CVE-2025-20197

This CVE (CVE-2025-20197) affects Cisco IOS XE Software and concerns a CLI input-validation flaw in config processing that enables a locally authenticated attacker with privilege level 15 to escalate to root on the device OS. The vulnerability arises from insufficient input validation when handli...

CVE-2025-20155

A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is firs...

CVE-2025-20155

Cisco IOS XE Software vulnerability CVE-2025-20155: insecure bootstrap file validation can let an authenticated, local attacker write arbitrary files to the device when SD-WAN/SD-Routing bootstrap is used. Root cause is insufficient input validation of the bootstrap file read during initial deplo...

CVE-2025-20155

A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is firs...

CVE-2025-20192

A vulnerability in the Internet Key Exchange version 1 IKEv1 implementation of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition. The attacker must have valid IKEv1 VPN credentials to exploit this vulnerability. This vulnerability is du...

CVE-2025-32821

A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance...

CVE-2025-32821

CVE-2025-32821 (SonicWall SMA100) is a post-authentication command-injection/file-write vulnerability in the SMA100 SSL-VPN. An admin user can inject shell arguments to write a file anywhere the nobody user can write to, potentially enabling root-level remote code execution when chained with CVE-...

CVE-2025-32820

A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the SMA appliance writable...

CVE-2025-32820

A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the SMA appliance writable...

CVE-2025-20151

CVE-2025-20151 affects Cisco IOS and IOS XE SNMPv3 configuration handling. The issue arises from how SNMPv3 settings are stored in startup configuration, allowing an authenticated remote attacker with valid SNMPv3 credentials to poll the device from a source address or interface that should be de...

CVE-2025-20122 Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to gain privileges of the root user on the underlying operating system. This vulnerability is due to insufficient input validation. An authenticated attacker wi...

CVE-2025-20213

CVE-2025-20213 affects Cisco Catalyst SD-WAN Manager (SD-WAN vManage) with a vulnerability in the CLI that allows an authenticated, local attacker with valid read-only CLI credentials to overwrite arbitrary files on the local filesystem, potentially gaining root privileges. Root cause is improper...

Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to gain privileges of the root user on the underlying operating system. This vulnerability is due to insufficient input validation. An authenticated attacker wi...

Cisco IOS XE Software Privilege Escalation Vulnerabilities

Multiple vulnerabilities in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device. These vulnerabilities are due to insufficient input validation when processing...

Cisco IOS XE Software Bootstrap Arbitrary File Write Vulnerability

A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is firs...

K000139502: F5OS vulnerability CVE-2025-43878

Security Advisory Description When running in appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Appliance mode restrictions utilizing system diagnostics tcpdump command utility on a F5OS-A/C system. CVE-2025-43878 Impact In...

CVE-2025-3852 WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover

The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email & password through the update function. This makes i...

CVE-2025-4335 Woocommerce Multiple Addresses <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation

The Woocommerce Multiple Addresses plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.7.1. This is due to insufficient restrictions on user meta that can be updated through the savemultipleshippingaddresses function. This makes it possible for...

CVE-2025-26241

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket =1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topicid" URL parameters combination...

PT-2025-20273 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying...