Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778
A security vulnerability in MikoPBX (CVSS 9.9) that allows uploading a php script. Critical severity with potential for significant impact on affected systems.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the `/controle/getProdutosPorAlmox.php` endpoint. This issue allows any unauthenticated attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. Version 3.4.0 fixes the issue.
A vulnerability, which was classified as critical, was found in Linksys E8450 up to 1.2.00.360516. This affects the function set_device_language of the file portal.cgi of the component HTTP POST Request Handler. The manipulation of the argument dut_language leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in Linksys WRT1900ACS, EA7200, EA7450 and EA7500 up to 20250619 and classified as critical. This vulnerability affects the function SetDefaultConnectionService of the file /upnp/control/Layer3Forwarding of the component IGD. The manipulation of the argument NewDefaultConnectionService leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown functionality of the file /setupA.cfg of the component Web-based Management Interface. Performing manipulation results in missing authentication. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made public and could be used. There are still doubts about whether this vulnerability truly exists. The vendor explains, that "[d]evices described at CVE are not intended to be exposed into internet and proper security of devices is to end-users."
CVE-2025-44557 is a security vulnerability (CVSS 8.1) that allows attackers. Risk factors: public PoC available.
A buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 <=V15.03.05.19 via the page parameter.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending crafted IOCTL commands to the NeacSafe64.sys component.
An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a Denial of Service (DoS) via sending a specific sequence of crafted control packets.
D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services.
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the `entity` parameter to overwrite arbitrary files writable by the web server via abuse of the `tee` command used in shell execution.
We need to produce a JSON object per strict instructions. The CVE details: CVE-2025-49885, unrestricted file upload, affects HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce, version n/a through 5.0.6, CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), CWE-434. EPSS 0.19% percentile 41%. Tags: File Upload, WordPress. Reported by audit@patchstack.com. References point to Patchstack. No KEV, no POC explicitly mentioned. So exploitation status: "no public exploit identified at time of analysis". No mention of active exploitation. Patches? Patchstack advisory likely indicates a patch, but we have no exact fixed version. The affected versions from EUVD: n/a to 5.0.6. So presumably fixed in a version higher than 5.0.6. The patch data not available in the snippet except that there's a reference. The references are Patchstack pages; likely there is a fix. But we don't have explicit patch version. I'll state patch available per vendor advisory, but no exact fix version mentioned. I'll say "Vendor-released patch: upgrade to version beyond 5.0.6." Actually I need to be cautious: the input says "from n/a through 5.0.6", so any version > 5.0.6 is patched. I can state "Patch available: update to a version higher than 5.0.6." The remediation should recommend upgrade to latest version. If no version is named, I can say "Update the Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin to the latest version (post-5.0.6)." The Patchstack reference may contain the exact fixed version; I could infer that the fix is in a later version. I'll phrase as "Vendor-released patch: update to a version after 5.0.6 (specific fixed version not confirmed in provided data)". The advisory might mention the fixed version, but only reference URL is given. I'll assume it's listed there, but for the JSON, I'll state "Update to the latest version (at least 5.0.7 or later) according to the vendor advisory." But I can't guarantee 5.0.7. I'll say "Update the plugin to a version later tha
Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution.
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.
The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.6. This is due to the plugin not properly checking for an empty token value prior to resetting a user's password through the dwt_listing_reset_password() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Remote code execution in CouponXxL WordPress theme up to version 3.0.0 allows unauthenticated attackers to inject arbitrary PHP objects through unsafe deserialization of untrusted data, resulting in full site compromise. The vulnerability, reported via Patchstack, carries a CVSS 9.8 critical score but has no known in‑the‑wild exploitation or public exploit code at this time. EPSS probability is low (0.13%) but the ease of exploitation makes patching urgent.
Remote code execution in BoldThemes Amwerk theme for WordPress versions up to 1.2.0 allows unauthenticated attackers to inject malicious PHP objects via deserialization of untrusted data, leading to full site compromise. The vulnerability has a critical CVSS score but a low EPSS probability (0.13%), with no reported active exploitation or public proof-of-concept at this time.
Object injection via unsafe deserialization in the WP Optimize By xTraffic WordPress plugin allows unauthenticated remote attackers to achieve code execution by sending crafted serialized data. All plugin versions up to and including 5.1.6 are affected. No active exploitation or public exploit code has been identified, and EPSS predicts only a 0.13% chance of exploitation.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL Injection.This issue affects Guest Tracking Software. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Wowwo CRM allows Blind SQL Injection.This issue affects Wowwo CRM. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB allows SQL Injection.This issue affects Mikro Hand Terminal - MikroDB. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Case Informatics Case ERP allows SQL Injection.This issue affects Case ERP: before V2.0.1.
authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, however this check is missing in versions prior to 2025.6.3 and 2025.4.3. When, for example, using RAC during a screenshare, a malicious user could access the same session by copying the URL from the shown browser. authentik 2025.4.3 and 2025.6.3 fix this issue. As a workaround, it is recommended to decrease the duration a token is valid for (in the RAC Provider settings, set Connection expiry to `minutes=5` for example). The maintainers of authentik also recommend enabling the option Delete authorization on disconnect.
We need to produce a JSON with the specified fields, synthesizing data. The CVE is CVE-2025-53314. From description: CSRF in WP Optimizer (WordPress plugin) allows SQL Injection. Affected: n/a through 2.3.6. CVSS 9.6, vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L. CWE-352 is CSRF. Tags: CSRF, SQLi. EPSS 0.03% (very low), percentile 7%. Reported by audit@patchstack.com. ENISA EUVD ID. References: patchstack advisory. No KEV mentioned, no POC explicitly mentioned; from input, we have patch availability? There's a patchstack advisory with a CVE, likely describing the vulnerability patch; often patchstack provides details on fix version. The description says "from n/a through 2.3.6", so the fix is likely 2.3.7 or higher, but not specified. Patchstack reference may indicate version. I'll check: patchstack.com/database/wordpress/plugin/wp-optimizer/vulnerability/wordpress-wp-optimizer-plugin-2-3-6-cross-site-request-forgery-csrf-vulnerability. That reference likely states that the fixed version is something. Without access, we can infer that a patch exists since it's a reported vulnerability, typically with a fix version. But we need to be accurate: "Patch available per vendor advisory" if we can't confirm exact version. However, from the description "from n/a through 2.3.6", it likely means 2.3.6 is the last vulnerable, so fixed in 2.3.7 or later. I'll state that as "Vendor-released patch: likely in version after 2.3.6 (specific version not independently confirmed)" but better to use the exact phrase if known. Since it's not provided, I'll say "Patch available via WordPress plugin update (exact fix version not confirmed, but versions after 2.3.6 are likely safe)." The requirement: "If input includes an exact fix version: 'Vendor-released patch: [exact version]'. If patch refs point to a GitHub PR or commit... 'Upstream fix available (PR/commit); released patched version not independently confirmed'. If patch data says available but no version: 'Patch available pe
Path traversal in the unauthenticated file upload endpoint of openvpn-cms-flask 1.2.7 and earlier allows remote attackers to write arbitrary files to the server, potentially achieving remote code execution. The vulnerability is publicly disclosed with a proof-of-concept, and a vendor patch is available in version 1.2.8.
We need to produce a JSON with all required fields, synthesizing data from all sources. We are told: "A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used." CVSS: 5.5, CVSS vector: 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P ... So it's a critical classification from vuldb, but CVSS 5.5 is medium. Actually CVSS 4.0 base score? 5.5 is medium. The EPSS: 0.43% (62 percentile) moderate. POC is publicly available, no KEV. CPE: cpe:2.3:a:dbgpt:db-gpt:*:*:*:*:*:*:*:*. Tags: Path Traversal. References: NVD link to github issue, vuldb entries. Affected versions from EUVD: db-gpt 0.7.1, 0.7.0, 0.7.2. (up to 0.7.2). We need to produce: product_name (1-3 words): "db-gpt" maybe? It's eosphoros-ai DB-GPT. I'd say "DB-GPT". Product name: "db-gpt" according to CPE. We'll output "DB-GPT". Summary: not copying description, write original synthesis: e.g., "Path traversal in DB-GPT up to 0.7.2 allows remote unauthenticated attackers to upload arbitrary files via the import_flow endpoint." The description: manipulation of argument File leads to path traversal. The import_flow endpoint likely expects a file upload and then path traversal on the filename? So file upload traversal. "Allows remote attackers to write files to arbitrary locations on the server, potentially leading to code execution." But need to ground in data. CVSS vector says VC:L/VI:L/VA:L so confidentiality, integrity, availability all low. So low impact. But critical classification might be hyperbole. We'll synthesize: "Path traversal in the AWEL flow import functionality allows remote attackers to overwrite or create files outside the intended directory, potentially leading to low-level system compromise."
SQL injection in code-projects Food Distributor Site 1.0 allows remote attackers to bypass authentication or extract sensitive data via crafted username/password inputs at /admin/process_login.php. A public proof-of-concept exploit is available, but no active exploitation has been confirmed. Despite being classified as "critical" by the reporter, the CVSS 4.0 base score is 5.5 (Medium) with low impact across confidentiality, integrity, and availability.
The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
SQL injection in the LifterLMS WordPress plugin (versions up to and including 8.0.6) lets remote attackers inject crafted SQL into a vulnerable query, exposing sensitive database contents such as user records, course data, and WordPress secrets. Patchstack assigns a critical 9.3 (CVSS 3.1) with an unauthenticated network vector, though there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.06%, 17th percentile). The flaw is a classic CWE-89 improper neutralization of special elements in an SQL command.
SQL injection in ThemeMove Amely WordPress theme (≤3.1.4) allows unauthenticated remote attackers to extract sensitive database data via crafted SQL queries. The vulnerability is network-exploitable with no user interaction, presenting a severe risk to sites using the theme. No public exploit or active exploitation has been confirmed at this time.
2-3 sentence plain-language. Start with impact: SQL injection vulnerability in favethemes Homey theme for WordPress allows unauthenticated remote attackers to extract sensitive data from the database. Affects versions up to 2.4.5. No known active exploitation (no KEV, EPSS low), but POC not mentioned. The high CVSS is due to network vector and no auth, but scope change indicates impact may be limited to database if no further compromise. Just synthesize:
SQL injection in DirectIQ Email Marketing plugin ≤2.0 for WordPress allows unauthenticated remote attackers to extract sensitive data from the underlying database. The vulnerability carries a CVSS 9.3 critical rating due to its network attack vector, low complexity, and lack of required privileges or user interaction. No public exploit or active exploitation has been confirmed, and EPSS likelihood is very low (0.05%).
We need to produce a JSON analysis. The input includes CVE, description, CVSS, CWE, tags, references, EPSS, and multi-source intelligence. First, understand the product: "Classiera" appears to be a WordPress theme from JoinWebs. Affects versions up to 4.0.34. Vulnerability: SQL injection. CVSS 9.3, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. So high impact on confidentiality, low on availability, no integrity impact, scope changed. EPSS 0.05% (very low). Tags: SQLi. Reported by Patchstack. KEV status? Not mentioned, so assume false. POC? Not mentioned in data, but Tags alone don't confirm POC. No explicit patch availability in provided data? References from Patchstack, but no explicit patch version. However, typical Patchstack advisory would mention a fix. The references are to Patchstack database, which likely contains info about fix. The summary might indicate if fixed. Since it says "from n/a through 4.0.34", maybe there is a fixed version. But we need to synthesize without inventing. The input doesn't provide patch details. So I'll need to infer: Patchstack database likely includes a fix version, but we don't have it. So remediation: "No patch information explicitly provided; consult Patchstack advisory for updates." But I'll check text: "This issue affects Classiera: from n/a through 4.0.34." That is from description. Does the Patchstack link provide a fix? Not directly in data. I'll treat patch status as unknown, but note the advisory may contain fix. So I'll say: "No vendor-released patch version confirmed in the provided data; refer to Patchstack advisory." But I need to be careful: "No vendor-released patch identified at time of analysis" fits. However, the Patchstack reference likely points to a known vulnerability with fix. I'll state: "Patch availability not independently confirmed; check Patchstack advisory." For remediation paragraph, I'll suggest upgrading to a version beyond 4.0.34 or applying the fix from the advisory. Since the description says th
SQL injection in GG Bought Together for WooCommerce plugin allows unauthenticated attackers to extract sensitive data from the WordPress database. Affects versions up to 1.0.2. The EPSS exploitation probability is very low (0.05%) and no public exploit or active exploitation has been identified, suggesting limited real-world risk despite the critical CVSS rating.
Remote code execution in the File Manager Plugin for WordPress versions up to 7.5 allows authenticated administrators to upload malicious PHP files via an unrestricted file upload flaw, leading to web shell deployment on the server. This vulnerability, reported by Patchstack, carries a CVSS 9.1 critical rating but has a low EPSS exploitation probability (0.09%) and no known active exploitation or public exploit code.
PHP object injection in the uxper Nuss WordPress theme through version 1.3.3 allows authenticated attackers with low privileges to execute arbitrary code or manipulate data via deserialization of untrusted input. Exploitation requires a valid WordPress account and the active theme; there is no evidence of active exploitation, and EPSS indicates low probability (0.16%).
Authenticated PHP object injection in the Sala WordPress theme (versions ≤1.1.3) enables remote code execution or data manipulation. Attackers with subscriber-level access can exploit insecure deserialization of untrusted data to inject arbitrary PHP objects. No active exploitation or public exploit code is currently known, and the EPSS score indicates low exploitation probability (0.16%).
Privilege escalation vulnerability in the MDJM Mobile DJ Manager WordPress plugin (versions ≤ 1.7.6) allows authenticated users to gain unauthorized access via missing authorization checks. A low-privilege attacker can exploit this to achieve full site compromise, with high impact on confidentiality, integrity, and availability. No active exploitation or public exploit code has been reported.
Account takeover via authentication bypass in WP SmartPay plugin versions up to 2.7.13 allows authenticated low-privileged users to gain full administrative control of the WordPress site. By exploiting an alternate authentication channel, attackers can escalate privileges, compromising confidentiality, integrity, and availability. No public exploit or active exploitation is known; EPSS is low at 0.07%.
The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Object Injection via Cross-Site Request Forgery (CSRF) in Infigo Software IS-theme-companion WordPress plugin allows attackers to execute arbitrary code on affected websites when an authenticated administrator is tricked into clicking a malicious link. The vulnerability exists in versions up to and including 1.57 and can lead to full site compromise. No public exploit or active exploitation has been confirmed, and the EPSS probability of exploitation is very low (0.03%).
A security vulnerability in versions (CVSS 8.7) that allows attackers. High severity vulnerability requiring prompt remediation.
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `<tabber>` tag. Version 3.1.1 contains a patch for the bug.
Arbitrary file deletion in the FW Food Menu WordPress plugin (≤6.0.0) allows remote attackers to delete server files, potentially causing service unavailability. Exploitation requires no authentication or user interaction, making it highly accessible. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability (0.08%).
Privilege escalation in the CouponXxL Custom Post Types WordPress plugin (version ≤3.0) allows unauthenticated attackers to gain higher-level permissions due to incorrect privilege assignment. No active exploitation or public exploit code is known; EPSS predicts a 0.08 % probability of exploitation activity.
Remote, unauthenticated code injection in the Content No Cache WordPress plugin allows attackers to execute arbitrary PHP functions, leading to high confidentiality impact. This vulnerability, rated CVSS 8.6, affects all versions up to 0.1.3 and can be exploited without user interaction to disclose sensitive data such as configuration files. While exploitation is technically straightforward, EPSS data suggests a low probability of active exploitation in the wild.
A security vulnerability in BuddyPress Docs WordPress (CVSS 4.3) that allows a logged. Risk factors: public PoC available.