2025-07-05 - CVE Archive

CVE-2025-47228 Jul 05, 03:15 MEDIUM POC This Month

In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests.

Command Injection

NVD GitHub Exploit-DB

CVSS 3.1

6.7

EPSS

5.2%

CVE-2025-26850 Jul 05, 00:15 CRITICAL PATCH Act Now

The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.

Authentication Bypass Privilege Escalation

NVD

CVSS 3.1

9.3

EPSS

0.0%

CVE-2025-43711 Jul 05, 00:15 HIGH PATCH This Week

A remote code execution vulnerability (CVSS 8.1) that allows attackers. High severity vulnerability requiring prompt remediation.

RCE

NVD

CVSS 3.1

8.1

EPSS

0.0%

CVE-2025-47227 Jul 05, 03:15 HIGH This Week

In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.

PHP Authentication Bypass

NVD GitHub

CVSS 3.1

7.5

EPSS

1.1%

CVE-2025-53603 Jul 05, 01:15 HIGH PATCH This Week

In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.

Denial Of Service Null Pointer Dereference Debian Ubuntu

NVD GitHub

CVSS 3.1

7.5

EPSS

0.0%

CVE-2025-7074 Jul 05, 09:15 LOW POC Monitor

Inefficient regular expression complexity in Vercel Hyper up to 3.4.1 allows remote attackers with low privileges to cause denial of service via specially crafted input to the brace expansion logic. The vulnerability resides in the expand/braceExpand/ignoreMap function within the rimraf-standalone.js script. Public exploit code is available, but no evidence of active exploitation exists and EPSS indicates a low probability (0.17%) of widespread exploitation.

Denial Of Service Hyper Vercel

NVD GitHub VulDB

CVSS 4.0

2.1

EPSS

0.2%

CVE-2025-53605 Jul 05, 01:15 MEDIUM PATCH This Month

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Information Disclosure Debian Ubuntu Red Hat

NVD GitHub

CVSS 3.1

5.9

EPSS

0.0%

CVE-2024-58254 Jul 05, 02:15 MEDIUM PATCH This Month

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure

NVD GitHub

CVSS 3.1

5.3

CVE-2023-50786 Jul 05, 04:15 MEDIUM This Month

A remote code execution vulnerability in Dradis through 4.16.0 (CVSS 4.1). Remediation should follow standard vulnerability management procedures.

Windows Information Disclosure Microsoft Dradis Dradisframework

NVD

CVSS 3.1

4.1

EPSS

0.0%

CVE-2025-53604 Jul 05, 01:15 MEDIUM PATCH This Month

The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header.

Denial Of Service

NVD GitHub

CVSS 3.1

4.0

EPSS

0.1%

CVE-2025-6022 Jul 05, 23:15 Awaiting Data