CVE Vulnerability Advisory Database

[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.

[Impact] Attackers can bypass authentication using crafted JWTs, leading to full administrative account takeover.

[Mitigation] Apply official vendor patches immediately and enforce strict JWT algorithm validation policies.

[Affected Scope] All versions of Adobe Commerce and Magento Open Source prior to APSB26-73.

[Impact] Remote Code Execution (RCE) via malicious file upload, leading to full server compromise and potential data exfiltration.

[Mitigation] Apply official Adobe security patches (APSB26-73) immediately and restrict execution permissions in upload directories.

[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software

[Impact] Unauthenticated remote attackers can bypass authentication and execute scripts to obtain full root access to the underlying operating system

[Mitigation] Immediate application of official security patches and restriction of management interface access via ACLs

[Affected Scope] xiweicheng TMS up to version 2.28.0

[Impact] Unauthenticated remote attackers can access internal network resources, invoke internal APIs, or potentially escalate to Remote Code Execution (RCE)

[Mitigation] Apply the latest security patches, sanitize the 'url' parameter in HtmlUtil.java, or deploy WAF rules to block outbound requests to private IP ranges

[Affected Scope] FeMiner wms up to commit 9cad1f1b179a98b9547fd003c23b07c7594775fa

[Impact] Unauthenticated remote attackers can manipulate the Username parameter to execute arbitrary SQL commands and compromise the database

[Mitigation] Implement parameterized queries in the source code and deploy Web Application Firewall (WAF) rules to block malicious payloads

[Affected Scope] FortiOS versions 6.4 through 7.6 and FortiSwitchManager versions 7.0 through 7.2.

[Impact] Unauthenticated remote attackers can execute arbitrary code or commands with system privileges by sending crafted packets, leading to full system compromise.

[Mitigation] Immediately apply the latest firmware updates provided by Fortinet and restrict exposure of management interfaces and VPN services to the public internet.

[Affected Scope] Administrator panel component (/Administrator/PHP/AdminViewSongs.php) in code-projects Online Music Site 1.0

[Impact] Unauthenticated remote attackers can manipulate the ID parameter to execute arbitrary SQL commands, leading to complete database compromise

[Mitigation] Implement parameterized queries (Prepared Statements) immediately and restrict external access to the administrator directory

[Affected Scope] Campcodes Supplier Management System version 1.0, specifically the /retailer/edit_profile.php endpoint.

[Impact] Unauthenticated remote attackers can manipulate the txtRetailerAddress parameter to compromise the database, extract sensitive data, or potentially achieve remote code execution.

[Mitigation] Implement parameterized queries (Prepared Statements), sanitize user inputs, and deploy Web Application Firewall (WAF) rules to block malicious SQL payloads.

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-61882

[Impact] Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versi...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-53770

[Impact] Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network....

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Craft CMS versions 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server via crafted HTTP requests, leading to complete system compromise.

[Mitigation] Immediately upgrade your Craft CMS installation to the patched versions (3.9.15, 4.14.15, or 5.6.17) depending on your major version branch.

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-24989

[Impact] An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially byp...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-0282

[Impact] A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Systems running unpatched versions impacted by CVE-2024-40711

[Impact] A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE)....

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Systems running unpatched versions impacted by CVE-2024-7593

[Impact] Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated a...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Systems running unpatched versions impacted by CVE-2024-21413

[Impact] Microsoft Outlook Remote Code Execution Vulnerability...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Systems running unpatched versions impacted by CVE-2023-47246

[Impact] In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat we...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Systems running unpatched versions impacted by CVE-2023-27350

[Impact] This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentic...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Systems running unpatched versions impacted by CVE-2021-32030

[Impact] The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authenticatio...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Systems running unpatched versions impacted by CVE-2020-10987

[Impact] The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via t...

[Mitigation] Apply vendor security patches and restrict external network exposure.