CVE-2025-64446
Fortinet FortiWeb Path Traversal Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Friday's vulnerability landscape demonstrates significant escalation with 12 critical vulnerabilities (100% increase from yesterday's 6), including two maximum severity CVSS 10.0 issues affecting Azure Bastion and The Itel DAB Encoder. High-priority CVEs decreased 20% from 71 to 57, while nine actively exploited CISA KEV vulnerabilities (13% increase from 8) require priority weekend remediation. The disclosure environment includes eight CVSS 9.8 vulnerabilities enabling unauthenticated remote code execution and authentication bypass attacks. Patch availability declined to 17% from yesterday's 24%, requiring organizations to maintain compensating controls heading into the weekend.
Immediate action: URGENT WEEKEND ACTION: Security teams must immediately assess CVE-2025-49752 (CVSS 10.0) affecting Azure Bastion cloud infrastructure and CVE-2025-63224 (CVSS 10.0) affecting Itel DAB Encoder systems. Priority patching should address the eight CVSS 9.8 unauthenticated remote code execution and authentication bypass vulnerabilities, particularly CVE-2025-59245 (SharePoint Online), CVE-2025-12057 (WordPress WavePlayer), and CVE-2025-63206 (Dasan Switch) where vendor patches may be available. With only 17% patch availability and weekend approaching, organizations must deploy network segmentation, restrict administrative access, and implement Web Application Firewalls with command injection and authentication bypass detection rules. The nine actively exploited CISA KEV vulnerabilities require immediate remediation before weekend staffing reductions limit response capabilities.
Fortinet FortiWeb Path Traversal Vulnerability - Active in CISA KEV catalog.
Fortinet FortiWeb OS Command Injection Vulnerability - Active in CISA KEV catalog.
CWP Control Web Panel OS Command Injection Vulnerability - Active in CISA KEV catalog.
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability - Active in CISA KEV catalog.
Samsung Mobile Devices Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
Gladinet Triofox Improper Access Control Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Race Condition Vulnerability - Active in CISA KEV catalog.
WatchGuard Firebox Out-of-Bounds Write Vulnerability - Active in CISA KEV catalog.
Google Chromium V8 Type Confusion Vulnerability - Active in CISA KEV catalog.
Azure Bastion Elevation of Privilege Vulnerability
The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE
Microsoft SharePoint Online Elevation of Privilege Vulnerability
The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.
The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.
The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the passwords and networks are different. This allows full compromise of affected devices.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection.This issue affects Webpack Management System: through 20251119.
An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing attackers to gain escalated privileges via storing crafted cookies in the web browser.
The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit this issue by modifying intercepted responses from the /celoxservice endpoint. By injecting a forged response body during the loginWithUserName flow, the attacker can gain Superuser or Operator access without providing valid credentials.
Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1.
The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on the /_Passwd.html endpoint. An attacker can send an unauthenticated POST request to change the Admin, Operator, and User passwords, resulting in complete system compromise.
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability exists in the poll finalization feature of the application. Any authenticated user can finalize a poll they do not own by manipulating the pollId parameter in the request. This allows unauthorized users to finalize other usersβ polls and convert them into events without proper authorization checks, potentially disrupting user workflows and causing data integrity and availability issues. This issue has been patched in version 4.5.4.
The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3
The WP Import β Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7
The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'dayofyear' parameter in all versions up to, and including, 1
Azure Monitor Elevation of Privilege Vulnerability
Microsoft Defender Portal Spoofing Vulnerability
The fetch function in file thinkphp\library\think\Template
The Giveaways and Contests by RafflePress β Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple social media username parameters in all versions up to, and including, 1
The GiveWP β Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the βnameβ parameter in all versions up to, and including, 4
A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash
The Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests
The ELCA Star Transmitter Remote Control firmware 1
D-Link Router DIR-868L A1 FW106KRb01
A vulnerability was detected in Tenda CH22 1
OpenSTAManager is an open source management software for technical assistance and invoicing
A flaw has been found in Tenda AC21 16
A vulnerability has been found in Tenda AC21 16
Authorization bypass in Revive Adserver 5
IBM webMethods Integration 10
Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network
Improper input neutralization in the stats-conversions
esm
Rallly is an open-source scheduling and collaboration tool
Rallly is an open-source scheduling and collaboration tool
Rallly is an open-source scheduling and collaboration tool
Homarr is an open-source dashboard
The ITEL ISO FM SFN Adapter (firmware ISO2 2
An issue was discovered in bridgetech probes VB220 IP Network Probe,VB120 Embedded IP + RF Probe, VB330 High-Capacity Probe, VB440 ST 2110 Production Analytics Probe, and NOMAD, firmware versions 6
An issue was discovered in bridgetech VB288 Objective QoE Content Extractor, firmware version 5
A path Traversal vulnerability found in FileCodeBox v2
A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2
Milos Paripovic OneCommander 3
An issue in Ilevia EVE X1 Server Firmware Version v4
An issue was discovered in Clerk-js 5
Quark Cloud Drive v3
An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13)
A security flaw has been discovered in codehub666 94list up to 5831c8240e99a72b7d3508c79ef46ae4b96befe8
A vulnerability has been found in Campcodes Retro Basketball Shoes Online Store 1
Campcodes Online Hospital Management System 1
A weakness has been identified in itsourcecode Human Resource Management System 1
A security vulnerability has been detected in itsourcecode Human Resource Management System 1
A vulnerability was detected in freeprojectscodes Sports Club Management System 1
A security vulnerability has been detected in UTT θΏε 750W up to 3
A vulnerability was found in code-projects Online Shop Project 1
A vulnerability was identified in SourceCodester Online Shop Project 1
Lite XL versions 2
Lite XL versions 2
i-Educar is free, fully online school management software
i-Educar is free, fully online school management software
i-Educar is free, fully online school management software
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Narkom Communication and Software Technologies Trade Ltd
Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd
Astro is a web framework
Rallly is an open-source scheduling and collaboration tool
Missing authorization check in Revive Adserver 5
A security flaw has been discovered in Muse Group MuseHub 2