Explore CVE records

CritPublished 10 Jun 2025, 13:05 WIB

CVE-2025-1041

Avaya Call Management System RCE vulnerability

An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.

Excerpt language: en.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 03:00 WIB

Official record

UnscoredPublished 10 Jun 2025, 13:00 WIB

CVE-2025-4954

Axle Demo Importer <= 1.0.3 - Author+ Arbitrary File Upload

The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server

Excerpt language: en.

UnscoredPublished 10 Jun 2025, 13:00 WIB

CVE-2025-4840

Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated11 Jun 2025, 03:04 WIB

Official record

MedPublished 10 Jun 2025, 12:00 WIB

CVE-2025-5952

Zend.To NSSDropoff.php exec os command injection

A vulnerability, which was classified as critical, has been found in Zend.To up to 6.10-6 Beta. This issue affects the function exec of the file NSSDropoff.php. The manipulation of the argument file_1 leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:18 WIB

Official record

MedPublished 10 Jun 2025, 11:33 WIB

CVE-2025-5935

Open5GS AMF/MME emm-sm.c common_register_state denial of service

A vulnerability was found in Open5GS up to 2.7.3. It has been declared as problematic. Affected by this vulnerability is the function common_register_state of the file src/mme/emm-sm.c of the component AMF/MME. The manipulation of the argument ran_ue_id leads to denial of service. The attack can be launched remotely. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 21:42 WIB

Official record

MedPublished 10 Jun 2025, 11:23 WIB

CVE-2025-3076

Elementor Pro <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_text’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:35 WIB

Official record

HighPublished 10 Jun 2025, 10:41 WIB

CVE-2025-4601

RH - Real Estate WordPress Theme <= 4.4.0 - Authenticated (Subscriber+) Privilege Escalation

The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to the theme not properly restricting user roles that can be updated as part of the inspiry_update_profile() function. This makes it possible for authenticated attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:13 WIB

Official record

HighPublished 10 Jun 2025, 10:41 WIB

CVE-2025-4387

Abandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File Upload

The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level ac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:55 WIB

Official record

MedPublished 10 Jun 2025, 10:41 WIB

CVE-2025-5925

Bunny’s Print CSS <= 0.95 - Cross-Site Request Forgery to Settings Update

The Bunny’s Print CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.95. This is due to missing or incorrect nonce validation on the pcss_options_subpanel() function. This makes it possible for unauthenticated attackers to update settings via a forged request gr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:53 WIB

Official record

HighPublished 10 Jun 2025, 10:31 WIB

CVE-2025-5934

Netgear EX3700 mtd sub_41619C stack-based overflow

A vulnerability was found in Netgear EX3700 up to 1.0.0.88. It has been classified as critical. Affected is the function sub_41619C of the file /mtd. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgradi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 20:11 WIB

Official record

MedPublished 10 Jun 2025, 10:31 WIB

CVE-2025-5913

PHPGurukul Vehicle Record Management System search-vehicle.php sql injection

A vulnerability was found in PHPGurukul Vehicle Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/search-vehicle.php. The manipulation of the argument searchinputdata leads to sql injection. The attack may be initiated remotely. The exploit has be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 20:12 WIB

Official record

HighPublished 10 Jun 2025, 10:00 WIB

CVE-2025-5912

D-Link DIR-632 HTTP POST Request do_file stack-based overflow

A vulnerability was found in D-Link DIR-632 FW103B08. It has been declared as critical. This vulnerability affects the function do_file of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 20:13 WIB

Official record

HighPublished 10 Jun 2025, 09:31 WIB

CVE-2025-5911

TOTOLINK EX1200T HTTP POST Request formDMZ buffer overflow

A vulnerability was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formDMZ of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 20:15 WIB

Official record

HighPublished 10 Jun 2025, 09:00 WIB

CVE-2025-5910

TOTOLINK EX1200T HTTP POST Request formWsc buffer overflow

A vulnerability has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formWsc of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:17 WIB

Official record

HighPublished 10 Jun 2025, 08:31 WIB

CVE-2025-5909

TOTOLINK EX1200T HTTP POST Request formReflashClientTbl buffer overflow

A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formReflashClientTbl of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:23 WIB

Official record

HighPublished 10 Jun 2025, 08:00 WIB

CVE-2025-5908

TOTOLINK EX1200T HTTP POST Request formIpQoS buffer overflow

A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:24 WIB

Official record

HighPublished 10 Jun 2025, 07:31 WIB

CVE-2025-5907

TOTOLINK EX1200T HTTP POST Request formFilter buffer overflow

A vulnerability classified as critical was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:24 WIB

Official record

MedPublished 10 Jun 2025, 07:31 WIB

CVE-2025-5906

code-projects Laundry System data missing authentication

A vulnerability classified as critical has been found in code-projects Laundry System 1.0. This affects an unknown part of the file /data/. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:19 WIB

Official record

MedPublished 10 Jun 2025, 07:14 WIB

CVE-2025-42998

Security misconfiguration vulnerability in SAP Business One Integration Framework

The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:14 WIB

Official record

MedPublished 10 Jun 2025, 07:13 WIB

CVE-2025-42996

Multiple vulnerabilities in SAP MDM Server

SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticate giving the ability to access or modify non-sensitive information or consume sufficient resources which could degrade the performance of the server causing low impact on confident…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.6v3.1KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:15 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage