Description Summary:
A path traversal vulnerability in the portenable cgi component allows remote authenticated users to retrieve the status of installed packages on Synology Router Manager.

Executive Summary:
A path traversal vulnerability in Synology Router Manager (SRM) allows remote authenticated users to access sensitive system package information, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-29846

Affected Software: Synology Synology Router Manager (SRM)

Affected Versions: 1.3 up to (excluding) 1.3.1-9346-13

Vulnerability: This flaw involves an improper limitation of a pathname to a restricted directory (CWE-22) within the portenable cgi function, which can be triggered by an authenticated user with high privileges.

Business Impact

The vulnerability carries a CVSS score of 7.2, indicating a high severity risk. Successful exploitation allows an authenticated attacker to bypass intended directory restrictions, which could lead to unauthorized information disclosure or further system compromise, potentially impacting the overall security posture and stability of the network environment.

Remediation Plan

Immediate Action: Organizations should update Synology Router Manager (SRM) to version 1.3.1-9346-13 or later as specified in the vendor security advisory.

Proactive Monitoring: Security teams should monitor system logs for unusual access attempts to cgi scripts or unexpected directory traversal patterns originating from authenticated administrative sessions.

Compensating Controls: Ensure that access to the management interface is restricted to trusted internal networks and that administrative credentials are protected with multi-factor authentication to limit the risk of an attacker gaining the required privilege level.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of December 5, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for high-level administrative authentication significantly limits the attack surface for this path traversal flaw.

Analyst Recommendation

Given the high severity score and the potential for unauthorized information access, administrators must prioritize the update to the patched version of SRM. Applying the vendor-provided update is the only effective way to remediate the underlying directory traversal vulnerability and ensure continued system security.

Description Summary:
A vulnerability in the Emsisoft Anti-Malware scanning module allows remote unauthenticated attackers to capture Net-NTLMv2 hash information via a malicious A2S extension file.

Executive Summary:
A critical vulnerability in Emsisoft Anti-Malware allows remote attackers to perform NTLM relay or cracking attacks by stealing Net-NTLMv2 hashes.

Vulnerability Details

CVE-ID: CVE-2025-29745

Affected Software: Emsisoft Anti-Malware

Affected Versions: Versions prior to 2024.12

Vulnerability: The flaw resides in the scanning module, which improperly handles specially crafted A2S extension files. An unauthenticated attacker can trigger this behavior to force the application to leak Net-NTLMv2 hashes to a remote server.

Business Impact

The capture of Net-NTLMv2 hashes poses a significant risk to organizational identity security. These hashes can be leveraged by attackers to perform NTLM relay attacks or offline brute-force cracking, potentially leading to unauthorized access to internal network resources and domain compromise. Given the CVSS score of 7.5, this vulnerability represents a high risk to environment integrity.

Remediation Plan

Immediate Action: Update Emsisoft Anti-Malware to version 2024.12 or later immediately to resolve the vulnerable scanning logic.

Proactive Monitoring: Review network logs for unusual outbound SMB or HTTP traffic originating from endpoints running Emsisoft, specifically looking for connections to unknown external IP addresses.

Compensating Controls: Implement SMB signing or enforce NTLMv2 with Extended Protection for Authentication (EPA) to mitigate the impact of relayed hashes.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the linked technical write-up from PacketStorm.

Analyst Notes: As of August 5, 2025, there is no confirmed active exploitation in the wild, but a published PoC exists, making the risk of exploitation credible. The reliance on A2S extension files suggests that attackers must convince a user to load a malicious file, though the unauthenticated nature of the underlying hash capture makes the attack vector highly dangerous.

Analyst Recommendation

This vulnerability presents a clear path for credential theft and lateral movement within the network. IT administrators should prioritize the deployment of the vendor-supplied update across all managed endpoints. Until patching is complete, ensure that network segmentation and robust authentication policies are in place to limit the potential success of NTLM relay attempts.

Description Summary:
A command injection vulnerability in D-Link DIR-823X firmware allows authorized attackers to execute arbitrary system commands via a POST request to the set_prohibiting function.

Executive Summary:
A critical command injection vulnerability in legacy D-Link DIR-823X routers is being actively exploited in the wild to recruit devices into a DDoS botnet.

Vulnerability Details

CVE-ID: CVE-2025-29635

Affected Software: D-Link DIR-823X

Affected Versions: D-Link DIR-823X firmware versions 240126 and 240802. The devices were discontinued in 2025.

Vulnerability: The vulnerability exists because attacker-controlled input is passed to the system() function without sanitization, allowing shell metacharacter injection. While the CVSS vector indicates high privileges are required, the vulnerability is being actively exploited in the wild.

Business Impact

The exploitation of this flaw allows attackers to execute arbitrary code on the affected router with system-level privileges. This poses a severe risk of total device compromise, potential inclusion in botnets for distributed denial of service attacks, and lateral movement into the local network. Given the CVSS score of 9.5, this vulnerability represents a critical security risk to any organization still utilizing these legacy devices.

Remediation Plan

Immediate Action: As these devices are discontinued and vulnerable, the primary recommendation is to decommission and replace the affected hardware immediately.

Proactive Monitoring: Monitor network traffic for anomalous outbound connections, particularly those associated with Mirai botnet command and control signatures.

Compensating Controls: If immediate removal is not possible, place the devices on an isolated management network and restrict access to the web interface to authorized internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes (Nuclei detection template exists).

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of April 24, 2026. Akamai SIRT has identified active exploitation in honeypots involving Mirai botnet variants.

Analyst Recommendation

Due to the critical nature of this vulnerability and the observed active exploitation in the wild, immediate action is required. Organizations should prioritize the retirement of these end-of-life D-Link devices to eliminate the risk of continued compromise and potential network disruption.

Description Summary:
ExaGrid EX10 appliances in versions 6.3 through 7.0.1.P08 contain an access control flaw allowing administrative users to bypass security restrictions during account creation.

Executive Summary:
A critical access control vulnerability in ExaGrid EX10 appliances enables administrative users to escalate privileges to the Security Officer role, bypassing mandatory approval workflows.

Vulnerability Details

CVE-ID: CVE-2025-29556

Affected Software: ExaGrid EX10

Affected Versions: 6.3 - 7.0.1.P08

Vulnerability: This vulnerability involves incorrect access control, specifically a flaw in the API request handling process. An attacker holding Admin privileges can manipulate API requests to assign the Security Officer role to new accounts without the required authorization, effectively bypassing established security governance.

Business Impact

The ability to arbitrarily elevate privileges to the Security Officer level poses a severe risk to data integrity and system confidentiality. Because the Security Officer role is designed to oversee and restrict administrative actions, unauthorized access to this role could allow an actor to disable security logs, alter backup configurations, or exfiltrate sensitive data. With a CVSS score of 7.3, this flaw represents a High severity risk that could lead to full compromise of the backup infrastructure.

Remediation Plan

Immediate Action: Organizations should verify their current firmware version and coordinate with ExaGrid support to apply the necessary security patches or configuration changes to address this API vulnerability.

Proactive Monitoring: Security teams should audit user account creation logs and monitor for unauthorized changes to the Security Officer group membership, paying close attention to API requests originating from administrative accounts.

Compensating Controls: Restrict access to the management API to known, trusted management workstations and implement strict network segmentation to limit the attack surface of the ExaGrid management interface.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the GitHub repository provided by the vulnerability researchers.

Analyst Notes: As of August 1, 2025, there is no confirmed active exploitation in the wild. However, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept significantly lowers the barrier for motivated actors to leverage this API manipulation flaw.

Analyst Recommendation

Given the potential for privilege escalation and the existence of a public proof-of-concept, this vulnerability must be addressed with high priority. Administrators should immediately audit existing Security Officer accounts for unauthorized additions and apply vendor-supplied patches to close the API manipulation vector. Failure to remediate this issue may result in an attacker gaining persistent, unauthorized control over critical backup security functions.

Description Summary:
An authenticated remote code execution vulnerability exists in the PowerStick Wave Dual-Band Wifi Extender V1 due to improper input sanitization in the cgi_vista.cgi executable.

Executive Summary:
An authenticated remote code execution vulnerability in the PowerStick Wave Dual-Band Wifi Extender V1 allows attackers with valid credentials to achieve full system compromise with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2025-29534

Affected Software: PowerStick Wave Dual-Band Wifi Extender V1

Affected Versions: See vendor advisory

Vulnerability: This vulnerability occurs because the /cgi-bin/cgi_vista.cgi endpoint fails to sanitize user-supplied input, which is subsequently passed directly to a system-level function call. This flaw permits an authenticated user to execute arbitrary commands with root privileges on the device.

Business Impact

The ability for an authenticated attacker to execute arbitrary code as root poses a severe risk to network integrity and confidentiality. Given the high CVSS score of 8.8, this flaw could lead to full device takeover, enabling attackers to pivot into the internal network, intercept traffic, or persist within the infrastructure.

Remediation Plan

Immediate Action: Restrict administrative access to the device management interface to trusted users only and monitor for vendor-released firmware updates.

Proactive Monitoring: Review access logs for the /cgi-bin/cgi_vista.cgi endpoint for unusual command strings or unauthorized access patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) or network-level access control list to restrict access to the management interface from untrusted IP addresses.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the research write-up referenced in the CVE record.

Analyst Notes: As of July 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous because it facilitates privilege escalation to the root level.

Analyst Recommendation

Due to the critical nature of remote code execution with root privileges, organizations should immediately audit all instances of the PowerStick Wave Dual-Band Wifi Extender V1. Limit administrative access strictly to authorized personnel and apply vendor patches as soon as they become available to mitigate the risk of unauthorized system-level command execution.

Description Summary:
A command injection vulnerability in the D-Link DSL-7740C router allows an authenticated administrator to execute arbitrary commands via the ping6 function.

Executive Summary:
A command injection vulnerability in the D-Link DSL-7740C router allows privileged attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-29523

Affected Software: D-Link DSL-7740C

Affected Versions: firmware DSL7740C.V6.TR069.20211230

Vulnerability: This vulnerability is a command injection flaw located in the ping6 function. Based on the CVSS vector (PR:H), the attacker must possess high-level administrative credentials to trigger the execution of arbitrary commands.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with administrative privileges on the affected device. This could lead to a total loss of confidentiality, integrity, and availability of the router, potentially serving as a pivot point for further attacks on the internal network. Given the CVSS score of 7.2, this represents a significant risk to network security and operational continuity.

Remediation Plan

Immediate Action: Monitor official D-Link security bulletins for the release of a firmware patch and apply it as soon as it becomes available.

Proactive Monitoring: Review administrative access logs for unusual activity and monitor network traffic for unexpected outbound connections originating from the router device.

Compensating Controls: Restrict administrative access to the device management interface to trusted internal IP addresses only. Disable remote management features if they are not strictly required for business operations.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in a GitHub gist reference.

Analyst Notes: As of August 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a published proof-of-concept increases the likelihood that malicious actors may attempt to weaponize this flaw.

Analyst Recommendation

The severity of this command injection vulnerability necessitates prompt attention from network administrators. While administrative privileges are currently required for exploitation, organizations must prioritize restricting management access to prevent unauthorized use of the vulnerable ping6 function. Ensure that all affected devices are tracked and updated once the vendor provides a corrected firmware version to eliminate this risk entirely.

Description Summary:
D-Link DSL-7740C routers running firmware DSL7740C.V6.TR069.20211230 contain a command injection vulnerability in the backup function.

Executive Summary:
A critical command injection vulnerability in the D-Link DSL-7740C router allows authenticated attackers to execute arbitrary system commands, potentially leading to a total device compromise.

Vulnerability Details

CVE-ID: CVE-2025-29516

Affected Software: D-Link DSL-7740C

Affected Versions: Firmware DSL7740C.V6.TR069.20211230

Vulnerability: The device contains a command injection flaw within its backup functionality. The CVSS vector (PR:H) indicates that an attacker must possess high privileges to successfully trigger this vulnerability.

Business Impact

The ability to inject arbitrary commands into the router operating system poses a significant risk to network integrity. Successful exploitation could result in full administrative control over the device, enabling attackers to intercept traffic, pivot into internal network segments, or permanently disable the hardware. With a CVSS score of 7.2, this vulnerability represents a high risk to the availability and confidentiality of the affected network infrastructure.

Remediation Plan

Immediate Action: Review the D-Link security bulletin for firmware updates and apply the latest available patch to address the command injection flaw.

Proactive Monitoring: Monitor device logs for unusual administrative activity or unexpected system processes initiated by the backup function.

Compensating Controls: Restrict administrative access to the device management interface to authorized IP addresses only and disable remote management features if they are not strictly required for operations.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the referenced GitHub Gist.

Analyst Notes: As of August 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input sanitization in the backup feature.

Analyst Recommendation

Given the high CVSS severity and the existence of a public proof-of-concept, administrators should treat this vulnerability with urgency. Ensure that administrative interfaces are secured and prioritize the application of vendor patches as soon as they become available to prevent unauthorized system execution.

Description Summary:
An incorrect access control vulnerability in the DELT_file.xgi endpoint of D-Link DSL-7740C allows unauthenticated attackers to modify arbitrary settings within the device's XML database.

Executive Summary:
A critical access control flaw in D-Link DSL-7740C firmware allows unauthenticated remote attackers to modify device configurations, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-29515

Affected Software: D-Link DSL-7740C

Affected Versions: DSL7740C.V6.TR069.20211230

Vulnerability: The vulnerability exists in the DELT_file.xgi endpoint, which fails to perform sufficient access control checks. This allows an unauthenticated attacker to inject or modify settings in the device's XML database.

Business Impact

The ability for an attacker to modify arbitrary settings in the device configuration poses a severe risk to network integrity and confidentiality. With a CVSS score of 9.8, this vulnerability could be leveraged to redirect traffic, disable security features, or create backdoors, resulting in total loss of control over the affected network infrastructure.

Remediation Plan

Immediate Action: Contact D-Link support or check the official support portal for a firmware update addressing this vulnerability.

Proactive Monitoring: Monitor network traffic for unusual requests directed at the .xgi endpoints and review device configuration logs for unauthorized changes.

Compensating Controls: Restrict access to the device management interface to trusted IP addresses only and ensure the device is not exposed directly to the public internet.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Aug 25, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity of 9.8, administrators should prioritize the mitigation of this vulnerability. If an official patch is not immediately available, isolating the affected device from external networks is essential to prevent unauthorized configuration tampering.

Description Summary:
An incorrect access control vulnerability in the config.xgi function of D-Link DSL-7740C allows unauthenticated attackers to download sensitive configuration files via crafted web requests.

Executive Summary:
A critical access control vulnerability in D-Link DSL-7740C firmware permits unauthenticated attackers to exfiltrate sensitive configuration data, including potential credentials.

Vulnerability Details

CVE-ID: CVE-2025-29514

Affected Software: D-Link DSL-7740C

Affected Versions: DSL7740C.V6.TR069.20211230

Vulnerability: The config.xgi function lacks proper authentication enforcement, enabling unauthenticated remote attackers to retrieve the device configuration file. This file often contains sensitive information required for further exploitation of the network.

Business Impact

Successful exploitation allows an attacker to gain deep insight into the internal network configuration, including administrative credentials and connection settings. Given the 9.8 CVSS score, this represents a high-impact breach of confidentiality that could facilitate lateral movement and further compromise of the internal environment.

Remediation Plan

Immediate Action: Verify if a firmware update is available from the vendor and apply it immediately to restrict unauthorized access to configuration endpoints.

Proactive Monitoring: Review web server access logs for repeated requests to the config.xgi endpoint originating from unauthorized sources.

Compensating Controls: Implement strict network access control lists (ACLs) to block external access to the device's management functions.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Aug 25, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a significant risk to sensitive information. Administrators must treat this as a high-priority item and ensure that the management interface of the DSL-7740C is not reachable from untrusted networks until a vendor-supplied patch is successfully deployed.

Description Summary:
PerfreeBlog version 4.0.11 contains an arbitrary file read vulnerability within the getThemeFileContent function, allowing unauthenticated access to sensitive system files.

Executive Summary:
A critical arbitrary file read vulnerability in PerfreeBlog 4.0.11 allows unauthenticated attackers to access unauthorized system files, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-29421

Affected Software: PerfreeBlog PerfreeBlog

Affected Versions: 4.0.11

Vulnerability: The application is susceptible to an arbitrary file read flaw located in the getThemeFileContent function. This vulnerability is accessible to unauthenticated remote attackers, requiring no specific privileges to trigger.

Business Impact

The ability for an unauthenticated actor to read arbitrary files from the server can lead to the exposure of sensitive configuration files, database credentials, or source code. This level of unauthorized access compromises the confidentiality of the entire application environment and could serve as a precursor to further system compromise. Given the CVSS score of 7.5, this vulnerability is classified as High severity.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to the affected function or the entire application until the vendor releases a security update.

Proactive Monitoring: Monitor server access logs for anomalous requests targeting theme-related file paths or unexpected attempts to traverse directories.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences or attempts to access system files via the getThemeFileContent parameter.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of August 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input sanitization in the file retrieval logic.

Analyst Recommendation

Due to the high severity and the availability of proof-of-concept information, organizations should prioritize the identification of all PerfreeBlog instances within their infrastructure. Until an official patch is provided by the vendor, ensure that strict access controls and network-level protections are in place to prevent unauthorized exploitation of this file read flaw.

Description Summary:
PerfreeBlog version 4.0.11 is vulnerable to a directory traversal flaw within the getThemeFilesByName function, allowing unauthorized file access.

Executive Summary:
A directory traversal vulnerability in PerfreeBlog 4.0.11 enables unauthenticated attackers to read sensitive files from the underlying server.

Vulnerability Details

CVE-ID: CVE-2025-29420

Affected Software: PerfreeBlog PerfreeBlog

Affected Versions: 4.0.11

Vulnerability: The application fails to properly sanitize user input in the getThemeFilesByName function, which leads to a directory traversal vulnerability. This flaw is remotely exploitable by unauthenticated attackers.

Business Impact

The ability to perform directory traversal allows an attacker to bypass file system restrictions and access sensitive configuration files or source code. With a CVSS score of 7.5, this high-severity vulnerability poses a significant risk of data exfiltration and intellectual property theft, potentially leading to a full compromise of the application environment.

Remediation Plan

Immediate Action: Since a vendor-provided patch is currently unknown, administrators should restrict access to the affected application or disable the impacted theme functionality if possible.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal sequences, such as dot-dot-slash (../) patterns, targeting the theme directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to intercept and block HTTP requests containing path traversal characters aimed at the identified vulnerable function.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the provided researcher write-up.

Analyst Notes: As of August 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated nature and the relative ease of triggering the traversal via a standard web request.

Analyst Recommendation

Given the public availability of technical details and the unauthenticated nature of this vulnerability, organizations using PerfreeBlog 4.0.11 must prioritize mitigation. Apply the vendor update immediately once released and continue to monitor for any signs of unauthorized access to the server file system in the interim.

Description Summary:
A buffer overflow vulnerability exists in the READ_STRING_SYSCALL function of spimsimulator spim versions 9.1.24 and earlier, potentially allowing arbitrary code execution.

Executive Summary:
A critical buffer overflow vulnerability in spimsimulator spim versions 9.1.24 and earlier poses a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-29365

Affected Software: spimsimulator spim

Affected Versions: v9.1.24 and before

Vulnerability: This is a buffer overflow vulnerability (CWE-120) triggered via the READ_STRING_SYSCALL function. The vulnerability is exploitable by an unauthenticated remote attacker who can send malicious input to the affected system.

Business Impact

The identified vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation could allow an attacker to achieve full remote code execution, leading to total system compromise, unauthorized data access, and potential disruption of critical operations.

Remediation Plan

Immediate Action: Users should restrict access to the affected service until a security patch is released by the vendor. Given that no specific patch version is currently identified, monitor the project repository for updates and apply them immediately upon release.

Proactive Monitoring: Review system logs for unusual input patterns or unexpected crashes associated with system calls. Implement enhanced monitoring on network segments where this software is deployed to detect anomalous traffic.

Compensating Controls: Deploy a Web Application Firewall or an intrusion detection system with rules designed to identify and block malformed strings or buffer overflow attempts directed at the application.

Exploitation Status

Public Exploit Available: Yes, a published proof of concept exists, attributed to the technical write-up provided in the reference documentation.

Analyst Notes: As of Aug 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the nature of buffer overflows in system-level code.

Analyst Recommendation

Given the critical CVSS score and the existence of a public proof of concept, this vulnerability represents a significant threat to infrastructure integrity. Organizations should immediately audit their environments for the presence of spimsimulator and apply vendor-supplied updates as soon as they become available. Until a patch is confirmed, internal isolation of the affected service is strongly recommended.

Description Summary:
The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion via the font_upload_handler function, potentially leading to remote code execution.

Executive Summary:
The JKDEVKIT plugin for WordPress contains a critical path traversal vulnerability that allows authenticated attackers to delete arbitrary files on the server, posing a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-2932

Affected Software: JKDevStudio JKDEVKIT

Affected Versions: 0 through 1.9.4

Vulnerability: The plugin fails to perform sufficient path validation within the font_upload_handler function. This flaw allows authenticated users with Subscriber-level access (or Contributor-level if WooCommerce is active) to delete arbitrary files on the host server.

Business Impact

Successful exploitation permits the deletion of critical system files, such as wp-config.php, which can lead to complete site takeover or remote code execution. With a CVSS score of 8.8, this vulnerability represents a high risk to business continuity and data integrity, as it provides a path for attackers to gain unauthorized control over the web server environment.

Remediation Plan

Immediate Action: As no patched version is currently confirmed, administrators should immediately deactivate and uninstall the JKDEVKIT plugin until a vendor-supplied security update is released.

Proactive Monitoring: Monitor server access logs for suspicious requests directed at the fonts_manager.php file or unusual file deletion patterns occurring within the WordPress installation directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and restrict access to plugin-specific upload handlers for unauthorized user roles.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 8, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the ability to delete arbitrary files makes the plugin inherently dangerous in any production environment.

Analyst Recommendation

Given the potential for remote code execution and the high CVSS severity, this vulnerability must be treated with extreme urgency. Organizations currently utilizing the JKDEVKIT plugin should prioritize its removal from all WordPress instances until the developer provides a version that incorporates robust path validation and capability checks.

Description Summary:
Multiple H3C network devices contain command injection vulnerabilities in the /api/esps request handler, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges.

Executive Summary:
A critical command injection vulnerability in various H3C network devices allows unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-29296

Affected Software: H3C Network Devices

Affected Versions: H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002

Vulnerability: This is a command injection flaw within the /api/esps request handler. The device fails to validate user-supplied parameters before passing them to system shell expressions, which enables an unauthenticated attacker to execute arbitrary commands as root.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to organizational infrastructure. Successful exploitation grants an attacker complete administrative control over the affected network device, potentially leading to unauthorized network access, data interception, and total system downtime.

Remediation Plan

Immediate Action: Review the H3C security advisory for available firmware updates and apply them to all affected devices immediately.

Proactive Monitoring: Monitor device logs for anomalous API requests directed at the /api/esps endpoint, particularly those containing shell metacharacters.

Compensating Controls: Implement strict network segmentation and restrict access to the management interfaces of these devices to trusted management subnets using a firewall.

Exploitation Status

Public Exploit Available: Yes — the vulnerability is confirmed to have public proof-of-concept material available.

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly dangerous due to its unauthenticated nature and the high-privilege execution environment.

Analyst Recommendation

Given the critical severity of this vulnerability and the availability of proof-of-concept code, administrators should prioritize patching these devices immediately. If an official patch is pending, restrict all external access to the management API to prevent remote exploitation.

Description Summary:
A SQL injection vulnerability exists in the Archiver role of Genetec Security Center, allowing an authenticated administrator to manipulate database queries.

Executive Summary:
A high-severity SQL injection vulnerability in Genetec Security Center allows authenticated attackers with administrative privileges to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-2928

Affected Software: Genetec Inc. Security Center

Affected Versions: Genetec Security Center: 5.9.0.0 to 5.9.5.8, 5.10.0.0 to 5.10.4.27, 5.11.0.0 to 5.11.3.18, 5.12.0.0 to 5.12.2.5, and 5.13.0.0 to 5.13.1.0.

Vulnerability: This flaw, categorized as CWE-89, involves improper neutralization of special elements within SQL commands in the Archiver role. The CVSS vector indicates that while the vulnerability is network-accessible, it requires high-level administrative authentication to trigger.

Business Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data exfiltration, modification, or destruction of security system records. Given the CVSS score of 7.2, this vulnerability poses a significant risk to the integrity and confidentiality of the physical security infrastructure managed by the software.

Remediation Plan

Immediate Action: Update Genetec Security Center to the fixed versions: 5.9.5.9, 5.10.4.28, 5.11.3.19, 5.12.2.6, 5.13.1.1, or any later release.

Proactive Monitoring: Review database access logs for anomalous, high-volume, or malformed queries originating from the service account associated with the Archiver role.

Compensating Controls: Ensure that the database service account operates under the principle of least privilege, restricting its permissions to only those necessary for its core functions to limit the potential impact of an injection attack.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 30, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for high privileges makes this an internal-facing threat that necessitates immediate patching to prevent lateral movement or malicious configuration changes by compromised administrative accounts.

Analyst Recommendation

Organizations utilizing Genetec Security Center must prioritize the installation of the provided security updates. Because this vulnerability grants significant control over the application database, failure to patch could allow an attacker to bypass security controls entirely. Please verify your current version and apply the appropriate vendor-supplied fix as part of your next maintenance cycle.

Description Summary:
An incorrect access control vulnerability in the realtime.cgi endpoint of Deep Sea Electronics DSE855 devices allows unauthenticated attackers to gain administrative control.

Executive Summary:
This critical authentication bypass vulnerability in Deep Sea Electronics DSE855 devices allows unauthenticated attackers to achieve full administrative control, presenting a severe risk to operational security.

Vulnerability Details

CVE-ID: CVE-2025-29270

Affected Software: Deep Sea Electronics DSE855

Affected Versions: v1.1.0 to v1.1.26

Vulnerability: This is an authentication bypass vulnerability located in the realtime.cgi endpoint. The flaw allows an unauthenticated, remote attacker to gain unauthorized access to the administrative panel, resulting in full control over the device.

Business Impact

The CVSS score of 10.0 reflects a critical severity, indicating that an attacker can take complete control of the affected device without prior authentication. Successful exploitation may lead to total system compromise, unauthorized modification of device configurations, and potential disruption of critical operational processes, which could have significant safety and financial implications.

Remediation Plan

Immediate Action: Organizations should restrict network access to the DSE855 device to trusted management networks only and contact the vendor for the latest firmware update to address the vulnerability.

Proactive Monitoring: Security teams should monitor network traffic for suspicious requests targeting the realtime.cgi endpoint and review device logs for unauthorized administrative login attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an industrial firewall to block unauthorized access to the web interface of the device until a permanent patch is applied.

Exploitation Status

Public Exploit Available: Yes — a technical write-up detailing the vulnerability exists and is linked in the reference section.

Analyst Notes: As of Oct 31, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no user interaction or authentication to trigger.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for full device takeover, immediate containment is required. Administrators must ensure that the DSE855 is not exposed to the public internet and should prioritize applying the vendor-supplied firmware update as soon as it becomes available to mitigate the risk of remote exploitation.

Description Summary:
Linksys E5600 firmware version V1.1.0.26 contains a command injection vulnerability in the ddnsStatus function, allowing unauthenticated attackers to execute arbitrary system commands.

Executive Summary:
A critical command injection vulnerability in Linksys E5600 routers allows unauthenticated remote attackers to gain full control of the affected device.

Vulnerability Details

CVE-ID: CVE-2025-29229

Affected Software: Linksys E5600

Affected Versions: V1.1.0.26

Vulnerability: This is a command injection flaw located within the ddnsStatus function that does not require user authentication, enabling an attacker to execute arbitrary shell commands with elevated privileges.

Business Impact

The exploitation of this vulnerability poses a severe risk, as it allows for full remote code execution on the router. This can lead to total compromise of the network, unauthorized access to sensitive internal data, and the potential for the device to be used as a pivot point for further attacks on the internal infrastructure. With a CVSS score of 9.8, the urgency for remediation is extreme.

Remediation Plan

Immediate Action: As no official patch is currently identified, verify if a firmware update is available on the official Linksys support portal and apply it immediately if found.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or spikes in administrative activity originating from external sources.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses only, and disable the Dynamic DNS (DDNS) feature if it is not strictly required for business operations.

Exploitation Status

Public Exploit Available: Yes, a technical write-up detailing the command injection vulnerability and providing a proof-of-concept is available via the researcher-provided GitHub reference.

Analyst Notes: As of Dec 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the critical nature of this command injection flaw and the availability of a public proof-of-concept, users must prioritize securing the affected Linksys E5600 devices. If a vendor-supplied firmware update is not yet available, immediately isolate the device from public-facing network segments and disable vulnerable services like DDNS to reduce the attack surface until a permanent patch can be deployed.

Description Summary:
Linksys E5600 firmware V1.1.0.26 contains a command injection vulnerability in the runtime.macClone function via the mc.ip parameter.

Executive Summary:
A critical command injection vulnerability in the Linksys E5600 router allows unauthenticated attackers to execute arbitrary system commands, posing a severe risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2025-29228

Affected Software: Linksys E5600

Affected Versions: V1.1.0.26

Vulnerability: This is a command injection vulnerability occurring within the runtime.macClone function. Because the vulnerability is reachable via the mc.ip parameter without requiring authentication, it allows for remote code execution.

Business Impact

Successful exploitation grants an attacker complete control over the affected router, potentially leading to unauthorized network access, interception of traffic, and the use of the device as a pivot point for lateral movement into the internal network. With a CVSS score of 9.8, the impact is considered critical due to the ease of remote exploitation and the potential for total system compromise.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, isolate the affected E5600 devices from the internet or disable the vulnerable MAC clone feature if possible until the vendor releases a firmware update.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or shell-related patterns originating from the router's management interface.

Compensating Controls: Ensure the router is behind a firewall that restricts management access to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Dec 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of command injection flaws makes them highly susceptible to automated exploitation.

Analyst Recommendation

Given the critical CVSS severity and the existence of a proof-of-concept, users should treat this vulnerability with extreme urgency. Immediately restrict access to the device management interface and monitor vendor channels for the release of a patched firmware version.

Description Summary:
Flowise versions prior to 3.0.5 are vulnerable to Cross-site Scripting (XSS) via FORM and INPUT elements when an administrator views chat logs.

Executive Summary:
A stored Cross-site Scripting vulnerability in Flowise allows unauthenticated attackers to execute malicious scripts in an administrator's browser session, potentially leading to unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2025-29192

Affected Software: FlowiseAI Flowise

Affected Versions: 0 up to 3.0.5

Vulnerability: The application fails to properly neutralize user-supplied input within FORM and INPUT elements, allowing an attacker to inject malicious scripts that execute when an administrator views the chat logs. This flaw is classified as CWE-79 and requires no authentication to trigger the initial injection.

Business Impact

The successful exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the Flowise administrative interface. By compromising an administrator session, an attacker could potentially gain unauthorized access to sensitive data, modify system configurations, or perform actions on behalf of the administrator. With a CVSS score of 8.2, this vulnerability is categorized as High severity due to the potential for administrative account takeover.

Remediation Plan

Immediate Action: Update the Flowise installation to version 3.0.5 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Review administrative access logs and monitor for unusual activity, particularly within the chat log management modules, to identify potential exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common XSS payloads, particularly those targeting FORM and INPUT parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of October 7, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it targets the administrative interface, which is a high value target for attackers seeking to escalate privileges within the application environment.

Analyst Recommendation

Given the High severity of this vulnerability and the existence of a proof-of-concept, organizations using Flowise should prioritize the update to version 3.0.5 immediately. Failure to patch allows for a clear path to session hijacking and administrative compromise. Please ensure all instances are verified against the fixed version to eliminate this risk.

Description Summary:
Hitachi Virtual Storage Platform maintenance utilities contain an improper authorization vulnerability that may allow unauthorized access.

Executive Summary:
An improper authorization vulnerability in the maintenance utility of Hitachi Virtual Storage Platform systems poses a significant risk of unauthorized administrative access to storage infrastructure.

Vulnerability Details

CVE-ID: CVE-2025-2902

Affected Software: Hitachi Virtual Storage Platform (E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an improper authorization vulnerability within the system's maintenance utility. It is likely that an authenticated user with lower-level access could exploit this flaw to perform unauthorized maintenance actions.

Business Impact

The vulnerability carries a CVSS score of 8.3, reflecting a High severity rating. Successful exploitation could lead to full unauthorized control over storage maintenance functions, potentially resulting in data manipulation, service disruption, or the compromise of sensitive storage configurations.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Hitachi to address the authorization flaw in the maintenance utility.

Proactive Monitoring: Monitor management interface access logs for unauthorized attempts to access maintenance-specific functions or anomalous administrative behavior.

Compensating Controls: Restrict network access to the maintenance utility interface to trusted administrative IP addresses only, utilizing strict firewall rules.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of storage infrastructure, the potential for exploitation remains high.

Analyst Recommendation

Given the High severity of this authorization flaw, organizations utilizing the affected Hitachi VSP models must prioritize the application of vendor patches. Immediate remediation is required to ensure the integrity and availability of storage management services.

Description Summary:
An unrestricted file upload vulnerability in the Webkul Medical Prescription Attachment Plugin for WooCommerce allows unauthenticated attackers to upload a web shell to the server.

Executive Summary:
A critical unauthenticated file upload vulnerability in the Webkul Medical Prescription Attachment Plugin for WooCommerce allows remote attackers to execute arbitrary code on the web server.

Vulnerability Details

CVE-ID: CVE-2025-29009

Affected Software: Webkul Medical Prescription Attachment Plugin for WooCommerce

Affected Versions: 0 through 1.2.3

Vulnerability: The flaw is an unrestricted upload of files with dangerous types (CWE-434), which enables an unauthenticated attacker to upload executable scripts directly to the web server.

Business Impact

Successful exploitation of this vulnerability leads to full system compromise, allowing an attacker to gain complete control over the web server. Given the CVSS score of 10.0, this represents a critical risk that could result in total data exfiltration, unauthorized access to sensitive medical prescription data, and complete operational downtime.

Remediation Plan

Immediate Action: There is no specific patch version provided in the available data; users should immediately deactivate and remove the Medical Prescription Attachment Plugin for WooCommerce until a security update is confirmed by the vendor.

Proactive Monitoring: Review web server access logs for requests to non-standard or newly uploaded files within the plugin directory or associated upload folders.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block file upload requests containing suspicious extensions or content-types directed at the plugin endpoints.

Exploitation Status

Public Exploit Available: Yes, multiple public proofs-of-concept exist, as evidenced by the repositories hosted on GitHub.

Analyst Notes: As of July 16, 2025, there is no confirmed active exploitation in the wild; however, the availability of public proof-of-concept code significantly lowers the barrier for entry for malicious actors. The vulnerability's design allows for trivial, automated exploitation by unauthenticated remote users.

Analyst Recommendation

Due to the critical nature of this vulnerability and the existence of public exploit code, immediate action is required to mitigate the risk of full system compromise. Organizations currently utilizing this plugin must disable it immediately and monitor their infrastructure for signs of unauthorized file uploads or anomalous activity until a verified vendor patch is applied.

Description Summary:
These WordPress plugins contain an incorrect privilege assignment vulnerability that allows authenticated users to escalate their privileges within the application.

Executive Summary:
A privilege escalation vulnerability in multiple AA-Team WordPress plugins allows authenticated users to gain unauthorized administrative access, posing a severe risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2025-29004

Affected Software: AA-Team Premium Age Verification / Restriction for WordPress and AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPress

Affected Versions: Premium Age Verification / Restriction for WordPress: through 3.0.2; Responsive Coming Soon Landing Page / Holding Page for WordPress: through 3.0

Vulnerability: The plugins suffer from an incorrect privilege assignment (CWE-266) flaw that allows an authenticated user, typically with lower-level access, to escalate their privileges to an administrative level.

Business Impact

Successful exploitation of this vulnerability enables an attacker to gain full administrative control over the affected WordPress installation. This can lead to complete site compromise, unauthorized data exfiltration, the injection of malicious code, or total service disruption. With a CVSS score of 8.8, this flaw represents a high-severity risk that demands immediate attention to prevent unauthorized administrative escalation.

Remediation Plan

Immediate Action: Administrators must update the affected plugins to the latest available versions immediately to resolve the privilege assignment flaw.

Proactive Monitoring: Security teams should review WordPress administrative user logs for unexpected account creation or unauthorized changes to user roles and capabilities.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block suspicious requests targeting plugin administrative endpoints or privilege management functions.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Analyst Notes: As of January 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for total control over the web application, necessitating prompt patching despite the current lack of observed in-the-wild exploitation.

Analyst Recommendation

Given the high CVSS score and the critical nature of privilege escalation, organizations using these AA-Team plugins should prioritize updates in their next maintenance cycle. Failure to remediate this vulnerability leaves the application open to complete administrative takeover by any authenticated user. Monitor vendor release channels closely for any further security guidance or patch revisions.

Description Summary:
A missing authorization vulnerability in the Multi-language Responsive Contact Form plugin allows unauthenticated users to access restricted functionality due to improper access control.

Executive Summary:
A critical missing authorization flaw in the August Infotech Multi-language Responsive Contact Form plugin allows unauthenticated attackers to bypass access controls and potentially access sensitive data.

Vulnerability Details

CVE-ID: CVE-2025-29000

Affected Software: August Infotech Multi-language Responsive Contact Form

Affected Versions: 0 through 2.8

Vulnerability: The vulnerability is a missing authorization flaw (CWE-862) within the plugin, which fails to perform necessary capability checks. This allows an unauthenticated attacker to interact with restricted functions that should be protected by access control lists.

Business Impact

This vulnerability poses a significant risk to data confidentiality, as unauthorized parties may access information not intended for public view. With a CVSS score of 7.5, the flaw is classified as High severity. Successful exploitation could lead to unauthorized data exposure or administrative function abuse, potentially compromising the integrity of the WordPress installation and associated business operations.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate and remove the Multi-language Responsive Contact Form plugin from their environments until a secure update is released by August Infotech.

Proactive Monitoring: Security teams should audit web server access logs for suspicious requests directed at plugin-specific endpoints, particularly those originating from unauthorized or unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access attempts to plugin-specific directories and administrative endpoints to provide a layer of virtual patching.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of July 17, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the lack of required user interaction, making it a prime candidate for automated scanning and exploitation.

Analyst Recommendation

The presence of a missing authorization flaw in a widely used plugin type requires immediate attention to prevent unauthorized access. Administrators must prioritize the removal of the vulnerable component to eliminate the attack surface, as relying on monitoring alone is insufficient for high-severity authorization bypass vulnerabilities.

Description Summary:
A SQL injection vulnerability in the ThimPress WP Pipes WordPress plugin allows unauthenticated attackers to execute unauthorized database queries.

Executive Summary:
The ThimPress WP Pipes plugin contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity and availability.

Vulnerability Details

CVE-ID: CVE-2025-28982

Affected Software: ThimPress WP Pipes

Affected Versions: n/a through 1.4.3

Vulnerability: This vulnerability is a SQL injection flaw, categorized as CWE-89, stemming from the improper neutralization of special elements used in SQL commands within the WP Pipes plugin. The vulnerability is exploitable by unauthenticated remote attackers with no required user interaction.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data stored within the WordPress database. Given the CVSS score of 9.3, this flaw poses a severe risk to organizational confidentiality and system stability, potentially allowing attackers to extract data or cause service disruptions.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate and uninstall the WP Pipes plugin until a secure update is released by ThimPress.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, such as unexpected use of union statements or syntax errors originating from the web application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns directed at the WordPress environment.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of July 16, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements significantly increases the inherent risk, as the attack surface is accessible to any remote user.

Analyst Recommendation

The critical nature of this SQL injection vulnerability necessitates an immediate response. Organizations utilizing the WP Pipes plugin must prioritize its removal from production environments to prevent potential data exfiltration or system compromise. Continue to monitor the vendor security advisories for the release of a patched version before considering re-installation.

Description Summary:
ThimPress WP Pipes is vulnerable to PHP local file inclusion due to improper control of filenames used in include or require statements, potentially allowing unauthorized file access.

Executive Summary:
The ThimPress WP Pipes WordPress plugin contains a local file inclusion vulnerability that could allow unauthenticated attackers to read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2025-28979

Affected Software: ThimPress WP Pipes

Affected Versions: n/a through 1.4.3

Vulnerability: This vulnerability is a local file inclusion flaw (CWE-98) occurring because the application fails to properly sanitize filenames used in include or require statements. An unauthenticated attacker can exploit this via crafted input to the vulnerable component to access or manipulate files on the underlying filesystem.

Business Impact

The ability to include arbitrary local files poses a severe risk to the confidentiality, integrity, and availability of the host server. With a CVSS score of 8.1, this high-severity flaw could lead to full system compromise, the exposure of sensitive configuration files, or remote code execution, which may result in significant data breaches and operational downtime.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate and uninstall the WP Pipes plugin until a secure update is released by ThimPress.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal sequences (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal characters or unexpected file path parameters targeting the plugin directory.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of August 15, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is theoretically exploitable by an unauthenticated actor, the high attack complexity noted in the CVSS vector suggests that successful exploitation requires specific conditions or non-standard configurations.

Analyst Recommendation

Given the high CVSS score and the inherent dangers of local file inclusion vulnerabilities, this issue presents a substantial risk to any environment hosting the WP Pipes plugin. Organizations must prioritize the removal of the vulnerable component from the production environment until an official vendor fix is verified and deployed.

Description Summary:
ThimPress WP Pipes is vulnerable to Reflected Cross-site Scripting (XSS) due to improper neutralization of user-supplied input during web page generation.

Executive Summary:
A reflected Cross-site Scripting vulnerability in the ThimPress WP Pipes plugin allows unauthenticated attackers to execute malicious scripts in the context of a user session.

Vulnerability Details

CVE-ID: CVE-2025-28977

Affected Software: ThimPress WP Pipes

Affected Versions: n/a through 1.4.3

Vulnerability: This vulnerability is a Reflected Cross-site Scripting (CWE-79) flaw. It allows an unauthenticated attacker to inject malicious scripts into the web page, which are subsequently executed when a victim interacts with a crafted link.

Business Impact

Successful exploitation of this vulnerability could lead to the theft of session cookies, unauthorized actions performed on behalf of authenticated users, or the redirection of users to malicious external domains. Given the CVSS score of 7.1, this represents a significant security risk that could facilitate account compromise and undermine the integrity of the affected WordPress environment.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, administrators should monitor the ThimPress official website and the Patchstack database for the release of a security update and apply it immediately upon availability.

Proactive Monitoring: Security teams should review web access logs for suspicious URL parameters containing script tags or encoded characters that are characteristic of XSS attack patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block malicious input patterns, specifically focusing on reflected script injections targeting the WP Pipes plugin endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of August 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable via crafted links sent to unsuspecting users, making user awareness an important secondary defense.

Analyst Recommendation

This vulnerability presents a high risk due to the lack of required authentication for exploitation. While a patch is not yet confirmed, organizations should restrict access to the affected plugin functionality if possible or utilize a WAF to provide virtual patching. Prioritize the application of updates as soon as the vendor releases a version addressing this flaw to maintain the security posture of the WordPress instance.

Description Summary:
A SQL injection vulnerability in the cybio Gallery Widget plugin allows authenticated attackers to execute arbitrary SQL commands via improper neutralization of special elements.

Executive Summary:
A critical SQL injection vulnerability in the cybio Gallery Widget plugin allows authenticated attackers to potentially compromise database confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2025-28969

Affected Software: cybio Gallery Widget

Affected Versions: 0 through 1.2.1

Vulnerability: This vulnerability is a classic SQL Injection (CWE-89) arising from the improper handling of user-supplied input. It requires the attacker to possess at least low-level (authenticated) privileges to interact with the vulnerable plugin components.

Business Impact

The ability to inject arbitrary SQL commands poses a significant risk to organizational data. Successful exploitation could lead to unauthorized access to sensitive database information, potential data exfiltration, or disruption of database services. With a CVSS score of 8.5, this high-severity flaw requires immediate attention to prevent unauthorized database manipulation.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, users should monitor the official Patchstack advisory for updates and remove or deactivate the plugin if it is not mission-critical.

Proactive Monitoring: Security teams should review database query logs for anomalous syntax or suspicious patterns originating from the Gallery Widget plugin.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at WordPress plugin endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 7, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for complete database exposure, and the requirement for authenticated access does not significantly diminish the risk in environments where user accounts are compromised.

Analyst Recommendation

Given the high CVSS score of 8.5, this vulnerability represents a significant risk to the integrity of the backend database. Administrators must prioritize the identification of all instances of the cybio Gallery Widget within their environment and prepare to disable the plugin until a verified security update is released by the vendor.

Description Summary:
A SQL injection vulnerability exists in the Contact Us page - Contact people LITE plugin for WordPress, allowing authenticated users to execute arbitrary SQL commands via the plugin.

Executive Summary:
The Contact Us page - Contact people LITE plugin contains a SQL injection vulnerability that allows authenticated attackers to potentially exfiltrate sensitive database information.

Vulnerability Details

CVE-ID: CVE-2025-28967

Affected Software: Steve Truman Contact Us page - Contact people LITE

Affected Versions: 0 through 3.7.4

Vulnerability: The plugin fails to properly neutralize special elements in SQL commands. The CVSS vector indicates that an attacker with low privileges (authenticated) can trigger this flaw through a network-based attack vector.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to the underlying WordPress database. Given the CVSS score of 8.5, this is a high-severity issue that could result in the disclosure of sensitive user information, administrative credentials, or other critical application data.

Remediation Plan

Immediate Action: As there is no confirmed patch available at this time, administrators should immediately deactivate and remove the Contact Us page - Contact people LITE plugin until a secure version is released by the vendor.

Proactive Monitoring: Review database query logs for anomalous patterns or unexpected syntax that may indicate automated SQL injection attempts targeting the plugin.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a layer of protection while the plugin remains inactive.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 8, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for direct database interaction, which bypasses application-level logic.

Analyst Recommendation

The severity of this vulnerability, combined with the lack of an available patch, necessitates immediate action to secure the environment. Organizations should prioritize deactivating the affected plugin and assessing the database for any signs of unauthorized access or data modification.

Description Summary:
A missing authorization vulnerability in the URL Shortener plugin allows unauthenticated attackers to access restricted functionality due to improper access control constraints.

Executive Summary:
A critical missing authorization flaw in the Md Yeasin Ul Haider URL Shortener plugin allows unauthenticated remote attackers to bypass access controls, posing a significant risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2025-28965

Affected Software: Md Yeasin Ul Haider URL Shortener

Affected Versions: 0 through 3.0.7

Vulnerability: The vulnerability is a case of missing authorization (CWE-862) within the exact-links component, which fails to perform necessary capability checks. This allows unauthenticated users to execute functions that should be restricted to authorized administrators.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized modification of link data or the execution of administrative functions, potentially resulting in site defacement or the redirection of traffic to malicious destinations. Given the CVSS score of 8.6, this represents a high-severity risk that could undermine the integrity of the web application and compromise user trust.

Remediation Plan

Immediate Action: Since no official patch is currently confirmed, administrators should deactivate and remove the URL Shortener plugin until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for unusual requests directed at URL shortener endpoints, particularly those originating from unauthorized IP addresses or attempting to access administrative paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to the plugin's specific endpoints, though this should be considered a temporary measure only.

Exploitation Status

Public Exploit Available: No — exploit_available (false).

Analyst Notes: As of July 17, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any remote, unauthenticated user, making it an attractive target for automated scanning tools.

Analyst Recommendation

Due to the lack of a verified patch and the high CVSS score, the risk of unauthorized access is significant. Organizations using this plugin should prioritize removing the software from their environments immediately to prevent potential exploitation of these missing access controls.

Description Summary:
A deserialization of untrusted data vulnerability in the URL Shortener WordPress plugin allows unauthenticated attackers to perform object injection.

Executive Summary:
The URL Shortener plugin for WordPress contains a critical deserialization vulnerability that allows unauthenticated remote attackers to execute arbitrary code or cause a total system compromise.

Vulnerability Details

CVE-ID: CVE-2025-28961

Affected Software: Md Yeasin Ul Haider URL Shortener

Affected Versions: 0 through 3.0.7

Vulnerability: The vulnerability is an instance of CWE-502, Deserialization of Untrusted Data, which occurs because the plugin fails to properly validate input before deserializing it. This allows an unauthenticated attacker to inject malicious PHP objects into the application.

Business Impact

The severity of this flaw is reflected by its CVSS score of 9.8, indicating a critical risk that requires immediate attention. Successful exploitation grants an attacker the ability to achieve full system compromise, leading to unauthorized data access, potential data loss, and complete loss of service availability.

Remediation Plan

Immediate Action: There is no patch currently available for this vulnerability; users should immediately deactivate and uninstall the URL Shortener plugin until an official security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious serialized data patterns or unexpected POST requests directed at the plugin endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block malicious serialized objects and restrict access to the plugin directory if the software must remain installed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it allows for remote code execution without requiring user interaction or authentication.

Analyst Recommendation

Given the critical CVSS score of 9.8 and the lack of an available patch, this vulnerability poses a severe threat to your environment. Organizations must prioritize the immediate removal of the affected plugin to prevent potential exploitation. If the functionality is essential, continue to monitor the vendor references for the release of a secure version.

Description Summary:
A SQL injection vulnerability in the Md Yeasin Ul Haider URL Shortener plugin allows unauthenticated attackers to execute arbitrary SQL commands.

Executive Summary:
The URL Shortener plugin for WordPress contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-28959

Affected Software: Md Yeasin Ul Haider URL Shortener

Affected Versions: 0 through 3.0.7

Vulnerability: This is a SQL injection vulnerability (CWE-89) within the exact-links plugin. It allows an unauthenticated attacker to inject malicious SQL commands through unsanitized input parameters, enabling unauthorized database access.

Business Impact

The CVSS score of 9.3 classifies this as a critical severity issue. Successful exploitation grants attackers the ability to read sensitive information directly from the database, potentially leading to a total compromise of user data, plugin settings, or the underlying WordPress environment.

Remediation Plan

Immediate Action: Since a specific patch version is not currently listed, administrators should immediately deactivate and remove the URL Shortener plugin until a secure version is released by the vendor.

Proactive Monitoring: Monitor database query logs for unusual patterns or syntax errors that typically indicate SQL injection attempts. Review web server logs for suspicious requests targeting URL shortening parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads targeting WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements and the nature of SQL injection make this an attractive target for automated scanning tools.

Analyst Recommendation

Given the critical CVSS score and the unauthenticated nature of this flaw, the risk to your environment is severe. We strongly recommend immediate deactivation of the affected plugin to prevent potential data exfiltration. Monitor the vendor advisory page for updates regarding a fix before considering re-deployment.

Description Summary:
A path traversal vulnerability in the Easy Video Player Wordpress & WooCommerce plugin allows unauthenticated attackers to read arbitrary files from the server.

Executive Summary:
A critical path traversal vulnerability in the Easy Video Player plugin for WordPress allows unauthenticated attackers to perform unauthorized file access on the host server.

Vulnerability Details

CVE-ID: CVE-2025-28955

Affected Software: FWDesign Easy Video Player Wordpress & WooCommerce

Affected Versions: 0 through 10.0

Vulnerability: This is a path traversal vulnerability (CWE-22) caused by improper limitation of a pathname to a restricted directory. The flaw is exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/PR:N/UI:N.

Business Impact

The ability for an unauthenticated user to read arbitrary files poses a significant risk to data confidentiality. Attackers could potentially access sensitive configuration files, database credentials, or environment variables, leading to full site compromise or further lateral movement within the hosting environment. With a CVSS score of 7.5, this high-severity vulnerability requires immediate attention to prevent unauthorized data exfiltration.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate and uninstall the Easy Video Player plugin until the vendor releases a secure version.

Proactive Monitoring: Monitor web server access logs for suspicious requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the plugin's endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common directory traversal strings and unauthorized access attempts to sensitive file paths.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available in the provided data.

Analyst Notes: As of July 17, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the potential for direct file system access.

Analyst Recommendation

Given the unauthenticated nature of this vulnerability and the potential for sensitive information disclosure, administrators must prioritize the removal of the affected plugin. If the plugin is not essential, permanent removal is the safest course of action. Monitor vendor communications closely for the release of a patched version before considering re-installation.

Description Summary:
A blind SQL injection vulnerability in Codedraft Mediabay - WordPress Media Library Folders allows an authenticated attacker to manipulate database queries.

Executive Summary:
A blind SQL injection vulnerability in the Codedraft Mediabay WordPress plugin allows authenticated attackers to extract sensitive database information.

Vulnerability Details

CVE-ID: CVE-2025-28949

Affected Software: Codedraft Mediabay - WordPress Media Library Folders

Affected Versions: n/a through 1.4

Vulnerability: The plugin fails to properly neutralize special elements used in SQL commands, resulting in a blind SQL injection vulnerability (CWE-89). This flaw is exploitable by an authenticated user with low privileges, allowing for unauthorized data access.

Business Impact

This vulnerability poses a significant risk to data confidentiality and system integrity. Because it allows for blind SQL injection, an attacker could extract sensitive information from the WordPress database, potentially leading to a complete compromise of user credentials or proprietary site content. The CVSS score of 8.5 reflects the high potential for impact on sensitive data.

Remediation Plan

Immediate Action: There is no confirmed patch available at this time. Users should disable and remove the Mediabay plugin until a vendor-supplied security update is released and verified.

Proactive Monitoring: Security teams should monitor database query logs for anomalous patterns or unexpected syntax that may indicate automated injection attempts. Review access logs for unusual activity originating from low-privileged user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust SQL injection filtering rules to inspect and block malicious payloads targeting the WordPress environment.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown).

Analyst Notes: As of January 2, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the flaw is theoretically dangerous, the requirement for authentication limits the initial attack surface to existing site accounts.

Analyst Recommendation

Given the high CVSS score and the nature of SQL injection, this vulnerability should be treated as a priority for remediation. Administrators must identify all instances of the Mediabay plugin and remove them immediately, as no official patch is currently available to mitigate the underlying flaw.

Description Summary:
The Red Hat Cluster Observability Operator improperly assigns excessive permissions to ServiceAccounts, allowing namespaced users to escalate privileges to the cluster level.

Executive Summary:
A critical privilege escalation vulnerability in the Red Hat Cluster Observability Operator allows authenticated users with limited namespace access to gain unauthorized cluster-wide administrative control.

Vulnerability Details

CVE-ID: CVE-2025-2843

Affected Software: Red Hat Cluster Observability Operator

Affected Versions: rhobs observability-operator versions 0 up to 1.3.0

Vulnerability: This vulnerability involves incorrect privilege assignment (CWE-266) where the operator creates a ServiceAccount with ClusterRole permissions when deploying a MonitorStack. An authenticated attacker controlling a namespace can impersonate this ServiceAccount to escalate privileges from a namespaced user to a cluster-level administrator.

Business Impact

The ability to escalate privileges to the cluster level poses a severe risk to organizational infrastructure, potentially leading to a total compromise of the Kubernetes environment. Given the CVSS score of 8.8, this flaw represents a High severity risk that could result in unauthorized data access, service disruption, and the manipulation of sensitive cluster resources.

Remediation Plan

Immediate Action: Update the Red Hat Cluster Observability Operator to version 1.3.0 or later, specifically ensuring the deployment reflects version 1.3.0-1762825457 or higher.

Proactive Monitoring: Monitor Kubernetes audit logs for suspicious ServiceAccount impersonation attempts or unexpected escalation of privileges within namespaces where MonitorStack resources are deployed.

Compensating Controls: Implement strict Kubernetes Role-Based Access Control (RBAC) policies to limit the ability of users to create or modify Custom Resources within sensitive namespaces until the patch is applied.

Exploitation Status

Public Exploit Available: False (exploit_available: unknown)

Analyst Notes: As of November 14, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the nature of Kubernetes privilege escalation, which bypasses standard isolation boundaries.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity and confidentiality of Kubernetes clusters. Organizations utilizing the Observability Operator must prioritize the deployment of the provided patch to prevent unauthorized escalation. Immediate action is required to ensure that tenant-level users cannot bypass intended security boundaries and gain cluster-wide administrative access.

Description Summary:
A CRLF injection vulnerability in Neto CMS versions 6.313.0 through 6.314.0 allows unauthenticated attackers to execute arbitrary code via a crafted HTTP request.

Executive Summary:
A critical CRLF injection vulnerability in Neto CMS allows unauthenticated attackers to achieve remote code execution, necessitating immediate attention.

Vulnerability Details

CVE-ID: CVE-2025-28357

Affected Software: Neto CMS

Affected Versions: v6.313.0 through v6.314.0

Vulnerability: The application suffers from a CRLF injection flaw that allows unauthenticated remote attackers to inject malicious headers or payloads into HTTP responses, ultimately leading to arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability permits an unauthenticated attacker to execute arbitrary code on the underlying server, which may lead to a complete system compromise. Given the CVSS score of 8.8, this flaw represents a significant risk to data confidentiality, integrity, and system availability. Organizations should consider this a high priority event to prevent unauthorized access and potential data exfiltration.

Remediation Plan

Immediate Action: Since a specific patch is not yet confirmed, administrators should restrict access to the affected CMS interfaces and monitor for unusual HTTP request patterns. Contact the vendor immediately for the latest security guidance or security-hardened releases.

Proactive Monitoring: Security teams should review web server logs for suspicious characters such as carriage return (CR) or line feed (LF) sequences in incoming HTTP requests. Monitor for unauthorized child processes spawned by the web server service.

Compensating Controls: Deploy or update rules on a Web Application Firewall (WAF) to inspect and block HTTP requests containing CRLF sequences or unexpected control characters. Ensure the web server is running with the principle of least privilege to minimize the impact of a potential code execution event.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up referenced by the CVE record.

Analyst Notes: As of October 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public write-up detailing the attack vector significantly lowers the barrier for potential attackers.

Analyst Recommendation

Due to the severity of remote code execution and the existence of public proof-of-concept material, this vulnerability poses a severe threat to infrastructure integrity. Administrators must prioritize the identification of affected instances and apply vendor-provided updates as soon as they become available. Until an official patch is deployed, implement aggressive WAF filtering to mitigate the risk of exploitation.

Description Summary:
IBM Operational Decision Manager is vulnerable to an open redirect flaw that allows remote attackers to conduct phishing attacks by spoofing trusted URLs.

Executive Summary:
A vulnerability in IBM Operational Decision Manager allows unauthenticated remote attackers to perform open redirect attacks, potentially facilitating credential theft or phishing campaigns.

Vulnerability Details

CVE-ID: CVE-2025-2824

Affected Software: IBM Operational Decision Manager

Affected Versions: 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0

Vulnerability: This is an open redirect vulnerability (CWE-601) occurring when the application improperly validates user supplied input used for redirection. An unauthenticated attacker can exploit this to craft malicious links that appear to originate from the trusted IBM domain, thereby deceiving users into visiting malicious external sites.

Business Impact

Successful exploitation of this flaw significantly increases the risk of successful phishing campaigns against organizational users. By leveraging the trust associated with the legitimate IBM domain, attackers can bypass typical user vigilance, leading to the theft of sensitive credentials, session tokens, or other proprietary information. Given the CVSS score of 7.4, this issue is considered high severity due to its potential to facilitate broader social engineering attacks.

Remediation Plan

Immediate Action: Apply the specific interim fixes provided by IBM for each affected version, as detailed in the official security bulletin.

Proactive Monitoring: Monitor web server access logs for anomalous redirection patterns or frequent requests to external domains initiated from the internal application.

Compensating Controls: Implement a Content Security Policy (CSP) that restricts allowed redirection targets and ensure that any user redirection logic is strictly validated against a whitelist of trusted domains.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 1, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While open redirects are often categorized as lower risk, their utility in sophisticated phishing campaigns makes them a frequent target for attackers seeking to establish initial access.

Analyst Recommendation

Organizations utilizing IBM Operational Decision Manager must prioritize the application of the vendor provided interim fixes to neutralize this redirection vector. Given the ease of exploitation, administrators should treat this update with urgency to prevent the application from being weaponized to target internal personnel through phishing.

Description Summary:
Grandstream GXP1628 devices running firmware version 1.0.4.130 or earlier contain an incorrect access control flaw, allowing unauthorized directory listing and access to sensitive files.

Executive Summary:
The Grandstream GXP1628 IP phone is vulnerable to an incorrect access control flaw that permits unauthorized access to sensitive system files and directories.

Vulnerability Details

CVE-ID: CVE-2025-28170

Affected Software: Grandstream GXP1628

Affected Versions: <=1.0.4.130

Vulnerability: The device suffers from an incorrect access control vulnerability due to directory listing being enabled by default. This flaw allows an authenticated user with low privileges to traverse and access sensitive directories and files on the device.

Business Impact

The ability for an unauthorized user to list directories and access sensitive files poses a significant risk to the confidentiality of the device configuration and potentially stored credentials. Given the CVSS score of 7.6, this vulnerability represents a high risk that could lead to full device compromise or lateral movement within the voice network.

Remediation Plan

Immediate Action: Organizations should restrict network access to the administrative interface of the GXP1628 to trusted management subnets only. Verify if a firmware update is available from the vendor and apply it as soon as it is released.

Proactive Monitoring: Monitor network traffic for unusual GET requests to directories or attempts to access configuration files. Review device access logs for unauthorized attempts to navigate the file system.

Compensating Controls: Implement strict network segmentation to isolate IP phones from the main corporate network. Use a firewall to block all external access to the device web interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub Gist.

Analyst Notes: As of July 30, 2025, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the nature of the directory listing flaw.

Analyst Recommendation

This vulnerability presents a high risk to organizational security due to the exposure of sensitive system data. Administrators should prioritize isolating affected devices from untrusted networks and check the vendor support page frequently for a firmware patch to address this access control failure.

Description Summary:
An unauthenticated remote attacker can trigger a Denial of Service on Phoenix Contact AXL F BK devices by flooding the HTTP service on port 80 with excessive requests.

Executive Summary:
A critical resource exhaustion vulnerability in Phoenix Contact AXL F BK series modules allows unauthenticated remote attackers to perform a Denial of Service attack.

Vulnerability Details

CVE-ID: CVE-2025-2813

Affected Software: Phoenix Contact AXL F BK Series

Affected Versions: AXL F BK PN (0.0-1.33), AXL F BK PN XC (0.0-1.33), AXL F BK PN discontinued (0.0-1.06), AXL F BK PN XC discontinued (0.0-1.06), AXL F BK SAS discontinued (0.0-1.35), AXL F BK ETH (0.0-1.31)

Vulnerability: This vulnerability is a resource exhaustion flaw (CWE-770) occurring because the HTTP service lacks proper request throttling, allowing an unauthenticated remote attacker to crash the service via high traffic volume.

Business Impact

The successful exploitation of this vulnerability results in a Denial of Service, which effectively takes the affected industrial communication modules offline. Given a CVSS score of 7.5, this represents a high-severity risk to operational continuity, potentially causing significant disruption to connected industrial processes and systems.

Remediation Plan

Immediate Action: Consult the official Phoenix Contact security advisory at the CERT VDE portal to identify available firmware updates or vendor-recommended configuration changes for the specific hardware revision.

Proactive Monitoring: Monitor network traffic for unusual spikes or sustained high request rates directed at port 80 on industrial control devices.

Compensating Controls: Implement network segmentation and restrict access to the web management interface of these devices to trusted management subnets only, effectively blocking untrusted remote access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 1, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its automatable nature, meaning the barrier to entry for an attacker is minimal.

Analyst Recommendation

Organizations utilizing these Phoenix Contact modules must prioritize the application of vendor patches as soon as they become available. Until updates are deployed, strict network isolation of the management interface is necessary to mitigate the risk of remote service disruption.

Description Summary:
A flaw in the doFilter function of itranswarp versions up to 2.19 allows unauthenticated remote attackers to bypass access controls and gain unauthorized access to sensitive components.

Executive Summary:
A critical access control vulnerability in itranswarp allows unauthenticated attackers to gain unauthorized access to sensitive system components.

Vulnerability Details

CVE-ID: CVE-2025-28041

Affected Software: Michael Liao itranswarp

Affected Versions: Up to 2.19

Vulnerability: The application fails to properly enforce access controls within the doFilter function, enabling unauthenticated users to access restricted resources or sensitive components.

Business Impact

The ability for an unauthenticated attacker to access sensitive components poses a significant risk to data confidentiality and integrity. With a CVSS score of 8.6, this vulnerability is categorized as High severity, as it permits unauthorized parties to interact with backend functions without any credentials. Successful exploitation could lead to unauthorized data exposure or manipulation, potentially resulting in severe reputational damage and loss of system trust.

Remediation Plan

Immediate Action: Review the official GitHub repository for itranswarp to identify if a security patch has been released for version 2.19 or higher.

Proactive Monitoring: Monitor server access logs for anomalous traffic patterns, specifically requests directed toward administrative or sensitive endpoints originating from unknown or unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block unauthorized requests to internal application paths or sensitive components that should not be exposed to the public internet.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of August 21, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements, making it highly automatable for remote attackers.

Analyst Recommendation

Given the High severity of this vulnerability and the lack of authentication required for exploitation, organizations using itranswarp should prioritize identifying their current version. If the software is running version 2.19 or earlier, immediately restrict public access to the vulnerable instance and monitor for vendor updates via the official GitHub repository to mitigate the risk of unauthorized access.

Description Summary:
The WP Event Manager plugin is vulnerable to Stored Cross-Site Scripting via the organizer_name parameter, allowing unauthenticated attackers to inject malicious scripts into the application.

Executive Summary:
A high-severity stored Cross-Site Scripting vulnerability in the WP Event Manager plugin allows unauthenticated attackers to execute arbitrary web scripts, posing a significant risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2025-2800

Affected Software: WP Event Manager, WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce

Affected Versions: 0 through 3.1.50

Vulnerability: This flaw is a Stored Cross-Site Scripting (CWE-79) vulnerability occurring due to insufficient input sanitization and output escaping on the organizer_name parameter. It allows unauthenticated attackers to inject malicious JavaScript that executes when a user visits the affected page.

Business Impact

Successful exploitation of this vulnerability allows unauthorized actors to execute arbitrary scripts in the context of a victim's browser session. This can lead to session hijacking, unauthorized actions performed on behalf of administrators, or the redirection of site visitors to malicious domains. Given the CVSS score of 7.2, this vulnerability represents a high risk to organizational security and user trust.

Remediation Plan

Immediate Action: Update the WP Event Manager plugin to the latest version, ensuring it is at least version 3.1.51 or higher, as provided by the vendor.

Proactive Monitoring: Monitor site traffic for suspicious patterns, particularly interactions involving the organizer_name field, and regularly audit administrative logs for unauthorized session activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured rules to detect and block cross-site scripting attempts targeting common WordPress plugin parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature, which facilitates automated exploitation attempts.

Analyst Recommendation

The severity of this vulnerability, combined with the lack of required authentication for exploitation, necessitates immediate attention. Administrators must prioritize updating the affected plugin across all WordPress instances to prevent potential compromise. Failure to patch may expose the platform and its users to persistent malicious script injection and subsequent account takeovers.

Description Summary:
A vulnerability in AnyDesk through 9.0.4 allows a remotely connected user with specific permissions to modify security settings and bypass future connection confirmation requirements.

Executive Summary:
A high-severity authentication bypass vulnerability in AnyDesk allows an attacker to gain persistent, unauthorized access to remote devices by manipulating security profiles.

Vulnerability Details

CVE-ID: CVE-2025-27919

Affected Software: AnyDesk AnyDesk

Affected Versions: Through 9.0.4

Vulnerability: The vulnerability exists because an authenticated remote user with "Control my device" permissions can modify application settings to enable a Full Access profile without requiring counterparty authorization. This allows the attacker to establish subsequent connections to the host without any interaction or consent from the victim.

Business Impact

The ability to gain persistent, unauthorized access to a remote system poses a severe risk to organizational data integrity and confidentiality. Given the CVSS score of 8.2, this vulnerability is considered a high-risk flaw that could facilitate lateral movement or the deployment of malicious software within an internal network. Organizations utilizing remote access tools for support or administration are at significant risk of compromise if their AnyDesk instances are not secured.

Remediation Plan

Immediate Action: Update the AnyDesk application to a version beyond 9.0.4 immediately to remediate the underlying logic flaw.

Proactive Monitoring: Review AnyDesk access logs for unauthorized connections or unexpected modifications to security settings and user profiles.

Compensating Controls: Restrict remote access permissions to trusted users only and implement network-level access controls to limit the exposure of remote administration software.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 7, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw relies on an existing remote session, meaning an attacker must already have a foothold in a session with specific permissions to trigger the bypass.

Analyst Recommendation

This vulnerability represents a significant security risk for any environment relying on AnyDesk for remote support or connectivity. Administrators should prioritize updating all instances of the software to the latest available version to close the unauthorized access path. Failure to patch allows a previously authorized user to transform their access into persistent, unauthenticated-style entry, which could be leveraged for long-term espionage or system control.

Description Summary:
AnyDesk is vulnerable to a remote denial of service attack due to improper deserialization, causing memory allocation failures and NULL pointer dereferences.

Executive Summary:
A remote denial of service vulnerability in AnyDesk allows unauthenticated attackers to crash the application across multiple platforms.

Vulnerability Details

CVE-ID: CVE-2025-27917

Affected Software: AnyDesk

Affected Versions: Windows before 9.0.5, macOS before 9.0.1, Linux before 7.0.0, iOS before 7.1.2, Android before 8.0.0

Vulnerability: This vulnerability involves incorrect deserialization of data, which triggers a failed memory allocation and subsequent NULL pointer dereference. The flaw is exploitable by unauthenticated remote attackers.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation results in a complete denial of service, rendering remote support and administrative access unavailable. This disruption can significantly impact IT operations, incident response capabilities, and general business productivity.

Remediation Plan

Immediate Action: Update AnyDesk software to the latest versions (Windows 9.0.5+, macOS 9.0.1+, Linux 7.0.0+, iOS 7.1.2+, or Android 8.0.0+) immediately to resolve the deserialization flaw.

Proactive Monitoring: Monitor system logs for unexpected application crashes or service restarts that may indicate attempted exploitation of this memory-related flaw.

Compensating Controls: Restrict network access to AnyDesk management ports via firewall rules to ensure that only authorized IP ranges can communicate with the application.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of November 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of this flaw makes it inherently susceptible to automated exploitation attempts.

Analyst Recommendation

Given the high CVSS score and the existence of proof-of-concept material, organizations must prioritize patching their AnyDesk deployments. Failure to update leaves remote management infrastructure vulnerable to service disruption, which may be leveraged to impede security operations or organizational agility.

Description Summary:
AnyDesk for Windows before 9.0.6 and Android before 8.0.0 are vulnerable to ID spoofing when connections are established via IP address, allowing for potential data manipulation.

Executive Summary:
A critical vulnerability in AnyDesk allows unauthenticated attackers to spoof AnyDesk IDs and manipulate connection data, posing a significant risk to remote access integrity.

Vulnerability Details

CVE-ID: CVE-2025-27916

Affected Software: AnyDesk (Windows and Android)

Affected Versions: Windows before 9.0.6; Android before 8.0.0

Vulnerability: The vulnerability exists in the connection handshake process when two clients connect directly via IP address. An unauthenticated attacker can manipulate data packets to spoof the expected AnyDesk ID, effectively performing a man-in-the-middle or impersonation attack.

Business Impact

The ability to spoof an AnyDesk ID undermines the core trust model of remote support and management sessions. Successful exploitation could allow unauthorized parties to masquerade as legitimate administrators or support staff, potentially leading to unauthorized system access, data exfiltration, or the deployment of malicious payloads. Given the CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent compromise of remote management infrastructure.

Remediation Plan

Immediate Action: Update all instances of AnyDesk for Windows to version 9.0.6 or later and AnyDesk for Android to version 8.0.0 or later.

Proactive Monitoring: Review AnyDesk connection logs for unexpected IP addresses or anomalous connection patterns during remote support sessions.

Compensating Controls: Restrict AnyDesk direct IP connections via host-based firewalls, requiring all traffic to route through verified AnyDesk relay infrastructure where possible.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of November 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it targets the trust mechanism used to verify the identity of remote counterparts.

Analyst Recommendation

Organizations relying on AnyDesk for remote operations must prioritize this update to maintain the integrity of their remote access environment. Because the flaw allows for impersonation without authentication, the risk of exploitation is elevated. Please verify that all endpoints are updated to the specified versions immediately to neutralize the risk of ID spoofing and session manipulation.

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the Zimbra Classic Web Client allows attackers to execute arbitrary JavaScript by sending malicious ICS files to victims.

Executive Summary:
A critical stored cross-site scripting vulnerability in Zimbra Collaboration Suite is currently being exploited in the wild, posing a significant risk of account compromise and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2025-27915

Affected Software: Synacor Zimbra Collaboration Suite (ZCS)

Affected Versions: ZCS 9.0 prior to P44, 10.0 prior to 10.0.13, and 10.1 prior to 10.1.5

Vulnerability: This is a stored cross-site scripting (XSS) flaw in the Classic Web Client that occurs due to improper sanitization of HTML content within ICS files. An attacker can trigger the execution of arbitrary JavaScript within a victim's session when they view a specially crafted email, requiring authenticated user interaction to successfully execute the payload.

Business Impact

The vulnerability carries a CVSS score of 9.5, reflecting its potential for severe impact on organizational security. A successful exploit allows an attacker to hijack user sessions, which can lead to unauthorized actions such as modifying email filters to redirect communications or exfiltrating sensitive corporate data. Given the active exploitation status, this flaw represents an immediate threat to the confidentiality and integrity of email environments.

Remediation Plan

Immediate Action: Administrators must immediately upgrade to the patched versions: ZCS 9.0.0/P44, ZCS 10.0.13, or ZCS 10.1.5.

Proactive Monitoring: Security teams should monitor mail logs for suspicious filtering activity or unexpected redirection rules created by users.

Compensating Controls: Deploy Web Application Firewall (WAF) rules designed to identify and block malicious ICS attachments or suspicious

Description Summary:
A vulnerability in the ESPEC North America Web Controller allows unauthenticated attackers to retrieve a JWT secret, leading to unauthorized UI access and elevated permissions.

Executive Summary:
A critical vulnerability in the ESPEC North America Web Controller allows unauthenticated attackers to hijack sessions and gain elevated administrative access.

Vulnerability Details

CVE-ID: CVE-2025-27845

Affected Software: ESPEC North America Web Controller

Affected Versions: 3 before 3.3.4

Vulnerability: The flaw resides in the /api/v4/auth/ endpoint, which exposes a JSON Web Token (JWT) secret when processing invalid authentication requests. This allows an unauthenticated attacker to forge tokens and achieve elevated UI permissions.

Business Impact

The ability for an unauthenticated attacker to gain administrative control over the web controller poses a severe risk to operational integrity. A successful exploit could result in unauthorized configuration changes, potential manipulation of controlled hardware, and complete compromise of the management interface. Given the high CVSS score of 9.8, this vulnerability represents an urgent threat to system confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update all instances of the ESPEC North America Web Controller to version 3.3.4 or later to patch the authentication disclosure flaw.

Proactive Monitoring: Monitor network traffic for unusual requests directed at the /api/v4/auth/ endpoint and review system access logs for unauthorized administrative activity.

Compensating Controls: Implement strict network segmentation to ensure the web controller interface is not exposed to the public internet, and utilize a Web Application Firewall to filter suspicious API requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 14, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of required authentication and the ease of reaching the vulnerable API endpoint.

Analyst Recommendation

This vulnerability is critical due to the potential for total system compromise by unauthenticated actors. Security teams must prioritize patching to version 3.3.4 immediately. If an immediate update is not feasible, restrict access to the web controller interface to authorized management networks only to mitigate the risk of remote exploitation.

Description Summary:
An out of bounds write vulnerability exists in the Apache Hadoop HDFS native client, potentially allowing for memory corruption or unauthorized system behavior.

Executive Summary:
An out of bounds write vulnerability in the Apache Hadoop HDFS native client presents a significant risk of memory corruption and potential system instability.

Vulnerability Details

CVE-ID: CVE-2025-27821

Affected Software: Apache Software Foundation Hadoop HDFS native client

Affected Versions: 3.2.0 up to (excluding) 3.4.2

Vulnerability: This vulnerability is an out of bounds write (CWE-787) flaw within the HDFS native client. Based on the CVSS vector, the vulnerability is exploitable by an unauthenticated remote attacker with low complexity.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high severity. Successful exploitation could lead to memory corruption, which may result in application crashes, denial of service, or potentially lead to remote code execution depending on the specific environment and memory layout. Such impacts threaten the availability and integrity of data processing pipelines reliant on Hadoop clusters.

Remediation Plan

Immediate Action: Upgrade the Apache Hadoop HDFS native client to version 3.4.2 or later to apply the necessary security fixes.

Proactive Monitoring: Review system and application logs for unusual crashes, segmentation faults, or unexpected behavior in the HDFS native client processes that may indicate exploitation attempts.

Compensating Controls: Ensure the Hadoop cluster is deployed within a protected network segment with strict access controls to minimize exposure of the native client to untrusted network traffic.

Exploitation Status

Public Exploit Available: No confirmed public exploit is available.

Analyst Notes: As of January 28, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The flaw is inherently dangerous due to its potential for memory corruption, but current data shows no widespread exploitation activity.

Analyst Recommendation

Given the potential for memory corruption and the high CVSS severity, organizations should prioritize updating their Hadoop deployments. Administrators must verify their current version of the HDFS native client and plan for an immediate migration to version 3.4.2 to eliminate this exposure.

Description Summary:
UpTrain is susceptible to an injection vulnerability due to improper neutralization of special elements in output used by a downstream component.

Executive Summary:
An injection vulnerability in the UpTrain platform allows authenticated attackers to potentially compromise system integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-27772

Affected Software: uptrain-ai uptrain

Affected Versions: <= 0.7.1

Vulnerability: This vulnerability is categorized as CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. The flaw requires low-level user privileges to execute, allowing an authenticated attacker to inject malicious elements into downstream processes.

Business Impact

The exploitation of this injection vulnerability could lead to total loss of confidentiality, integrity, and availability for the affected platform. With a CVSS score of 7.4, the risk is classified as high, indicating that successful exploitation could result in unauthorized data access or disruption of critical AI evaluation workflows, leading to significant operational impact.

Remediation Plan

Immediate Action: Review the official GitHub repository for UpTrain to identify if a security patch has been released for version 0.7.1, and update the software immediately upon availability.

Proactive Monitoring: Monitor application logs for suspicious input patterns or unexpected execution of system commands that deviate from normal operational behavior.

Compensating Controls: Implement strict input validation and sanitization routines at the application layer to neutralize special characters before they are passed to downstream components.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by an authenticated user, necessitating prompt attention to security updates.

Analyst Recommendation

Given the high severity of this injection vulnerability, administrators should prioritize updating their instances of UpTrain. Until a formal patch is applied, ensure that access controls are strictly enforced to minimize the risk of unauthorized users leveraging this vector.