Week 28, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2025-47812 In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session …

  Wftpserver · Wing FTP Server

  EPSS 94%
• Critical 9.6
  CVE-2025-6514 OS command injection in mcp-remote when connecting to untrusted MCP servers
  EPSS 77%
• Critical 9.8
  CVE-2025-49533 Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)

  Adobe · Adobe Experience Manager (MS)

  EPSS 52%
• Critical 9.8
  CVE-2020-36847 Simple File List < 4.2.3 - Remote Code Execution

  eemitch · Simple File List

  EPSS 44%
• Critical 9.8
  CVE-2025-47981 SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 41%
• Critical 9.5
  CVE-2025-50121 A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remo…

  Schneider Electric · EcoStruxure™ IT Data Center Expert

  EPSS 22%
• Critical 9.8
  CVE-2025-7206 D-Link DIR-825 httpd switch_language.cgi sub_410DDC stack-based overflow

  D-Link · DIR-825

  EPSS 22%
• Critical 9.4
  CVE-2025-6793 Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability

  Marvell · QConvergeConsole

  EPSS 17%
• Critical 10.0
  CVE-2025-34077 WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCE

  Genetech Solutions · WordPress Pie Register Plugin

  EPSS 17%
• Critical 9.3
  CVE-2025-34102 CryptoLog Unauthenticated RCE via SQL Injection and Command Injection

  Crypttech · CryptoLog

  EPSS 9.5%
• Critical 9.8
  CVE-2020-36849 AIT CSV import/export <= 3.0.3 - Unauthenticated Arbitrary File Upload

  AIT Themes · AIT CSV import/export

  EPSS 8%
• Critical 9.8
  CVE-2025-6058 WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

  Iqonic Design · WPBookit

  EPSS 6.2%
• Critical 9.3
  CVE-2025-34095 Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp

  Real Time Logic · Mako Server

  EPSS 6.2%
• Critical 9.3
  CVE-2025-34101 Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO Parameter

  Serviio · Media Server

  EPSS 4.4%
• Critical 9.3
  CVE-2025-34100 BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload

  BuilderEngine · CMS

  EPSS 3.9%

All 83 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2025-49704 Microsoft SharePoint Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016

  EPSS 100%
• Medium 6.5
  CVE-2025-49706 Microsoft SharePoint Server Spoofing Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 100%
• High 8.3
  CVE-2013-3307 Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the …

  Linksys · E3200 · E1000 · E1200

  EPSS 63%
• Medium 4.3
  CVE-2025-47813 loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

  Wftpserver · Wing FTP Server

  EPSS 63%
• High 7.5
  CVE-2025-6970 Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter

  netweblogic · Events Manager – Calendar, Bookings, Tickets, and more!

  EPSS 56%
• High 7.5
  CVE-2025-47984 Windows GDI Information Disclosure Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 23%
• High 7.2
  CVE-2025-6771 OS command injection in Ivanti Endpoint Manager

  ivanti · Endpoint Manager Mobile

  EPSS 23%
• High 7.2
  CVE-2024-58258 SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.

  SugarCRM · SugarCRM

  EPSS 22%