Skip to content
OpenAdvisories

Archive

27 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /27 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

59 results · Clear filters · Feed

  • Medium 6.9
    CVE-2025-30060

    SQL injection in ReturnUserUnitsXML.pl via the UserID parameter

    In the ReturnUserUnitsXML.pl service, the "getUserInfo" function is vulnerable to SQL injection through the "UserID" parameter.

    CGM CGM CLININET
  • Medium 6.9
    CVE-2025-30059

    Authenticated SQL injection in PrepareCDExportJSON.pl

    In the PrepareCDExportJSON.pl service, the "getPerfServiceIds" function is vulnerable to SQL injection.

    CGM CGM CLININET
  • Medium 6.9
    CVE-2025-30058

    SQL injection in getPatientIdentifier function of PatientService.pl

    In the PatientService.pl service, the "getPatientIdentifier" function is vulnerable to SQL injection through the "pesel" parameter.

    CGM CGM CLININET
  • Medium 5.3
    CVE-2025-30048

    Unauthenticated access to module configuration endpoint

    The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authentication.

    CGM CGM CLININET
  • Medium 6.5
    CVE-2021-4459

    SMA: Directory Traversal in Sunny Boy <3.10.27.R

    An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices.

    SMA Boy 5.0 Boy 3.0 Boy 4.0
  • Medium 5.3
    CVE-2025-48081

    WordPress Printeers Print & Ship plugin <= 1.17.0 - Directory Traversal vulnerability

    Path Traversal: '.../...//' vulnerability in Printeers Printeers Print & Ship allows Path Traversal.This issue affects Printeers Print & Ship: from n/a through 1.17.0.

    Printeers Printeers Print & Ship
  • Medium 5.9
    CVE-2025-49035

    WordPress Admin Menu Groups plugin <= 0.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaimchaikin Admin Menu Groups admin-menu-groups allows Stored XSS.This issue affects Admin Menu Groups: from n/a through <= 0.1.2.

    chaimchaikin Admin Menu Groups
  • Medium 5.9
    CVE-2025-49039

    WordPress Link View plugin <= 0.8.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View link-view allows Stored XSS.This issue affects Link View: from n/a through <= 0.8.0.

    mibuthu Link View
  • Medium 4.3
    CVE-2025-49040

    WordPress Backup Bolt plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery.This issue affects Backup Bolt: from n/a through <= 1.5.0.

    Backup Bolt Backup Bolt
  • Medium 6.4
    CVE-2025-7732

    Lazy Load for Videos <= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes

    The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lazy‑loading handlers in all versions up to, and including, 2.18.7 due to insufficient input sanitization and output escaping. The plugin’s JavaScript registrat…

    Kevin Weber Lazy Load for Videos Web / CMS
  • Medium 6.6
    CVE-2025-55582

    D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script `mydlink-watch-dog.sh`, which blindly…

  • Medium 6.5
    CVE-2025-55495

    Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind…

  • Medium 6.1
    CVE-2025-50977

    A template injection vulnerability leading to reflected cross-site scripting (XSS) has been identified in version 1.7.1…

  • Medium 5.3
    CVE-2025-50984

    diskover-web v2.3.0 Community Edition is vulnerable to multiple boolean-based blind SQL injection flaws in its Elastics…

  • Medium 6.1
    CVE-2025-50978

    In Gitblit v1.7.1, a reflected cross-site scripting (XSS) vulnerability exists in the way repository path names are han…

  • Medium 5.6
    CVE-2025-50985

    diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws in its web i…

  • Medium 5.6
    CVE-2025-50986

    diskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its ad…

  • Medium 6.5
    CVE-2025-54598

    The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete a…

  • Medium 5.8
    CVE-2025-56694

    Client-side password validation (CWE-602) in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to …