CVE Уведомления

Мониторинг уязвимостей, аналитика угроз и оперативные CVE-оповещения. База данных актуальных уязвимостей (Common Vulnerabilities and Exposures) с подробным описанием рисков, оценкой критичности по шкале CVSS и официальными рекомендациями по устранению.

  • CVE-2025-61505

    🚨 CVE-2025-61505 e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled...

  • CVE-2025-55903

    🚨 CVE-2025-55903 A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address...

  • CVE-2025-56747

    🚨 CVE-2025-56747 Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller...

  • CVE-2025-54603

    🚨 CVE-2025-54603 An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or...

  • CVE-2025-60535

    🚨 CVE-2025-60535 A Cross-Site Request Forgery (CSRF) in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute...

  • CVE-2025-57618

    🚨 CVE-2025-57618 A path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker to read arbitrary files on the server. By...

  • CVE-2025-60536

    🚨 CVE-2025-60536 An issue in the Configure New Cluster interface of kafka-ui v0.6.0 to v0.7.2 allows attackers to cause a Denial of Service (DoS)...

  • CVE-2025-60537

    🚨 CVE-2025-60537 Improper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafka-ui v0.6.0 to v0.7.2 allows attackers...

  • CVE-2025-60374

    🚨 CVE-2025-60374 Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. The...

  • CVE-2025-60540

    🚨 CVE-2025-60540 karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF).

  • CVE-2025-56746

    🚨 CVE-2025-56746 Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling...

  • CVE-2025-56748

    🚨 CVE-2025-56748 Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates...

  • CVE-2025-56749

    🚨 CVE-2025-56749 Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret...

  • CVE-2025-22381

    🚨 CVE-2025-22381 Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a...

  • CVE-2025-61536

    🚨 CVE-2025-61536 FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the untrusted `req.headers.host` header and...

  • CVE-2025-61539

    🚨 CVE-2025-61539 Cross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parameter in lostpassword.php.

  • CVE-2025-61540

    🚨 CVE-2025-61540 SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php.

  • CVE-2025-61541

    🚨 CVE-2025-61541 Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent...

Статистика статей

Статьи
53,084
Просмотры
242,330
Защита от мошенничества: Использование посредника минимизирует риски столкнуться с «продавцами-однодневками» или недобросовестными заказчиками, которые исчезают после получения предоплаты или результата работы.
Назад
Сверху