İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2025: sömürülen ve yeni ciddi CVE kayıtları

217 kayıt · 23 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 3

  • CVE-2025-13780
    35İzleyin

    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    pgadmin · pgadmin 411 Ara 2025

  • CVE-2025-55183
    40Planlayın

    An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.

    OrtaCVSS 5,3Kavram kanıtıEPSS %64

    vercel · next.js11 Ara 2025

  • CVE-2025-55184
    50Planlayın

    A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.

    YüksekCVSS 7,5Kavram kanıtıEPSS %66

    facebook · react11 Ara 2025

  • CVE-2025-55816
    24İzleyin

    HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    digitaldruid · hoteldruid11 Ara 2025

  • CVE-2024-58286
    60Bu hafta

    dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Path

    KritikCVSS 9,3SilahlaştırılmışEPSS %1

    vexorian · dizquetv11 Ara 2025

  • CVE-2024-58290
    37İzleyin

    Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpoint

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    elements · xhibiter nft marketplace11 Ara 2025

  • CVE-2025-67780
    16İzleyin

    SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gR

    OrtaCVSS 4,2Kavram kanıtıEPSS %0

    spacex · starlink dish11 Ara 2025

  • CVE-2025-67779
    36İzleyin

    It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attac

    YüksekCVSS 7,5İstismar yokEPSS %19

    facebook · react12 Ara 2025

  • CVE-2025-67725
    30İzleyin

    Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing

    YüksekCVSS 7,5İstismar yokEPSS %0

    tornadoweb · tornado12 Ara 2025

  • CVE-2025-67727
    27İzleyin

    Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    parseplatform · parse-server12 Ara 2025

  • CVE-2025-67730
    20İzleyin

    Frappe authenticated users can execute XSS through form description fields

    OrtaCVSS 5,1Kavram kanıtıEPSS %0

    frappe · learning12 Ara 2025

  • CVE-2025-12841
    21İzleyin

    Bookit < 2.5.1 – Unauthenticated Settings Update

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    unknown · bookit12 Ara 2025

  • CVE-2024-58299
    37İzleyin

    PCMan FTP Server 2.0 Remote Buffer Overflow via 'pwd' Command

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    pcman · ftp server12 Ara 2025

  • CVE-2025-14174
    72Bu hafta

    Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memo

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %22

    google · chrome12 Ara 2025

  • CVE-2025-14611
    74Bu hafta

    Gladinet CentreStack and TrioFox Hard Coded AES Keys

    YüksekCVSS 7,1KEVSilahlaştırılmışEPSS %53

    gladinet · centrestack12 Ara 2025

  • CVE-2025-43510
    61Bu hafta

    A memory corruption issue was addressed with improved lock state checking.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %0

    apple · ipados12 Ara 2025

  • CVE-2025-43520
    52Planlayın

    A memory corruption issue was addressed with improved memory handling.

    OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %0

    apple · ipados12 Ara 2025

  • CVE-2025-11693
    40Planlayın

    Export WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log File

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    recorp · export wordpress pages to static html & pdf — static site export13 Ara 2025

  • CVE-2025-14440
    39İzleyin

    JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    jayarsiech · jay login & register13 Ara 2025

  • CVE-2025-14659
    30İzleyin

    D-Link DIR-860LB1/DIR-868LB1 DHCP command injection

    YüksekCVSS 7,4Kavram kanıtıEPSS %3

    dlink · dir-868l b1 firmware14 Ara 2025

  • CVE-2025-67906
    36İzleyin

    In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

    KritikCVSS 9,0Kavram kanıtıEPSS %0

    misp-project · misp15 Ara 2025

  • CVE-2025-14704
    26İzleyin

    Shiguangwu sgwbox N3 API eshell path traversal

    OrtaCVSS 5,5İstismar yokEPSS %12

    sgwbox · n3 firmware15 Ara 2025

  • CVE-2025-14705
    40Planlayın

    Shiguangwu sgwbox N3 SHARESERVER Feature command injection

    YüksekCVSS 8,9İstismar yokEPSS %16

    sgwbox · n3 firmware15 Ara 2025

  • CVE-2025-14706
    41Planlayın

    Shiguangwu sgwbox N3 NETREBOOT http_eshell_server command injection

    YüksekCVSS 8,9İstismar yokEPSS %18

    sgwbox · n3 firmware15 Ara 2025

  • CVE-2025-14707
    41Planlayın

    Shiguangwu sgwbox N3 DOCKER Feature http_eshell_server command injection

    YüksekCVSS 8,9İstismar yokEPSS %18

    sgwbox · n3 firmware15 Ara 2025

  • CVE-2025-14156
    41Planlayın

    Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'

    KritikCVSS 9,8Kavram kanıtıEPSS %6

    ays-pro · fox lms – wordpress lms plugin15 Ara 2025

  • CVE-2025-65742
    32İzleyin

    An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive in

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    newgensoft · omnidocs15 Ara 2025

  • CVE-2025-64634
    21İzleyin

    WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability

    OrtaCVSS 5,3İstismar yokEPSS %0

    theme-fusion · avada16 Ara 2025

  • CVE-2025-68055
    34İzleyin

    WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability

    YüksekCVSS 8,5Kavram kanıtıEPSS %0

    themefic · hydra booking16 Ara 2025

  • CVE-2025-13956
    21İzleyin

    LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    thimpress · learnpress – wordpress lms plugin for create and sell online courses16 Ara 2025

  • CVE-2025-65318
    36İzleyin

    When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    canarymail · canary mail16 Ara 2025

  • CVE-2025-37164
    96Hemen

    A remote code execution issue exists in HPE OneView.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %90

    hpe · oneview16 Ara 2025

  • CVE-2025-68116
    21İzleyin

    FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    filerise · filerise16 Ara 2025

  • CVE-2025-33210
    36İzleyin

    NVIDIA Isaac Lab contains a deserialization vulnerability.

    KritikCVSS 9,0Kavram kanıtıEPSS %0

    nvidia · isaac lab16 Ara 2025

  • CVE-2025-46295
    39İzleyin

    Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input i

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    claris · filemaker server16 Ara 2025

  • CVE-2025-65427
    26İzleyin

    An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    dbitnet · dbit n300 t1 pro firmware16 Ara 2025

  • CVE-2025-68154
    36İzleyin

    Command Injection in fsSize() on Windows

    YüksekCVSS 8,1İstismar yokEPSS %12

    systeminformation · systeminformation16 Ara 2025

  • CVE-2025-14700
    41Planlayın

    Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller

    KritikCVSS 9,9Kavram kanıtıEPSS %6

    craftycontrol · crafty controller16 Ara 2025

  • CVE-2025-14765
    36İzleyin

    Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a cra

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    google · chrome16 Ara 2025

  • CVE-2025-59374
    67Bu hafta

    "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced thro

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %1

    asus · live update17 Ara 2025

  • CVE-2025-20393
    80Hemen

    Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %32

    cisco · asyncos17 Ara 2025

  • CVE-2025-62521
    60Bu hafta

    ChurchCRM has unauthenticated RCE in its Install Wizard

    KritikCVSS 9,8SilahlaştırılmışEPSS %4

    churchcrm · churchcrm17 Ara 2025

  • CVE-2025-34441
    60Bu hafta

    AVideo < 20.1 User Information Disclosure via Public API

    OrtaCVSS 6,9SilahlaştırılmışEPSS %0

    wwbn · avideo17 Ara 2025

  • CVE-2025-34442
    60Bu hafta

    AVideo < 20.1 System Path Disclosure via Public API

    OrtaCVSS 6,9SilahlaştırılmışEPSS %0

    wwbn · avideo17 Ara 2025

  • CVE-2025-65855
    26İzleyin

    The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentia

    OrtaCVSS 6,6Kavram kanıtıEPSS %0

    netun · helpflash iot firmware17 Ara 2025

  • CVE-2025-67876
    37İzleyin

    ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    churchcrm · churchcrm17 Ara 2025

  • CVE-2025-68400
    37İzleyin

    ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    churchcrm · churchcrm17 Ara 2025

  • CVE-2025-43529
    68Bu hafta

    A use-after-free issue was addressed with improved memory management.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %8

    apple · safari17 Ara 2025

  • CVE-2025-43541
    27İzleyin

    A type confusion issue was addressed with improved state handling.

    OrtaCVSS 4,3Kavram kanıtıEPSS %34

    apple · safari17 Ara 2025

  • CVE-2025-67875
    34İzleyin

    ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking

    YüksekCVSS 8,5Kavram kanıtıEPSS %0

    churchcrm · churchcrm17 Ara 2025

  • CVE-2025-68109
    40Planlayın

    ChurchCRM vulnerable to RCE with database restore functionality

    YüksekCVSS 7,2SilahlaştırılmışEPSS %1

    churchcrm · churchcrm17 Ara 2025

  • CVE-2025-68147
    32İzleyin

    opensourcepos has a Cross-site Scripting vulnerability

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    opensourcepos · open source point of sale17 Ara 2025

  • CVE-2025-68434
    35İzleyin

    opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    opensourcepos · open source point of sale17 Ara 2025

  • CVE-2025-68461
    62Bu hafta

    Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG d

    OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %26

    roundcube · webmail18 Ara 2025

  • CVE-2025-14364
    35İzleyin

    Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    kraftplugins · demo importer plus18 Ara 2025

  • CVE-2025-40602
    57Planlayın

    A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

    OrtaCVSS 6,6KEVSilahlaştırılmışEPSS %2

    sonicwall · sma6200 firmware18 Ara 2025

  • CVE-2025-14437
    31İzleyin

    Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    wpmudev · hummingbird performance – cache & page speed optimization for core web vitals | critical css | minify css | defer css javascript | cdn18 Ara 2025

  • CVE-2025-68325
    0İzleyin

    net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop

    Kavram kanıtıEPSS %0

    linux · linux18 Ara 2025

  • CVE-2025-14884
    32İzleyin

    D-Link DIR-605 Firmware Update Service command injection

    YüksekCVSS 7,3İstismar yokEPSS %10

    dlink · dir-605 firmware18 Ara 2025

  • CVE-2025-56157
    39İzleyin

    Default credentials in Dify thru 1.5.1.

    KritikCVSS 9,8İstismar yokEPSS %0

    langgenius · dify18 Ara 2025

  • CVE-2025-63387
    39İzleyin

    Dify v1.9.1 is vulnerable to Insecure Permissions.

    YüksekCVSS 7,5Kavram kanıtıEPSS %29

    langgenius · dify18 Ara 2025

  • CVE-2025-14733
    75Bu hafta

    WatchGuard Firebox iked Out of Bounds Write Vulnerability

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %26

    watchguard · fireware18 Ara 2025

  • CVE-2025-14847
    89Hemen

    Zlib compressed protocol header length confusion may allow memory read

    YüksekCVSS 8,7KEVSilahlaştırılmışEPSS %83

    mongodb · mongodb19 Ara 2025

  • CVE-2025-34433
    60Bu hafta

    AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt

    KritikCVSS 9,3SilahlaştırılmışEPSS %1

    world wide broadcast network · avideo19 Ara 2025

  • CVE-2025-68613
    95Hemen

    n8n Vulnerable to Remote Code Execution via Expression Injection

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %98

    n8n · n8n19 Ara 2025

  • CVE-2023-25445
    21İzleyin

    WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability

    OrtaCVSS 5,4İstismar yokEPSS %0

    happyfiles · happyfiles pro20 Ara 2025

  • CVE-2025-14855
    28İzleyin

    SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    brainstormforce · sureforms – contact form, payment form & other custom form builder21 Ara 2025

  • CVE-2025-14018
    29İzleyin

    Unquoted Service Path in NetBT Consultancy's e-Fatura

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    netbt consulting services inc. · e-fatura22 Ara 2025

  • CVE-2025-65270
    24İzleyin

    Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    clincapture · captivate electronic data capture22 Ara 2025

  • CVE-2025-68645
    80Hemen

    A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %48

    synacor · zimbra collaboration suite22 Ara 2025

  • CVE-2025-65790
    24İzleyin

    A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    realtimelogic · fuguhub22 Ara 2025

  • CVE-2025-65817
    35İzleyin

    LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh.

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    lsc · smart connect indoor ip camera firmware22 Ara 2025

  • CVE-2025-65856
    39İzleyin

    Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenti

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    xiongmaitech · xm530v200 x6-weq 8m firmware22 Ara 2025

  • CVE-2025-65857
    30İzleyin

    An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    xiongmaitech · xm530v200 x6-weq 8m firmware22 Ara 2025

  • CVE-2025-68615
    52Planlayın

    Net-SNMP snmptrapd crash

    KritikCVSS 9,8İstismar yokEPSS %42

    net-snmp · net-snmp23 Ara 2025

  • CVE-2025-14155
    21İzleyin

    Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    leap13 · premium addons for elementor23 Ara 2025

  • CVE-2025-59886
    35İzleyin

    Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access t

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    eaton · xcomfort ethernet communication interface23 Ara 2025

  • CVE-2024-57521
    40Planlayın

    SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in S

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    ruoyi · ruoyi23 Ara 2025

  • CVE-2025-65354
    39İzleyin

    Improper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem_nam

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    puneethreddyhc · event management23 Ara 2025

  • CVE-2025-66209
    36İzleyin

    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup

    YüksekCVSS 8,8Kavram kanıtıEPSS %3

    coollabs · coolify23 Ara 2025

  • CVE-2025-66210
    38İzleyin

    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import

    KritikCVSS 9,4İstismar yokEPSS %2

    coollabs · coolify23 Ara 2025

  • CVE-2025-15048
    26İzleyin

    Tenda WH450 HTTP Request CheckTools command injection

    OrtaCVSS 5,5İstismar yokEPSS %12

    tenda · wh450 firmware23 Ara 2025

  • CVE-2025-68664
    45Planlayın

    LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

    YüksekCVSS 8,2Kavram kanıtıEPSS %42

    langchain · langchain core23 Ara 2025

  • CVE-2025-13773
    40Planlayın

    Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    tychesoftwares · print invoice & delivery notes for woocommerce24 Ara 2025

  • CVE-2025-13407
    27İzleyin

    GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    unknown · gravity forms24 Ara 2025

  • CVE-2025-68509
    18İzleyin

    WordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability

    OrtaCVSS 4,7Kavram kanıtıEPSS %0

    jeff starr · user submitted posts24 Ara 2025

  • CVE-2025-68602
    18İzleyin

    WordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerability

    OrtaCVSS 4,7Kavram kanıtıEPSS %0

    scott paterson · accept donations with paypal & stripe24 Ara 2025

  • CVE-2019-25246
    34İzleyin

    Beward N100 H.264 VGA IP Camera M2.1.6 Authenticated File Disclosure

    YüksekCVSS 7,1Kavram kanıtıEPSS %18

    beward r&d co., ltd · n100 h.264 vga ip camera24 Ara 2025

  • CVE-2025-68937
    38İzleyin

    Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-

    KritikCVSS 9,5Kavram kanıtıEPSS %0

    forgejo · forgejo26 Ara 2025

  • CVE-2025-66947
    26İzleyin

    SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    krishanmurariji · student management system26 Ara 2025

  • CVE-2025-68668
    43Planlayın

    n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node

    KritikCVSS 9,9İstismar yokEPSS %13

    n8n · n8n26 Ara 2025

  • CVE-2025-54322
    44Planlayın

    Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py.

    KritikCVSS 9,8Kavram kanıtıEPSS %15

    xspeeder · sxzos27 Ara 2025

  • CVE-2025-14177
    25İzleyin

    Information Leak of Memory in getimagesize

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    php · php27 Ara 2025

  • CVE-2025-15136
    32İzleyin

    TRENDnet TEW-800MB Management wizardset do_setWizard_asp command injection

    YüksekCVSS 7,4İstismar yokEPSS %10

    trendnet · tew-800mb firmware28 Ara 2025

  • CVE-2025-15137
    32İzleyin

    TRENDnet TEW-800MB NTPSyncWithHost.cgi sub_F934  command injection

    YüksekCVSS 7,4İstismar yokEPSS %11

    trendnet · tew-800mb firmware28 Ara 2025

  • CVE-2025-15139
    12İzleyin

    TRENDnet TEW-822DRE formWsc sub_43ACF4  command injection

    DüşükCVSS 2,1İstismar yokEPSS %13

    trendnet · tew-822dre firmware28 Ara 2025

  • CVE-2025-52691
    96Hemen

    Upload Arbitrary Files

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %85

    smartertools · smartermail29 Ara 2025

  • CVE-2025-57460
    39İzleyin

    File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    machsol · machpanel29 Ara 2025

  • CVE-2025-57462
    24İzleyin

    Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF fi

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    machsol · machpanel29 Ara 2025

  • CVE-2025-60458
    26İzleyin

    UxPlay 1.72 contains a double free vulnerability in its RTSP request handling.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    antimof · uxplay29 Ara 2025