[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 423975
> CVE-2025-3423 [MEDIUM 5.4]
[PUBLISHED: 2025-04-13] [EPSS 0.28%]
IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
AFFECTED_PRODUCTS: IBM Aspera Faspex
> CVE-2025-3535 [MEDIUM 4.3]
[PUBLISHED: 2025-04-13] [EPSS 0.47%]
A vulnerability has been found in shuanx BurpAPIFinder up to 2.0.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file BurpApiFinder.db. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed...
> CVE-2025-3534 [MEDIUM 6.3]
[PUBLISHED: 2025-04-13] [EPSS 0.33%]
A vulnerability, which was classified as critical, was found in PowerCreator CMS 1.0. Affected is an unknown function of the file /OpenPublicCourse.aspx. The manipulation of the argument cid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the p...
> CVE-2025-3533 [MEDIUM 4.3]
[PUBLISHED: 2025-04-13] [EPSS 0.46%]
A vulnerability, which was classified as problematic, has been found in YouDianCMS 9.5.21. This issue affects some unknown processing of the file /App/Tpl/Admin/Default/Channel/index.html.Attackers. The manipulation of the argument Parent leads to cross site scripting. The attack may be initiated re...
AFFECTED_PRODUCTS: Youdiancms Youdiancms
> CVE-2025-3532 [MEDIUM 4.3]
[PUBLISHED: 2025-04-13] [EPSS 0.46%]
A vulnerability classified as problematic was found in YouDianCMS 9.5.21. This vulnerability affects unknown code of the file /App/Tpl/Member/Default/Order/index.html.Attackers. The manipulation of the argument OrderNumber leads to cross site scripting. The attack can be initiated remotely. The expl...
AFFECTED_PRODUCTS: Youdiancms Youdiancms
> CVE-2025-3531 [MEDIUM 4.3]
[PUBLISHED: 2025-04-13] [EPSS 0.46%]
A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Default/Log/index.html. The manipulation of the argument UserName/LogType leads to cross site scripting. It is possible to initiate the attack remotely. The exploit...
AFFECTED_PRODUCTS: Youdiancms Youdiancms
> CVE-2025-2814 [MEDIUM 4.0]
[PUBLISHED: 2025-04-13] [EPSS 0.20%]
Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable.  In that case, Crypt::CBC will fallback to...
> CVE-2025-1456 [MEDIUM 6.4]
[PUBLISHED: 2025-04-12] [EPSS 0.29%]
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes...
AFFECTED_PRODUCTS: Royal-Elementor-Addons Royal Elementor Addons
> CVE-2025-1455 [MEDIUM 6.4]
[PUBLISHED: 2025-04-12] [EPSS 0.29%]
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contr...
AFFECTED_PRODUCTS: Royal-Elementor-Addons Royal Elementor Addons
> CVE-2025-3418 [HIGH 8.8]
[PUBLISHED: 2025-04-12] [EPSS 0.41%]
The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting user meta values that can be updated through the ajax_edit_save() function. This makes it possible for authenticated attackers, with Subscri...
> CVE-2025-3292 [MEDIUM 4.3]
[PUBLISHED: 2025-04-12] [EPSS 0.31%]
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the 'user_id'...
AFFECTED_PRODUCTS: Wpeverest User Registration \& Membership
> CVE-2025-3282 [MEDIUM 5.3]
[PUBLISHED: 2025-04-12] [EPSS 0.28%]
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_membership_register_member() due to missing validation on the 'memb...
AFFECTED_PRODUCTS: Wpeverest User Registration \& Membership
> CVE-2025-3276 [MEDIUM 6.4]
[PUBLISHED: 2025-04-12] [EPSS 0.23%]
The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Carousel block in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with C...
AFFECTED_PRODUCTS: Sktthemes Skt Blocks
> CVE-2024-13338 [MEDIUM 5.3]
[PUBLISHED: 2025-04-12] [EPSS 0.16%]
The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on the wclearfy_cache_delete functionality . This makes i...
AFFECTED_PRODUCTS: Cm-Wp Clearfy
> CVE-2024-13337 [MEDIUM 4.3]
[PUBLISHED: 2025-04-12] [EPSS 0.20%]
The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.2. This is due to missing or incorrect nonce validation on the 'setup-wbcr_clearfy' page. This makes it possible...
AFFECTED_PRODUCTS: Cm-Wp Clearfy
> CVE-2025-2871 [MEDIUM 4.3]
[PUBLISHED: 2025-04-12] [EPSS 0.20%]
The WordPress Mega Menu – QuadMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the ajax_dismiss_notice() function. This makes it possible for unauthenticated attackers to update...
> CVE-2025-2881 [MEDIUM 5.3]
[PUBLISHED: 2025-04-12] [EPSS 0.40%]
The Developer Toolbar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the e...
> CVE-2025-2841 [MEDIUM 5.3]
[PUBLISHED: 2025-04-12] [EPSS 0.41%]
The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the expose...
> CVE-2025-32726 [MEDIUM 6.8]
[PUBLISHED: 2025-04-12] [EPSS 0.45%]
Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS: Microsoft Visual Studio Code
> CVE-2025-29834 [HIGH 7.5]
[PUBLISHED: 2025-04-12] [EPSS 0.64%]
Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
AFFECTED_PRODUCTS: Microsoft Edge Chromium
> CVE-2025-29803 [HIGH 7.3]
[PUBLISHED: 2025-04-12] [EPSS 0.75%]
Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS: Microsoft Sql Server Management Studio, Microsoft Visual Studio Tools For Applications 2019, Microsoft Visual Studio Tools For Applications 2019 Sdk ... (+2)
> CVE-2025-2269 [MEDIUM 6.1]
[PUBLISHED: 2025-04-12] [EPSS 0.27%]
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthentic...
> CVE-2025-0129
[PUBLISHED: 2025-04-11] [EPSS 0.18%]
An improper exception check in Palo Alto Networks Prisma Access Browser allows a low privileged user to prevent Prisma Access Browser from applying it's Policy Rules. This enables the user to use Prisma Access Browser without any restrictions.
> CVE-2024-11679 [MEDIUM 4.4]
[PUBLISHED: 2025-04-11] [EPSS 0.17%]
An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker with elevated privileges to read the contents of memory.
> CVE-2025-0123
[PUBLISHED: 2025-04-11] [EPSS 0.12%]
A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/take-packet-captures/take-a-custom-packet-capture in decrypted HTTP/2...
> CVE-2025-0119
[PUBLISHED: 2025-04-11] [EPSS 0.56%]
A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS commands with root privileges on the host operating system running Broker VM.
> CVE-2025-32367 [HIGH 8.6]
[PUBLISHED: 2025-04-11] [EPSS 0.44%]
The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the number 4.0.8 was used for both the unpatched and patched versions.
> CVE-2025-32080
[PUBLISHED: 2025-04-11] [EPSS 0.47%]
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43.
> CVE-2025-32079 [MEDIUM 6.5]
[PUBLISHED: 2025-04-11] [EPSS 0.40%]
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments allows HTTP DoS.This issue affects Mediawiki - GrowthExperiments: from 1.39 through 1.43.
> CVE-2025-32078
[PUBLISHED: 2025-04-11] [EPSS 0.40%]
Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Version Compare Extension: from 1.39 through 1.43.
> CVE-2025-32077
[PUBLISHED: 2025-04-11] [EPSS 0.40%]
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Extension:SimpleCalendar: from 1.39 through 1.43.
> CVE-2025-32076
[PUBLISHED: 2025-04-11] [EPSS 0.40%]
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Data Extension: from 1.39 through 1.43.
> CVE-2025-32075
[PUBLISHED: 2025-04-11] [EPSS 0.40%]
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extension: from 1.39 through 1.43.
> CVE-2025-32074 [MEDIUM 5.4]
[PUBLISHED: 2025-04-11] [EPSS 0.23%]
Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Confirm Account Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Confirm Account Extension: from 1.39 through 1.43.
> CVE-2025-32073 [MEDIUM 5.4]
[PUBLISHED: 2025-04-11] [EPSS 0.23%]
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - HTML Tags allows Cross-Site Scripting (XSS).This issue affects Mediawiki - HTML Tags: from 1.39 through 1.43.
> CVE-2025-32072
[PUBLISHED: 2025-04-11] [EPSS 0.50%]
Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43.
> CVE-2025-32071 [MEDIUM 5.4]
[PUBLISHED: 2025-04-11] [EPSS 0.23%]
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikidata Extension allows Cross-Site Scripting (XSS) from widthheight message via ImageHandler::getDimensionsString()This issue affects Mediawiki - Wikidata Extension: from 1.39 through 1.43.
> CVE-2025-32070 [MEDIUM 5.4]
[PUBLISHED: 2025-04-11] [EPSS 0.23%]
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - AJAX Poll Extension: from 1.39 through 1.43.
> CVE-2025-32069 [MEDIUM 5.4]
[PUBLISHED: 2025-04-11] [EPSS 0.23%]
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Media Info Extension: from 1.39 through 1.43.
> CVE-2025-32068 [MEDIUM 5.4]
[PUBLISHED: 2025-04-11] [EPSS 0.27%]
Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth Extension: from 1.39 through 1.43.
> CVE-2025-32067 [MEDIUM 5.4]
[PUBLISHED: 2025-04-11] [EPSS 0.23%]
Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Growth Experiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Growth Experiments Extension: from 1.39 through 1.43.
> CVE-2025-31935 [MEDIUM 6.2]
[PUBLISHED: 2025-04-11] [EPSS 0.18%]
Subnet Solutions PowerSYSTEM Center is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the API may trigger an exception, resulting in a denial-of-service condition.
> CVE-2025-31354 [MEDIUM 4.3]
[PUBLISHED: 2025-04-11] [EPSS 0.14%]
Subnet Solutions PowerSYSTEM Center's SMTPS notification service can be affected by importing an EC certificate with crafted F2m parameters, which can lead to excessive CPU consumption during the evaluation of the curve parameters.
> CVE-2023-42983 [MEDIUM 6.4]
[PUBLISHED: 2025-04-11] [EPSS 0.26%]
Processing a file may lead to a denial-of-service or potentially disclose memory contents. This issue is fixed in macOS 14. The issue was addressed with improved checks.
AFFECTED_PRODUCTS: Apple macOS
> CVE-2023-42982 [MEDIUM 6.4]
[PUBLISHED: 2025-04-11] [EPSS 0.26%]
Processing a file may lead to a denial-of-service or potentially disclose memory contents. This issue is fixed in macOS 14. The issue was addressed with improved checks.
AFFECTED_PRODUCTS: Apple macOS
> CVE-2023-42981 [MEDIUM 5.4]
[PUBLISHED: 2025-04-11] [EPSS 0.33%]
Processing a file may lead to a denial-of-service or potentially disclose memory contents. This issue is fixed in macOS 14. The issue was addressed with improved checks.
AFFECTED_PRODUCTS: Apple macOS
> CVE-2023-42977 [HIGH 7.8]
[PUBLISHED: 2025-04-11] [EPSS 0.20%]
A path handling issue was addressed with improved validation. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to break out of its sandbox.
AFFECTED_PRODUCTS: Apple macOS, Apple Iphone Os, Apple Ipad Os
> CVE-2023-42973 [MEDIUM 4.0]
[PUBLISHED: 2025-04-11] [EPSS 0.19%]
Private Browsing tabs may be accessed without authentication. This issue is fixed in iOS 17 and iPadOS 17. The issue was addressed with improved UI.
AFFECTED_PRODUCTS: Apple Iphone Os, Apple Ipados
> CVE-2023-42970 [HIGH 8.8]
[PUBLISHED: 2025-04-11] [EPSS 0.57%]
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari 17. Processing web content may lead to arbitrary code execution.
AFFECTED_PRODUCTS: Red Hat Red Hat Enterprise Linux 8, Red Hat Red Hat Enterprise Linux 9, Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support ... (+10)
> CVE-2023-42969 [LOW 3.3]
[PUBLISHED: 2025-04-11] [EPSS 0.17%]
An app may be able to break out of its sandbox. This issue is fixed in iOS 17 and iPadOS 17, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14, macOS Ventura 13.6, macOS Monterey 12.7. The issue was addressed with improved handling of caches.
AFFECTED_PRODUCTS: Apple macOS, Apple macOS, Apple Iphone Os ... (+1)