Veille CVE

Semaine du 14 juillet au 20 juillet 2025

5 CVE

Critique 3 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2025-54313 7.5 Élevée Exploitée

    prettier eslint-config-prettier · Prettier eslint-plugin-prettier · Un-ts synckit · Un-ts pkgr\/core

    eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

  2. CVE-2025-54309 9.8 Critique Exploitée

    CrushFTP · Crushftp crushftp

    CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

  3. CVE-2025-25257 9.8 Critique Exploitée

    Fortinet FortiWeb

    An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

  4. CVE-2025-20337 10.0 Critique Exploitée

    Cisco Identity Services Engine Software · Cisco ISE Passive Identity Connector · Cisco identity services engine · Cisco identity services engine passive identity connector

    A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

  5. CVE-2025-6558 8.8 Élevée Exploitée

    Google Chrome · Debian debian linux · Apple safari · Apple ipados

    Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)