Mon, Jan 05 · 11:17 AM CSTCVE-2025-31048
9.9/10 · Must read/watchNVDvuln
Summary
Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a through 1.1.4.
CVECVE-2025-31048
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 05 · 11:17 AM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-59157
9.9/10 · Must read/watchNVDvuln
Summary
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creation is vulnerable to command injection. User input is not properly sanitized, allowing attackers to inject arbitrary shell commands that exe
CVECVE-2025-59157
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 05 · 06:15 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-64420
9.9/10 · Must read/watchNVDvuln
Summary
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authenticate as root us
CVECVE-2025-64420
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 05 · 08:16 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2024-32832
9.8/10 · Must read/watchNVDvuln
Summary
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.
CVECVE-2024-32832
SeverityCRITICAL
TypeUPDATED
PublishedSun, Aug 31 · 04:15 AM CDT
ModifiedTue, Oct 06 · 10:10 PM CDT
CVE-2024-46484
9.8/10 · Must read/watchNVDvuln
Summary
TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component.
CVECVE-2024-46484
SeverityCRITICAL
TypeUPDATED
PublishedFri, Aug 29 · 08:15 PM CDT
ModifiedTue, Oct 06 · 10:10 PM CDT
CVE-2025-14996
9.8/10 · Must read/watchNVDvuln
Summary
The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated
CVECVE-2025-14996
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jan 06 · 05:15 AM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-15001
9.8/10 · Must read/watchNVDvuln
Summary
The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change a
CVECVE-2025-15001
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jan 06 · 05:16 AM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-15026
9.8/10 · Must read/watchNVDvuln
Summary
Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
CVECVE-2025-15026
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 05 · 03:15 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-15029
9.8/10 · Must read/watchNVDvuln
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
CVECVE-2025-15029
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 05 · 03:15 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-15385
9.8/10 · Must read/watchNVDvuln
Summary
Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue affects com.Afmobi.Boomplayer: 7.4.63.
CVECVE-2025-15385
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jan 06 · 02:15 AM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-15444
9.8/10 · Must read/watchNVDvuln
Summary
Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium libsodium <= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277 https://www.cve.org/CVERecord?id=CVE-2025-69277 . The libsodium vulnerability sta
CVECVE-2025-15444
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jan 06 · 01:16 AM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-39477
9.8/10 · Must read/watchNVDvuln
Summary
Missing Authorization vulnerability in Sfwebservice InWave Jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InWave Jobs: from n/a through 3.5.8.
CVECVE-2025-39477
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jan 06 · 05:15 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-64419
9.6/10 · Must read/watchNVDvuln
Summary
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose")
CVECVE-2025-64419
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 05 · 08:16 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-30633
9.3/10 · Must read/watchNVDvuln
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL Injection.This issue affects Amazon Native Shopping Recommendations: from n/a through 1.3.
CVECVE-2025-30633
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 05 · 11:17 AM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-39484
9.3/10 · Must read/watchNVDvuln
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects Entrada: from n/a through 5.7.7.
CVECVE-2025-39484
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 05 · 05:15 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-68865
9.3/10 · Must read/watchNVDvuln
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through <= 2.15.06.
CVECVE-2025-68865
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 05 · 11:17 AM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-68456
9.1/10 · Must read/watchNVDvuln
Summary
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions
CVECVE-2025-68456
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 05 · 10:15 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-14997
8.8/10 · Worth your timeNVDvuln
Summary
The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in all versions up to, and including, 1.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to del
CVECVE-2025-14997
SeverityHIGH
TypeUPDATED
PublishedTue, Jan 06 · 05:16 AM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-31047
8.8/10 · Worth your timeNVDvuln
Summary
Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Themify Edmin: from n/a through 2.0.0.
CVECVE-2025-31047
SeverityHIGH
TypeUPDATED
PublishedMon, Jan 05 · 11:17 AM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-47553
8.8/10 · Worth your timeNVDvuln
Summary
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.25.
CVECVE-2025-47553
SeverityHIGH
TypeUPDATED
PublishedTue, Jan 06 · 05:15 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-55204
8.8/10 · Worth your timeNVDvuln
Summary
muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerability in. An attacker can exploit this issue by embedding a specially crafted `muffon://` link on any website they control. When a victim visits the site or clicks the link, the br
CVECVE-2025-55204
SeverityHIGH
TypeUPDATED
PublishedMon, Jan 05 · 06:15 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-59156
8.8/10 · Worth your timeNVDvuln
Summary
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)*vulnerability exists in Coolify's application deployment workflow. This flaw allows a low-privileged member to inject arbitrary Docker Compose directives d
CVECVE-2025-59156
SeverityHIGH
TypeUPDATED
PublishedMon, Jan 05 · 06:15 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-64423
8.8/10 · Worth your timeNVDvuln
Summary
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can see and use invitation links sent to an administrator. When they use the link before the legitimate recipient does, they are abl
CVECVE-2025-64423
SeverityHIGH
TypeUPDATED
PublishedMon, Jan 05 · 09:16 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-64424
8.8/10 · Worth your timeNVDvuln
Summary
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user (member) to execute system commands as root o
CVECVE-2025-64424
SeverityHIGH
TypeUPDATED
PublishedMon, Jan 05 · 09:16 PM CST
ModifiedWed, Oct 07 · 10:10 AM CDT
CVE-2025-68278
8.8/10 · Worth your timeNVDvuln
Summary
Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @t
CVECVE-2025-68278
SeverityHIGH
TypeUPDATED
PublishedThu, Dec 18 · 04:15 PM CST
ModifiedTue, Oct 06 · 10:10 PM CDT
