Explore CVE records

HighPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30765

WordPress FlexStock plugin <= 3.13.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPPOOL FlexStock stock-sync-with-google-sheet-for-woocommerce allows Blind SQL Injection.This issue affects FlexStock: from n/a through <= 3.13.1.

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30764

WordPress Football Pool plugin <= 2.12.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in AntoineH Football Pool football-pool allows Cross Site Request Forgery.This issue affects Football Pool: from n/a through <= 2.12.2.

Excerpt language: en.

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30763

WordPress EO4WP plugin <= 1.0.8.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer EO4WP fw-integration-for-emailoctopus allows Stored XSS.This issue affects EO4WP: from n/a through <= 1.0.8.4.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 27 Mar 2025, 16:06 WIB

CVE-2025-29993

The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail.

Excerpt language: en.

CVSS5.3v3.0KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:30 WIB

Official record

MedPublished 27 Mar 2025, 14:16 WIB

CVE-2024-45361

Mi Connect Service APP protocol flaws lead to leaking sensitive user information

A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to leak sensitive user information.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated23 Jun 2025, 16:43 WIB

Official record

HighPublished 27 Mar 2025, 14:11 WIB

CVE-2024-45356

Xiaomi phone framework has unauthorized access vulnerability

A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.

Excerpt language: en.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:31 WIB

Official record

MedPublished 27 Mar 2025, 13:48 WIB

CVE-2024-45355

Xiaomi phone framework has unauthorized access vulnerability

A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.

Excerpt language: en.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:32 WIB

Official record

MedPublished 27 Mar 2025, 13:25 WIB

CVE-2024-45354

xiaomi shop application Webview has code execution vulnerability

A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:37 WIB

Official record

MedPublished 27 Mar 2025, 13:12 WIB

CVE-2024-45353

quick App has intent redriction vulnerability

An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper input validation and can be exploited by attackers tointent redriction.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 Mar 2025, 21:18 WIB

Official record

MedPublished 27 Mar 2025, 12:22 WIB

CVE-2025-2685

TablePress – Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting

The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘table-name’ parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level ac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:29 WIB

Official record

CritPublished 27 Mar 2025, 12:22 WIB

CVE-2025-2332

Export All Posts, Products, Orders, Refunds & Users <= 2.13 - Unauthenticated PHP Object Injection

The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.13 via deserialization of untrusted input in the 'returnMetaValueAsCustomerInput' function. This makes it possible for unauthenticated attackers to inject a PHP Obje…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:10 WIB

Official record

MedPublished 27 Mar 2025, 12:03 WIB

CVE-2025-0273

HCL DevOps Deploy / HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerability

HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user.

Excerpt language: en.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated27 Mar 2025, 21:37 WIB

Official record

MedPublished 27 Mar 2025, 11:00 WIB

CVE-2025-31165

Cross Site Scripting in NightWolf Penetration Platform

Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through the markdown editor feature.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Mar 2025, 10:58 WIB

Official record

MedPublished 27 Mar 2025, 11:00 WIB

CVE-2025-2835

zhangyd-c OneBlog RestApiController.java autoLink server-side request forgery

A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the file com/zyd/blog/controller/RestApiController.java. The manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:40 WIB

Official record

MedPublished 27 Mar 2025, 11:00 WIB

CVE-2025-2833

zhangyd-c OneBlog HTTP Header redos

A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:41 WIB

Official record

MedPublished 27 Mar 2025, 10:31 WIB

CVE-2025-2832

mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 cross-site request forgery

A vulnerability was found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:43 WIB

Official record

MedPublished 27 Mar 2025, 10:00 WIB

CVE-2025-2831

mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 bookList getBookList sql injection

A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. This vulnerability affects the function getBookList of the file /admin/bookList?page=1&limit=10. The manipulation of the argument condition leads to sql injection. The a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:44 WIB

Official record

HighPublished 27 Mar 2025, 09:02 WIB

CVE-2024-45352

Xiaomi smarthome application Webview has code execution vulnerability

An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:44 WIB

Official record

MedPublished 27 Mar 2025, 08:48 WIB

CVE-2025-2481

MediaView <= 1.1.2 - Reflected Cross-Site Scripting via id Parameter

The MediaView plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id' parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:22 WIB

Official record

HighPublished 27 Mar 2025, 07:59 WIB

CVE-2025-30355

Synapse vulnerable to federation denial of service via malformed events

Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:47 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage