CVE-2025-34253

D-Link Nuclias Connect <= v1.3.1.4 Stored Cross-Site Scripting (XSS)

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link fixed this issue in version 1.3.1.5.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

D-link Dlink

Products

Nuclias Connect Nuclias Connect

CVE-2025-30006

Xorcom CompletePBX <= 5.2.35 Reflected Cross-Site Scripting

Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel. This issue affects CompletePBX: all versions up to and including 5.2.35

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Xorcom

Products

Completepbx

CVE-2024-58394

Retool < 3.88.0 XSS via /api/imageProxy SVG Proxying

Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a Content Security Policy, executing JavaScript in victims' sessions. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-10-15.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Retool

Products

Retool

CVE-2024-58366

SurrealDB before 1.1.1 Format String via Scripting Functions

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Delskayn Surrealdb

Products

Rquickjs Surrealdb

CVE-2024-58363

SurrealDB before 1.5.4 Authentication Bypass via Database Switch

SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Surrealdb

Products

Surrealdb

CVE-2024-58300

Siklu MultiHaul TG Series <= 2.0.0 Unauthenticated Credential Disclosure Vulnerability

Siklu MultiHaul TG series devices through version 2.0.0 contain an unauthenticated vulnerability that allows remote attackers to retrieve randomly generated credentials via a network request. Attackers can send a specific hex-encoded command to port 12777 to obtain username and password, enabling direct SSH access to the device.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Siklu

Products

Multihaul Tg Series

CVE-2024-58296

CE Phoenix v1.0.8.20 Stored Cross-Site Scripting via admin/currencies.php

CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce Phoenixcart

Products

Ce Phoenix Ce Phoenix Cart

CVE-2024-58276

Obi08-Enrollment System 1.0 get_subject.php SQL Injection

Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can use UNION-based injection to extract sensitive information from the users table including usernames and passwords.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Enrollment System Project

Products

Enrollment System

CVE-2024-58275

Easywall 0.3.1 - Authenticated Command Injection in /ports-save Endpoint

Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server.

CVSS 4.0 · 8.7 High EPSS 1.8% KEV · Not listed

Vendors

Easywall Project

Products

Easywall

CVE-2024-23690

EOL Netgear FVS336Gv2 and FVS336Gv3 Telnet Configuration Backup Command Injection

The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulnerability in the Telnet interface. An authenticated and remote attacker can execute arbitrary OS commands as root over Telnet by sending crafted "util backup_configuration" commands.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Netgear

Products

Fvs336gv2 Fvs336gv3

CVE-2024-22047

Audited Log Integrity Errors Due to Race Condition

A race condition exists in Audited 4.0.0 before 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Collectiveidea Redhat

Products

Audited Satellite

CVE-2023-53982

PMB 7.4.6 SQL Injection Vulnerability via Unsanitized id Parameter

PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the storage module (categ=storage) of the opac_css/ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements to extract information or perform time-based blind SQL injection attacks.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Sigb

Products

Pmb

CVE-2023-53937

Hubstaff 1.6.13 and 1.6.14 DLL Search Order Hijacking via wow64log Library

Hubstaff 1.6.13 and 1.6.14 contain a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Hubstaff

Products

Hubstaff

CVE-2023-53907

Bludit < 3.13.0 Authenticated Arbitrary File Download via Backup Plugin

Bludit versions before 3.13.0 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to access arbitrary files. Attackers can exploit the plugin's download functionality by manipulating file path parameters to read sensitive system files through directory traversal.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Bludit

Products

Bludit

CVE-2018-25308

BuddyPress Xprofile Custom Fields Type 2.6.3 Arbitrary File Deletion

BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Buddypress Donmik Wordpress

Products

Buddypress Buddypress Xprofile Custom Fields Type Wordpress

CVE-2026-62018

WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62013

WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62008

WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62002

WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-61995

WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—