Skip to content
OpenAdvisories

Archive

13 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /13 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

147 results · Feed

  • Medium 6.5
    CVE-2025-50946 Public exploit

    OliveTin OS Command Injection vulnerability

    OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.

    github.com/OliveTin/OliveTin Go
  • High 7.5
    CVE-2025-50612

    A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_004743f8 function of the …

  • High 7.5
    CVE-2025-50608

    A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00471994 function of the cgit…

  • High 7.5
    CVE-2025-50617

    A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046ed68 function of the cgit…

  • Critical 9.1
    CVE-2025-50251

    Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery.

  • Medium 6.1
    CVE-2025-50690

    A Cross-Site Scripting (XSS) vulnerability exists in SpatialReference.org (OSGeo/spatialreference.org) versions prior t…

  • High 7.5
    CVE-2025-50609

    A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the Function_00465620 of the cgitest.…

  • High 7.5
    CVE-2025-50616

    A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046f984 function of the cgit…

  • High 7.5
    CVE-2025-50613

    A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00475e1c function of the cgit…

  • High 7.5
    CVE-2025-50615

    A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00470c50 function of the cgit…

  • High 7.5
    CVE-2025-50610

    A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00476598 function of the cgit…

  • High 7.5
    CVE-2025-50635

    A null pointer dereference vulnerability was discovered in Netis WF2780 v2.2.35445. The vulnerability exists in the FUN…

  • Medium 6.1
    CVE-2025-45316

    A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers …

  • Medium 5.4
    CVE-2025-45315

    A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers…

  • Medium 6.1
    CVE-2025-45313

    A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arb…

  • Medium 6.5
    CVE-2025-45317

    A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute a…

  • Medium 6.1
    CVE-2025-45314

    A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute …

  • Medium 5.4
    CVE-2025-52392 Public exploit

    Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms

    Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. T…

    soosyze/soosyze Packagist
  • Critical 9.8
    CVE-2025-52385 Public exploit

    An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to…

  • Medium 5.4
    CVE-2025-52386

    CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file

  • Critical 9.8
    CVE-2025-51452

    In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through f…

  • Critical 9.8
    CVE-2025-51451

    In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLogin…

  • Medium 6.1
    CVE-2025-51691

    Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) al…

  • Critical 9.8
    CVE-2025-43986

    An issue was discovered on KuWFi GC111 GC111-GL-LM321_V3.0_20191211 devices. The TELNET service is enabled by default a…

  • Medium 6.5
    CVE-2025-43989

    The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishand…

  • Critical 9.8
    CVE-2025-43982

    Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default. There is a hidden…

  • High 7.5
    CVE-2025-43988

    KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers …