[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 423304
> CVE-2025-58987 [MEDIUM 6.5]
[PUBLISHED: 2025-09-09] [EPSS 0.17%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool allows Stored XSS. This issue affects Football Pool: from n/a through 2.12.6.
> CVE-2025-58985 [MEDIUM 6.5]
[PUBLISHED: 2025-09-09] [EPSS 0.17%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce allows Stored XSS. This issue affects Additional Custom Product Tabs for WooCommerce: from n/a through 1.7.3.
> CVE-2025-58984 [MEDIUM 5.9]
[PUBLISHED: 2025-09-09] [EPSS 0.18%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nanbu Welcart e-Commerce allows Stored XSS. This issue affects Welcart e-Commerce: from n/a through 2.11.20.
> CVE-2025-58983 [MEDIUM 5.9]
[PUBLISHED: 2025-09-09] [EPSS 0.18%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Lissa Include Me allows Stored XSS. This issue affects Include Me: from n/a through 1.3.2.
> CVE-2025-58982 [MEDIUM 5.9]
[PUBLISHED: 2025-09-09] [EPSS 0.18%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline Pixeline's Email Protector allows Stored XSS. This issue affects Pixeline's Email Protector: from n/a through 1.3.8.
> CVE-2025-58981 [MEDIUM 5.4]
[PUBLISHED: 2025-09-09] [EPSS 0.17%]
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Accessibility Checker by Equalize Digital: from n/a through 1.31.0.
> CVE-2025-58980 [MEDIUM 5.3]
[PUBLISHED: 2025-09-09] [EPSS 0.23%]
Missing Authorization vulnerability in recorp Export WP Page to Static HTML/CSS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Export WP Page to Static HTML/CSS: from n/a through 4.1.0.
> CVE-2025-58979 [MEDIUM 5.3]
[PUBLISHED: 2025-09-09] [EPSS 0.22%]
Missing Authorization vulnerability in BerqWP BerqWP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BerqWP: from n/a through 2.2.53.
> CVE-2025-58978 [MEDIUM 5.3]
[PUBLISHED: 2025-09-09] [EPSS 0.24%]
Missing Authorization vulnerability in WP Swings PDF Generator for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Generator for WordPress: from n/a through 1.5.4.
> CVE-2025-58977 [MEDIUM 4.9]
[PUBLISHED: 2025-09-09] [EPSS 0.15%]
Server-Side Request Forgery (SSRF) vulnerability in Rhys Wynne WP eBay Product Feeds allows Server Side Request Forgery. This issue affects WP eBay Product Feeds: from n/a through 3.4.8.
> CVE-2025-58976 [MEDIUM 4.3]
[PUBLISHED: 2025-09-09] [EPSS 0.21%]
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Accessibility Checker by Equalize Digital: from n/a through 1.31.0.
> CVE-2025-58975 [MEDIUM 4.3]
[PUBLISHED: 2025-09-09] [EPSS 0.12%]
Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings allows Cross Site Request Forgery. This issue affects Advanced Settings: from n/a through 3.1.1.
> CVE-2025-58215 [HIGH 8.1]
[PUBLISHED: 2025-09-09] [EPSS 0.53%]
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Ziston allows PHP Local File Inclusion. This issue affects Ziston: from n/a through n/a.
> CVE-2025-57540 [MEDIUM 5.4]
[PUBLISHED: 2025-09-09] [EPSS 0.29%]
A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, e...
AFFECTED_PRODUCTS: Proxmox Virtual Environment
> CVE-2025-57539 [MEDIUM 5.4]
[PUBLISHED: 2025-09-09] [EPSS 0.29%]
A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially...
AFFECTED_PRODUCTS: Proxmox Virtual Environment
> CVE-2025-57538 [MEDIUM 5.4]
[PUBLISHED: 2025-09-09] [EPSS 0.34%]
A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 allows an authenticated user to inject malicious input. The input is stored and executed in the context of other users' browsers when they view...
AFFECTED_PRODUCTS: Proxmox Virtual Environment
> CVE-2025-57087 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.49%]
Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the countryCode parameter in the werlessAdvancedSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
AFFECTED_PRODUCTS: Tenda W30e Firmware
> CVE-2025-57072 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.49%]
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the staticRouteGateway parameter in the formSetStaticRoute function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
AFFECTED_PRODUCTS: Tenda G3 Firmware
> CVE-2025-57071 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.49%]
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the vpnUsers parameter in the formAddVpnUsers function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
AFFECTED_PRODUCTS: Tenda G3 Firmware
> CVE-2025-57070 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.49%]
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the gstUp parameter in the guestWifiRuleRefresh function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
AFFECTED_PRODUCTS: Tenda G3 Firmware
> CVE-2025-57069 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.49%]
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the pPppUser parameter in the getsinglepppuser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
AFFECTED_PRODUCTS: Tenda G3 Firmware
> CVE-2025-57064 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.49%]
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the bindDhcpIndex parameter in the modifyDhcpRule function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
AFFECTED_PRODUCTS: Tenda G3 Firmware
> CVE-2025-57063 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.49%]
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the portMappingIndex parameter in the formDelPortMapping function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
AFFECTED_PRODUCTS: Tenda G3 Firmware
> CVE-2025-57062 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.49%]
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the delDhcpIndex parameter in the formDelDhcpRule function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
AFFECTED_PRODUCTS: Tenda G3 Firmware
> CVE-2025-57061 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.49%]
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formIPMacBindModify function via the ruleId, ip, mac, v6 and remark parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
AFFECTED_PRODUCTS: Tenda G3 Firmware
> CVE-2025-57059 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.49%]
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the dhcpIndex parameter in the addDhcpRule function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
AFFECTED_PRODUCTS: Tenda G3 Firmware
> CVE-2025-57058 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.49%]
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formSetDebugCfg function via the pEnable, pLevel, and pModule parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
AFFECTED_PRODUCTS: Tenda G3 Firmware
> CVE-2025-57057 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.49%]
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the listStr parameter in the ipMacBindListStore function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
AFFECTED_PRODUCTS: Tenda G3 Firmware
> CVE-2025-55317 [HIGH 7.8]
[PUBLISHED: 2025-09-09] [EPSS 0.42%]
Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS: Microsoft Autoupdate
> CVE-2025-55316 [HIGH 7.8]
[PUBLISHED: 2025-09-09] [EPSS 0.37%]
External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS: Microsoft Azure Connected Machine Agent
> CVE-2025-55245 [HIGH 7.8]
[PUBLISHED: 2025-09-09] [EPSS 0.42%]
Improper link resolution before file access ('link following') in Xbox allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS: Microsoft Xbox Gaming Services
> CVE-2025-55243 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 1.16%]
Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network.
AFFECTED_PRODUCTS: Microsoft Officeplus
> CVE-2025-55236 [HIGH 7.3]
[PUBLISHED: 2025-09-09] [EPSS 0.43%]
Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally.
AFFECTED_PRODUCTS: Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows 10 1809 ... (+7)
> CVE-2025-55234 [HIGH 8.8]
[PUBLISHED: 2025-09-09] [âš¡ EPSS 20.8%]
SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make the users subject to elevation of privilege attacks. The SMB Server already supports mechanisms for hardening against rel...
AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+15)
> CVE-2025-55232 [CRITICAL 9.8]
[PUBLISHED: 2025-09-09] [EPSS 2.13%]
Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network.
> CVE-2025-55228 [HIGH 7.8]
[PUBLISHED: 2025-09-09] [EPSS 0.33%]
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
AFFECTED_PRODUCTS: Microsoft Windows Server 2022, Microsoft Windows 10 21h2, Microsoft Windows 10 22h2 ... (+5)
> CVE-2025-55227 [HIGH 8.8]
[PUBLISHED: 2025-09-09] [EPSS 1.42%]
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
AFFECTED_PRODUCTS: Microsoft Sql Server 2019, Microsoft Sql Server 2019, Microsoft Sql Server 2022 ... (+5)
> CVE-2025-55226 [MEDIUM 6.7]
[PUBLISHED: 2025-09-09] [EPSS 0.53%]
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute code locally.
AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+15)
> CVE-2025-55225 [MEDIUM 6.5]
[PUBLISHED: 2025-09-09] [EPSS 1.26%]
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+4)
> CVE-2025-55224 [HIGH 7.8]
[PUBLISHED: 2025-09-09] [EPSS 0.34%]
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
AFFECTED_PRODUCTS: Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows 10 1809 ... (+7)
> CVE-2025-55223 [HIGH 7.0]
[PUBLISHED: 2025-09-09] [EPSS 0.30%]
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS: Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows 10 1809 ... (+7)
> CVE-2025-54919 [HIGH 7.5]
[PUBLISHED: 2025-09-09] [EPSS 0.39%]
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
AFFECTED_PRODUCTS: Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows 10 1809 ... (+7)
> CVE-2025-54918 [HIGH 8.8]
[PUBLISHED: 2025-09-09] [âš¡ EPSS 25.3%]
Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.
AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+15)
> CVE-2025-54917 [MEDIUM 4.3]
[PUBLISHED: 2025-09-09] [EPSS 0.95%]
Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+15)
> CVE-2025-54916 [HIGH 7.8]
[PUBLISHED: 2025-09-09] [EPSS 2.78%]
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+15)
> CVE-2025-54915 [MEDIUM 6.7]
[PUBLISHED: 2025-09-09] [EPSS 0.48%]
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+15)
> CVE-2025-54913 [HIGH 7.8]
[PUBLISHED: 2025-09-09] [EPSS 0.30%]
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS: Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows 10 1507 ... (+10)
> CVE-2025-54912 [HIGH 7.8]
[PUBLISHED: 2025-09-09] [EPSS 0.51%]
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+15)
> CVE-2025-54911 [HIGH 7.3]
[PUBLISHED: 2025-09-09] [EPSS 0.77%]
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+15)
> CVE-2025-54910 [HIGH 8.4]
[PUBLISHED: 2025-09-09] [EPSS 0.61%]
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
AFFECTED_PRODUCTS: Microsoft Office, Microsoft Office, Microsoft Office Long Term Servicing Channel ... (+1)