4799 matches found
CVE-2025-41719 Sauter: Improper Validation of user-controlled data
A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known default password...
EUVD-2025-35337
A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known default password...
Sauter modu680-AS 安全漏洞
Sauter modu680-AS is a modular automation station cum web server from Sauter, Switzerland. A security vulnerability exists in the Sauter modu680-AS that originates from a low-privileged remote attacker who can corrupt the web server user store on the appliance by setting a series of unsupported...
PT-2025-43025
A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known default password...
PT-2025-43248
Name of the Vulnerable Software and Affected Versions appscreo Hello Followers versions through 2.5 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a Reflected Cross-Site Scripting XSS condition. This allows an attacker t...
Five New Exploited Bugs Land in CISA's Catalog — Oracle and Microsoft Among Targets
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added five security flaws to its Known Exploited Vulnerabilities KEV Catalog, officially confirming a recently disclosed vulnerability impacting Oracle E-Business Suite EBS has been weaponized in real-world attacks. The...
Five New Exploited Bugs Land in CISA's Catalog — Oracle and Microsoft Among Targets
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added five security flaws to its Known Exploited Vulnerabilities KEV Catalog, officially confirming a recently disclosed vulnerability impacting Oracle E-Business Suite EBS has been weaponized in real-world attacks. The...
CVE-2025-58778
CVE-2025-58778 concerns Ruijie Networks RG-EST300 devices, where an undocumented SSH server feature is enabled by default in the initial configuration. The vulnerability allows anyone with the relevant credentials to log in, potentially leading to information disclosure, unauthorized changes to s...
PT-2025-42460
Name of the Vulnerable Software and Affected Versions WSO2 Products affected versions not specified Description An insufficient access control implementation exists in multiple WSO2 Products. This allows bypassing authentication and authorization checks for certain REST APIs, enabling invocation...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-54253link is external Adobe Experience Manager Forms Code Execution Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber...
CVE-2025-9967
CVE-2025-9967 concerns the WordPress plugin Orion SMS OTP Verification. The vulnerability is an authentication bypass enabling privilege escalation via account takeover in versions
CVE-2025-61678
CVE-2025-61678 affects FreePBX Endpoint Manager: an authenticated arbitrary file upload via the fwbrand parameter in FreePBX 16 prior to 16.0.92 and FreePBX 17 prior to 17.0.6. Successful exploitation by an authenticated user can upload files to attacker-controlled paths, potentially leading to r...
CVE-2025-61675 FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the...
CVE-2025-9064
A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete any file within the panels operating system. Exploitation of this vulnerability is dependent on the knowledge of filenames to be deleted...
CVE-2025-9064 Rockwell Automation FactoryTalk View Machine Edition Path Traversal
A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete any file within the panels operating system. Exploitation of this vulnerability is dependent on the knowledge of filenames to be deleted...
EUVD-2025-34184
A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete any file within the panels operating system. Exploitation of this vulnerability is dependent on the knowledge of filenames to be deleted...
APSB25-96 : Security update available for Adobe Bridge
Adobe has released a security update for Adobe Bridge. This update addresses a critical and important vulnerabilities that could lead to arbitrary code execution and memory exposure. Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates...
CISA Known Exploited Vulnerabilities May 2025: A Guide
Your vulnerability management backlog is probably overflowing. With thousands of new CVEs disclosed every year, it’s impossible to patch everything, and trying to do so leads to burnout and wasted effort. The CISA KEV catalog is the answer to this overwhelming noise. It’s not just another list of...
