background

CVE & CWE, restez informé

Gestion des CVE et CWE : Votre bouclier contre les Menaces Cyber.

Notre plateforme CVE Find, dédiée à la gestion des CVE et CWE, offre une surveillance en temps réel des vulnérabilités et des faiblesses courantes. Cela permet à nos clients de rester constamment informés des dernières évolutions en matière de cybersécurité. Grâce à notre système d'alerte avancé, vous recevrez des notifications immédiates par SMS et email, garantissant ainsi une réactivité maximale face aux nouvelles menaces.

Avec notre service, vous pourrez sécuriser de manière optimale votre infrastructure réseau et web, renforçant ainsi la protection de vos données critiques contre les intrusions et les cyberattaques. Chez BEXXO, nous vous fournissons les outils nécessaires pour une défense robuste et proactive.

icon

Alerte par Email

icon

Alerte sur les produits que vous utilisez

icon

Déterminer l'impact des risques sur vos produits

icon

Mise à jour permanente

Explorez notre solution mondiale

Avec CVE Find, explorez la plus grande base de données de vulnérabilités au monde.

Le CVE (Common Vulnerabilities and Exposures) est une liste de failles de sécurité informatique divulguées publiquement. Le programme CVE a pour objectif de faciliter le partage des données entre les différentes capacités de détection des vulnérabilités, qu'il s'agisse d'outils, de bases de données ou de services. Il fournit également une norme pour évaluer la couverture de ces outils et services.

Accédez à CVE Find
Mise à jour permanente

Découvrez les derniers CVE critiques publiés.

Précédent
Prochain
8.2

CVE-2025-43865 - HIGH
25/04/2025

React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.

OWSAP: A08

>> Plus d'informations avec CVE Find

8.5

CVE-2025-2185 - HIGH
24/04/2025

ALBEDO Telecom Net.Time - PTP/NTP clock (Serial No. NBC0081P) software release 1.4.4 is vulnerable to an insufficient session expiration vulnerability, which could permit an attacker to transmit passwords over unencrypted connections, resulting in the product becoming vulnerable to interception.

authorisationproblemOWSAP: A07

>> Plus d'informations avec CVE Find

8.7

CVE-2025-3606 - HIGH
24/04/2025

Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing sensitive information, such as credentials which could be used to further compromise the device.

OWSAP: A01

>> Plus d'informations avec CVE Find

9.3

CVE-2025-46271 - CRITICAL
24/04/2025

UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data.

oscommandinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

9.3

CVE-2025-46272 - CRITICAL
24/04/2025

WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system.

oscommandinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

9.3

CVE-2025-46273 - CRITICAL
24/04/2025

UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices.

OWSAP: A07

>> Plus d'informations avec CVE Find

9.3

CVE-2025-46274 - CRITICAL
24/04/2025

UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database.

OWSAP: A07

>> Plus d'informations avec CVE Find

9.3

CVE-2025-46275 - CRITICAL
24/04/2025

WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials.

authorisationproblemOWSAP: A07

>> Plus d'informations avec CVE Find

9.3

CVE-2025-26382 - CRITICAL
24/04/2025

Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issue

>> Plus d'informations avec CVE Find
9.1

CVE-2025-43859 - CRITICAL
24/04/2025

h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mit...

OWSAP: A04

>> Plus d'informations avec CVE Find

9.2

CVE-2025-43858 - CRITICAL
24/04/2025

YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting `yt-dlp` from a commands prompt running on Windows OS with the `UseWindowsEncodingWorkaround` value defined to true (default behavior). If a user is using buil...

commandinjectionoscommandinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

10

CVE-2025-31324 - CRITICAL
24/04/2025

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

fileinclusionOWSAP: A04

>> Plus d'informations avec CVE Find

8.5

CVE-2025-39377 - HIGH
24/04/2025

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Appsero Helper allows SQL Injection. This issue affects Appsero Helper: from n/a through 1.3.4.

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

9.3

CVE-2025-46248 - CRITICAL
24/04/2025

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard allows SQL Injection. This issue affects Frontend Dashboard: from n/a through 2.2.5.

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

9.9

CVE-2025-46264 - CRITICAL
24/04/2025

Unrestricted Upload of File with Dangerous Type vulnerability in Angelo Mandato PowerPress Podcasting allows Upload a Web Shell to a Web Server. This issue affects PowerPress Podcasting: from n/a through 11.12.5.

fileinclusionOWSAP: A04

>> Plus d'informations avec CVE Find

8.7

CVE-2025-43855 - HIGH
24/04/2025

tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server. Any tRPC 11 server with WebSocket enabled with a createContext method set...

>> Plus d'informations avec CVE Find
8.8

CVE-2025-3058 - HIGH
24/04/2025

The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the xwc_save_settings() function in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be l...

authorisationproblemOWSAP: A01

>> Plus d'informations avec CVE Find

9.1

CVE-2025-3065 - CRITICAL
24/04/2025

The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

directorytraversalOWSAP: A01

>> Plus d'informations avec CVE Find

8.8

CVE-2025-3101 - HIGH
24/04/2025

The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.7. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change escalate their privileges to Administrator.

priviliegemanagementOWSAP: A04

>> Plus d'informations avec CVE Find

9.8

CVE-2025-3603 - CRITICAL
24/04/2025

The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain...

OWSAP: A07

>> Plus d'informations avec CVE Find

Découvrez comment bexxo peut sécuriser votre entreprise. N'hésitez pas à nous contacter pour une consultation personnalisée dès aujourd'hui !
Contactez-nous Chat avec un expert
575+ CVE
Ces 7 Derniers Jours
Dernière mise à jour : 2025-04-25 05:03

Gestion des CVE et CWE : Votre bouclier contre les Menaces Cyber.

14194+ CVE - Authorization problems

7477+ CVE - Cross-Site Request Forgery

14520+ CVE - SQL Injection

35365+ CVE - Cross-site Scripting