Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2024-52890 2025-08-05 MEDIUM 6.1 IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.03 could be susceptible to cross-site scripting due to no validation of URIs.
CVE-2025-54987 2025-08-05 CRITICAL 9.4 A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability…
CVE-2025-54948 2025-08-05 CRITICAL 9.4 A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
CVE-2025-8555 2025-08-05 LOW 3.5 A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. Affected is an unknown function of the file /search. The manipulation of the…
CVE-2025-8554 2025-08-05 LOW 2.4 A vulnerability, which was classified as problematic, has been found in atjiu pybbs up to 6.0.0. This issue affects some unknown processing of the file /admin/user/list. The manipulation…
CVE-2025-8553 2025-08-05 LOW 2.4 A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0. This vulnerability affects unknown code of the file /admin/sensitive_word/list. The manipulation of the argument word…
CVE-2025-8552 2025-08-05 LOW 2.4 A vulnerability classified as problematic has been found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /admin/tag/list. The manipulation of the argument…
CVE-2025-8551 2025-08-05 LOW 3.5 A vulnerability was found in atjiu pybbs up to 6.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/comment/list.…
CVE-2025-8295 2025-08-05 MEDIUM 6.4 The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input…
CVE-2025-8294 2025-08-05 MEDIUM 6.4 The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due to insufficient input…
CVE-2025-6207 2025-08-05 HIGH 7.5 The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' function in all versions up…
CVE-2025-5061 2025-08-05 HIGH 7.5 The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up…
CVE-2025-41698 2025-08-05 HIGH 7.8 A low privileged local attacker can interact with the affected service although user-interaction should not be allowed.
CVE-2025-2810 2025-08-05 MEDIUM 5.5 A low privileged local attacker can abuse the affected service by using a hardcoded cryptographic key.
CVE-2025-8550 2025-08-05 LOW 2.4 A vulnerability was found in atjiu pybbs up to 6.0.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/topic/list.…
CVE-2025-8549 2025-08-05 LOW 3.7 A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java. The manipulation leads…
CVE-2025-8548 2025-08-05 LOW 3.7 A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java of the component Registered…
CVE-2025-8315 2025-08-05 MEDIUM 6.4 The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.0.1 due to insufficient…
CVE-2025-8313 2025-08-05 MEDIUM 6.4 The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1.9.1 due to insufficient input…
CVE-2025-7050 2025-08-05 HIGH 7.2 The Use-your-Drive | Google Drive plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in file metadata in all versions up…
CVE-2025-8547 2025-08-05 MEDIUM 5.3 A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical. This vulnerability affects unknown code of the component Email Verification Handler. The manipulation…
CVE-2025-54982 2025-08-05 CRITICAL 9.6 An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse.
CVE-2025-8546 2025-08-05 MEDIUM 5.3 A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verification Code Handler. The manipulation…
CVE-2025-8545 2025-08-05 LOW 2.4 A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the file /intranet/educar_motivo_afastamento_cad.php. The manipulation…
CVE-2025-8544 2025-08-05 LOW 2.4 A vulnerability classified as problematic was found in Portabilis i-Educar 2.10. Affected by this vulnerability is an unknown functionality of the file /module/RegraAvaliacao/edit. The manipulation of the argument…
CVE-2025-54868 2025-08-05 HIGH 7.5 LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint…
CVE-2025-8543 2025-08-05 LOW 2.4 A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educar_raca_cad.php. The manipulation of the argument nm_raca leads…
CVE-2025-8542 2025-08-05 LOW 2.4 A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empresas_cad.php. The manipulation of the…
CVE-2025-8541 2025-08-05 LOW 2.4 A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /intranet/public_uf_cad.php. The manipulation of the argument…
CVE-2025-8540 2025-08-05 LOW 2.4 A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municipio_cad.php. The manipulation of the argument…
CVE-2025-53417 2025-08-05 N/A 0.0 DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability
CVE-2025-8539 2025-08-05 LOW 2.4 A vulnerability was found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this issue is some unknown functionality of the file /intranet/public_distrito_cad.php. The manipulation of the…
CVE-2025-8538 2025-08-05 LOW 2.4 A vulnerability has been found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /usuarios/tipos/novo. The manipulation of…
CVE-2025-8537 2025-08-05 LOW 3.7 A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of the file Mp4Decrypt.cpp of the component mp4decrypt.…
CVE-2025-54870 2025-08-05 N/A 0.0 VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules might cause reversion to plaintext due to insufficient error handling.…
CVE-2025-54865 2025-08-05 HIGH 7.3 Tilesheets MediaWiki Extension adds a table lookup parser function for an item and returns the requested image. A missing backtick in a query executed by the Tilesheets extension…
CVE-2025-54795 2025-08-05 N/A 0.0 Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to trigger…
CVE-2025-54794 2025-08-05 N/A 0.0 Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass…
CVE-2025-54780 2025-08-05 HIGH 7.7 The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /ajax/screenshot.php endpoint to leak files from…
CVE-2025-54387 2025-08-05 N/A 0.0 IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether…
CVE-2025-54135 2025-08-05 HIGH 8.5 Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a…
CVE-2025-54130 2025-08-05 HIGH 7.5 Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file is…
CVE-2025-54119 2025-08-05 CRITICAL 10.0 ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. In versions 5.22.9 and below, improper escaping of a query parameter may…
CVE-2025-53544 2025-08-05 HIGH 7.5 Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0.97.0, a brute-force protection bypass in the…
CVE-2025-52892 2025-08-05 MEDIUM 4.5 EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a…
CVE-2025-8529 2025-08-04 MEDIUM 6.3 A vulnerability classified as critical was found in cloudfavorites favorites-web up to 1.3.0. Affected by this vulnerability is the function getCollectLogoUrl of the file app/src/main/java/com/favorites/web/CollectController.java. The manipulation of…
CVE-2025-27212 2025-08-04 CRITICAL 9.8 An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi…
CVE-2025-27211 2025-08-04 HIGH 7.5 An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network.
CVE-2025-8528 2025-08-04 LOW 3.7 A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList. The manipulation leads to cleartext…
CVE-2025-8527 2025-08-04 MEDIUM 6.3 A vulnerability was found in Exrick xboot up to 3.3.4. It has been rated as critical. This issue affects some unknown processing of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/SecurityController.java of the…
« Anterior Página 943 de 4305 Siguiente »