2,896 results · Clear filters · Feed
-
Critical 9.3CVE-2025-68400 Public exploit
ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Reports/ConfirmReportEmail.php` in ChurchCRM prior to version 6.5.3. Although the feature was removed from the UI, the file remains deployed an…
-
Critical 9.1CVE-2025-68109 Public exploit
ChurchCRM vulnerable to RCE with database restore functionality
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently uploa…
-
Critical 9.3CVE-2025-67876 Public exploit
ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking
ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM versions 6.4.0 and prior that allows a low-privilege user with the “Manage Groups” permission to inject persistent JavaScript into grou…
-
Critical 10.0CVE-2025-62521 Public exploit
ChurchCRM has unauthenticated RCE in its Install Wizard
ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation p…
-
Critical 10.0
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root…
KEV Dec 17, 2025 -
Critical 9.9CVE-2025-14700 Public exploit
Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.
-
Critical 9.8CVE-2025-46295 Public exploit
Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications pas…
-
Critical 9.0CVE-2025-33210 Public exploit
NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to cod…
-
Critical 10.0
A remote code execution issue exists in HPE OneView.
KEV Jan 7, 2026 -
Critical 9.1CVE-2025-65318 Public exploit
When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system with…
-
Critical 9.8CVE-2025-14156 Public exploit
Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/pa…
-
Critical 9.8CVE-2025-14440 Public exploit
JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie
The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_regist…
-
Critical 9.8CVE-2024-58299 Public exploit
PCMan FTP Server 2.0 Remote Buffer Overflow via 'pwd' Command
PCMan FTP Server 2.0 contains a buffer overflow vulnerability in the 'pwd' command that allows remote attackers to execute arbitrary code. Attackers can send a specially crafted payload during the FTP login process to overwrite memory and potentially gain sys…
-
Critical 9.3CVE-2024-58290 Public exploit
Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpoint
Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection …
-
Critical 9.3CVE-2024-58286 Public exploit
dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Path
dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. Attackers can modify the executable path with shell commands to read system files like /etc/passwd by…
-
Critical 9.1CVE-2025-13780 Public exploit
Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the s…
-
Critical 9.7CVE-2025-67511 Public exploit
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is availab…
-
Critical 9.4CVE-2025-65950 Public exploit
WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameter
WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to modify users to execute arbitrary SQL queries. This can be escalated to a full database compromise,…
-
Critical 9.3CVE-2025-67494 Public exploit
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, …
-
Critical 9.3CVE-2025-66039 Public exploit
FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a se…
-
Critical 9.1
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0…
KEV Dec 16, 2025 -
Critical 9.8CVE-2025-14321 Public exploit
Use-after-free in the WebRTC: Signaling component
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
-
Critical 9.8CVE-2025-65741 Public exploit
Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file …
-
Critical 9.4CVE-2025-65964 Public exploit
n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through the project's pre-commit hooks. The Add Config operation allows workflows to set arbitrary Git configuration values, i…
-
Critical 9.8CVE-2025-12673 Public exploit
Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to u…
-
Critical 9.4
Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie c…
KEV May 21, 2026 -
Critical 9.1CVE-2025-65346 Public exploit
alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction path…
-
Critical 10.0
React Server Components are Vulnerable to RCE
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vul…
KEV Dec 5, 2025 -
Critical 10.0
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the fea…
-
Critical 9.8
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOpti…
-
Critical 9.8
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func…
-
Critical 9.8CVE-2025-60854 Public exploit
A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter durin…
-
Critical 9.8CVE-2025-60736 Public exploit
code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.
-
Critical 9.0CVE-2025-3500 Public exploit
Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation
Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981.6 before 25.3.
-
Critical 9.0CVE-2025-66224 Public exploit
OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail configuration and delivery workflow that allows user-controlled values to flow directly into the sy…
-
Critical 9.4
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-ba…
KEV Aug 17, 2026 -
Critical 9.8CVE-2025-59390 Public exploit
Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-gr…
-
Critical 9.8CVE-2025-50433 Public exploit
An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted …
-
Critical 9.1CVE-2025-65669 Public exploit
An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page withou…
-
Critical 9.8CVE-2025-13597 Public exploit
AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload
The AI Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizador_git.php' file in all versions up to, and including, 1.0.11. This makes it possible for unauthenticated attackers to download arbitra…