Skip to content
OpenAdvisories

Archive

1 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /1 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 7.2
    CVE-2025-54136 Public exploit EPSS 32%

    Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals

    Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally…

    cursor cursor
  • High 8.1
    CVE-2025-54424 Public exploit

    1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution

    1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTPS protocol used for communication between the Core and Agent endpoints has incomplete certificate ve…

    1Panel-dev 1Panel github.com/1Panel-dev/1Panel/core Go
  • High 8.7
    CVE-2013-10053 Public exploit

    ZPanel <= 10.0.0.2 htpasswd Module Username Command Execution

    A remote command execution vulnerability exists in ZPanel version 10.0.0.2 in its htpasswd module. When creating .htaccess files, the inHTUsername field is passed unsanitized to a system() call that invokes the system’s htpasswd binary. By injecting shell met…

    ZPanel Project ZPanel
  • High 7.5
    CVE-2013-10057 Public exploit

    Synactis PDF In-The-Box ConnectToSynactic Stack-Based Buffer Overflow

    A stack-based buffer overflow vulnerability exists in Synactis PDF In-The-Box ActiveX control (PDF_IN_1.ocx), specifically the ConnectToSynactis method. When a long string is passed to this method—intended to populate the ldCmdLine argument of a WinExec call—…

    Synactis PDF In-The-Box
  • High 8.7
    CVE-2013-10044 Public exploit

    OpenEMR ≤ 4.1.1 SQL Injection Privilege Escalation and RCE

    An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file uploa…

    Open-Emr openemr
  • High 8.6
    CVE-2013-10061 Public exploit

    Netgear Routers setup.cgi RCE

    An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutral…

    NETGEAR DGN1000B Network devices
  • High 8.6
    CVE-2013-10058 Public exploit

    Linksys Routers apply.cgi Remote Command Injection

    An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_…

    Linksys WRT160nv2
  • High 8.5
    CVE-2012-10022 Public exploit

    Kloxo <= 6.1.12 Local Privilege Escalation

    Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matc…

    LXCenter Kloxo
  • High 8.7
    CVE-2013-10050 Public exploit EPSS 13%

    D-Link Devices tools_vct.xgi Authenticated RCE

    An OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13) via the authenticated tools_vct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the pingIp…

    D-Link DIR-615 rev D DIR-300 rev A Network devices
  • High 8.6
    CVE-2013-10059 Public exploit EPSS 26%

    D-Link Routers tools_vct.htm OS Command Injection

    An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the too…

    D-Link DIR-615H1 Network devices
  • High 8.5
    CVE-2013-10046 Public exploit

    Agnitum Outpost Internet Security Local Privilege Escalation

    A local privilege escalation vulnerability exists in Agnitum Outpost Internet Security 8.1 that allows an unprivileged user to execute arbitrary code with SYSTEM privileges. The flaw resides in the acs.exe component, which exposes a named pipe that accepts un…

    Agnitum Outpost Internet Security
  • High 8.7
    CVE-2025-41373 Public exploit

    SQL injection vulnerability in Gandia Integra Total

    A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encu…

    TESI Gandia Integra Total