Explore CVE records

CritPublished 31 Mar 2025, 23:58 WIB

CVE-2025-31122

scratch-coding-hut.github.io Login Links Generation vulnerability

scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the username in the username field.

Excerpt language: en.

CVSS9v4.0KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:24 WIB

Official record

CritPublished 31 Mar 2025, 23:17 WIB

CVE-2025-30223

Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victim…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CritPublished 31 Mar 2025, 18:09 WIB

CVE-2025-3022

OS Command Injection vulnerability in e-management of e-solutions

Os command injection vulnerability in e-solutions e-management. This vulnerability allows an attacker to execute arbitrary commands on the server via the ‘client’ parameter in the /data/apache/e-management/api/api3.php endpoint.

Excerpt language: en.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 19:03 WIB

Official record

CritPublished 31 Mar 2025, 15:33 WIB

CVE-2025-2071

OS Command Injection Vulnerability in FAST LTA Silent Brick WebUI

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed directly to system-level comm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS10v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 23:26 WIB

Official record

CritPublished 31 Mar 2025, 11:49 WIB

CVE-2025-26689

Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request to the product, the product data may be obtained or deleted, and/or the product settings may be altered.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated31 Mar 2025, 22:58 WIB

Official record

CritPublished 31 Mar 2025, 11:49 WIB

CVE-2025-25211

Weak password requirements issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a brute-force attack may allow an attacker unauthorized access and login.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated31 Mar 2025, 23:01 WIB

Official record

CritPublished 31 Mar 2025, 10:30 WIB

CVE-2025-3011

PiExtract SOOP-CLM - SQL Injection

SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated31 Mar 2025, 20:00 WIB

Official record

CritPublished 31 Mar 2025, 07:52 WIB

CVE-2025-1268

Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / Generic FAX Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / PDF Dri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated16 Mar 2026, 06:36 WIB

Official record

CritPublished 31 Mar 2025, 07:00 WIB

CVE-2025-29266

Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled.

Excerpt language: en.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated31 Mar 2025, 20:03 WIB

Official record

CritPublished 31 Mar 2025, 07:00 WIB

CVE-2025-30095

VyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations. Thus, an attacker can conduct active man-in-the-middle attacks against SSH connections if Dropbear is enabled as the SSH daemon. I n VyOS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9v3.1KEVNot listedEPSSPresentUpdated22 Apr 2025, 01:55 WIB

Official record

CritPublished 29 Mar 2025, 14:03 WIB

CVE-2025-2266

Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Update

The Checkout Mestres do WP for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the cwmpUpdateOptions() function in versions 8.6.5 to 8.7.5. This makes it possible for unauthenticated attackers to update arbitr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated31 Mar 2025, 20:17 WIB

Official record

CritPublished 28 Mar 2025, 22:12 WIB

CVE-2025-22526

WordPress PHP/MySQL CPU performance statistics Plugin <= 1.2.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in mywebtonet PHP/MySQL CPU performance statistics mywebtonet-performancestats allows Object Injection.This issue affects PHP/MySQL CPU performance statistics: from n/a through <= 1.2.1.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

CritPublished 28 Mar 2025, 22:12 WIB

CVE-2025-22523

WordPress Schedule Plugin <= 1.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scheduler Schedule schedule allows Blind SQL Injection.This issue affects Schedule: from n/a through <= 1.0.0.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

CritPublished 28 Mar 2025, 11:22 WIB

CVE-2025-2294

Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion

The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load_template function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:44 WIB

Official record

CritPublished 28 Mar 2025, 08:41 WIB

CVE-2025-22398

Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution as root. Exploitation may lead…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

CritPublished 28 Mar 2025, 08:24 WIB

CVE-2025-24383

Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability to delete arbitrary files. This vulnerability is considered critical a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

CritPublished 28 Mar 2025, 04:59 WIB

CVE-2025-26873

WordPress Traveler theme <= 3.1.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.

Excerpt language: en.

CVSS9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

CritPublished 28 Mar 2025, 04:51 WIB

CVE-2025-26898

WordPress Traveler theme < 3.2.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

CritPublished 27 Mar 2025, 23:43 WIB

CVE-2023-53006

cifs: Fix oops due to uncleared server->smbd_conn in reconnect

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uncleared server->smbd_conn in reconnect In smbd_destroy(), clear the server->smbd_conn pointer after freeing the smbd_connection struct that it points to so that reconnection doesn't get confused.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:41 WIB

Official record

CritPublished 27 Mar 2025, 23:30 WIB

CVE-2025-30367

WeGIA SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS10v4.0KEVNot listedEPSSPresentUpdated28 Mar 2025, 01:40 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage