Latest Critical CVEs

• CVE-2025-8898 - WordPress E-cab Plugin Privilege Escalation Vulnerability

  CVE ID :CVE-2025-8898
  Published : Aug. 16, 2025, 7:15 a.m. | 2 hours, 20 minutes ago
  Description :The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.0. This is due to the plugin not properly validating a user's capabilities prior to updating a plugin setting or their identity prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
  Severity: 9.8 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-7441 - StoryChief WordPress Arbitrary File Upload Vulnerability

  CVE ID :CVE-2025-7441
  Published : Aug. 16, 2025, 4:16 a.m. | 5 hours, 19 minutes ago
  Description :The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
  Severity: 9.8 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-6080 - "Wordpress Gym Management System Unauthenticated Admin Account Creation Vulnerability"

  CVE ID :CVE-2025-6080
  Published : Aug. 16, 2025, 4:15 a.m. | 5 hours, 19 minutes ago
  Description :The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to, and including, 67.7.0. This is due to the plugin not properly validating a user's capabilities prior to adding users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new users, including admins.
  Severity: 8.8 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-6079 - "WordPress School Management System File Upload Vulnerability"

  CVE ID :CVE-2025-6079
  Published : Aug. 16, 2025, 4:15 a.m. | 5 hours, 19 minutes ago
  Description :The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the homework.php file in all versions up to, and including, 93.2.0. This makes it possible for authenticated attackers, with Student-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
  Severity: 8.8 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-3671 - "Wordpress Gym Management System - Local File Inclusion Vulnerability"

  CVE ID :CVE-2025-3671
  Published : Aug. 16, 2025, 4:15 a.m. | 5 hours, 19 minutes ago
  Description :The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67.7.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The Local File Inclusion exploit can be chained to include various dashboard view files in the plugin. One in particular reported by the researcher can be leveraged to update the password of Super Administrator accounts in Multisite environments making privilege escalation possible.
  Severity: 8.8 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-49895 - PluginBuddy.Com ServerBuddy CSRF Object Injection Vulnerability

  CVE ID :CVE-2025-49895
  Published : Aug. 16, 2025, 3:15 a.m. | 6 hours, 20 minutes ago
  Description :Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy.Com: from n/a through 1.0.5.
  Severity: 8.8 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-9060 - MSoft MFlash Remote Code Execution Vulnerability

  CVE ID :CVE-2025-9060
  Published : Aug. 15, 2025, 5:15 p.m. | 16 hours, 20 minutes ago
  Description :A vulnerability has been found in the  MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration configuration functionality that is only available to MFlash administrators. The vulnerability is related to insufficient validation of parameters when setting up security components. This issue affects MFlash v. 8.0 and possibly others. To mitigate apply 8.2-653 hotfix 11.06.2025 and above.
  Severity: 9.1 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-8995 - Drupal Authenticator Login Authentication Bypass

  CVE ID :CVE-2025-8995
  Published : Aug. 15, 2025, 5:15 p.m. | 16 hours, 20 minutes ago
  Description :Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.4.
  Severity: 9.8 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-49897 - Gopiplus Vertical Scroll Slideshow Gallery SQL Injection

  CVE ID :CVE-2025-49897
  Published : Aug. 15, 2025, 4:15 p.m. | 17 hours, 20 minutes ago
  Description :Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1.
  Severity: 8.5 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-54475 - "Joomla JS Jobs Plugin SQL Injection Vulnerability"

  CVE ID :CVE-2025-54475
  Published : Aug. 15, 2025, 12:15 p.m. | 21 hours, 20 minutes ago
  Description :A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands.
  Severity: 8.7 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-54474 - "DJ-Classifieds SQL Injection Vulnerability"

  CVE ID :CVE-2025-54474
  Published : Aug. 15, 2025, 12:15 p.m. | 21 hours, 20 minutes ago
  Description :A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands.
  Severity: 8.5 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-54473 - Joomla Phoca Commander Authenticated Remote Code Execution

  CVE ID :CVE-2025-54473
  Published : Aug. 15, 2025, 12:15 p.m. | 21 hours, 20 minutes ago
  Description :An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature.
  Severity: 9.2 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-9046 - Tenda AC20 Stack-Based Buffer Overflow Vulnerability

  CVE ID :CVE-2025-9046
  Published : Aug. 15, 2025, 11:15 a.m. | 22 hours, 20 minutes ago
  Description :A vulnerability was identified in Tenda AC20 16.03.08.12. This issue affects the function sub_46A2AC of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
  Severity: 9.0 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-9023 - Tenda AC7/AC18 Buffer Overflow in formSetSchedLed

  CVE ID :CVE-2025-9023
  Published : Aug. 15, 2025, 9:15 a.m. | 1 day ago
  Description :A vulnerability has been found in Tenda AC7 and AC18 15.03.05.19/15.03.06.44. Affected is the function formSetSchedLed of the file /goform/SetLEDCfg. The manipulation of the argument Time leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
  Severity: 9.0 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-7778 - WordPress Icons Factory Plugin Arbitrary File Deletion Vulnerability

  CVE ID :CVE-2025-7778
  Published : Aug. 15, 2025, 9:15 a.m. | 1 day ago
  Description :The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delete_files() function in all versions up to, and including, 1.6.12. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
  Severity: 9.8 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-6679 - Bit Form for WordPress Remote File Upload Vulnerability

  CVE ID :CVE-2025-6679
  Published : Aug. 15, 2025, 7:15 a.m. | 1 day, 2 hours ago
  Description :The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. For this to be exploitable, the PRO version needs to be installed and activated as well. Additionally a form with an advanced file upload element needs to be published.
  Severity: 9.8 | CRITICAL
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-9007 - Tenda CH22 Buffer Overflow Vulnerability

  CVE ID :CVE-2025-9007
  Published : Aug. 15, 2025, 4:15 a.m. | 1 day, 5 hours ago
  Description :A vulnerability has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formeditFileName of the file /goform/editFileName. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
  Severity: 9.0 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-9006 - Tenda CH22 Buffer Overflow Vulnerability

  CVE ID :CVE-2025-9006
  Published : Aug. 15, 2025, 3:15 a.m. | 1 day, 6 hours ago
  Description :A vulnerability was identified in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function formdelFileName of the file /goform/delFileName. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
  Severity: 9.0 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-8342 - WooCommerce OTP Login With Phone Number Authentication Bypass Vulnerability

  CVE ID :CVE-2025-8342
  Published : Aug. 15, 2025, 3:15 a.m. | 1 day, 6 hours ago
  Description :The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.
  Severity: 8.1 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...

• CVE-2025-55708 - ExpressTech Systems Quiz And Survey Master SQL Injection

  CVE ID :CVE-2025-55708
  Published : Aug. 14, 2025, 7:15 p.m. | 1 day, 14 hours ago
  Description :Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master allows SQL Injection. This issue affects Quiz And Survey Master: from n/a through 10.2.4.
  Severity: 8.5 | HIGH
  Visit the link for more details, such as CVSS details, affected products, timeline, and more...