2025-07-05 - CVE Archive

CVE-2025-47228 MEDIUM POC This Month

In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests.

Command Injection

NVD GitHub Exploit-DB

CVSS 3.1

6.7

EPSS

5.2%

CVE-2025-26850 CRITICAL PATCH Act Now

The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.

Privilege Escalation Authentication Bypass

NVD

CVSS 3.1

9.3

EPSS

0.0%

CVE-2025-43711 HIGH PATCH This Week

A remote code execution vulnerability (CVSS 8.1) that allows attackers. High severity vulnerability requiring prompt remediation.

RCE

NVD

CVSS 3.1

8.1

EPSS

0.0%

CVE-2025-47227 HIGH This Week

In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.

PHP Authentication Bypass

NVD GitHub

CVSS 3.1

7.5

EPSS

1.1%

CVE-2025-53603 HIGH PATCH This Week

In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.

Null Pointer Dereference Denial Of Service Ubuntu Debian

NVD GitHub

CVSS 3.1

7.5

EPSS

0.0%

CVE-2025-7074 LOW POC Monitor

A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1. This affects the function expand/braceExpand/ignoreMap of the file hyper/bin/rimraf-standalone.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Denial Of Service Vercel

NVD GitHub VulDB

CVSS 4.0

2.1

EPSS

0.2%

CVE-2025-53605 MEDIUM PATCH This Month

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Information Disclosure Ubuntu Debian Red Hat

NVD GitHub

CVSS 3.1

5.9

EPSS

0.0%

CVE-2024-58254 MEDIUM PATCH This Month

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure

NVD GitHub

CVSS 3.1

5.3

CVE-2023-50786 MEDIUM This Month

A remote code execution vulnerability in Dradis through 4.16.0 (CVSS 4.1). Remediation should follow standard vulnerability management procedures.

Microsoft Information Disclosure Dradis Windows

NVD

CVSS 3.1

4.1

EPSS

0.0%

CVE-2025-53604 MEDIUM PATCH This Month

The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header.

Denial Of Service

NVD GitHub

CVSS 3.1

4.0

EPSS

0.1%

CVE-2025-6022 Awaiting Data