CVE-2025-67813
Quest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for inter-process communication
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2025-67811
Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers to inject arbitrary SQL commands, resulting in unauthorized database access and potential compromise of sensitive data. Fixed in v.1.47.4 and beyond.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67810
In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read arbitrary files from the server filesystem. Fixed in 1.47.4 (#7254) and further versions.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-6781
The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the 'copymatic-menu' page. This makes it possible for unauthenticated attackers to update the copymatic_apikey option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PUBLISHED
- Vendor
- ryanfaber
- Product
- Copymatic – AI Content Writer & Generator
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-67809
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. Because these credentials are embedded directly in the Zimlet, any unauthorized party could retrieve them and misuse the Flickr integration. An attacker with access to the exposed credentials could impersonate the legitimate application and initiate valid Flickr OAuth flows. If a user is tricked into approvin
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67807
The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behaviour in newer versions.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67806
The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behavior in newer versions.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- LOW
- Conflicts
- 1
CVE-2025-67805
A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensitive information such as hashes and table names. This feature is disabled by default in all installations and never available in Sage DPW Cloud. It was forcibly disabled again in version 2025_06_003.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67796
IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users data and, in some cases, perform privileged actions. This issue may enable cross-tenant access. Fixed in version 2.10.6.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-67794
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the agent are created with overly permissive ACLs, allowing local users without administrator rights to trigger actions or destabilize the agent.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-67793
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the Administrator role. This issue mainly affects cloud multi-tenant deployments; on-prem single-tenant installations are typically not impacted because local admins usually already have Supervisor privileges.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-67792
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate a DriveLock process to execute arbitrary commands on Windows computers.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-67791
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in DriveLock tenant allows attackers to impersonate any DriveLock agent on the network against the DES (DriveLock Enterprise Service).
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-67790
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. An unprivileged user could cause occasionally a Blue Screen Of Death (BSOD) on Windows computers by using an IOCTL and an unterminated string.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-6779
An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
PUBLISHED
- Vendor
- Axis Communications AB
- Product
- AXIS OS
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-67789
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users can retrieve the computer count of other DriveLock tenants via the DriveLock API.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67787
An issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allows for session takeover over a network.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-67781
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate privileged processes to gain more privileges on Windows computers.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-6778
A vulnerability, which was classified as problematic, was found in code-projects Food Distributor Site 1.0. Affected is an unknown function of the file /admin/save_settings.php. The manipulation of the argument site_phone/site_email/address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
PUBLISHED
- Vendor
- code-projects
- Product
- Food Distributor Site
- Provider severity
- LOW, MEDIUM
- Conflicts
- 2
CVE-2025-67779
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
PUBLISHED
- Vendor
- Meta, Meta, Meta
- Product
- react-server-dom-parcel, react-server-dom-webpack, react-server-dom-turbopack
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2025-6777
A vulnerability, which was classified as critical, has been found in code-projects Food Distributor Site 1.0. This issue affects some unknown processing of the file /admin/process_login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
PUBLISHED
- Vendor
- code-projects
- Product
- Food Distributor Site
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 2
CVE-2025-6776
A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.8 is able to address this issue. The name of the patch is e23559b98c8ea2957f09978c29f4e512ba78
PUBLISHED
- Vendor
- xiaoyunjie
- Product
- openvpn-cms-flask
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1
CVE-2025-67752
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper (`oeHttp`/`oeHttpRequest`) disables SSL/TLS certificate verification by default (`verify: false`), making all external HTTPS connections vulnerable to man-in-the-middle (MITM) attacks. This affects communication with government healthcare APIs and user-configurable external services, potentially exposing Protected Health Information (PHI).
PUBLISHED
- Vendor
- openemr
- Product
- openemr
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-67751
ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the `EventEditor.php` file. When creating a new event and selecting an event type, the `EN_tyid` POST parameter is not sanitized. This allows an authenticated user with event management permissions (`isAddEvent`) to execute arbitrary SQL queries. Version 6.5.0 fixes the issue.
PUBLISHED
- Vendor
- ChurchCRM
- Product
- CRM
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-67750
Lightning Flow Scanner provides a A CLI plugin, VS Code Extension and GitHub Action for analysis and optimization of Salesforce Flows. Versions 6.10.5 and below allow a maliciously crafted flow metadata file to cause arbitrary JavaScript execution during scanning. The APIVersion rule uses new Function() to evaluate expression strings, enabling an attacker to supply a malicious expression within rule configuration or crafted flow metadata. This could compromise developer machines, CI runners, or
PUBLISHED
- Vendor
- Flow-Scanner
- Product
- lightning-flow-scanner
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-6775
A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function create_user of the file /app/api/v1/openvpn.py of the component User Creation Endpoint. The manipulation of the argument Username leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.8 is able to address this issue. The patch is named e23559b98c8ea2957f09978c29f4e5
PUBLISHED
- Vendor
- xiaoyunjie
- Product
- openvpn-cms-flask
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-67749
PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. In versions 2.5.377 and below, an unchecked offset and size used in a memcpy operation inside PCSX2's CDVD SCMD 0x91 and SCMD 0x8F handlers allow a specially crafted disc image or ELF to cause an out-of-bounds read from emulator memory. Because the offset and size is controlled through MG header fields, a specially crafted ELF can read data beyond the bounds of mg_buffer and have it reflected back into emulated memory. This issue is f
PUBLISHED
- Vendor
- PCSX2
- Product
- pcsx2
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-67748
Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles based on `pty.spawn()` being incorrectly flagged as `LIKELY_SAFE`, and was fixed in version 0.1.6. This impacted any user or system that used Fickling to vet pickle files for security issues.
PUBLISHED
- Vendor
- trailofbits
- Product
- fickling
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-67747
Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module imports. Fickling started blocking both modules to address this issue. This allows an attacker to craft a malicious pickle file that can bypass fickling since it misses detections for `types.FunctionType` and `marshal.loads`. A user who deserializes such a file, believing it to be safe, would inadvertently execute arbitrary code on their sys
PUBLISHED
- Vendor
- trailofbits
- Product
- fickling
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-67746
Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be o
PUBLISHED
- Vendor
- composer
- Product
- composer
- Provider severity
- LOW
- Conflicts
- 0
CVE-2025-67745
MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the whole backup info, including the encryption key. Version 1.3.0 fixes the issue. As a workaround, direct logs into /dev/null.
PUBLISHED
- Vendor
- Aiven-Open
- Product
- myhoard
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-67744
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exists in the Mermaid diagram rendering component that allows arbitrary JavaScript execution. Due to the exposure of the Electron IPC renderer to the DOM, this Cross-Site Scripting (XSS) flaw escalates to full Remote Code Execution (RCE), allowing an attacker to execute arbitrary system commands. Two concurrent issues, unsafe Mermaid configura
PUBLISHED
- Vendor
- ThinkInAIXYZ
- Product
- deepchat
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-67743
Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service (download_service.py) makes HTTP requests using raw requests.get() without utilizing the application's SSRF protection (safe_requests.py). This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through
PUBLISHED
- Vendor
- LearningCircuit
- Product
- local-deep-research
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-67742
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
PUBLISHED
- Vendor
- JetBrains
- Product
- TeamCity
- Provider severity
- LOW
- Conflicts
- 0
CVE-2025-67741
In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
PUBLISHED
- Vendor
- JetBrains
- Product
- TeamCity
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-67740
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
PUBLISHED
- Vendor
- JetBrains
- Product
- TeamCity
- Provider severity
- LOW
- Conflicts
- 1
CVE-2025-6774
A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been rated as critical. Affected by this issue is the function AddTemp of the file api/template.go. The manipulation of the argument filename leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9 is able to address this issue. The patch is identified as 778d26aef723daa58df98c8060c43f5bf5d1b10b. It is recommended to upgrade the affected
PUBLISHED
- Vendor
- gooaclok819
- Product
- sublinkX
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67739
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure
PUBLISHED
- Vendor
- JetBrains
- Product
- TeamCity
- Provider severity
- LOW
- Conflicts
- 0
CVE-2025-67738
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).
PUBLISHED
- Vendor
- Webmin
- Product
- Webmin
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-67737
AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a station's operations can craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station. In order to carry out an attack,
PUBLISHED
- Vendor
- AzuraCast
- Product
- AzuraCast
- Provider severity
- LOW
- Conflicts
- 0
CVE-2025-67736
The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 and 17.0.5 are vulnerable to SQL injection by authenticated users with administrator access. Authenticated users with administrative access to the Administrator Control Panel (ACP) can leverage this SQL injection vulnerability to extract sensitive information from the database and execute code on the system as the `asterisk` user with chaine
PUBLISHED
- Vendor
- FreePBX
- Product
- tts
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-67735
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.1
PUBLISHED
- Vendor
- netty
- Product
- netty
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-67734
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers to enter JavaScript through the Company Website field of the Job Form, exposing users to an XSS attack. The script could then be executed in the browsers of users who opened the malicious job posting. This issue is fixed in version 2.42.0.
PUBLISHED
- Vendor
- frappe
- Product
- lms
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-67733
A flaw was found in Valkey, a distributed key-value database. A malicious user can exploit this vulnerability by using scripting commands to inject arbitrary information into the response stream. This is caused by improper handling of null characters in the error handling code for Lua scripts. Successful exploitation could lead to corrupting or returning tampered data to other users on the same connection, impacting data integrity and availability.
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, valkey-io
- Product
- Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10.0 Extended Update Support, valkey
- Provider severity
- HIGH
- Conflicts
- 3
CVE-2025-67732
Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed in plaintext to the frontend, allowing non-administrator users to view and reuse it. This can lead to unauthorized access to third-party services, potentially consuming limited quotas. Version 1.11.0 fixes the issue.
PUBLISHED
- Vendor
- langgenius
- Product
- dify
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-67731
Servify Express is a Node.js package to start an Express server and log the port it's running on. Prior to 1.2, the Express server used express.json() without a size limit, which could allow attackers to send extremely large request bodies. This can cause excessive memory usage, degraded performance, or process crashes, resulting in a Denial of Service (DoS). Any application using the JSON parser without limits and exposed to untrusted clients is affected. The issue is not a flaw in Express itse
PUBLISHED
- Vendor
- Aarondoran
- Product
- servify-express
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-67730
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.
PUBLISHED
- Vendor
- frappe
- Product
- lms
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-6773
A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.
PUBLISHED
- Vendor
- HKUDS
- Product
- LightRAG
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67729
LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where torch.load() is called without the weights_only=True parameter when loading model checkpoint files. This allows an attacker to execute arbitrary code on the victim's machine when they load a malicious .bin or .pt model file. This issue has been patched in version 0.11.1.
PUBLISHED
- Vendor
- InternLM
- Product
- lmdeploy
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-67728
Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public Uploads setting is enabled, to craft a malicious filename when uploading a video file. The malicious filename is then concatenated directly into a shell command, which can be used for uploading files to arbitrary directories via path traversal, or executing system commands for Remote Code Execution (RCE). This issue is fixed in version 1.3.0.
PUBLISHED
- Vendor
- ShaneIsrael
- Product
- fireshare
- Provider severity
- CRITICAL
- Conflicts
- 0