Skip to content
OpenAdvisories

Archive

19 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /19 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

48 results · Clear filters · Feed

  • High 8.7
    CVE-2025-52478

    Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source

    n8n is a workflow automation platform. From 1.77.0 to before 1.98.2, a stored Cross-Site Scripting (XSS) vulnerability was identified in n8n, specifically in the Form Trigger node's HTML form element. An authenticated attacker can inject malicious HTML via an…

    n8n-io n8n n8n npm
  • High 8.5
    CVE-2025-4046

    Missing Authorization in Lexmark Cloud Services badge management

    A missing authorization vulnerability in Lexmark Cloud Services badge management allows attacker to reassign badges within their organization

    Lexmark Lexmark Cloud Services
  • High 8.2
    CVE-2025-4044

    XML External Entity Injection vulnerability in various Lexmark Universal Drivers

    Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL.

    Lexmark Printer Software G2 Universal Print Driver
  • High 7.5
    CVE-2025-41689

    Wiesemann & Theis: Motherbox 3 allows unauthenticated read-only DB access

    An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-only access to the stored measurement data.

    Wiesemann & Theis Motherbox 3
  • High 8.8
    CVE-2025-7654

    Multiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library

    Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including authentication cookie…

    amans2k FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce FunnelKit – Funnel Builder for WooCommerce Checkout Web / CMS
  • High 7.5
    CVE-2025-7670

    JS Archive List <= 6.1.5 - Unauthenticated SQL Injection via build_sql_where Function

    The JS Archive List plugin for WordPress is vulnerable to time-based SQL Injection via the build_sql_where() function in all versions up to, and including, 6.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…

    skatox JS Archive List Web / CMS
  • High 8.8
    CVE-2025-8218

    Real Spaces - WordPress Properties Directory Theme <= 3.5 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member'

    The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and including, 3.5. This is due to a lack of restriction in the profile update role.…

    imithemes Real Spaces - WordPress Properties Directory Theme Web / CMS
  • High 7.2
    CVE-2025-50891

    The server-side backend for Adform Site Tracking before 2025-08-28 allows attackers to inject HTML or execute arbitrary…

    Adform server-side backend for Site Tracking