CVE-2025-60552 · 内存破坏
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formTcpipSetup.
安全史上的今天（2025-10-24）安全事件列表。
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formTcpipSetup.
【中文导读】该 CVE 涉及内存破坏（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard52.
【中文导读】该 CVE 涉及内存破坏（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizardSelectMode.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizard1.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEasy_Wizard.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formVirtualServ.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetDomainFilter.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEmail.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formWlSiteSurvey.
【中文导读】该 CVE 涉及文件包含（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through 1.4.
【中文导读】WooCommerce Designer Pro 存在远程代码执行、任意文件上传风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
【中文导读】该 CVE 涉及SQL 注入（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection. This issue affects Netty ERP: before V.1.1000.
【中文导读】Quickcreator – AI Blog Writer 存在跨站脚本、信息泄露风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】The Quickcreator – AI Blog Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 0.0.9 to 0.1.17 through the /wp-content/plugins/quickcreator/dupasrala.txt file. This makes it possible for unauthenticated attackers to view the plugin's API key and subsequently use that to perform actions on the site like creating new posts and injecting XSS payloads.
【中文导读】AIO Forms – Craft Complex Forms Easily 存在远程代码执行、任意文件上传风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】The AIO Forms – Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 1.3.18. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
【中文导读】IndieAuth 存在跨站请求伪造风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a user into performing an action such as clicking on a link or visiting a malicious page while logged in. The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete).
【中文导读】OpenVPN 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use
【中文导读】Linux kernel 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode When u32_replace_hw_knode fails, we need to undo the tcf_bind_filter operation done at u32_set_parms.
【中文导读】该 CVE 涉及服务端请求伪造、输入验证（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.1.4. This is due to insufficient validation on the URLs supplied via the URL parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, as well as conduct network reconnaissance. The vulnerability was partially patched in version 2.1.4.
【中文导读】Linux kernel 存在内存破坏、释放后使用风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately.
【中文导读】Linux kernel 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhost_task. vhost_task_create() creates a task and keeps a reference to its task_struct. That task may exit early via a signal and its task_struct will be released. A pending vhost_task_wake() will then attempt to wake the task and access a task_struct which is no longer there. Acquire a reference on the task_struct while creating the thread and release the reference while the struct vhost_task itself is removed. If the task exits early due to a signal, then the vhost_task_wake() will still access a valid task_struct. The wake is safe and will be skipped in this case.
【中文导读】Utils.deserialize function in pgCodeKeeper 存在反序列化风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】The Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted sources. If an attacker provides a specially crafted .ser file, deserialization may result in unintended code execution or other malicious behavior on the target system.
【中文导读】该 CVE 涉及安全缺陷（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in CBK Soft Software Hardware Electronic Computer Systems Industry and Trade Inc. EnVision allows Account Footprinting. This issue affects enVision: before 250566.
【中文导读】该 CVE 涉及信息泄露（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
【中文导读】该 CVE 涉及认证绕过（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector. An unauthenticated remote attacker can access APIs exposed by ApiProxy.war in DataCollectorEar.ear by using a special SessionKey and UserId. These userid are special users created in compellentservicesapi for special purposes.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvFirewall.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetRoute.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLogDnsquery.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600LAx FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetQoS.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvNetwork.
【中文导读】Emoncms 存在远程代码执行、输入验证风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the target system. The vulnerability stems from insufficient input validation of user-controlled parameters including filename, port, baud_rate, core, and autoreset within the /admin/upload-custom-firmware endpoint.
【中文导读】该 CVE 涉及安全缺陷（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard7.
【中文导读】该 CVE 涉及内存破坏（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLanSetupRouterSettings.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAutoDetecWAN_wizard4.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formEasySetTimezone.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the next_page parameter in the function formDeviceReboot.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetPortTr.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetLog.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSchedule.
【中文导读】该 CVE 涉及内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetMACFilter.
【中文导读】该 CVE 涉及远程代码执行（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function.
【中文导读】Antabot White-Jotter up to commit 存在远程代码执行风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the component /api/aaa;/../register.
【中文导读】PerfreeBlog 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function
【中文导读】PerfreeBlog 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function
【中文导读】PerfreeBlog 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function
【中文导读】该 CVE 涉及跨站脚本、权限提升、信息泄露（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to supply arbitrary schemes (e.g., javascript:) that are passed directly to router.push. This results in a cross-site scripting (XSS) vulnerability, enabling attackers to execute arbitrary JavaScript in the victim’s browser. The issue can be exploited without authentication and has severe impact, including information disclosure, and privilege escalation and modifications of administrative settings. This issue has been patched in version 1.1.0.
【中文导读】Microweber CMS 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts.
【中文导读】该 CVE 涉及安全缺陷（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error. This means the verification code could be reused anywhere an email verification code is required. This issue has been fixed in commit 1f726df.