İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2025: sömürülen ve yeni ciddi CVE kayıtları

195 kayıt · 10 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 1 / 2

  • CVE-2025-39913
    31İzleyin

    tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel1 Eki 2025

  • CVE-2025-61622
    52Planlayın

    Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory

    KritikCVSS 9,8Kavram kanıtıEPSS %43

    apache · fory1 Eki 2025

  • CVE-2025-56514
    21İzleyin

    Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are r

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    suisuijiang · fiora1 Eki 2025

  • CVE-2025-56515
    35İzleyin

    File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality.

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    suisuijiang · fiora1 Eki 2025

  • CVE-2025-57389
    21İzleyin

    A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to exe

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    1 Eki 2025

  • CVE-2025-61734
    36İzleyin

    Apache Kylin: improper restriction of file read

    YüksekCVSS 7,5İstismar yokEPSS %19

    apache · kylin2 Eki 2025

  • CVE-2025-56379
    21İzleyin

    A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scr

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    frappe · erpnext2 Eki 2025

  • CVE-2025-56380
    26İzleyin

    Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    frappe · erpnext2 Eki 2025

  • CVE-2025-56381
    26İzleyin

    ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    frappe · erpnext2 Eki 2025

  • CVE-2025-56019
    26İzleyin

    An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to co

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    agasta · easy touch plus firmware2 Eki 2025

  • CVE-2025-61666
    34İzleyin

    Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File

    YüksekCVSS 8,7Kavram kanıtıEPSS %1

    traccar · traccar2 Eki 2025

  • CVE-2025-59536
    42Planlayın

    Claude Code's startup trust dialog could lead to Command Execution attack

    YüksekCVSS 8,7Kavram kanıtıEPSS %27

    anthropic · claude code3 Eki 2025

  • CVE-2025-27237
    29İzleyin

    DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    zabbix · zabbix3 Eki 2025

  • CVE-2025-9209
    40Planlayın

    RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    magnigenie · restropress – online food ordering system3 Eki 2025

  • CVE-2025-9286
    39İzleyin

    Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    hancock11 · appy pie connect for woocommerce3 Eki 2025

  • CVE-2025-9876
    25İzleyin

    Ird Slider <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    OrtaCVSS 6,4Kavram kanıtıEPSS %0

    inforrada · ird slider3 Eki 2025

  • CVE-2025-55971
    18İzleyin

    TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthentic

    OrtaCVSS 4,7Kavram kanıtıEPSS %0

    tcl · 65c655 firmware3 Eki 2025

  • CVE-2025-55972
    30İzleyin

    A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS)

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    tcl · 65c655 firmware3 Eki 2025

  • CVE-2025-60787
    34İzleyin

    MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name.

    YüksekCVSS 7,2SilahlaştırılmışEPSS %18

    motioneye project · motioneye3 Eki 2025

  • CVE-2025-46817
    36İzleyin

    Lua library commands may lead to integer overflow and potential RCE

    YüksekCVSS 8,8Kavram kanıtıEPSS %3

    redis · redis3 Eki 2025

  • CVE-2025-59489
    29İzleyin

    Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code f

    YüksekCVSS 7,4Kavram kanıtıEPSS %0

    unity · editor3 Eki 2025

  • CVE-2025-46818
    29İzleyin

    Redis: Authenticated users can execute LUA scripts as a different user

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    redis · redis3 Eki 2025

  • CVE-2025-46819
    28İzleyin

    Redis is vulnerable to DoS via specially crafted LUA scripts

    YüksekCVSS 7,1Kavram kanıtıEPSS %1

    redis · redis3 Eki 2025

  • CVE-2025-49844
    64Bu hafta

    Redis Lua Use-After-Free may lead to remote code execution

    KritikCVSS 9,9Kavram kanıtıEPSS %82

    redis · redis3 Eki 2025

  • CVE-2025-34226
    28İzleyin

    OpenPLC Runtime v3 Persistent DoS

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    autonomy logic · openplc runtime3 Eki 2025

  • CVE-2025-59944
    39İzleyin

    Cursor IDE: Sensitive File Overwrite Bypass is Possible

    KritikCVSS 9,8İstismar yokEPSS %0

    anysphere · cursor3 Eki 2025

  • CVE-2025-9485
    39İzleyin

    OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    cyberlord92 · oauth single sign on – sso (oauth client)4 Eki 2025

  • CVE-2025-39946
    25İzleyin

    tls: make sure to abort the stream if headers are bogus

    OrtaCVSS 5,5Kavram kanıtıEPSS %9

    linux · linux kernel4 Eki 2025

  • CVE-2025-9886
    17İzleyin

    Trinity Audio <= 5.20.2 - Cross-Site Request Forgery

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    sergiotrinity · trinity audio – text to speech ai audio player to convert content into audio4 Eki 2025

  • CVE-2025-61882
    99Hemen

    Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    oracle · concurrent processing5 Eki 2025

  • CVE-2025-50538
    28İzleyin

    Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.

    OrtaCVSS 6,1İstismar yokEPSS %14

    flowiseai · flowise6 Eki 2025

  • CVE-2025-11331
    13İzleyin

    IdeaCMS Website Name Config.php command injection

    DüşükCVSS 2,0İstismar yokEPSS %17

    ideacms · ideacms6 Eki 2025

  • CVE-2025-61224
    26İzleyin

    Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q pa

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    6 Eki 2025

  • CVE-2025-52472
    38İzleyin

    XWiki Platform vulnerable to HQL injection via wiki and space search REST API

    KritikCVSS 9,3Kavram kanıtıEPSS %2

    xwiki · xwiki-platform6 Eki 2025

  • CVE-2025-61687
    38İzleyin

    FlowiseAI/Flosise has File Upload vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %10

    flowiseai · flowise6 Eki 2025

  • CVE-2025-61765
    25İzleyin

    python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments

    OrtaCVSS 6,4Kavram kanıtıEPSS %0

    miguelgrinberg · python-socketio6 Eki 2025

  • CVE-2025-61777
    36İzleyin

    FlagForge Allows Unauthenticated Badge Template API Access

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    flagforge · flagforge6 Eki 2025

  • CVE-2025-61984
    14İzleyin

    ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leadin

    DüşükCVSS 3,6Kavram kanıtıEPSS %0

    openbsd · openssh6 Eki 2025

  • CVE-2025-10162
    35İzleyin

    OrderConvo <= 15.1 - Unauthenticated Arbitrary File Read

    YüksekCVSS 8,6Kavram kanıtıEPSS %4

    unknown · admin and customer messages after order for woocommerce: orderconvo7 Eki 2025

  • CVE-2025-50505
    31İzleyin

    Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key funct

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    7 Eki 2025

  • CVE-2025-52021
    39İzleyin

    A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    7 Eki 2025

  • CVE-2025-56243
    24İzleyin

    A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the event

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    puneethreddyhc · event management system7 Eki 2025

  • CVE-2025-44823
    40Planlayın

    Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.ph

    YüksekCVSS 8,8Kavram kanıtıEPSS %16

    nagios · log server7 Eki 2025

  • CVE-2025-11171
    21İzleyin

    Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    ays-pro · chartify – wordpress chart plugin8 Eki 2025

  • CVE-2025-61183
    24İzleyin

    Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    webreinvent · vaahcms8 Eki 2025

  • CVE-2025-10351
    37İzleyin

    SQL injection vulnerability in Melis Platform

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    melis technology · melis platform8 Eki 2025

  • CVE-2025-10352
    37İzleyin

    Missing Authorization vulnerability in Melis Platform

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    melis technology · melis platform8 Eki 2025

  • CVE-2025-10353
    38İzleyin

    Missing Authorization vulnerability in Melis Platform

    KritikCVSS 9,3Kavram kanıtıEPSS %2

    melis technology · melis platform8 Eki 2025

  • CVE-2025-57457
    35İzleyin

    An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Command

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    8 Eki 2025

  • CVE-2025-61913
    43Planlayın

    Flowise is vulnerable to arbitrary file read, arbitrary file write

    KritikCVSS 9,9İstismar yokEPSS %12

    flowiseai · flowise8 Eki 2025

  • CVE-2025-10249
    26İzleyin

    Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read

    OrtaCVSS 6,5İstismar yokEPSS %0

    revolution slider · slider revolution9 Eki 2025

  • CVE-2025-4615
    22İzleyin

    PAN-OS: Improper Neutralization of Input in the Management Web Interface

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    paloaltonetworks · pan-os9 Eki 2025

  • CVE-2025-60375
    29İzleyin

    The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validat

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    9 Eki 2025

  • CVE-2025-11371
    88Hemen

    Gladinet CentreStack and TrioFox Local File Inclusion Flaw

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %92

    gladinet · centrestack9 Eki 2025

  • CVE-2025-61928
    42Planlayın

    Better Auth: Unauthenticated API key creation through api-key plugin

    KritikCVSS 9,3İstismar yokEPSS %17

    better-auth · better-auth9 Eki 2025

  • CVE-2025-11554
    8İzleyin

    Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    portabilis · i-educar9 Eki 2025

  • CVE-2025-11555
    22İzleyin

    Campcodes Online Learning Management System calendar_of_events.php sql injection

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    campcodes · online learning management system9 Eki 2025

  • CVE-2025-11449
    21İzleyin

    Reflected Cross Site Scripting in ServiceNow AI Platform

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    servicenow · servicenow ai platform10 Eki 2025

  • CVE-2025-21065
    26İzleyin

    Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices.

    OrtaCVSS 6,6Kavram kanıtıEPSS %0

    samsung mobile · retail mode10 Eki 2025

  • CVE-2025-41088
    20İzleyin

    Stored Cross-Site Scripting (XSS) in CMS

    OrtaCVSS 5,1Kavram kanıtıEPSS %0

    xibo signage · xibo cms10 Eki 2025

  • CVE-2025-41089
    19İzleyin

    Reflected Cross-Site Scripting (XSS) in CMS

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    xibo signage · xibo cms10 Eki 2025

  • CVE-2025-61319
    24İzleyin

    ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    yogeshojha · rengine10 Eki 2025

  • CVE-2025-60378
    32İzleyin

    Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages.

    YüksekCVSS 8,1Kavram kanıtıEPSS %1

    fairsketch · rise ultimate project manager10 Eki 2025

  • CVE-2025-11579
    26İzleyin

    DoS via Out Of Memory Crash

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    nwaples · rardecode10 Eki 2025

  • CVE-2025-11580
    22İzleyin

    PowerJob list authorization

    OrtaCVSS 5,5Kavram kanıtıEPSS %1

    powerjob · powerjob10 Eki 2025

  • CVE-2025-60880
    33İzleyin

    An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a

    YüksekCVSS 8,3Kavram kanıtıEPSS %0

    webkul · bagisto10 Eki 2025

  • CVE-2025-61505
    26İzleyin

    e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    e107 · e10710 Eki 2025

  • CVE-2025-55903
    33İzleyin

    A HTML injection vulnerability exists in Perfex CRM v3.3.1.

    YüksekCVSS 8,3Kavram kanıtıEPSS %0

    10 Eki 2025

  • CVE-2025-11380
    23İzleyin

    Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure

    OrtaCVSS 5,9Kavram kanıtıEPSS %0

    everestthemes · everest backup – wordpress cloud backup, migration, restore & cloning plugin11 Eki 2025

  • CVE-2025-9196
    21İzleyin

    Trinity Audio <= 5.21.0 - Unauthenticated Information Exposure

    OrtaCVSS 5,3Kavram kanıtıEPSS %1

    sergiotrinity · trinity audio – text to speech ai audio player to convert content into audio11 Eki 2025

  • CVE-2025-10175
    26İzleyin

    WP Links Page <= 4.9.6 - Authenticated (Subscriber+) SQL Injection

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    rico-macchi · wp links page11 Eki 2025

  • CVE-2025-61884
    89Hemen

    Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %95

    oracle · configurator12 Eki 2025

  • CVE-2025-10720
    26İzleyin

    WP Private Content Plus <= 3.6.2 - Password Protection Bypass

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    unknown · wp private content plus13 Eki 2025

  • CVE-2025-39964
    52Planlayın

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %1

    linux · linux kernel13 Eki 2025

  • CVE-2025-39965
    22İzleyin

    xfrm: xfrm_alloc_spi shouldn't use 0 as SPI

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    linux · linux kernel13 Eki 2025

  • CVE-2025-9713
    40Planlayın

    Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution.

    YüksekCVSS 8,8İstismar yokEPSS %15

    ivanti · endpoint manager13 Eki 2025

  • CVE-2025-62360
    37İzleyin

    WeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php`

    KritikCVSS 9,4Kavram kanıtıEPSS %0

    wegia · wegia13 Eki 2025

  • CVE-2025-24990
    63Bu hafta

    Windows Agere Modem Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %6

    microsoft · windows 10 150714 Eki 2025

  • CVE-2025-55315
    59Planlayın

    ASP.NET Security Feature Bypass Vulnerability

    KritikCVSS 9,9Kavram kanıtıEPSS %65

    microsoft · asp.net core14 Eki 2025

  • CVE-2025-55320
    27İzleyin

    Configuration Manager Elevation of Privilege Vulnerability

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    microsoft · configuration manager 240314 Eki 2025

  • CVE-2025-58726
    30İzleyin

    Windows SMB Server Elevation of Privilege Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    microsoft · windows 10 150714 Eki 2025

  • CVE-2025-59194
    29İzleyin

    Windows Kernel Elevation of Privilege Vulnerability

    YüksekCVSS 7,0Kavram kanıtıEPSS %2

    microsoft · windows 11 22h214 Eki 2025

  • CVE-2025-59213
    35İzleyin

    Configuration Manager Elevation of Privilege Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    microsoft · configuration manager 240314 Eki 2025

  • CVE-2025-59230
    62Bu hafta

    Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %2

    microsoft · windows 10 150714 Eki 2025

  • CVE-2025-59254
    31İzleyin

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %1

    microsoft · windows 10 150714 Eki 2025

  • CVE-2025-59284
    22İzleyin

    Windows NTLM Spoofing Vulnerability

    OrtaCVSS 5,5Kavram kanıtıEPSS %1

    microsoft · windows 11 22h214 Eki 2025

  • CVE-2025-59287
    99Hemen

    Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    microsoft · windows server 201214 Eki 2025

  • CVE-2025-22831
    23İzleyin

    Buffer Overflow in NTFS when parsing the VOLUME_NAME

    OrtaCVSS 5,9İstismar yokEPSS %0

    ami · aptio v14 Eki 2025

  • CVE-2025-10242
    34İzleyin

    OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke

    YüksekCVSS 7,2İstismar yokEPSS %20

    ivanti · endpoint manager mobile14 Eki 2025

  • CVE-2025-10243
    34İzleyin

    OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke

    YüksekCVSS 7,2İstismar yokEPSS %20

    ivanti · endpoint manager mobile14 Eki 2025

  • CVE-2025-10985
    34İzleyin

    OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke

    YüksekCVSS 7,2İstismar yokEPSS %20

    ivanti · endpoint manager mobile14 Eki 2025

  • CVE-2025-5946
    32İzleyin

    RCE via the poller reload feature available only to user with high privilege

    YüksekCVSS 7,2SilahlaştırılmışEPSS %13

    centreon · centreon web14 Eki 2025

  • CVE-2025-60374
    24İzleyin

    Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    14 Eki 2025

  • CVE-2025-61675
    46Planlayın

    FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters

    YüksekCVSS 8,6SilahlaştırılmışEPSS %38

    freepbx · endpoint14 Eki 2025

  • CVE-2025-61678
    47Planlayın

    FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter

    YüksekCVSS 8,6SilahlaştırılmışEPSS %43

    freepbx · endpointman14 Eki 2025

  • CVE-2025-31702
    27İzleyin

    A vulnerability exists in certain Dahua embedded products.

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    dahua · ipc15 Eki 2025

  • CVE-2025-9967
    39İzleyin

    Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    gsayed786 · orion sms otp verification.15 Eki 2025

  • CVE-2025-10041
    39İzleyin

    Flex QR Code Generator <= 1.2.5 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    ajitdas · flex qr code generator15 Eki 2025

  • CVE-2025-10294
    39İzleyin

    OwnID Passwordless Login <= 1.3.4 - Authentication Bypass

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    victornavarro · ownid passwordless login15 Eki 2025

  • CVE-2025-11177
    30İzleyin

    External Login <= 1.11.2 - Unauthenticated SQL Injection via log

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    tbenyon · external login15 Eki 2025