code execution vulnerability exists in HybridAuth versions 2.0.9 through 2.2.2 due to insecure use of the install.php installation script. The script remains accessible after deployment and fails to sanitize input before writing to the application’s …

    HybridAuth HybridAuth
  • High 8.7
    CVE-2013-10032 Public exploit

    GetSimple CMS 3.2.1 Authenticated RCE via Arbitrary PHP File Upload

    An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1. The application’s upload.php endpoint allows authenticated users to upload arbitrary files without proper validation of MIME types or extensions. By uploading a .pht fi…

    GetSimple CMS GetSimple CMS
  • Critical 9.4
    CVE-2014-125118 Public exploit

    eScan 5.5-2 Web Management Console Command Injection

    A command injection vulnerability exists in the eScan Web Management Console version 5.5-2. The application fails to properly sanitize the 'pass' parameter when processing login requests to login.php, allowing an authenticated attacker with a valid username t…

    MicroWorld eScan Web Management Console
  • Critical 9.3
    CVE-2014-125117 Public exploit

    D-Link info.cgi POST Request Stack-Based Buffer Overflow RCE

    A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, including the DSP-W215 version 1.02, can be exploited via a specially crafted HTTP POST request to the /common/info.cgi endpoint. This flaw enables an unauthent…

    D-Link DSP-W215 Network devices
  • Critical 9.8
    CVE-2015-10143 Public exploit

    Platform < 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options Update

    The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the *_ajax_save_options() function in all versions up to 1.4.4 (exclusive). This makes it possible f…

    PageLines Platform Web / CMS
  • Critical 9.8
    CVE-2019-25224 Public exploit EPSS 22%

    WP Database Backup < 5.2 - Unauthenticated OS Command Injection

    The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.

    databasebackup WP Database Backup – Unlimited Database & Files Backup by Backup for WP Web / CMS
  • High 8.8
    CVE-2015-10144 Public exploit

    Responsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload

    The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level…

    nik00726 Thumbnail carousel slider Web / CMS
  • Critical 9.4
    CVE-2025-29628 Public exploit

    A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware bef…

    Gardyn Home Kit Firmware
  • High 8.8
    CVE-2025-45466 Public exploit

    Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcode…

  • High 7.1
    CVE-2025-45467 Public exploit

    Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Eth…

  • Medium 6.1
    CVE-2025-45960 Public exploit

    Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via …

  • Medium 6.5
    CVE-2025-44608 Public exploit

    CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter.

  • Medium 6.1
    CVE-2025-51411 Public exploit

    A reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0 via the email paramet…