[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 423614
> CVE-2025-46708 [MEDIUM 4.3]
[PUBLISHED: 2025-06-27] [EPSS 0.20%]
Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU.
> CVE-2025-46707 [MEDIUM 5.2]
[PUBLISHED: 2025-06-27] [EPSS 0.15%]
Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU.
> CVE-2025-44559 [MEDIUM 6.5]
[PUBLISHED: 2025-06-27] [EPSS 0.24%]
An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a Denial of Service (DoS) via sending a specific sequence of crafted control packets.
> CVE-2025-44557 [HIGH 8.1]
[PUBLISHED: 2025-06-27] [EPSS 0.28%]
A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing process and authentication via a crafted pairing_failed packet.
> CVE-2024-12364 [CRITICAL 9.8]
[PUBLISHED: 2025-06-27] [EPSS 0.43%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL Injection.This issue affects Guest Tracking Software.  NOTE: The vendor did not inform about the completion of the fixing process within the s...
> CVE-2024-12150 [CRITICAL 9.8]
[PUBLISHED: 2025-06-27] [EPSS 0.40%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Wowwo CRM allows Blind SQL Injection.This issue affects Wowwo CRM.  NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will...
> CVE-2024-12143 [CRITICAL 9.8]
[PUBLISHED: 2025-06-27] [EPSS 0.40%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB allows SQL Injection.This issue affects Mikro Hand Terminal - MikroDB.  NOTE: The vendor did not inform about the completion of the fixing...
> CVE-2025-50370 [MEDIUM 6.5]
[PUBLISHED: 2025-06-27] [EPSS 0.16%]
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Inquiry Management functionality /mcgs/admin/readenq.php of the Phpgurukul Medical Card Generation System 1.0. The vulnerable endpoint allows an authenticated admin to delete inquiry records via a simple GET request, without requiring a...
AFFECTED_PRODUCTS: Anujk305 Medical Card Generation System
> CVE-2025-50369 [MEDIUM 6.5]
[PUBLISHED: 2025-06-27] [EPSS 0.16%]
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Manage Card functionality (/mcgs/admin/manage-card.php) of PHPGurukul Medical Card Generation System 1.0. The vulnerable endpoint allows an authorized admin to delete medical card records by sending a simple GET request without verifyin...
AFFECTED_PRODUCTS: Anujk305 Medical Card Generation System
> CVE-2025-50367 [MEDIUM 6.1]
[PUBLISHED: 2025-06-27] [EPSS 0.24%]
A stored blind XSS vulnerability exists in the Contact Page of the Phpgurukul Medical Card Generation System 1.0 mcgs/contact.php. The name field fails to properly sanitize user input, allowing an attacker to inject malicious JavaScript.
AFFECTED_PRODUCTS: Anujk305 Medical Card Generation System
> CVE-2024-11739 [CRITICAL 9.8]
[PUBLISHED: 2025-06-27] [EPSS 0.40%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Case Informatics Case ERP allows SQL Injection.This issue affects Case ERP: before V2.0.1.
> CVE-2025-6705 [MEDIUM 5.3]
[PUBLISHED: 2025-06-27] [EPSS 0.26%]
A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without proper isolation, potentially exposing a privileged token. This token enabled the publishing of new ext...
> CVE-2025-53091 [CRITICAL 9.8]
[PUBLISHED: 2025-06-27] [EPSS 0.54%]
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the `/controle/getProdutosPorAlmox.php` endpoint. This issue allows any unauthenticated attac...
AFFECTED_PRODUCTS: Wegia Wegia
> CVE-2025-52553 [CRITICAL 9.6]
[PUBLISHED: 2025-06-27] [EPSS 0.52%]
authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, however...
AFFECTED_PRODUCTS: Goauthentik Authentik, Goauthentik Authentik
> CVE-2023-38007 [MEDIUM 5.4]
[PUBLISHED: 2025-06-27] [EPSS 0.25%]
IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser w...
AFFECTED_PRODUCTS: IBM Cloud Pak System, IBM Cloud Pak System, IBM Cloud Pak System ... (+2)
> CVE-2025-6768 [MEDIUM 6.3]
[PUBLISHED: 2025-06-27] [EPSS 0.30%]
A vulnerability classified as critical has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is the function findAllHosByCondition of the file HospitalServiceImpl.java. The manipulation of the argument hospitalName leads to sql injection. It is possible to la...
> CVE-2025-53339 [HIGH 7.5]
[PUBLISHED: 2025-06-27] [EPSS 0.58%]
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in devnex Devnex Addons For Elementor allows PHP Local File Inclusion. This issue affects Devnex Addons For Elementor: from n/a through 1.0.9.
> CVE-2025-53338 [HIGH 7.1]
[PUBLISHED: 2025-06-27] [EPSS 0.13%]
Cross-Site Request Forgery (CSRF) vulnerability in dor re.place allows Stored XSS. This issue affects re.place: from n/a through 0.2.1.
> CVE-2025-53336 [MEDIUM 6.5]
[PUBLISHED: 2025-06-27] [EPSS 0.20%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in abditsori My Resume Builder allows Stored XSS. This issue affects My Resume Builder: from n/a through 1.0.3.
> CVE-2025-53332 [HIGH 7.1]
[PUBLISHED: 2025-06-27] [EPSS 0.13%]
Cross-Site Request Forgery (CSRF) vulnerability in ethoseo Track Everything allows Stored XSS. This issue affects Track Everything: from n/a through 2.0.1.
> CVE-2025-53331 [HIGH 7.1]
[PUBLISHED: 2025-06-27] [EPSS 0.13%]
Cross-Site Request Forgery (CSRF) vulnerability in samcharrington RSS Digest allows Stored XSS. This issue affects RSS Digest: from n/a through 1.5.
> CVE-2025-53329 [HIGH 7.1]
[PUBLISHED: 2025-06-27] [EPSS 0.16%]
Cross-Site Request Forgery (CSRF) vulnerability in szajenw Społecznościowa 6 PL 2013 allows Stored XSS. This issue affects Społecznościowa 6 PL 2013: from n/a through 2.0.6.
> CVE-2025-53327 [MEDIUM 4.3]
[PUBLISHED: 2025-06-27] [EPSS 0.15%]
Cross-Site Request Forgery (CSRF) vulnerability in rui_mashita Aioseo Multibyte Descriptions allows Cross Site Request Forgery. This issue affects Aioseo Multibyte Descriptions: from n/a through 0.0.6.
> CVE-2025-53325 [MEDIUM 5.9]
[PUBLISHED: 2025-06-27] [EPSS 0.21%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dilip kumar Beauty Contact Popup Form allows Stored XSS. This issue affects Beauty Contact Popup Form: from n/a through 6.0.
> CVE-2025-53323 [MEDIUM 4.3]
[PUBLISHED: 2025-06-27] [EPSS 0.22%]
Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pre-Publish Post Checklist: from n/a through 3.1.
> CVE-2025-53322 [MEDIUM 5.3]
[PUBLISHED: 2025-06-27] [EPSS 0.28%]
Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Authorize.NET Payments Using Contact Form 7 allows Retrieve Embedded Sensitive Data. This issue affects Accept Authorize.NET Payments Using Contact Form 7: from n/a through 2.5.
> CVE-2025-53321 [MEDIUM 6.5]
[PUBLISHED: 2025-06-27] [EPSS 0.19%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raise The Money Raise The Money allows DOM-Based XSS. This issue affects Raise The Money: from n/a through 5.2.
> CVE-2025-53320 [MEDIUM 6.5]
[PUBLISHED: 2025-06-27] [EPSS 0.19%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wp Enhanced Free Downloads EDD allows DOM-Based XSS. This issue affects Free Downloads EDD: from n/a through 1.0.4.
> CVE-2025-53318 [MEDIUM 5.4]
[PUBLISHED: 2025-06-27] [EPSS 0.26%]
Missing Authorization vulnerability in WPManiax WP DB Booster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP DB Booster: from n/a through 1.0.1.
> CVE-2025-53317 [HIGH 7.1]
[PUBLISHED: 2025-06-27] [EPSS 0.12%]
Cross-Site Request Forgery (CSRF) vulnerability in AcmeeDesign WPShapere Lite allows Stored XSS. This issue affects WPShapere Lite: from n/a through 1.4.
> CVE-2025-53315 [HIGH 7.1]
[PUBLISHED: 2025-06-27] [EPSS 0.12%]
Cross-Site Request Forgery (CSRF) vulnerability in alanft Relocate Upload allows Stored XSS. This issue affects Relocate Upload: from n/a through 0.24.1.
> CVE-2025-53314 [CRITICAL 9.6]
[PUBLISHED: 2025-06-27] [EPSS 0.17%]
Cross-Site Request Forgery (CSRF) vulnerability in sh1zen WP Optimizer allows SQL Injection. This issue affects WP Optimizer: from n/a through 2.3.6.
> CVE-2025-53313 [HIGH 7.1]
[PUBLISHED: 2025-06-27] [EPSS 0.12%]
Cross-Site Request Forgery (CSRF) vulnerability in plumwd Twitch TV Embed Suite allows Stored XSS. This issue affects Twitch TV Embed Suite: from n/a through 2.1.0.
> CVE-2025-53312 [HIGH 7.1]
[PUBLISHED: 2025-06-27] [EPSS 0.12%]
Cross-Site Request Forgery (CSRF) vulnerability in Looks Awesome OnionBuzz allows Stored XSS. This issue affects OnionBuzz: from n/a through 1.0.7.
> CVE-2025-53311 [HIGH 7.1]
[PUBLISHED: 2025-06-27] [EPSS 0.12%]
Cross-Site Request Forgery (CSRF) vulnerability in Amol Nirmala Waman Navayan Subscribe allows Stored XSS. This issue affects Navayan Subscribe: from n/a through 1.13.
> CVE-2025-53310 [HIGH 7.1]
[PUBLISHED: 2025-06-27] [EPSS 0.12%]
Cross-Site Request Forgery (CSRF) vulnerability in Funnnny HidePost allows Reflected XSS. This issue affects HidePost: from n/a through 2.3.8.
> CVE-2025-53309 [MEDIUM 5.3]
[PUBLISHED: 2025-06-27] [EPSS 0.28%]
Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Stripe Payments Using Contact Form 7 allows Retrieve Embedded Sensitive Data. This issue affects Accept Stripe Payments Using Contact Form 7: from n/a through 3.0.
> CVE-2025-53308 [HIGH 7.1]
[PUBLISHED: 2025-06-27] [EPSS 0.12%]
Cross-Site Request Forgery (CSRF) vulnerability in gopi_plus Image Slider With Description allows Stored XSS. This issue affects Image Slider With Description: from n/a through 9.2.
> CVE-2025-53306 [HIGH 7.6]
[PUBLISHED: 2025-06-27] [EPSS 0.32%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in lucidcrew WP Forum Server allows SQL Injection. This issue affects WP Forum Server: from n/a through 1.8.2.
> CVE-2025-53305 [HIGH 7.1]
[PUBLISHED: 2025-06-27] [EPSS 0.12%]
Cross-Site Request Forgery (CSRF) vulnerability in lucidcrew WP Forum Server allows Stored XSS. This issue affects WP Forum Server: from n/a through 1.8.2.
> CVE-2025-53304 [MEDIUM 5.3]
[PUBLISHED: 2025-06-27] [EPSS 0.30%]
Missing Authorization vulnerability in Rohil Contact Form – 7 : Hide Success Message allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Contact Form – 7 : Hide Success Message: from n/a through 1.1.4.
> CVE-2025-53301 [MEDIUM 6.5]
[PUBLISHED: 2025-06-27] [EPSS 0.23%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Junkie Theme Junkie Team Content allows DOM-Based XSS. This issue affects Theme Junkie Team Content: from n/a through 0.1.1.
> CVE-2025-53300 [MEDIUM 6.5]
[PUBLISHED: 2025-06-27] [EPSS 0.23%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in douglaskarr Podcast Feed Player Widget and Shortcode allows Stored XSS. This issue affects Podcast Feed Player Widget and Shortcode: from n/a through 2.2.0.
> CVE-2025-53298 [MEDIUM 4.9]
[PUBLISHED: 2025-06-27] [EPSS 0.50%]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gioni Plugin Inspector allows Path Traversal. This issue affects Plugin Inspector: from n/a through 1.5.
> CVE-2025-53296 [MEDIUM 5.9]
[PUBLISHED: 2025-06-27] [EPSS 0.25%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ecoal95 EC Stars Rating allows Stored XSS. This issue affects EC Stars Rating: from n/a through 1.0.11.
> CVE-2025-53295 [MEDIUM 5.3]
[PUBLISHED: 2025-06-27] [EPSS 0.30%]
Missing Authorization vulnerability in iCount iCount Payment Gateway allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects iCount Payment Gateway: from n/a through 2.0.6.
> CVE-2025-53294 [MEDIUM 6.5]
[PUBLISHED: 2025-06-27] [EPSS 0.23%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smart Agenda Smart Agenda allows Stored XSS. This issue affects Smart Agenda: from n/a through 4.9.
> CVE-2025-53293 [MEDIUM 4.3]
[PUBLISHED: 2025-06-27] [EPSS 0.27%]
Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Dashboard Widget Sidebar: from n/a through 1.2.3.
> CVE-2025-53292 [MEDIUM 6.5]
[PUBLISHED: 2025-06-27] [EPSS 0.24%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk WP DataTable allows DOM-Based XSS. This issue affects WP DataTable: from n/a through 0.2.7.
> CVE-2025-53290 [MEDIUM 6.5]
[PUBLISHED: 2025-06-27] [EPSS 0.24%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MS WP Visual Sitemap allows Stored XSS. This issue affects WP Visual Sitemap: from n/a through 1.0.2.