İçeriğe atla
Noroxi

Yayın tarihine göre

Kasım 2025: sömürülen ve yeni ciddi CVE kayıtları

164 kayıt · 11 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 1 / 2

  • CVE-2025-11174
    21İzleyin

    Document Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposure

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    barn2media · document library lite1 Kas 2025

  • CVE-2025-11833
    57Planlayın

    Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Lo

    KritikCVSS 9,8Kavram kanıtıEPSS %61

    saadiqbal · post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app1 Kas 2025

  • CVE-2025-11740
    26İzleyin

    wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    tomdever · wpforo forum1 Kas 2025

  • CVE-2025-12137
    19İzleyin

    Import WP – Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read

    OrtaCVSS 4,9Kavram kanıtıEPSS %0

    jcollings · import wp – export and import csv and xml files to wordpress1 Kas 2025

  • CVE-2025-60503
    34İzleyin

    A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted i

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    ultimatefosters · ultimatepos3 Kas 2025

  • CVE-2025-11953
    97Hemen

    Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %93

    react-native-community · react native community cli3 Kas 2025

  • CVE-2025-50363
    21İzleyin

    Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hiring.php va the name field.

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    phpgurukul · maid hiring management system3 Kas 2025

  • CVE-2025-63441
    29İzleyin

    Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/frien

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    opensource-socialnetwork · open source social network3 Kas 2025

  • CVE-2025-43426
    22İzleyin

    A logging issue was addressed with improved data redaction.

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    apple · ipados3 Kas 2025

  • CVE-2025-43407
    31İzleyin

    This issue was addressed with improved entitlements.

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    apple · ipados4 Kas 2025

  • CVE-2025-43504
    19İzleyin

    A buffer overflow was addressed with improved bounds checking.

    OrtaCVSS 4,9Kavram kanıtıEPSS %0

    apple · xcode4 Kas 2025

  • CVE-2025-20730
    26İzleyin

    In preloader, there is a possible escalation of privilege due to an insecure default value.

    OrtaCVSS 6,7Kavram kanıtıEPSS %0

    linuxfoundation · yocto4 Kas 2025

  • CVE-2024-56426
    30İzleyin

    An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    samsung · exynos 1080 firmware4 Kas 2025

  • CVE-2025-62507
    32İzleyin

    Redis: Bug in XACKDEL may lead to stack overflow and potential RCE

    YüksekCVSS 7,7Kavram kanıtıEPSS %6

    redis · redis4 Kas 2025

  • CVE-2025-62369
    28İzleyin

    Xibo CMS: Remote Code Execution through module templates

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    xibosignage · xibo4 Kas 2025

  • CVE-2025-12735
    40Planlayın

    The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    jorenbroekema · javascript expression evaluator5 Kas 2025

  • CVE-2025-12197
    35İzleyin

    The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s

    YüksekCVSS 7,5İstismar yokEPSS %18

    stellarwp · the events calendar5 Kas 2025

  • CVE-2025-11749
    61Bu hafta

    AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation

    KritikCVSS 9,8SilahlaştırılmışEPSS %74

    tigroumeow · ai engine – the chatbot, ai framework & mcp for wordpress5 Kas 2025

  • CVE-2025-12139
    31İzleyin

    File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    princeahmed · file manager for google drive – integrate google drive5 Kas 2025

  • CVE-2025-12674
    39İzleyin

    KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    mykiot · kiotviet sync5 Kas 2025

  • CVE-2025-64458
    31İzleyin

    Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    djangoproject · django5 Kas 2025

  • CVE-2025-64459
    42Planlayın

    Potential SQL injection via _connector keyword argument in QuerySet and Q objects

    KritikCVSS 9,1Kavram kanıtıEPSS %19

    djangoproject · django5 Kas 2025

  • CVE-2025-61304
    40Planlayın

    OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    dynatrace · activegate ping extension5 Kas 2025

  • CVE-2025-59716
    21İzleyin

    ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint.

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    owncloud · guests5 Kas 2025

  • CVE-2025-10713
    36İzleyin

    XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration

    KritikCVSS 9,1İstismar yokEPSS %0

    wso2 · api control plane5 Kas 2025

  • CVE-2023-43000
    66Bu hafta

    A use-after-free issue was addressed with improved memory management.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %4

    apple · safari5 Kas 2025

  • CVE-2025-63585
    26İzleyin

    OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    opensource-socialnetwork · open source social network5 Kas 2025

  • CVE-2025-20343
    30İzleyin

    Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    cisco · identity services engine5 Kas 2025

  • CVE-2025-43990
    31İzleyin

    Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability.

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    dell · command monitor5 Kas 2025

  • CVE-2025-62039
    30İzleyin

    WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.6.6 - Sensitive Data Exposure vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    ays pro · ai chatbot with chatgpt and content generator by ays6 Kas 2025

  • CVE-2025-63307
    32İzleyin

    alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS).

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    alexusmai · laravel file manager6 Kas 2025

  • CVE-2025-63588
    28İzleyin

    An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and ex

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    cmsimple-xh · cmsimple xh6 Kas 2025

  • CVE-2025-63589
    28İzleyin

    A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encod

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    cmsimple-xh · cmsimple xh6 Kas 2025

  • CVE-2025-27918
    39İzleyin

    An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS

    KritikCVSS 9,8İstismar yokEPSS %0

    anydesk · anydesk6 Kas 2025

  • CVE-2025-60188
    31İzleyin

    WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %3

    vito peleg · atarim6 Kas 2025

  • CVE-2025-62950
    17İzleyin

    WordPress Contest Gallery plugin <= 28.0.0 - Cross Site Request Forgery (CSRF) vulnerability

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    wasiliy strecker / contestgallery developer · contest gallery6 Kas 2025

  • CVE-2025-6325
    39İzleyin

    WordPress King Addons for Elementor plugin <= 51.1.36 - Privilege Escalation vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    kingaddons.com · king addons for elementor6 Kas 2025

  • CVE-2025-31133
    29İzleyin

    runc container escape via "masked path" abuse due to mount race conditions

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    linuxfoundation · runc6 Kas 2025

  • CVE-2025-12490
    40Planlayın

    Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %16

    netgate · pfsense6 Kas 2025

  • CVE-2025-52881
    29İzleyin

    runc: LSM labels can be bypassed with malicious config using dummy procfs files

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    linuxfoundation · runc6 Kas 2025

  • CVE-2025-64328
    89Hemen

    FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

    YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %84

    sangoma · filestore7 Kas 2025

  • CVE-2025-34299
    60Bu hafta

    Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload

    KritikCVSS 9,3SilahlaştırılmışEPSS %72

    monstaftp · monsta ftp7 Kas 2025

  • CVE-2025-60574
    30İzleyin

    A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    webair · tquadra cms7 Kas 2025

  • CVE-2025-63420
    16İzleyin

    CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling pe

    OrtaCVSS 4,1Kavram kanıtıEPSS %0

    crushftp · crushftp7 Kas 2025

  • CVE-2025-12890
    26İzleyin

    Bluetooth: peripheral: Invalid handling of malformed connection request

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    zephyrproject-rtos · zephyr7 Kas 2025

  • CVE-2025-10230
    52Planlayın

    Samba: command injection in wins server hook script

    KritikCVSS 10,0Kavram kanıtıEPSS %39

    red hat · red hat enterprise linux 107 Kas 2025

  • CVE-2025-64495
    21İzleyin

    Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    openwebui · open webui7 Kas 2025

  • CVE-2025-11452
    30İzleyin

    Asgaros Forum <= 3.1.0 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    asgaros · asgaros forum8 Kas 2025

  • CVE-2025-12399
    28İzleyin

    Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    alexreservations · alex reservations: smart restaurant booking8 Kas 2025

  • CVE-2025-12916
    10İzleyin

    Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection

    DüşükCVSS 2,1Kavram kanıtıEPSS %5

    sangfor · operation and maintenance security management system9 Kas 2025

  • CVE-2025-12480
    95Hemen

    Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even

    KritikCVSS 9,1KEVSilahlaştırılmışEPSS %95

    gladinet · triofox10 Kas 2025

  • CVE-2025-56503
    26İzleyin

    An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Admini

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    10 Kas 2025

  • CVE-2025-60876
    26İzleyin

    BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the re

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    busybox · busybox10 Kas 2025

  • CVE-2025-63296
    26İzleyin

    KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: durin

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    keruistore · kerui k259 firmware10 Kas 2025

  • CVE-2025-62780
    21İzleyin

    changedetection.io vulnerable to stored XSS in Watch update via API

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    changedetection · changedetection10 Kas 2025

  • CVE-2025-64512
    31İzleyin

    pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    pdfminer · pdfminer.six10 Kas 2025

  • CVE-2025-64513
    37İzleyin

    Milvus Proxy has Critical Authentication Bypass Vulnerability

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    milvus-io · milvus10 Kas 2025

  • CVE-2021-4462
    38İzleyin

    Employee Records System v1.0 Arbitrary File Upload RCE

    KritikCVSS 9,3Kavram kanıtıEPSS %3

    skittles · employee records system10 Kas 2025

  • CVE-2025-12433
    17İzleyin

    Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    google · chrome10 Kas 2025

  • CVE-2025-11307
    36İzleyin

    WP Google Maps < 9.0.48 - Unauthenticated Stored XSS

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    unknown · wp go maps (formerly wp google maps)11 Kas 2025

  • CVE-2025-11170
    39İzleyin

    WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    kddiwebcommunications · wp移行専用プラグイン for cpi11 Kas 2025

  • CVE-2025-11986
    21İzleyin

    Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    odude · crypto tool11 Kas 2025

  • CVE-2025-11988
    21İzleyin

    Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    odude · crypto tool11 Kas 2025

  • CVE-2025-9223
    36İzleyin

    Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to

    YüksekCVSS 8,8Kavram kanıtıEPSS %4

    zohocorp · manageengine applications manager11 Kas 2025

  • CVE-2025-12539
    40Planlayın

    TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover

    KritikCVSS 10,0Kavram kanıtıEPSS %1

    leopardhost · tnc toolbox: web performance11 Kas 2025

  • CVE-2025-31931
    21İzleyin

    Uncontrolled search path for the Instrumentation and Tracing Technology API (ITT API) software before version 3.25.4 within Ring 3: User App

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    11 Kas 2025

  • CVE-2025-12101
    31İzleyin

    Cross-Site Scripting (XSS)

    OrtaCVSS 5,9Kavram kanıtıEPSS %26

    netscaler · adc11 Kas 2025

  • CVE-2025-60709
    31İzleyin

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    microsoft · windows 10 160711 Kas 2025

  • CVE-2025-60719
    29İzleyin

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    YüksekCVSS 7,0Kavram kanıtıEPSS %1

    microsoft · windows 10 160711 Kas 2025

  • CVE-2025-60724
    41Planlayın

    GDI+ Remote Code Execution Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %6

    microsoft · 365 copilot11 Kas 2025

  • CVE-2025-62215
    59Planlayın

    Windows Kernel Elevation of Privilege Vulnerability

    YüksekCVSS 7,0KEVSilahlaştırılmışEPSS %4

    microsoft · windows 10 180911 Kas 2025

  • CVE-2025-60710
    62Bu hafta

    Host Process for Windows Tasks Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %4

    microsoft · windows 11 24h211 Kas 2025

  • CVE-2025-62222
    35İzleyin

    Agentic AI and Visual Studio Code Remote Code Execution Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    microsoft · github copilot chat11 Kas 2025

  • CVE-2025-12748
    22İzleyin

    Libvirt: denial of service in xml parsing

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    red hat · red hat enterprise linux 1011 Kas 2025

  • CVE-2025-63666
    39İzleyin

    Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-en

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    tenda · ac15 firmware12 Kas 2025

  • CVE-2025-63667
    30İzleyin

    Incorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10-20240725 allows attackers to access sensiti

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    simicam · ip camera firmware12 Kas 2025

  • CVE-2025-40123
    31İzleyin

    bpf: Enforce expected_attach_type for tailcall compatibility

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux12 Kas 2025

  • CVE-2025-63353
    39İzleyin

    A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be pre

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    fiberhome · hg6145f1 firmware12 Kas 2025

  • CVE-2025-63419
    24İzleyin

    Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    crushftp · crushftp12 Kas 2025

  • CVE-2025-57310
    35İzleyin

    A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allo

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    salmen · simple faucet script12 Kas 2025

  • CVE-2025-11700
    43Planlayın

    N-central Multiple XXE Injection Vulnerabilities

    YüksekCVSS 8,4SilahlaştırılmışEPSS %31

    n-able · n-central12 Kas 2025

  • CVE-2025-9316
    60Bu hafta

    N-central unauthenticated sessionID generation

    OrtaCVSS 6,9SilahlaştırılmışEPSS %37

    n-able · n-central12 Kas 2025

  • CVE-2021-4463
    34İzleyin

    Longjing Technology BEMS API <= 1.21 Remote Arbitrary File Download

    YüksekCVSS 8,7Kavram kanıtıEPSS %1

    shenzhen longjing technology co. ltd. · bems api12 Kas 2025

  • CVE-2023-7327
    35İzleyin

    Ozeki SMS Gateway <= 10.3.208 Unauthenticated Arbitrary File Read

    YüksekCVSS 8,7Kavram kanıtıEPSS %2

    ozeki ltd. · ozeki sms gateway12 Kas 2025

  • CVE-2025-64500
    29İzleyin

    Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

    YüksekCVSS 7,3Kavram kanıtıEPSS %1

    sensiolabs · httpfoundation12 Kas 2025

  • CVE-2025-12536
    21İzleyin

    SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    brainstormforce · sureforms – contact form, payment form & other custom form builder13 Kas 2025

  • CVE-2025-12733
    35İzleyin

    Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic

    YüksekCVSS 8,8İstismar yokEPSS %0

    wpallimport · wp all import – drag & drop import for csv, xml, excel & google sheets13 Kas 2025

  • CVE-2025-60689
    26İzleyin

    An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmwar

    OrtaCVSS 5,4Kavram kanıtıEPSS %18

    linksys · e1200 firmware13 Kas 2025

  • CVE-2025-64714
    23İzleyin

    PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal

    OrtaCVSS 5,8Kavram kanıtıEPSS %0

    privatebin · privatebin13 Kas 2025

  • CVE-2025-12762
    43Planlayın

    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

    KritikCVSS 9,8Kavram kanıtıEPSS %12

    pgadmin · pgadmin 413 Kas 2025

  • CVE-2025-60690
    36İzleyin

    A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.1

    YüksekCVSS 8,8Kavram kanıtıEPSS %4

    linksys · e1200 firmware13 Kas 2025

  • CVE-2025-63406
    35İzleyin

    An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbTo

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    group-office · group office13 Kas 2025

  • CVE-2025-64525
    26İzleyin

    Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    astro · astro13 Kas 2025

  • CVE-2025-12904
    28İzleyin

    SNORDIAN's H5PxAPIkatchu <= 0.4.17 - Unauthenticated Stored Cross-Site Scripting via insert_data

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    otacke · snordian's h5pxapikatchu14 Kas 2025

  • CVE-2025-63830
    24İzleyin

    CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    cksource · ckfinder14 Kas 2025

  • CVE-2025-64446
    97Hemen

    A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %91

    fortinet · fortiweb14 Kas 2025

  • CVE-2025-12847
    17İzleyin

    All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media D

    OrtaCVSS 4,3İstismar yokEPSS %0

    smub · all in one seo – powerful seo plugin to boost seo rankings & increase traffic15 Kas 2025

  • CVE-2025-9501
    43Planlayın

    W3 Total Cache < 2.8.13 - Unauthenticated Command Injection

    KritikCVSS 9,0Kavram kanıtıEPSS %22

    unknown · w3 total cache17 Kas 2025

  • CVE-2025-63708
    24İzleyin

    Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to ex

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    remyandrade · ai font matcher17 Kas 2025

  • CVE-2025-4321
    28İzleyin

    DoS in RS9116W-WiSeConnect L2CAP protocol due to reception of malformed packets

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    silabs.com · rs9116w17 Kas 2025