Threat database

D-Link DCS-2530L and DCS-2670L devices have a command injection vulnerability in the cgi-bin/ddns_enc.cgi component. This vulnerability allows attackers to execute arbitrary commands on affected devices. The impacted products may be end-of-life or end-of-service, and users are advised to discontinue use. Exploitation of this vulnerability has been observed in the wild.

D-Link DCS-2530L and DCS-2670L devices have an unspecified vulnerability that can lead to remote disclosure of the administrator password. These devices may be end-of-life or end-of-service, and users are advised to discontinue their use. The vulnerability has been exploited in the wild.

CVE-2022-40799 is a high-severity vulnerability in the D-Link DNR-322L device that allows an authenticated attacker to execute operating system level commands by exploiting a code download process lacking integrity checks. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use. Exploits have been observed in the wild.

CVE-2025-2776 is a critical vulnerability in SysAid On-Prem involving improper restriction of XML external entity (XXE) references in the Server URL processing functionality. This flaw allows unauthenticated attackers to perform administrator account takeover and read arbitrary files on the affected system. The vulnerability has a high CVSS score of 9.3 and is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2025-54309 is a critical vulnerability in CrushFTP where an unprotected alternate channel flaw allows remote attackers to gain administrative access via HTTPS when the DMZ proxy feature is not enabled. This vulnerability involves improper handling of AS2 validation, leading to a serious security breach. It has a high CVSS score of 9.0 and is known to be exploited in the wild.

SysAid On-Prem has a critical XML External Entity (XXE) vulnerability in its Checkin processing functionality. This flaw allows an attacker to perform administrator account takeover and read arbitrary files. The vulnerability is actively exploited in the wild. No specific affected versions or patch information is provided.

Fortinet FortiWeb contains a critical SQL injection vulnerability (CVE-2025-25257) that allows unauthenticated attackers to execute arbitrary SQL commands via crafted HTTP or HTTPS requests. This vulnerability has a high CVSS score of 9.6 and is known to be exploited in the wild. No specific affected versions or patch information is provided.

CVE-2025-47812 is a critical vulnerability in Wing FTP Server involving improper neutralization of null byte or NUL characters. This flaw allows injection of arbitrary Lua code into user session files, enabling execution of system commands with the FTP service's privileges, which are typically root or SYSTEM. The vulnerability has a CVSS score of 10, indicating maximum severity, and is known to be exploited in the wild.

CVE-2019-5418 is a path traversal vulnerability in Ruby on Rails' Action View component. It allows specially crafted Accept headers combined with calls to `render file:` to cause arbitrary files on the server to be rendered, potentially disclosing their contents. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.

PHPMailer contains a command injection vulnerability in its mail() function due to improper sanitization of user input. This flaw allows attackers to execute arbitrary code within the application context. Unsuccessful exploitation attempts can cause denial-of-service conditions. The vulnerability has been exploited in the wild.

Multi-Router Looking Glass (MRLG) has a buffer overflow vulnerability (CVE-2014-3931) that allows remote attackers to perform arbitrary memory writes and cause memory corruption. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2019-9621 is a server-side request forgery (SSRF) vulnerability in the ProxyServlet component of Synacor Zimbra Collaboration Suite (ZCS). This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.

CVE-2019-6693 is a vulnerability in Fortinet FortiOS involving the use of hard-coded credentials. This flaw allows an attacker who knows the hard-coded key to decipher sensitive data contained in FortiOS configuration backup files. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the available data.

Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link.

CVE-2025-32433 is a critical vulnerability in the Erlang/OTP SSH server involving missing authentication for a critical function. This flaw allows attackers to execute arbitrary commands remotely without valid credentials, leading to unauthenticated remote code execution. The vulnerability arises from improper handling of SSH protocol messages. It affects multiple products implementing Erlang/OTP SSH server, including Cisco, NetApp, and SUSE. The vulnerability has a CVSS score of 10.0 and is known to be exploited in the wild.

CVE-2024-42009 is a critical cross-site scripting (XSS) vulnerability in RoundCube Webmail. It allows a remote attacker to exploit a desanitization issue in the message_body() function, enabling theft and unauthorized sending of emails via crafted messages. This vulnerability has been exploited in the wild.

ASUS Lyra Mini and ASUS GT-AC2900 routers have an improper authentication vulnerability (CVE-2021-32030) that allows attackers to gain unauthorized administrative access. The vulnerability is critical with a CVSS score of 9.8 and has been exploited in the wild. Affected products may be end-of-life or end-of-service, and users are advised to discontinue use.

Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.

ConnectWise ScreenConnect has an improper authentication vulnerability (CVE-2025-3935) that could enable a ViewState code injection attack. If machine keys are compromised, this vulnerability may lead to remote code execution. The vulnerability has a high severity score of 8.1 and is known to be exploited in the wild. No specific affected versions or patches are currently provided.

ASUS RT-AX55 routers have an OS command injection vulnerability (CVE-2023-39780) that allows a remote, authenticated attacker to execute arbitrary commands on the device. This vulnerability has a high severity score of 8.8 and has been exploited in the wild. It requires authentication but no user interaction. The vulnerability impacts confidentiality, integrity, and availability of affected devices.