CISA Known Exploited Vulnerabilities

D-Link DCS-2530L and DCS-2670L devices have an unspecified vulnerability that can lead to remote disclosure of the administrator password. These devices may be end-of-life or end-of-service, and users are advised to discontinue their use. The vulnerability has been exploited in the wild.

CVE-2022-40799 is a high-severity vulnerability in the D-Link DNR-322L device that allows an authenticated attacker to execute operating system level commands by exploiting a code download process lacking integrity checks. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use. Exploits have been observed in the wild.

D-Link DCS-2530L and DCS-2670L devices have a command injection vulnerability in the cgi-bin/ddns_enc.cgi component. This vulnerability allows attackers to execute arbitrary commands on affected devices. The impacted products may be end-of-life or end-of-service, and users are advised to discontinue use. Exploitation of this vulnerability has been observed in the wild.

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

CVE-2023-2533 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in PaperCut NG/MF version 22.0.10. It allows an attacker to trick an authenticated administrator into executing unauthorized actions by clicking a malicious link, potentially leading to changes in security settings or arbitrary code execution. Exploitation requires the admin to be logged in and interact with the malicious content. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 8.4. No known exploits are currently in the wild. European organizations using PaperCut NG/MF, especially in sectors with high administrative privileges, should prioritize patching and implement strict access controls to mitigate risk. Countries with significant PaperCut deployments and critical infrastructure are at higher risk.

New Critical CrushFTP CVE-2025-54309 RCE Explained + PoC Source: https://pwn.guide/free/web/crushftp

CVE-2025-2776 is a critical vulnerability in SysAid On-Prem involving improper restriction of XML external entity (XXE) references in the Server URL processing functionality. This flaw allows unauthenticated attackers to perform administrator account takeover and read arbitrary files on the affected system. The vulnerability has a high CVSS score of 9.3 and is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.

SysAid On-Prem has a critical XML External Entity (XXE) vulnerability in its Checkin processing functionality. This flaw allows an attacker to perform administrator account takeover and read arbitrary files. The vulnerability is actively exploited in the wild. No specific affected versions or patch information is provided.

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Fortinet FortiWeb contains a critical SQL injection vulnerability (CVE-2025-25257) that allows unauthenticated attackers to execute arbitrary SQL commands via crafted HTTP or HTTPS requests. This vulnerability has a high CVSS score of 9.6 and is known to be exploited in the wild. No specific affected versions or patch information is provided.

CVE-2025-47812 is a critical vulnerability in Wing FTP Server involving improper neutralization of null byte or NUL characters. This flaw allows injection of arbitrary Lua code into user session files, enabling execution of system commands with the FTP service's privileges, which are typically root or SYSTEM. The vulnerability has a CVSS score of 10, indicating maximum severity, and is known to be exploited in the wild.

PHPMailer contains a command injection vulnerability in its mail() function due to improper sanitization of user input. This flaw allows attackers to execute arbitrary code within the application context. Unsuccessful exploitation attempts can cause denial-of-service conditions. The vulnerability has been exploited in the wild.

CVE-2019-5418 is a path traversal vulnerability in Ruby on Rails' Action View component. It allows specially crafted Accept headers combined with calls to `render file:` to cause arbitrary files on the server to be rendered, potentially disclosing their contents. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.