The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Microsoft February 2025 Patch Tuesday

Published: 2025-02-11

Last Updated: 2025-02-11 20:02:21 UTC

by Renato Marinho (Version: 1)

This month, Microsoft has released patches addressing a total of 141 vulnerabilities. Among these, 4 are classified as critical, highlighting the potential for significant impact if exploited. Notably, 2 vulnerabilities are currently being exploited in the wild, underscoring the urgency for immediate updates. Additionally, 1 vulnerability has been disclosed prior to this patch cycle, marking it as a zero-day. Users are strongly advised to prioritize these updates to safeguard their systems against potential threats.

Significant Vulnerabilities

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2025-21418)

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21418

This vulnerability, identified as CVE-2025-21418, has a severity rating of Important with a CVSS score of 7.8. It is currently being exploited in the wild but has not been publicly disclosed, making it a significant concern for affected systems. The vulnerability allows an attacker to gain SYSTEM privileges, thereby elevating their access and control over the compromised system. Immediate attention and remediation are advised to mitigate the risk posed by this vulnerability.

Windows Storage Elevation of Privilege Vulnerability (CVE-2025-21391)

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21391

This is a disclosed vulnerability with a severity rating of Important and a CVSS score of 7.1, which is currently being exploited in the wild. This vulnerability allows an attacker to elevate their privileges to delete targeted files on a system, significantly impacting the integrity and availability of the system without compromising confidentiality. The exploitation of this vulnerability can lead to the deletion of critical data, potentially rendering services unavailable. Despite its exploitation, it has not been publicly disclosed as a zero-day, and users are advised to implement appropriate security measures to mitigate its impact.

NTLM Hash Disclosure Spoofing Vulnerability (CVE-2025-21377)

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21377

This is a disclosed zero-day vulnerability with a severity rating of Important and a CVSS score of 6.5, though it is not currently exploited in the wild. This vulnerability can lead to a total loss of confidentiality by allowing an attacker to obtain a user's NTLMv2 hash, which could be used to authenticate as the user. Exploitation requires minimal user interaction, such as selecting or inspecting a malicious file. It affects all supported versions of Microsoft Windows, and despite the retirement of Internet Explorer 11 and the deprecation of Microsoft Edge Legacy, updates are necessary due to the continued use of the MSHTML and EdgeHTML platforms in various applications. To ensure full protection, users are advised to install both Security Only updates and IE Cumulative updates.

Microsoft Dynamics 365 Sales Elevation of Privilege Vulnerability (CVE-2025-21177)

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21177

This vulnerability, identified as CVE-2025-21177, has not been exploited in the wild nor disclosed publicly, classifying it as a non-zero-day. It carries a severity rating of Critical with a CVSS score of 8.7, indicating a significant risk of elevation of privilege if exploited. Although the vulnerability could potentially allow attackers to gain unauthorized access and elevate their privileges within the Microsoft Dynamics 365 Sales environment, Microsoft has fully mitigated the issue, requiring no action from users. This CVE serves to enhance transparency regarding cloud service vulnerabilities.

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVE-2025-21376)

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21376

This is a critical vulnerability with a CVSS score of 8.1, which has not been exploited in the wild nor disclosed publicly, thus not classified as a zero-day. This vulnerability allows for remote code execution, posing a significant threat if exploited. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to a vulnerable LDAP server, potentially causing a buffer overflow. The attack complexity is high, as successful exploitation requires the attacker to win a race condition. Mitigation efforts should focus on securing LDAP servers and monitoring for unusual activity to prevent potential exploitation.

Microsoft Excel Remote Code Execution Vulnerability (CVE-2025-21381)

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21381

This vulnerability, identified as CVE-2025-21381, has not been exploited in the wild nor disclosed publicly, making it a non-zero-day threat. It carries a severity rating of Critical with a CVSS score of 7.8, indicating a significant risk of remote code execution. Despite the CVSS metric indicating a local attack vector, the vulnerability allows an attacker to execute code remotely by convincing a user, through social engineering, to download and open a specially crafted file. The attack can be executed locally, with the Preview Pane serving as a potential attack vector. Users are advised to exercise caution when opening files from untrusted sources and to apply any available security updates to mitigate this risk.

DHCP Client Service Remote Code Execution Vulnerability (CVE-2025-21379)

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21379

This vulnerability, identified as CVE-2025-21379, has not been exploited in the wild nor disclosed publicly, classifying it as a non-zero-day threat. It carries a severity rating of Critical with a CVSS score of 7.1, indicating a significant risk of remote code execution. The vulnerability requires a high attack complexity, necessitating a machine-in-the-middle (MITM) attack where the attacker must intercept the logical network path between the target and the resource. The attack vector is adjacent, meaning it is limited to systems on the same network segment, such as those connected to the same network switch or virtual network. This limitation prevents the attack from being executed across multiple networks, such as a WAN.

Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability (CVE-2025-21198)

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21198

is a critical security flaw with a CVSS score of 9.0, rated as Important, and is currently neither exploited in the wild nor publicly disclosed. This vulnerability allows for remote code execution, requiring an attacker to have low privileges and access to the network connecting the targeted HPC clusters and nodes. The attack vector is adjacent, meaning it relies on intra-net or private network access rather than exposure to the public internet. Exploitation involves sending a specially crafted HTTPS request to the head node or Linux compute node, potentially allowing the attacker to execute code on other clusters or nodes connected to the targeted head node. The scope of the attack is changed, indicating that successful exploitation could lead to broader impacts beyond the initially compromised system.

Windows Telephony Service Remote Code Execution Vulnerability (CVE-2025-21190)

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21190

This is a significant security issue with a CVSS score of 8.8, classified as Important. Although it has not been exploited in the wild or disclosed publicly, this vulnerability poses a risk of remote code execution. An attacker could exploit it by deceiving a user into sending a request to a malicious server, which could then return harmful data leading to arbitrary code execution on the user's system. The attack vector is network-based, requiring user interaction, as the attacker needs a client to connect to the malicious server to execute code on the client system.

Windows Telephony Service Remote Code Execution Vulnerability (CVE-2025-21200)

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21200

This is a significant security issue with a CVSS score of 8.8, rated as Important, though it has not been exploited in the wild nor disclosed publicly, thus not classified as a zero-day. This vulnerability allows for remote code execution, where an attacker could potentially trick a user into sending a request to a malicious server. The server could then return malicious data, leading to arbitrary code execution on the user's system. The attack vector is network-based, requiring user interaction, as the client must connect to a malicious server, which could enable the attacker to execute code on the client machine. Mitigation strategies should focus on user awareness and network security measures to prevent such exploitations.

This summary of Microsoft's monthly updates highlights several critical vulnerabilities, emphasizing the need for immediate attention to certain threats. The Windows Ancillary Function Driver for WinSock vulnerability (CVE-2025-21418) is currently being exploited and poses a significant risk due to its potential for SYSTEM privilege escalation. Users should prioritize patching this vulnerability. Additionally, the Windows Storage vulnerability (CVE-2025-21391) is actively exploited, risking data integrity and availability. The NTLM Hash Disclosure vulnerability (CVE-2025-21377), a zero-day, threatens confidentiality and requires prompt updates. Other critical vulnerabilities, such as those affecting Microsoft Dynamics 365 Sales and Windows LDAP, though not exploited, demand vigilance and timely updates to prevent potential exploitation. Users are advised to prioritize these updates and enhance security measures to mitigate risks effectively ...

Read the full entry: https://isc.sans.edu/diary/Microsoft+February+2025+Patch+Tuesday/31674/

The Unbreakable Multi-Layer Anti-Debugging System (2025.02.06)

Published: 2025-02-06

Last Updated: 2025-02-06 08:08:26 UTC

by Xavier Mertens (Version: 1)

The title of this diary is based on the string I found in a malicious Python script that implements many anti-debugging techniques. If some were common, others were interesting and demonstrated how low-level high-level languages like Python can access operating system information. Let’s review some of them!

Anti-debugging techniques are like a cat-and-mouse game. If you’re interested in malware analysis, this will show you how your task can be much more challenging if you’re prepared to face them. The file was found on VT with a low score of 2/62 ... The file just contains only anti-debugging stuff and not real malware. I suspect the file to be a proof-of-concept.

The script is multi-threaded and launches all the techniques in parallel ...

Read the full entry: https://isc.sans.edu/diary/The+Unbreakable+MultiLayer+AntiDebugging+System/31658/

Phishing via "com-" prefix domains (2025.02.05)

Published: 2025-02-05

Last Updated: 2025-02-05 17:50:33 UTC

by Johannes Ullrich (Version: 1)

Phishing is always a "whack the mole" like game. Attackers come up with new ways to fool victims. Security tools are often a step behind. Messages claiming to collect unpaid tolls are one current common theme among phishing (smishing?) messages. I just received another one today ...

The FBI's Internet Crime Complaint Center warned of these types of messages last April. The message was pretty easily identified as fraud by the "From" number, a phone number in the Philippines. But I found the domain clever.

Florida's toll system is commonly referred to as "Sunpass", and the legitimate website is sunpass.com. The scammer attempted to emulate this name by using a domain that starts with "com-". An unsuspecting user may consider this a valid sunpass.com address.

So I looked at our "newly registered domains" data to see how many "com-*" domains we have, and this prefix looks indeed popular, usually followed by a few random characters ...

Here are a few example:

Read the full entry: https://isc.sans.edu/diary/Phishing+via+com+prefix+domains/31654/

An ontology for threats, cybercrime and digital forensic investigation on Smart City Infrastructure (2025.02.12)

https://isc.sans.edu/diary/An+ontology+for+threats+cybercrime+and+digital+forensic+investigation+on+Smart+City+Infrastructure/31676/

Reminder: 7-Zip & MoW (2025.02.10)

https://isc.sans.edu/diary/Reminder+7Zip+MoW/31668/

Crypto Wallet Scam: Not For Free (2025.02.08)

https://isc.sans.edu/diary/Crypto+Wallet+Scam+Not+For+Free/31666/

SSL 2.0 turns 30 this Sunday... Perhaps the time has come to let it die? (2025.02.07)

https://isc.sans.edu/diary/SSL+20+turns+30+this+Sunday+Perhaps+the+time+has+come+to+let+it+die/31664/\

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

Product: Microsoft Windows Ancillary Function Driver for WinSock

CVSS Score: 7.8

** KEV since 2025-02-11 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21418

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21418

Product: Microsoft Windows Storage

CVSS Score: 7.1

** KEV since 2025-02-11 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21391

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391

Product: 7-Zip

CVSS Score: 0

** KEV since 2025-02-06 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0411

ISC Diary: https://isc.sans.edu/diary/31668

Product: Zyxel VMG4325-B10A

CVSS Score: 8.8

** KEV since 2025-02-11 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-40890

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-40891

NVD References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025

Product: Zyxel VMG4325-B10A

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0890

NVD References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025

Product: Trimble Cityworks

CVSS Score: 0

** KEV since 2025-02-07 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0994

NVD References:

- https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?

- https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04

Product: Audinate Dante_Application_Library

CVSS Score: 0

** KEV since 2025-02-06 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-23748

Product: Microsoft High Performance Compute (HPC) Pack

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21198

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21198

Product: Microsoft Dynamics 365 Sales

CVSS Score: 8.7

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21177

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21177

Product: Microsoft DHCP Client Service

CVSS Score: 7.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21379

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21379

Product: Microsoft ExcelCVSS Scores: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21381NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21386NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21387NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21390NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21394ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21381- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21386- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21387- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21390- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21394CVE-2025-21383 - Microsoft Excel Information Disclosure VulnerabilityProduct: Microsoft ExcelCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21383ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21383CVE-2025-21377 - NTLM Hash Disclosure Spoofing VulnerabilityProduct: Microsoft Windows Operating SystemCVSS Score: 6.5NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21377ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21377CVE-2025-21190, CVE-2025-21200, CVE-2025-21201, CVE-2025-21371, CVE-2025-21406, CVE-2025-21407 - Windows Telephony Service Remote Code Execution VulnerabilitiesProduct: Microsoft Windows Telephony ServiceCVSS Scores: 8.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21190NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21200NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21201NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21371NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21406NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21407ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21190- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21200- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21201- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21371- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21406- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21407CVE-2025-21376 - Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityProduct: Microsoft Windows Lightweight Directory Access Protocol (LDAP)CVSS Score: 8.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21376ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21376CVE-2025-22204 - Sourcerer extension for Joomla in versions before 11.0.0 is vulnerable to remote code execution due to improper code generation control.Product: Joomla SourcererCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22204NVD References: https://regularlabs.com/sourcererCVE-2025-1009 - Firefox, Firefox ESR, and Thunderbird versions prior to Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135 are vulnerable to a use-after-free exploit via crafted XSLT data, potentially resulting in a crash that can be exploited.Product: Mozilla FirefoxCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1009NVD References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1936613- https://www.mozilla.org/security/advisories/mfsa2025-07/- https://www.mozilla.org/security/advisories/mfsa2025-08/- https://www.mozilla.org/security/advisories/mfsa2025-09/- https://www.mozilla.org/security/advisories/mfsa2025-10/- https://www.mozilla.org/security/advisories/mfsa2025-11/CVE-2025-1016 - Firefox, Thunderbird, and Firefox ESR versions prior to 135, 128.7, and 115.20 respectively are vulnerable to memory safety bugs that could have allowed for arbitrary code execution.Product: Mozilla FirefoxCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1016NVD References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1936601%2C1936844%2C1937694%2C1938469%2C1939583%2C1940994- https://www.mozilla.org/security/advisories/mfsa2025-07/- https://www.mozilla.org/security/advisories/mfsa2025-08/- https://www.mozilla.org/security/advisories/mfsa2025-09/- https://www.mozilla.org/security/advisories/mfsa2025-10/- https://www.mozilla.org/security/advisories/mfsa2025-11/CVE-2025-1017 - Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 are vulnerable to memory safety bugs with the potential for memory corruption and running arbitrary code.Product: Mozilla FirefoxCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1017NVD References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1926256%2C1935984%2C1935471- https://www.mozilla.org/security/advisories/mfsa2025-07/- https://www.mozilla.org/security/advisories/mfsa2025-09/- https://www.mozilla.org/security/advisories/mfsa2025-10/- https://www.mozilla.org/security/advisories/mf…

Product: Microsoft Excel

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21383

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21383

Product: Microsoft Windows Operating System

CVSS Score: 6.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21377

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21377

Product: Microsoft Windows Telephony ServiceCVSS Scores: 8.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21190NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21200NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21201NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21371NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21406NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21407ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21190- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21200- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21201- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21371- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21406- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21407CVE-2025-21376 - Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityProduct: Microsoft Windows Lightweight Directory Access Protocol (LDAP)CVSS Score: 8.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21376ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21376CVE-2025-22204 - Sourcerer extension for Joomla in versions before 11.0.0 is vulnerable to remote code execution due to improper code generation control.Product: Joomla SourcererCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22204NVD References: https://regularlabs.com/sourcererCVE-2025-1009 - Firefox, Firefox ESR, and Thunderbird versions prior to Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135 are vulnerable to a use-after-free exploit via crafted XSLT data, potentially resulting in a crash that can be exploited.Product: Mozilla FirefoxCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1009NVD References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1936613- https://www.mozilla.org/security/advisories/mfsa2025-07/- https://www.mozilla.org/security/advisories/mfsa2025-08/- https://www.mozilla.org/security/advisories/mfsa2025-09/- https://www.mozilla.org/security/advisories/mfsa2025-10/- https://www.mozilla.org/security/advisories/mfsa2025-11/CVE-2025-1016 - Firefox, Thunderbird, and Firefox ESR versions prior to 135, 128.7, and 115.20 respectively are vulnerable to memory safety bugs that could have allowed for arbitrary code execution.Product: Mozilla FirefoxCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1016NVD References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1936601%2C1936844%2C1937694%2C1938469%2C1939583%2C1940994- https://www.mozilla.org/security/advisories/mfsa2025-07/- https://www.mozilla.org/security/advisories/mfsa2025-08/- https://www.mozilla.org/security/advisories/mfsa2025-09/- https://www.mozilla.org/security/advisories/mfsa2025-10/- https://www.mozilla.org/security/advisories/mfsa2025-11/CVE-2025-1017 - Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 are vulnerable to memory safety bugs with the potential for memory corruption and running arbitrary code.Product: Mozilla FirefoxCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1017NVD References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1926256%2C1935984%2C1935471- https://www.mozilla.org/security/advisories/mfsa2025-07/- https://www.mozilla.org/security/advisories/mfsa2025-09/- https://www.mozilla.org/security/advisories/mfsa2025-10/- https://www.mozilla.org/security/advisories/mfsa2025-11/CVE-2025-1020 - Firefox 134 and Thunderbird 134 are vulnerable to memory corruption bugs that could be exploited to run arbitrary code.Product: Mozilla FirefoxCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1020NVD References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1939063%2C1942169- https://www.mozilla.org/security/advisories/mfsa2025-07/- https://www.mozilla.org/security/advisories/mfsa2025-11/CVE-2024-9643, CVE-2024-9644 - The Four-Faith F3x36 router with firmware v2.0.0 is vulnerable to authentication bypass vulnerabilitiesProduct: Four-Faith F3x36 routerCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-9643NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-9644NVD References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1752- https://vulncheck.com/advisories/four-faith-hard-coded-creds- https://vulncheck.com/advisories/four-faith-hidden-apiCVE-2025-0364 - BigAntSoft BigAnt Server, up to and including version 5.6.06, allows unauthenticated remote attackers to execute arbitrary PHP code by creating an administrative user through the default registration mechanism.Product: BigAntSoft BigAnt ServerCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0364NVD References: https://vulncheck.com/advisories/big-ant-upload-rceCVE-2025-0960 - AutomationDirect C-more EA9 HMI has a vulnerability that allows attackers to bypass bounds checks and potentially achieve re…

Product: Microsoft Windows Lightweight Directory Access Protocol (LDAP)

CVSS Score: 8.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21376

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21376

Product: Joomla Sourcerer

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22204

NVD References: https://regularlabs.com/sourcerer

Product: Mozilla Firefox

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1009

NVD References:

- https://bugzilla.mozilla.org/show_bug.cgi?id=1936613

- https://www.mozilla.org/security/advisories/mfsa2025-07/

- https://www.mozilla.org/security/advisories/mfsa2025-08/

- https://www.mozilla.org/security/advisories/mfsa2025-09/

- https://www.mozilla.org/security/advisories/mfsa2025-10/

- https://www.mozilla.org/security/advisories/mfsa2025-11/

Product: Mozilla Firefox

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1016

NVD References:

- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1936601%2C1936844%2C1937694%2C1938469%2C1939583%2C1940994

- https://www.mozilla.org/security/advisories/mfsa2025-07/

- https://www.mozilla.org/security/advisories/mfsa2025-08/

- https://www.mozilla.org/security/advisories/mfsa2025-09/

- https://www.mozilla.org/security/advisories/mfsa2025-10/

- https://www.mozilla.org/security/advisories/mfsa2025-11/

Product: Mozilla Firefox

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1017

NVD References:

- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1926256%2C1935984%2C1935471

- https://www.mozilla.org/security/advisories/mfsa2025-07/

- https://www.mozilla.org/security/advisories/mfsa2025-09/

- https://www.mozilla.org/security/advisories/mfsa2025-10/

- https://www.mozilla.org/security/advisories/mfsa2025-11/

Product: Mozilla FirefoxCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1020NVD References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1939063%2C1942169- https://www.mozilla.org/security/advisories/mfsa2025-07/- https://www.mozilla.org/security/advisories/mfsa2025-11/CVE-2024-9643, CVE-2024-9644 - The Four-Faith F3x36 router with firmware v2.0.0 is vulnerable to authentication bypass vulnerabilitiesProduct: Four-Faith F3x36 routerCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-9643NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-9644NVD References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1752- https://vulncheck.com/advisories/four-faith-hard-coded-creds- https://vulncheck.com/advisories/four-faith-hidden-apiCVE-2025-0364 - BigAntSoft BigAnt Server, up to and including version 5.6.06, allows unauthenticated remote attackers to execute arbitrary PHP code by creating an administrative user through the default registration mechanism.Product: BigAntSoft BigAnt ServerCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0364NVD References: https://vulncheck.com/advisories/big-ant-upload-rceCVE-2025-0960 - AutomationDirect C-more EA9 HMI has a vulnerability that allows attackers to bypass bounds checks and potentially achieve remote code execution or cause denial-of-service.Product: AutomationDirect C-more EA9 HMICVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0960NVD References: - https://community.automationdirect.com/s/cybersecurity/security-advisories- https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-08CVE-2025-24964 - Vitest is vulnerable to arbitrary remote Code Execution due to a Cross-site WebSocket hijacking (CSWSH) attack on the Vitest API server, allowing attackers to edit and rerun test files to execute malicious code.Product: Vitest ViteCVSS Score: 9.6NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24964NVD References: - https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46- https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76- https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq- https://vitest.dev/config/#apiCVE-2024-48445 - compop.ca ONLINE MALL v.3.5.3 is vulnerable to remote code execution due to issues with certain parameters.Product: compop.ca ONLINE MALLCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-48445NVD References: https://packetstorm.news/files/id/188996/CVE-2025-0665 - Libcurl incorrectly closes eventfd file descriptor twice during connection takedown after threaded name resolve.Product: libcurlCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0665NVD References: - https://curl.se/docs/CVE-2025-0665.html- https://curl.se/docs/CVE-2025-0665.json- https://hackerone.com/reports/2954286- http://www.openwall.com/lists/oss-security/2025/02/05/2- http://www.openwall.com/lists/oss-security/2025/02/05/5CVE-2025-20124 - Cisco ISE API vulnerability allows authenticated remote attackers to execute arbitrary commands with root user privileges due to insecure deserialization of Java byte streams.Product: Cisco ISECVSS Score: 9.9NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-20124NVD References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multivuls-FTW9AOXFCVE-2025-20125 - Cisco ISE API vulnerability allows authenticated attackers with read-only credentials to access sensitive information and alter node configurations.Product: Cisco ISECVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-20125NVD References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multivuls-FTW9AOXFCVE-2020-36084 - SourceCodester Responsive E-Learning System 1.0 is vulnerable to SQL Injection via the id parameter in delete_teacher_students.php.Product: SourceCodester Responsive E-Learning SystemCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-36084NVD References: https://www.exploit-db.com/exploits/49357CVE-2024-57077 - Utils-extend version 1.0.8 is vulnerable to Prototype Pollution, allowing attackers to introduce or modify properties in the global prototype chain, leading to denial of service.Product: Utils-extend version 1.0.8CVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57077NVD References: https://gist.github.com/tariqhawis/64bac50f8c2706e6880e45d50a507114CVE-2024-57520 - Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig functionProduct: AsteriskCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57520NVD References: https://gist.github.com/hyp164D1/ae76ab25acfbe263b2ed7b24b6e5c621CVE-2025-1066 - OpenPLC_V3 contains an arbitrary file upload vulnerability, which could be leveraged for malvertising or phishing campaigns.Product: Ope…

Product: BigAntSoft BigAnt Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0364

NVD References: https://vulncheck.com/advisories/big-ant-upload-rce

Product: AutomationDirect C-more EA9 HMI

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0960

NVD References:

- https://community.automationdirect.com/s/cybersecurity/security-advisories

- https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-08

Product: Vitest Vite

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24964

NVD References:

- https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46

- https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76

- https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq

- https://vitest.dev/config/#api

Product: compop.ca ONLINE MALL

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-48445

NVD References: https://packetstorm.news/files/id/188996/

Product: libcurl

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0665

NVD References:

- https://curl.se/docs/CVE-2025-0665.html

- https://curl.se/docs/CVE-2025-0665.json

- https://hackerone.com/reports/2954286

- http://www.openwall.com/lists/oss-security/2025/02/05/2

- http://www.openwall.com/lists/oss-security/2025/02/05/5

Product: Cisco ISE

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-20124

NVD References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multivuls-FTW9AOXF

Product: Cisco ISE

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-20125

NVD References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multivuls-FTW9AOXF

Product: SourceCodester Responsive E-Learning System

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-36084

NVD References: https://www.exploit-db.com/exploits/49357

Product: Utils-extend version 1.0.8

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57077

NVD References: https://gist.github.com/tariqhawis/64bac50f8c2706e6880e45d50a507114

Product: Asterisk

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57520

NVD References: https://gist.github.com/hyp164D1/ae76ab25acfbe263b2ed7b24b6e5c621

Product: OpenPLC

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1066

NVD References:

- https://github.com/thiagoralves/OpenPLC_v3/commit/d1b1a3b7e97f2b3fef0876056cf9d7879991744a

- https://medium.com/@alimuhammadsecured/cyberforce-2024-how-i-found-my-first-cve-openplcv3-16c058b114b0

Product: IBM Security Verify Directory

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-51450

NVD References: https://www.ibm.com/support/pages/node/7182558

Product: ABB ASPECT-Enterprise

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-51547

NVD References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A6775&LanguageCode=en&DocumentPartId=pdf%20-%20Public%20Advisory&Action=Launch

Product: Honeywell OneWireless Wireless Device Manager (WDM)

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-5878

NVD References: https://process.honeywell.com/

Product: Tiny File Manager

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-40916

NVD References:

- https://github.com/prasathmani/tinyfilemanager

- https://github.com/whitej3rry/CVE-2022-40916/blob/main/PoC.md

Product: ClearML Enterprise Server

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-39272

NVD References:

- https://talosintelligence.com/vulnerability_reports/TALOS-2024-2110

- https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2110

Product: PHPJabbers Cinema Booking System v2.0CVSS Score: 9.3NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57428NVD References: - https://github.com/ahrixia/CVE-2024-57428- https://www.phpjabbers.com/cinema-booking-system/CVE-2024-57430 - PHPJabbers Cinema Booking System v2.0 is vulnerable to SQL injection via the column parameter, allowing attackers to manipulate database queries and potentially perform unauthorized actions.Product: PHPJabbers Cinema Booking SystemCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57430NVD References: - https://github.com/ahrixia/CVE-2024-57430- https://www.phpjabbers.com/cinema-booking-system/CVE-2024-36554 - Forever KidsWatch Call Me KW-50 and KW-60 allow a malicious user to retrieve sensitive information by sending an SMS to the device.Product: Forever KidsWatch Call Me KW-50CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36554NVD References: https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296CVE-2024-36555 - Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b have a vulnerability that allows malicious users to change the device's IMEI number, enabling them to forge the identity of the device.Product: Forever KidsWatchCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36555NVD References: https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296CVE-2024-36556 - Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b have a Hardcoded password vulnerability.Product: Forever KidsWatchCVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36556NVD References: https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296CVE-2025-24981 - MDC allows for arbitrary JavaScript code execution through unsafe parsing of URLs in markdown documents, mitigated in version 0.13.3 with no known workarounds.Product: Vuejs MDCCVSS Score: 9.3NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24981NVD References: - https://github.com/nuxt-modules/mdc/blob/main/src/runtime/parser/utils/props.ts#L16- https://github.com/nuxt-modules/mdc/commit/99097738b5561639e9bf247c55d8103236618bf3- https://github.com/nuxt-modules/mdc/security/advisories/GHSA-j82m-pc2v-2484CVE-2024-57668 - In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability.Product: Code-projects Shopping PortalCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57668NVD References: - https://code-projects.org/shopping-portal-using-php-source-code/- https://github.com/passevery/vul/issues/1CVE-2025-22992 - Emoncms project >= 11.6.9 is vulnerable to SQL Injection in the /feed/insert.json endpoint.Product: EmoncmsCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22992NVD References: - https://github.com/emoncms/emoncms/issues/1916- https://github.com/emoncms/emoncms/issues/1916CVE-2025-24786 - WhoDB is vulnerable to path traversal, allowing an unauthenticated attacker to access any Sqlite3 database on the host machine.Product: WhoDBCVSS Score: 10.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24786NVD References: - https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L14-L20- https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L26- https://github.com/clidey/whodb/security/advisories/GHSA-9r4c-jwx3-3j76- https://github.com/clidey/whodb/security/advisories/GHSA-9r4c-jwx3-3j76CVE-2025-0674 - Elber products are vulnerable to an authentication bypass, allowing attackers unauthorized administrative access.Product: Multiple Elber productsCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0674NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-03CVE-2025-1107 - Janto r12 and earlier versions have an unverified password change vulnerability that allows unauthenticated attackers to change other users' passwor…

Product: PHPJabbers Cinema Booking SystemCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57430NVD References: - https://github.com/ahrixia/CVE-2024-57430- https://www.phpjabbers.com/cinema-booking-system/CVE-2024-36554 - Forever KidsWatch Call Me KW-50 and KW-60 allow a malicious user to retrieve sensitive information by sending an SMS to the device.Product: Forever KidsWatch Call Me KW-50CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36554NVD References: https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296CVE-2024-36555 - Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b have a vulnerability that allows malicious users to change the device's IMEI number, enabling them to forge the identity of the device.Product: Forever KidsWatchCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36555NVD References: https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296CVE-2024-36556 - Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b have a Hardcoded password vulnerability.Product: Forever KidsWatchCVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36556NVD References: https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296CVE-2025-24981 - MDC allows for arbitrary JavaScript code execution through unsafe parsing of URLs in markdown documents, mitigated in version 0.13.3 with no known workarounds.Product: Vuejs MDCCVSS Score: 9.3NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24981NVD References: - https://github.com/nuxt-modules/mdc/blob/main/src/runtime/parser/utils/props.ts#L16- https://github.com/nuxt-modules/mdc/commit/99097738b5561639e9bf247c55d8103236618bf3- https://github.com/nuxt-modules/mdc/security/advisories/GHSA-j82m-pc2v-2484CVE-2024-57668 - In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability.Product: Code-projects Shopping PortalCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57668NVD References: - https://code-projects.org/shopping-portal-using-php-source-code/- https://github.com/passevery/vul/issues/1CVE-2025-22992 - Emoncms project >= 11.6.9 is vulnerable to SQL Injection in the /feed/insert.json endpoint.Product: EmoncmsCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22992NVD References: - https://github.com/emoncms/emoncms/issues/1916- https://github.com/emoncms/emoncms/issues/1916CVE-2025-24786 - WhoDB is vulnerable to path traversal, allowing an unauthenticated attacker to access any Sqlite3 database on the host machine.Product: WhoDBCVSS Score: 10.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24786NVD References: - https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L14-L20- https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L26- https://github.com/clidey/whodb/security/advisories/GHSA-9r4c-jwx3-3j76- https://github.com/clidey/whodb/security/advisories/GHSA-9r4c-jwx3-3j76CVE-2025-0674 - Elber products are vulnerable to an authentication bypass, allowing attackers unauthorized administrative access.Product: Multiple Elber productsCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0674NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-03CVE-2025-1107 - Janto r12 and earlier versions have an unverified password change vulnerability that allows unauthenticated attackers to change other users' passwords by sending a crafted POST request to the '/public/cgi/Gateway.php' endpoint.Product: JantoCVSS Score: 9.9NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1107NVD References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-jantoCVE-2024-57707 - An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components.Product: DataEaseCVSS Score: 9.8NVD: https:…

Product: Forever KidsWatch Call Me KW-50CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36554NVD References: https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296CVE-2024-36555 - Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b have a vulnerability that allows malicious users to change the device's IMEI number, enabling them to forge the identity of the device.Product: Forever KidsWatchCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36555NVD References: https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296CVE-2024-36556 - Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b have a Hardcoded password vulnerability.Product: Forever KidsWatchCVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36556NVD References: https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296CVE-2025-24981 - MDC allows for arbitrary JavaScript code execution through unsafe parsing of URLs in markdown documents, mitigated in version 0.13.3 with no known workarounds.Product: Vuejs MDCCVSS Score: 9.3NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24981NVD References: - https://github.com/nuxt-modules/mdc/blob/main/src/runtime/parser/utils/props.ts#L16- https://github.com/nuxt-modules/mdc/commit/99097738b5561639e9bf247c55d8103236618bf3- https://github.com/nuxt-modules/mdc/security/advisories/GHSA-j82m-pc2v-2484CVE-2024-57668 - In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability.Product: Code-projects Shopping PortalCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57668NVD References: - https://code-projects.org/shopping-portal-using-php-source-code/- https://github.com/passevery/vul/issues/1CVE-2025-22992 - Emoncms project >= 11.6.9 is vulnerable to SQL Injection in the /feed/insert.json endpoint.Product: EmoncmsCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22992NVD References: - https://github.com/emoncms/emoncms/issues/1916- https://github.com/emoncms/emoncms/issues/1916CVE-2025-24786 - WhoDB is vulnerable to path traversal, allowing an unauthenticated attacker to access any Sqlite3 database on the host machine.Product: WhoDBCVSS Score: 10.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24786NVD References: - https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L14-L20- https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L26- https://github.com/clidey/whodb/security/advisories/GHSA-9r4c-jwx3-3j76- https://github.com/clidey/whodb/security/advisories/GHSA-9r4c-jwx3-3j76CVE-2025-0674 - Elber products are vulnerable to an authentication bypass, allowing attackers unauthorized administrative access.Product: Multiple Elber productsCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0674NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-03CVE-2025-1107 - Janto r12 and earlier versions have an unverified password change vulnerability that allows unauthenticated attackers to change other users' passwords by sending a crafted POST request to the '/public/cgi/Gateway.php' endpoint.Product: JantoCVSS Score: 9.9NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1107NVD References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-jantoCVE-2024-57707 - An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components.Product: DataEaseCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57707NVD References: https://github.com/shigophilo/CVE/blob/main/DataEase-v1-code-execute.mdCVE-2024-55215 - An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register.Product: Jrohy trojanCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-20…

Product: Forever KidsWatch

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36556

NVD References: https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296

Product: Vuejs MDC

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24981

NVD References:

- https://github.com/nuxt-modules/mdc/blob/main/src/runtime/parser/utils/props.ts#L16

- https://github.com/nuxt-modules/mdc/commit/99097738b5561639e9bf247c55d8103236618bf3

- https://github.com/nuxt-modules/mdc/security/advisories/GHSA-j82m-pc2v-2484

Product: Code-projects Shopping Portal

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57668

NVD References:

- https://code-projects.org/shopping-portal-using-php-source-code/

- https://github.com/passevery/vul/issues/1

Product: Emoncms

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22992

NVD References:

- https://github.com/emoncms/emoncms/issues/1916

- https://github.com/emoncms/emoncms/issues/1916

Product: WhoDB

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24786

NVD References:

- https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L14-L20

- https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L26

- https://github.com/clidey/whodb/security/advisories/GHSA-9r4c-jwx3-3j76

- https://github.com/clidey/whodb/security/advisories/GHSA-9r4c-jwx3-3j76

Product: Multiple Elber products

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0674

NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-03

Product: Janto

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1107

NVD References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto

Product: DataEaseCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-57707NVD References: https://github.com/shigophilo/CVE/blob/main/DataEase-v1-code-execute.mdCVE-2024-55215 - An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register.Product: Jrohy trojanCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-55215NVD References: https://github.com/ainrm/Jrohy-trojan-unauth-poc/blob/main/README.en.mdCVE-2025-24016 - Wazuh platform prior to version 4.9.1 is vulnerable to remote code execution due to an unsafe deserialization issue in DistributedAPI parameters serialization.Product: WazuhCVSS Score: 9.9NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24016NVD References: https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qhCVE-2025-1144 - Quanxun's School Affairs System exposes sensitive information, allowing unauthenticated attackers to access specific pages and obtain database information and plaintext administrator credentials.Product: Quanxun School Affairs SystemCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1144NVD References: - https://www.twcert.org.tw/en/cp-139-8416-b6cba-2.html- https://www.twcert.org.tw/tw/cp-132-8415-853e0-1.htmlCVE-2025-26410 - Wattsense Bridge devices have a security flaw with hard-coded credentials that can be easily recovered, allowing unauthorized access to the device.Product: Wattsense BridgeCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-26410NVD References: - https://r.sec-consult.com/wattsense- https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-NotesCVE-2024-12366 - PandasAI is vulnerable to prompt injection, allowing attackers to execute arbitrary Python code and potentially achieve Remote Code Execution (RCE).Product: PandasAICVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-12366NVD References: - https://docs.getpanda.ai/v3/privacy-security- https://docs.pandas-ai.com/advanced-security-agent- https://www.kb.cert.org/vuls/id/148244CVE-2024-10644 - Ivanti Connect Secure and Ivanti Policy Secure are vulnerable to code injection attacks, permitting remote code execution by an authenticated attacker with admin privileges.Product: Ivanti Connect Secure and Ivanti Policy SecureCVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-10644NVD References: https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEsCVE-2024-47908 - Ivanti CSA before version 5.0.5 is vulnerable to OS command injection in the admin web console, allowing remote authenticated attackers with admin privileges to achieve remote code execution.Product: Ivanti CSACVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-47908NVD References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-47908-CVE-2024-11771CVE-2025-22467 - Ivanti Connect Secure before version 22.7R2.6 has a stack-based buffer overflow vulnerability, enabling a remote authenticated attacker to execute code.Product: Ivanti Connect SecureCVSS Score: 9.9NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22467NVD References: https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEsCVE-2025-24973 - Concorde, formerly known as Nexkey, is vulnerable to session hijacking due to an improper logout process that allows authentication credentials to remain in cookies, posing a risk of token theft for users, especially those with admin privileges on shared devices.Product: Misskey Concorde (formerly known as Nexkey)CVSS Score: 9.3NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24973NVD References: - https://github.com/nexryai/concorde/commit/1f6ac9b289906083b132e4f9667a31a60ef83e4e- https://github.com/nexryai/concorde/security/advisories/GHSA-2369-p2wh-7cc2CVE-2025-1126 - A Reliance on Untrusted Inputs in a Security Decision vulnerability has been identified in the Lexmark Print Management Client.Product: Lexmark Print Management ClientCVSS Score: 9.3NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1126NVD References: https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.htmlCVE-2025-24434 - Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are susceptible to an Improper Authorization flaw that may lead to Privilege escalation and unauthorized access without user interaction, allowing for session takeover and increasing confidentiality and integrity risks.Product: Adobe CommerceCVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24434NVD References: https://helpx.adobe.com/security/products/magento/apsb25-08.htmlCVE-2025-0444 - Skia in Google Chrome before version 133.0.6943.53 has a high severity vulnerability allowing remote attackers to exp…

Product: Wazuh

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24016

NVD References: https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh

Product: Quanxun School Affairs System

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1144

NVD References:

- https://www.twcert.org.tw/en/cp-139-8416-b6cba-2.html

- https://www.twcert.org.tw/tw/cp-132-8415-853e0-1.html

Product: Wattsense Bridge

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-26410

NVD References:

- https://r.sec-consult.com/wattsense

- https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notes

Product: PandasAI

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-12366

NVD References:

- https://docs.getpanda.ai/v3/privacy-security

- https://docs.pandas-ai.com/advanced-security-agent

- https://www.kb.cert.org/vuls/id/148244

Product: Ivanti Connect Secure and Ivanti Policy Secure

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-10644

NVD References: https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

Product: Ivanti CSA

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-47908

NVD References:

Product: Ivanti Connect Secure

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22467

NVD References: https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

Product: Misskey Concorde (formerly known as Nexkey)

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24973

NVD References:

- https://github.com/nexryai/concorde/commit/1f6ac9b289906083b132e4f9667a31a60ef83e4e

- https://github.com/nexryai/concorde/security/advisories/GHSA-2369-p2wh-7cc2

Product: Lexmark Print Management Client

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1126

NVD References: https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html

Product: Adobe Commerce

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24434

NVD References: https://helpx.adobe.com/security/products/magento/apsb25-08.html

Product: Google Chrome

CVSS Score: 6.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0444

ISC Diary: https://isc.sans.edu/diary/31674

NVD References:

- https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop.html

- https://issues.chromium.org/issues/390889644

Product: Google Chrome

CVSS Score: 5.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0445

ISC Diary: https://isc.sans.edu/diary/31674

NVD References:

- https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop.html

- https://issues.chromium.org/issues/392521083

Product: Google Chrome

CVSS Score: 6.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0451

ISC Diary: https://isc.sans.edu/diary/31674

NVD References:

- https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop.html

- https://issues.chromium.org/issues/40061026

Product: Microsoft Edge ChromiumCVSS Scores: 8.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21342NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21408ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21342- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21408CVE-2025-21181 - Microsoft Message Queuing (MSMQ) Denial of Service VulnerabilityProduct: Microsoft Message Queuing (MSMQ)CVSS Score: 7.5NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21181ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21181CVE-2025-21182 & CVE-2025-21183 - Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege VulnerabilitiesProduct: Microsoft Windows Resilient File System (ReFS)CVSS Scores: 7.4 NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21182NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21183ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21182- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21183CVE-2025-21184, CVE-2025-21358, CVE-2025-21414 - Windows Core Messaging Elevation of Privileges VulnerabilitiesProduct: Microsoft Windows Core MessagingCVSS Scores: 7.0 - 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21184NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21358NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21414ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21358- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21414- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21184CVE-2025-21194 - Microsoft Surface Security Feature Bypass VulnerabilityProduct: Microsoft SurfaceCVSS Score: 7.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21194ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21194CVE-2025-21206 - Visual Studio Installer Elevation of Privilege VulnerabilityProduct: Microsoft Visual Studio InstallerCVSS Score: 7.3NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21206ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21206CVE-2025-21208, CVE-2025-21410 - Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilitiesProduct: Microsoft Windows Routing and Remote Access Service (RRAS)CVSS Score: 8.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21208NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21410ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21208- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21410CVE-2025-21322 - Microsoft PC Manager Elevation of Privilege VulnerabilityProduct: Microsoft PC ManagerCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21322ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21322CVE-2025-21351 - Windows Active Directory Domain Services API Denial of Service VulnerabilityProduct: Microsoft Active Directory Domain ServicesCVSS Score: 7.5NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21351ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21351CVE-2025-21359 - Windows Kernel Security Feature Bypass VulnerabilityProduct: Microsoft Windows KernelCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21359ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21359CVE-2025-21367 - Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityProduct: Microsoft Windows Win32 Kernel SubsystemCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21367ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21367CVE-2025-21375 - Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityProduct: Microsoft Kernel Streaming WOW Thunk Service DriverCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21375ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21375CVE-2025-21368, CVE-2025-21369 - Microsoft Digest Authentication Remote Code Execution VulnerabilitiesProduct: Microsoft Digest AuthenticationCVSS Scores: 8.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21368 NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21369ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21368- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21369CVE-2025-21373 - Windows Installer Elevation of Pr…

Product: Microsoft Message Queuing (MSMQ)

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21181

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21181

CVE-2025-21182 & CVE-2025-21183 - Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege VulnerabilitiesProduct: Microsoft Windows Resilient File System (ReFS)CVSS Scores: 7.4 NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21182NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21183ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21182- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21183CVE-2025-21184, CVE-2025-21358, CVE-2025-21414 - Windows Core Messaging Elevation of Privileges VulnerabilitiesProduct: Microsoft Windows Core MessagingCVSS Scores: 7.0 - 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21184NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21358NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21414ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21358- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21414- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21184CVE-2025-21194 - Microsoft Surface Security Feature Bypass VulnerabilityProduct: Microsoft SurfaceCVSS Score: 7.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21194ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21194CVE-2025-21206 - Visual Studio Installer Elevation of Privilege VulnerabilityProduct: Microsoft Visual Studio InstallerCVSS Score: 7.3NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21206ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21206CVE-2025-21208, CVE-2025-21410 - Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilitiesProduct: Microsoft Windows Routing and Remote Access Service (RRAS)CVSS Score: 8.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21208NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21410ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21208- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21410CVE-2025-21322 - Microsoft PC Manager Elevation of Privilege VulnerabilityProduct: Microsoft PC ManagerCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21322ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21322CVE-2025-21351 - Windows Active Directory Domain Services API Denial of Service VulnerabilityProduct: Microsoft Active Directory Domain ServicesCVSS Score: 7.5NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21351ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21351CVE-2025-21359 - Windows Kernel Security Feature Bypass VulnerabilityProduct: Microsoft Windows KernelCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21359ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21359CVE-2025-21367 - Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityProduct: Microsoft Windows Win32 Kernel SubsystemCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21367ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21367CVE-2025-21375 - Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityProduct: Microsoft Kernel Streaming WOW Thunk Service DriverCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21375ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21375CVE-2025-21368, CVE-2025-21369 - Microsoft Digest Authentication Remote Code Execution VulnerabilitiesProduct: Microsoft Digest AuthenticationCVSS Scores: 8.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21368 NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21369ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21368- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21369CVE-2025-21373 - Windows Installer Elevation of Privilege VulnerabilityProduct: Microsoft Windows InstallerCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21373ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21373CVE-2025-21392, CVE-2025-21397 - Microsoft Office Remote Code Execution VulnerabilitiesProduct: Microsoft OfficeCVSS Scores: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21392NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21397ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21392- https://msrc.microsoft.com/update-guide/vulnerability…

Product: Microsoft Windows Core MessagingCVSS Scores: 7.0 - 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21184NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21358NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21414ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21358- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21414- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21184CVE-2025-21194 - Microsoft Surface Security Feature Bypass VulnerabilityProduct: Microsoft SurfaceCVSS Score: 7.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21194ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21194CVE-2025-21206 - Visual Studio Installer Elevation of Privilege VulnerabilityProduct: Microsoft Visual Studio InstallerCVSS Score: 7.3NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21206ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21206CVE-2025-21208, CVE-2025-21410 - Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilitiesProduct: Microsoft Windows Routing and Remote Access Service (RRAS)CVSS Score: 8.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21208NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21410ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21208- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21410CVE-2025-21322 - Microsoft PC Manager Elevation of Privilege VulnerabilityProduct: Microsoft PC ManagerCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21322ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21322CVE-2025-21351 - Windows Active Directory Domain Services API Denial of Service VulnerabilityProduct: Microsoft Active Directory Domain ServicesCVSS Score: 7.5NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21351ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21351CVE-2025-21359 - Windows Kernel Security Feature Bypass VulnerabilityProduct: Microsoft Windows KernelCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21359ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21359CVE-2025-21367 - Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityProduct: Microsoft Windows Win32 Kernel SubsystemCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21367ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21367CVE-2025-21375 - Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityProduct: Microsoft Kernel Streaming WOW Thunk Service DriverCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21375ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21375CVE-2025-21368, CVE-2025-21369 - Microsoft Digest Authentication Remote Code Execution VulnerabilitiesProduct: Microsoft Digest AuthenticationCVSS Scores: 8.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21368 NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21369ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21368- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21369CVE-2025-21373 - Windows Installer Elevation of Privilege VulnerabilityProduct: Microsoft Windows InstallerCVSS Score: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21373ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21373CVE-2025-21392, CVE-2025-21397 - Microsoft Office Remote Code Execution VulnerabilitiesProduct: Microsoft OfficeCVSS Scores: 7.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21392NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21397ISC Diary: https://isc.sans.edu/diary/31674NVD References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21392- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21397CVE-2025-21400 - Microsoft SharePoint Server Remote Code Execution VulnerabilityProduct: Microsoft SharePoint ServerCVSS Score: 8.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21400ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21400CVE-2025-21419 - Windows Setup Files Cleanup Elevation of Privilege VulnerabilityProduct: Microsoft Windows Setup Files CleanupCVSS Score: 7.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21419ISC Diary: https://isc.sans.edu/diary/31674NVD References: https://msrc.microsoft.com/update-guide…

Product: Microsoft Surface

CVSS Score: 7.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21194

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21194

Product: Microsoft Visual Studio Installer

CVSS Score: 7.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21206

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21206

Product: Microsoft Windows Routing and Remote Access Service (RRAS)

CVSS Score: 8.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21208

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21410

ISC Diary: https://isc.sans.edu/diary/31674

NVD References:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21208

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21410

CVE-2025-21322 - Microsoft PC Manager Elevation of Privilege Vulnerability

Product: Microsoft PC Manager

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21322

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21322

CVE-2025-21351 - Windows Active Directory Domain Services API Denial of Service Vulnerability

Product: Microsoft Active Directory Domain Services

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21351

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21351

CVE-2025-21359 - Windows Kernel Security Feature Bypass Vulnerability

Product: Microsoft Windows Kernel

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21359

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21359

CVE-2025-21367 - Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

Product: Microsoft Windows Win32 Kernel Subsystem

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21367

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21367

CVE-2025-21375 - Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

Product: Microsoft Kernel Streaming WOW Thunk Service Driver

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21375

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21375

CVE-2025-21368, CVE-2025-21369 - Microsoft Digest Authentication Remote Code Execution Vulnerabilities

Product: Microsoft Digest Authentication

CVSS Scores: 8.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21368

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21369

ISC Diary: https://isc.sans.edu/diary/31674

NVD References:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21368

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21369

CVE-2025-21373 - Windows Installer Elevation of Privilege Vulnerability

Product: Microsoft Windows Installer

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21373

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21373

CVE-2025-21392, CVE-2025-21397 - Microsoft Office Remote Code Execution Vulnerabilities

Product: Microsoft Office

CVSS Scores: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21392

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21397

ISC Diary: https://isc.sans.edu/diary/31674

NVD References:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21392

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21397

CVE-2025-21400 - Microsoft SharePoint Server Remote Code Execution Vulnerability

Product: Microsoft SharePoint Server

CVSS Score: 8.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21400

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21400

CVE-2025-21419 - Windows Setup Files Cleanup Elevation of Privilege Vulnerability

Product: Microsoft Windows Setup Files Cleanup

CVSS Score: 7.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21419

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21419

CVE-2025-21420 - Windows Disk Cleanup Tool Elevation of Privilege Vulnerability

Product: Microsoft Windows Disk Cleanup Tool

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21420

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21420

CVE-2025-24036 - Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability

Product: Microsoft AutoUpdate (MAU)

CVSS Score: 7.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24036

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24036

CVE-2025-24039 - Visual Studio Code Elevation of Privilege Vulnerability

Product: Microsoft Visual Studio Code

CVSS Score: 7.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24039

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24039

CVE-2025-24042 - Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability

Product: Visual Studio Code JS Debug Extension

CVSS Score: 7.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24042

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24042

CVE-2023-32002 - Node.js allows bypassing the policy mechanism by using `Module._load()`, allowing loading of modules not defined in policy.json, affecting all users of the experimental policy feature in versions 16.x, 18.x, and 20.x.

Product: Node.js

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-32002

ISC Diary: https://isc.sans.edu/diary/31674

CVE-2025-22699 - Traveler Code is vulnerable to SQL Injection from versions n/a through 3.1.0.

Product: Traveler Code

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22699

NVD References: https://patchstack.com/database/wordpress/plugin/traveler-code/vulnerability/wordpress-traveler-code-plugin-3-1-0-unauthenticated-arbitrary-sql-execution-vulnerability?_s_id=cve

CVE-2025-24677 - Post/Page Copying Tool: from n/a through 2.0.3 is vulnerable to Remote Code Inclusion due to improper control of code generation, allowing for Code Injection.

Product: WPSpins Post/Page Copying Tool

Active Installations: 200+

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24677

NVD References: https://patchstack.com/database/wordpress/plugin/postpage-import-export-with-custom-fields-taxonomies/vulnerability/wordpress-post-page-copying-tool-to-export-and-import-post-page-for-cross-site-migration-plugin-2-0-3-remote-code-execution-rce-vulnerability?_s_id=cve

CVE-2025-1061 - The Nextend Social Login Pro plugin for WordPress up to version 3.1.16 allows unauthenticated attackers to bypass authentication and login as any existing user, including administrators, by exploiting a flaw in Apple OAuth authentication.

Product: Nextend Social Login Pro plugin

Active Installations: 300,000+

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1061

NVD References:

- https://nextendweb.com/nextend-social-login-docs/pro-addon-changelog/

- https://nextendweb.com/nextend-social-login-docs/provider-apple/

- https://www.wordfence.com/threat-intel/vulnerabilities/id/6494e54c-db04-41f9-8b91-6ad12528cf01?source=cve

CVE-2025-0316 - The WP Directorybox Manager plugin is vulnerable to authentication bypass in versions up to 2.5, allowing unauthenticated attackers to log in as any existing user.

Product: WordPress WP Directorybox Manager plugin

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0316

NVD References:

- https://themeforest.net/item/directory-multipurpose-wordpress-theme/10480929

- https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee1f412-7555-4dec-ba59-49412471a42f?source=cve

CVE-2024-13011 - The WP Foodbakery plugin <= 4.7 for WordPress is vulnerable to arbitrary file uploads, allowing unauthenticated attackers to potentially execute remote code on affected sites.

Product: WP Foodbakery WordPress <= 4.7

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-13011

NVD References:

- https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331

- https://www.wordfence.com/threat-intel/vulnerabilities/id/850fc4db-6e02-44c7-836a-02c433a0bae7?source=cve

CVE-2025-0180 - The WP Foodbakery plugin <= 4.7 for WordPress allows unauthenticated attackers to register as an administrator due to privilege escalation vulnerability.

Product: WP Foodbakery WordPress <= 4.7

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0180

NVD References:

- https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331

- https://www.wordfence.com/threat-intel/vulnerabilities/id/d7140a6e-a528-428e-850e-5e4a481c5d7d?source=cve

CVE-2025-0181 - The WP Foodbakery plugin <= 4.7 for WordPress allows unauthenticated attackers to gain administrator access by not properly validating a user's identity.

Product: WP Foodbakery WordPress <= 4.7

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0181

NVD References:

- https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331

- https://www.wordfence.com/threat-intel/vulnerabilities/id/d722ec8d-bfca-4da1-8eb0-8d33735c5e44?source=cve

CVE-2024-13421 - The Real Estate 7 WordPress theme for WordPress allows unauthenticated attackers to register new administrative user accounts due to privilege escalation vulnerability.

Product: Real Estate 7 WordPress

Active Installations: unknown. Update to version 3.5.2, or a newer patched version

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-13421

NVD References:

- https://contempothemes.com/changelog/

- https://themeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778

- https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b3304-d55b-487a-8137-d5083c704cf4?source=cve

Product: Microsoft PC Manager

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21322

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21322

Product: Microsoft Active Directory Domain Services

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21351

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21351

Product: Microsoft Windows Kernel

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21359

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21359

Product: Microsoft Windows Win32 Kernel Subsystem

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21367

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21367

Product: Microsoft Kernel Streaming WOW Thunk Service Driver

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21375

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21375

Product: Microsoft Digest Authentication

CVSS Scores: 8.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21368

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21369

ISC Diary: https://isc.sans.edu/diary/31674

NVD References:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21368

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21369

CVE-2025-21373 - Windows Installer Elevation of Privilege Vulnerability

Product: Microsoft Windows Installer

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21373

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21373

CVE-2025-21392, CVE-2025-21397 - Microsoft Office Remote Code Execution Vulnerabilities

Product: Microsoft Office

CVSS Scores: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21392

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21397

ISC Diary: https://isc.sans.edu/diary/31674

NVD References:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21392

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21397

CVE-2025-21400 - Microsoft SharePoint Server Remote Code Execution Vulnerability

Product: Microsoft SharePoint Server

CVSS Score: 8.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21400

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21400

CVE-2025-21419 - Windows Setup Files Cleanup Elevation of Privilege Vulnerability

Product: Microsoft Windows Setup Files Cleanup

CVSS Score: 7.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21419

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21419

CVE-2025-21420 - Windows Disk Cleanup Tool Elevation of Privilege Vulnerability

Product: Microsoft Windows Disk Cleanup Tool

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21420

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21420

CVE-2025-24036 - Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability

Product: Microsoft AutoUpdate (MAU)

CVSS Score: 7.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24036

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24036

CVE-2025-24039 - Visual Studio Code Elevation of Privilege Vulnerability

Product: Microsoft Visual Studio Code

CVSS Score: 7.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24039

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24039

CVE-2025-24042 - Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability

Product: Visual Studio Code JS Debug Extension

CVSS Score: 7.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24042

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24042

CVE-2023-32002 - Node.js allows bypassing the policy mechanism by using `Module._load()`, allowing loading of modules not defined in policy.json, affecting all users of the experimental policy feature in versions 16.x, 18.x, and 20.x.

Product: Node.js

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-32002

ISC Diary: https://isc.sans.edu/diary/31674

CVE-2025-22699 - Traveler Code is vulnerable to SQL Injection from versions n/a through 3.1.0.

Product: Traveler Code

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22699

NVD References: https://patchstack.com/database/wordpress/plugin/traveler-code/vulnerability/wordpress-traveler-code-plugin-3-1-0-unauthenticated-arbitrary-sql-execution-vulnerability?_s_id=cve

CVE-2025-24677 - Post/Page Copying Tool: from n/a through 2.0.3 is vulnerable to Remote Code Inclusion due to improper control of code generation, allowing for Code Injection.

Product: WPSpins Post/Page Copying Tool

Active Installations: 200+

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24677

NVD References: https://patchstack.com/database/wordpress/plugin/postpage-import-export-with-custom-fields-taxonomies/vulnerability/wordpress-post-page-copying-tool-to-export-and-import-post-page-for-cross-site-migration-plugin-2-0-3-remote-code-execution-rce-vulnerability?_s_id=cve

CVE-2025-1061 - The Nextend Social Login Pro plugin for WordPress up to version 3.1.16 allows unauthenticated attackers to bypass authentication and login as any existing user, including administrators, by exploiting a flaw in Apple OAuth authentication.

Product: Nextend Social Login Pro plugin

Active Installations: 300,000+

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1061

NVD References:

- https://nextendweb.com/nextend-social-login-docs/pro-addon-changelog/

- https://nextendweb.com/nextend-social-login-docs/provider-apple/

- https://www.wordfence.com/threat-intel/vulnerabilities/id/6494e54c-db04-41f9-8b91-6ad12528cf01?source=cve

CVE-2025-0316 - The WP Directorybox Manager plugin is vulnerable to authentication bypass in versions up to 2.5, allowing unauthenticated attackers to log in as any existing user.

Product: WordPress WP Directorybox Manager plugin

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0316

NVD References:

- https://themeforest.net/item/directory-multipurpose-wordpress-theme/10480929

- https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee1f412-7555-4dec-ba59-49412471a42f?source=cve

CVE-2024-13011 - The WP Foodbakery plugin <= 4.7 for WordPress is vulnerable to arbitrary file uploads, allowing unauthenticated attackers to potentially execute remote code on affected sites.

Product: WP Foodbakery WordPress <= 4.7

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-13011

NVD References:

- https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331

- https://www.wordfence.com/threat-intel/vulnerabilities/id/850fc4db-6e02-44c7-836a-02c433a0bae7?source=cve

CVE-2025-0180 - The WP Foodbakery plugin <= 4.7 for WordPress allows unauthenticated attackers to register as an administrator due to privilege escalation vulnerability.

Product: WP Foodbakery WordPress <= 4.7

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0180

NVD References:

- https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331

- https://www.wordfence.com/threat-intel/vulnerabilities/id/d7140a6e-a528-428e-850e-5e4a481c5d7d?source=cve

CVE-2025-0181 - The WP Foodbakery plugin <= 4.7 for WordPress allows unauthenticated attackers to gain administrator access by not properly validating a user's identity.

Product: WP Foodbakery WordPress <= 4.7

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0181

NVD References:

- https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331

- https://www.wordfence.com/threat-intel/vulnerabilities/id/d722ec8d-bfca-4da1-8eb0-8d33735c5e44?source=cve

CVE-2024-13421 - The Real Estate 7 WordPress theme for WordPress allows unauthenticated attackers to register new administrative user accounts due to privilege escalation vulnerability.

Product: Real Estate 7 WordPress

Active Installations: unknown. Update to version 3.5.2, or a newer patched version

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-13421

NVD References:

- https://contempothemes.com/changelog/

- https://themeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778

- https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b3304-d55b-487a-8137-d5083c704cf4?source=cve

Product: Microsoft Windows Installer

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21373

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21373

Product: Microsoft Office

CVSS Scores: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21392

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21397

ISC Diary: https://isc.sans.edu/diary/31674

NVD References:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21392

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21397

CVE-2025-21400 - Microsoft SharePoint Server Remote Code Execution Vulnerability

Product: Microsoft SharePoint Server

CVSS Score: 8.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21400

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21400

CVE-2025-21419 - Windows Setup Files Cleanup Elevation of Privilege Vulnerability

Product: Microsoft Windows Setup Files Cleanup

CVSS Score: 7.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21419

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21419

CVE-2025-21420 - Windows Disk Cleanup Tool Elevation of Privilege Vulnerability

Product: Microsoft Windows Disk Cleanup Tool

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21420

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21420

CVE-2025-24036 - Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability

Product: Microsoft AutoUpdate (MAU)

CVSS Score: 7.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24036

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24036

CVE-2025-24039 - Visual Studio Code Elevation of Privilege Vulnerability

Product: Microsoft Visual Studio Code

CVSS Score: 7.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24039

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24039

CVE-2025-24042 - Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability

Product: Visual Studio Code JS Debug Extension

CVSS Score: 7.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24042

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24042

CVE-2023-32002 - Node.js allows bypassing the policy mechanism by using `Module._load()`, allowing loading of modules not defined in policy.json, affecting all users of the experimental policy feature in versions 16.x, 18.x, and 20.x.

Product: Node.js

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-32002

ISC Diary: https://isc.sans.edu/diary/31674

CVE-2025-22699 - Traveler Code is vulnerable to SQL Injection from versions n/a through 3.1.0.

Product: Traveler Code

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22699

NVD References: https://patchstack.com/database/wordpress/plugin/traveler-code/vulnerability/wordpress-traveler-code-plugin-3-1-0-unauthenticated-arbitrary-sql-execution-vulnerability?_s_id=cve

CVE-2025-24677 - Post/Page Copying Tool: from n/a through 2.0.3 is vulnerable to Remote Code Inclusion due to improper control of code generation, allowing for Code Injection.

Product: WPSpins Post/Page Copying Tool

Active Installations: 200+

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24677

NVD References: https://patchstack.com/database/wordpress/plugin/postpage-import-export-with-custom-fields-taxonomies/vulnerability/wordpress-post-page-copying-tool-to-export-and-import-post-page-for-cross-site-migration-plugin-2-0-3-remote-code-execution-rce-vulnerability?_s_id=cve

CVE-2025-1061 - The Nextend Social Login Pro plugin for WordPress up to version 3.1.16 allows unauthenticated attackers to bypass authentication and login as any existing user, including administrators, by exploiting a flaw in Apple OAuth authentication.

Product: Nextend Social Login Pro plugin

Active Installations: 300,000+

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1061

NVD References:

- https://nextendweb.com/nextend-social-login-docs/pro-addon-changelog/

- https://nextendweb.com/nextend-social-login-docs/provider-apple/

- https://www.wordfence.com/threat-intel/vulnerabilities/id/6494e54c-db04-41f9-8b91-6ad12528cf01?source=cve

CVE-2025-0316 - The WP Directorybox Manager plugin is vulnerable to authentication bypass in versions up to 2.5, allowing unauthenticated attackers to log in as any existing user.

Product: WordPress WP Directorybox Manager plugin

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0316

NVD References:

- https://themeforest.net/item/directory-multipurpose-wordpress-theme/10480929

- https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee1f412-7555-4dec-ba59-49412471a42f?source=cve

CVE-2024-13011 - The WP Foodbakery plugin <= 4.7 for WordPress is vulnerable to arbitrary file uploads, allowing unauthenticated attackers to potentially execute remote code on affected sites.

Product: WP Foodbakery WordPress <= 4.7

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-13011

NVD References:

- https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331

- https://www.wordfence.com/threat-intel/vulnerabilities/id/850fc4db-6e02-44c7-836a-02c433a0bae7?source=cve

CVE-2025-0180 - The WP Foodbakery plugin <= 4.7 for WordPress allows unauthenticated attackers to register as an administrator due to privilege escalation vulnerability.

Product: WP Foodbakery WordPress <= 4.7

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0180

NVD References:

- https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331

- https://www.wordfence.com/threat-intel/vulnerabilities/id/d7140a6e-a528-428e-850e-5e4a481c5d7d?source=cve

CVE-2025-0181 - The WP Foodbakery plugin <= 4.7 for WordPress allows unauthenticated attackers to gain administrator access by not properly validating a user's identity.

Product: WP Foodbakery WordPress <= 4.7

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0181

NVD References:

- https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331

- https://www.wordfence.com/threat-intel/vulnerabilities/id/d722ec8d-bfca-4da1-8eb0-8d33735c5e44?source=cve

CVE-2024-13421 - The Real Estate 7 WordPress theme for WordPress allows unauthenticated attackers to register new administrative user accounts due to privilege escalation vulnerability.

Product: Real Estate 7 WordPress

Active Installations: unknown. Update to version 3.5.2, or a newer patched version

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-13421

NVD References:

- https://contempothemes.com/changelog/

- https://themeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778

- https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b3304-d55b-487a-8137-d5083c704cf4?source=cve

Product: Microsoft SharePoint Server

CVSS Score: 8.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21400

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21400

Product: Microsoft Windows Setup Files Cleanup

CVSS Score: 7.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21419

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21419

Product: Microsoft Windows Disk Cleanup Tool

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21420

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21420

Product: Microsoft AutoUpdate (MAU)

CVSS Score: 7.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24036

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24036

Product: Microsoft Visual Studio Code

CVSS Score: 7.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24039

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24039

Product: Visual Studio Code JS Debug Extension

CVSS Score: 7.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24042

ISC Diary: https://isc.sans.edu/diary/31674

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24042

Product: Node.js

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-32002

ISC Diary: https://isc.sans.edu/diary/31674

Product: Traveler Code

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22699

NVD References: https://patchstack.com/database/wordpress/plugin/traveler-code/vulnerability/wordpress-traveler-code-plugin-3-1-0-unauthenticated-arbitrary-sql-execution-vulnerability?_s_id=cve

Product: WPSpins Post/Page Copying Tool

Active Installations: 200+

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24677

NVD References: https://patchstack.com/database/wordpress/plugin/postpage-import-export-with-custom-fields-taxonomies/vulnerability/wordpress-post-page-copying-tool-to-export-and-import-post-page-for-cross-site-migration-plugin-2-0-3-remote-code-execution-rce-vulnerability?_s_id=cve

Product: Nextend Social Login Pro plugin

Active Installations: 300,000+

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-1061

NVD References:

- https://nextendweb.com/nextend-social-login-docs/pro-addon-changelog/

- https://nextendweb.com/nextend-social-login-docs/provider-apple/

- https://www.wordfence.com/threat-intel/vulnerabilities/id/6494e54c-db04-41f9-8b91-6ad12528cf01?source=cve

Product: WordPress WP Directorybox Manager plugin

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0316

NVD References:

- https://themeforest.net/item/directory-multipurpose-wordpress-theme/10480929

- https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee1f412-7555-4dec-ba59-49412471a42f?source=cve

Product: WP Foodbakery WordPress <= 4.7

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-13011

NVD References:

- https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331

- https://www.wordfence.com/threat-intel/vulnerabilities/id/850fc4db-6e02-44c7-836a-02c433a0bae7?source=cve

Product: WP Foodbakery WordPress <= 4.7

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0180

NVD References:

- https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331

- https://www.wordfence.com/threat-intel/vulnerabilities/id/d7140a6e-a528-428e-850e-5e4a481c5d7d?source=cve

Product: WP Foodbakery WordPress <= 4.7

Active Installations: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0181

NVD References:

- https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331

- https://www.wordfence.com/threat-intel/vulnerabilities/id/d722ec8d-bfca-4da1-8eb0-8d33735c5e44?source=cve

Product: Real Estate 7 WordPress

Active Installations: unknown. Update to version 3.5.2, or a newer patched version

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-13421

NVD References:

- https://contempothemes.com/changelog/

- https://themeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778

- https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b3304-d55b-487a-8137-d5083c704cf4?source=cve