Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2023-53873 2025-12-15 N/A 0.0 SyncBreeze 15.2.24 contains a denial of service vulnerability in the login authentication mechanism that allows attackers to crash the service. Attackers can send an oversized password parameter with…
CVE-2023-53872 2025-12-15 N/A 0.0 Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the…
CVE-2023-53871 2025-12-15 N/A 0.0 Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file…
CVE-2023-53870 2025-12-15 N/A 0.0 Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can craft XSS payloads in the language parameter…
CVE-2023-53869 2025-12-15 N/A 0.0 WEBIGniter 28.7.23 contains a file upload vulnerability that allows authenticated attackers to upload and execute dangerous PHP files through the media function. Attackers can leverage any created account…
CVE-2023-53868 2025-12-15 N/A 0.0 Coppermine Gallery 1.6.25 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the plugin manager. Attackers can upload a zipped PHP…
CVE-2023-38913 2025-12-15 MEDIUM 5.3 SQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute arbitrary code via a crafted script.
CVE-2023-36338 2025-12-15 MEDIUM 5.3 Inventory Management System 1 was discovered to contain a SQL injection vulnerability.
CVE-2025-67809 2025-12-15 MEDIUM 4.7 An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by…
CVE-2025-55703 2025-12-15 LOW 2.5 An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint that applied arrays without proper input…
CVE-2025-36360 2025-12-15 MEDIUM 5.0 IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.10, and 8.1…
CVE-2025-14503 2025-12-15 HIGH 7.2 An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow authenticated users to escalate privileges via role assumption. The sample code for the EKS environment…
CVE-2025-11393 2025-12-15 HIGH 8.7 A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command…
CVE-2025-65742 2025-12-15 HIGH 8.2 An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive information and execute a full account takeover via a crafted API…
CVE-2025-66388 2025-12-15 MEDIUM 6.5 A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without…
CVE-2025-13888 2025-12-15 CRITICAL 9.1 A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including…
CVE-2025-55893 2025-12-15 MEDIUM 6.5 TOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to command Injection in setOpModeCfg via hostName.
CVE-2025-34181 2025-12-15 N/A 0.0 NetSupport Manager < 14.12.0001 contains an arbitrary file write vulnerability in its Connectivity Server/Gateway PUTFILE request handler. An attacker with a valid Gateway Key can supply a crafted filename…
CVE-2025-34180 2025-12-15 N/A 0.0 NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. The key is stored using a reversible encoding scheme. An…
CVE-2025-34179 2025-12-15 N/A 0.0 NetSupport Manager
CVE-2025-14023 2025-12-15 LOW 3.1 LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could create confusion about…
CVE-2025-66436 2025-12-15 N/A 0.0 An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (terms) using frappe.render_template() with a user-supplied…
CVE-2025-14038 2025-12-15 HIGH 7.0 EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or…
CVE-2025-66435 2025-12-15 N/A 0.0 An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (contract_terms) using frappe.render_template() with a user-supplied…
CVE-2025-66434 2025-12-15 N/A 0.0 An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (body_text) using frappe.render_template() with a user-supplied…
CVE-2025-55901 2025-12-15 MEDIUM 6.5 TOTOLINK A3300R V17.0.0cu.596_B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the host_time parameter.
CVE-2025-66963 2025-12-15 N/A 0.0 An issue in Hitron HI3120 v.7.2.4.5.2b1 allows a local attacker to obtain sensitive information via the Logout option in the index.html
CVE-2025-66844 2025-12-15 N/A 0.0 In grav
CVE-2025-66843 2025-12-15 N/A 0.0 grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious…
CVE-2025-60786 2025-12-15 HIGH 8.8 A Zip Slip vulnerability in the import a Project component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via uploading a crafted Zip file.
CVE-2025-14387 2025-12-15 MEDIUM 6.4 The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insufficient input sanitization…
CVE-2025-13824 2025-12-15 N/A 0.0 A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive.…
CVE-2025-13823 2025-12-15 N/A 0.0 A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packets during fuzzing. The controllers will go…
CVE-2024-44599 2025-12-15 HIGH 8.3 FNT Command 13.4.0 is vulnerable to Directory Traversal.
CVE-2024-44598 2025-12-15 HIGH 8.8 FNT Command 13.4.0 is vulnerable to Code Execution via the C Base Module.
CVE-2025-34412 2025-12-15 N/A 0.0 The Convercent Whistleblowing Platform operated by EQS Group contains a protection mechanism failure in its browser and session handling. By default, affected deployments omit HTTP security headers such…
CVE-2025-34411 2025-12-15 N/A 0.0 The Convercent Whistleblowing Platform operated by EQS Group exposes an unauthenticated API endpoint at /GetLegalEntity that returns internal customer legal-entity names based on a supplied searchText fragment. A…
CVE-2025-14383 2025-12-15 HIGH 7.5 The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' parameter in all versions up to, and including, 10.14.8 due to insufficient…
CVE-2025-14156 2025-12-15 CRITICAL 9.8 The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the…
CVE-2025-14003 2025-12-15 MEDIUM 4.3 The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `add_images_to_gallery_callback()`…
CVE-2025-13950 2025-12-15 MEDIUM 5.3 The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings handling functionality in…
CVE-2025-13728 2025-12-15 MEDIUM 6.4 The FluentAuth – The Ultimate Authorization & Security Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions…
CVE-2025-13610 2025-12-15 MEDIUM 6.4 The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RM_Forms' shortcode in all…
CVE-2025-13608 2025-12-15 MEDIUM 6.4 The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'child_pages' shortcode in all versions up to, and including, 2.0.0. This is due…
CVE-2025-13367 2025-12-15 MEDIUM 6.4 The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting…
CVE-2025-12900 2025-12-15 MEDIUM 4.3 The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the…
CVE-2025-65782 2025-12-15 N/A 0.0 An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members…
CVE-2025-65781 2025-12-15 N/A 0.0 An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as…
CVE-2025-65780 2025-12-15 N/A 0.0 An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond…
CVE-2025-65779 2025-12-15 N/A 0.0 An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value (Boards.allow…
« Anterior Página 210 de 3934 Siguiente »