Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

state:in-the-wild — CVE vulnerabilities tagged 412

412 CVE security advisories tagged "state:in-the-wild" with AI Chinese analysis, CVSS, references and POCs.

The tag "state:in-the-wild" signifies that a disclosed vulnerability has been actively exploited by attackers in real-world environments, rather than remaining theoretical or limited to controlled laboratory testing. This classification is critical because it indicates an immediate and tangible threat to public infrastructure, demanding urgent mitigation strategies from administrators and developers. Typically, these vulnerabilities involve remote code execution, authentication bypasses, or critical logic flaws that allow adversaries to compromise systems without physical access. The presence of this tag implies that exploit code is likely circulating in the wild, increasing the risk of widespread data breaches, service disruptions, or lateral movement within networks. Consequently, organizations must prioritize patching these specific CVEs to prevent active intrusion, as the window between disclosure and exploitation has effectively closed, leaving systems exposed to sophisticated threat actors seeking immediate gain.

CVE ID Title CVSS Severity Published
CVE-2024-58274 Hikvision CSMP iSecure Center 安全漏洞 — CSMP iSecure Center CWE-78 8.3 High 2025-10-22
CVE-2018-25118 GeoVision Command Injection RCE via /PictureCatch.cgi — GV-BX1500 CWE-78 9.8AI Critical AI 2025-10-20
CVE-2023-7305 SmartBI RMIServlet Unrestricted File Upload RCE — SmartBI CWE-434 10.0AI Critical AI 2025-10-15
CVE-2011-10033 WordPress Plugin is-human <= v1.4.2 Eval Injection RCE — is-human WordPress Plugin CWE-95 9.8AI Critical AI 2025-10-15
CVE-2018-25117 VestaCP Debian Installer Malicious Backdoor Supply Chain Compromise — Control Panel (CP) CWE-506 8.8AI High AI 2025-10-15
CVE-2024-13991 Huijietong Cloud Video Platform fileDownload Arbitrary File Read — Cloud Video Platform CWE-22 7.5AI High AI 2025-10-15
CVE-2025-59530 quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame — quic-go CWE-617 7.5 High 2025-10-10
CVE-2017-20203 NetSarang v5.0 Malicious Backdoor Supply Chain Compromise — Xmanager Enterprise CWE-506 10.0AI Critical AI 2025-10-09
CVE-2025-11371 Gladinet CentreStack and TrioFox Local File Inclusion Flaw — CentreStack and TrioFox 7.5AI High AI 2025-10-09
CVE-2025-42701 CrowdStrike Falcon Sensor for Windows Race Condition — Falcon sensor for Windows CWE-367 5.6 Medium 2025-10-08
CVE-2025-42706 CrowdStrike Falcon Sensor for Windows Logic Error — Falcon sensor for Windows CWE-346 6.5 Medium 2025-10-08
CVE-2022-4980 General Bytes Crypto Application Server (CAS) Unauthenticated Creation of Admin Account via Default-installation/First-admin Page — Crypto Application Server (CAS) CWE-306 9.8 - 2025-09-19
CVE-2025-8088 Path traversal vulnerability in WinRAR — WinRAR CWE-35 8.4 High 2025-08-08
CVE-2023-44976 Hangzhou Shunwang Rentdrv2 安全漏洞 — Rentdrv2 CWE-782 3.2 Low 2025-08-01
CVE-2014-125123 Kloxo < 6.1.12 Unauthenticated SQL Injection RCE — Kloxo CWE-89 9.8AI Critical AI 2025-07-31
CVE-2025-53770 Microsoft SharePoint Server Remote Code Execution Vulnerability — Microsoft SharePoint Enterprise Server 2016 CWE-502 9.8 Critical 2025-07-20
CVE-2025-54309 CrushFTP 安全漏洞 — CrushFTP CWE-420 9.0 Critical 2025-07-18
CVE-2025-34130 LILIN DVR Arbitrary File Read via net_html.cgi — DVR Firmware CWE-306 9.8AI Critical AI 2025-07-16
CVE-2025-34129 LILIN DVR RCE via Malicious FTP/NTP Configuration — DVR Firmware CWE-78 7.2AI High AI 2025-07-16
CVE-2025-49831 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to IAM Authenticator Bypass via Mis-configured Network Device — conjur CWE-287 9.3AI Critical AI 2025-07-15
CVE-2025-52572 Hikka vulnerable to RCE through dangling web interface — Hikka CWE-287 10.0 Critical 2025-06-24
CVE-2025-34037 Linksys Routers E/WAG/WAP/WES/WET/WRT-Series — E4200 CWE-78 9.8AI Critical AI 2025-06-24
CVE-2025-48928 TeleMessage 安全漏洞 — service CWE-528 4.0 Medium 2025-05-28
CVE-2025-48927 TeleMessage 安全漏洞 — service CWE-1188 5.3 Medium 2025-05-28
CVE-2025-48828 Internet Brands vBulletin 安全漏洞 — vBulletin CWE-424 9.0 Critical 2025-05-27
CVE-2025-48827 Internet Brands vBulletin 安全漏洞 — vBulletin CWE-424 10.0 Critical 2025-05-27
CVE-2024-46506 NetAlertX 安全漏洞 — NetAlertX CWE-306 10.0 Critical 2025-05-13
CVE-2024-48766 NetAlertX 安全漏洞 — NetAlertX CWE-698 8.6 High 2025-05-13
CVE-2025-47729 TeleMessage archiving backend 安全漏洞 — archiving backend CWE-912 1.9 Low 2025-05-08
CVE-2024-51991 October CMS Allows Unprotected SVG Rename in Media Manager — october CWE-434 4.8AI Medium AI 2025-05-05

Vulnerabilities classified as state:in-the-wild represent 412 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.