cisa.gov | Bulletins
Follow
Vulnerability Summary for the Week of April 28, 2025
Multiple critical vulnerabilities have been identified in various software and systems. Novel-Plus is susceptible to missing authentication in its genCode function. The WordPress Page View Count plugin allows unauthorized data modification leading to denial of service. ABB ANC and Automation Builder products are affected by Modification of Assumed-Immutable Data and Incorrect Permission Assignment vulnerabilities. Bosch Rexroth's ctrlX OS contains vulnerabilities in its web application, allowing remote command execution and file manipulation. SureTriggers plugin has an incorrect privilege assignment vulnerability enabling privilege escalation. Several itsourcecode products, including Gym, Placement, and Restaurant Management Systems, are vulnerable to SQL injection. SOLIDWORKS eDrawings contains Out-Of-Bounds Write and Use-After-Free vulnerabilities that could allow arbitrary code execution. Dell PowerProtect Data Manager suffers from incorrect use of privileged APIs, potentially leading to privilege escalation. Delta Electronics ISPSoft is vulnerable to stack-based buffer overflows and out-of-bounds write vulnerabilities. Finally, Agentflow has an account lockout bypass vulnerability, and Honeywell MB-Secure is affected by an OS Command Injection vulnerability.