CWE-20 · Improper Input Validation (page 14)
Page 14 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69288 | Critical | 9.1 | 2025-12-31 | Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the dat… |
CVE-2025-15375 | Medium | 6.3 | 2025-12-31 | A flaw has been found in EyouCMS up to 1.7.7. The impacted element is the function unserialize of the file application/api/controller/Ajax.php of the component… |
CVE-2025-15246 | Medium | 6.3 | 2025-12-30 | A vulnerability was determined in aizuda snail-job up to 1.7.0 on macOS. Affected by this vulnerability is the function FurySerializer.deserialize of the compo… |
CVE-2025-15358 | High | 7.5 | 2025-12-30 | DVP-12SE11T - Denial of Service Vulnerability |
CVE-2025-15222 | Medium | 5.0 | 2025-12-30 | A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateF… |
CVE-2025-15284 | Low | 3.7 | 2025-12-29 | Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not e… |
CVE-2025-69205 | Medium | 6.3 | 2025-12-29 | Micro Registration Utility (µURU) is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d5… |
CVE-2025-66866 | High | 7.5 | 2025-12-29 | An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-66864 | High | 7.5 | 2025-12-29 | An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-15117 | Low | 3.1 | 2025-12-28 | A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Execu… |
CVE-2025-8075 | Medium | 5.4 | 2025-12-26 | Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered that validat… |
CVE-2025-52600 | High | 7.2 | 2025-12-26 | Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerabil… |
CVE-2025-8769 | Critical | 9.8 | 2025-12-24 | Telenium Online Web Application is vulnerable due to a Perl script that is called to load the login page. Due to improper input validation, an attacker can i… |
CVE-2025-68667 | | 2025-12-23 | Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to f… | |
CVE-2025-59886 | High | 8.8 | 2025-12-23 | Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to the device execut… |
CVE-2025-59301 | Medium | 4.0 | 2025-12-22 | Delta Electronics DVP15MC11T lacks proper validation of the modbus/tcp packets and can lead to denial of service. |
CVE-2025-68398 | Critical | 9.1 | 2025-12-18 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavio… |
CVE-2025-67163 | Medium | 6.1 | 2025-12-18 | A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a cra… |
CVE-2025-65561 | High | 7.5 | 2025-12-18 | An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted he… |
CVE-2025-67493 | High | 7.5 | 2025-12-17 | Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups… |
CVE-2025-43533 | Medium | 5.7 | 2025-12-17 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-67170 | Medium | 6.1 | 2025-12-17 | A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's browser via a craf… |
CVE-2025-66923 | High | 7.2 | 2025-12-17 | A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web scr… |
CVE-2025-66921 | High | 7.2 | 2025-12-17 | A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web… |
CVE-2025-20393 | Critical | 10.0 | 2025-12-17 | A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an u… |
CVE-2025-58173 | High | 8.8 | 2025-12-16 | FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it… |
CVE-2025-14156 | Critical | 9.8 | 2025-12-15 | The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the… |
CVE-2025-9207 | Medium | 5.3 | 2025-12-13 | The TI WooCommerce Wishlist plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.10.0. This is due to the plugin accept… |
CVE-2025-14606 | Medium | 5.0 | 2025-12-13 | A security vulnerability has been detected in tiny-rdm Tiny RDM up to 1.2.5. Affected by this vulnerability is the function pickle.loads of the file pickle_con… |
CVE-2025-43494 | High | 7.5 | 2025-12-12 | A mail header parsing issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15… |
CVE-2025-43482 | Medium | 5.5 | 2025-12-12 | The issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able… |
CVE-2025-43464 | Medium | 6.5 | 2025-12-12 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Tahoe 26.1. Visiting a website may lead to an app denial-o… |
CVE-2025-66451 | Medium | 6.5 | 2025-12-11 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define and modify the prom… |
CVE-2025-36932 | High | 7.8 | 2025-12-11 | In tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead… |
CVE-2025-36929 | Medium | 5.5 | 2025-12-11 | In AreFencesRegistered of gxp_fence_manager.cc, there is a possible information leak due to improper input validation. This could lead to local information dis… |
CVE-2025-66918 | High | 8.8 | 2025-12-11 | edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter. |
CVE-2025-64993 | Medium | 6.8 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions. Imprope… |
CVE-2025-64992 | Medium | 6.8 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior V25… |
CVE-2025-64991 | Medium | 6.8 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-PatchInsights-Deploy instruction prior V15. Impr… |
CVE-2025-64990 | Medium | 6.8 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-LogoffUser instruction prio… |
CVE-2025-64989 | High | 7.2 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instr… |
CVE-2025-64988 | High | 7.2 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V1… |
CVE-2025-64987 | High | 7.2 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction… |
CVE-2025-64986 | High | 7.2 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort ins… |
CVE-2025-46266 | Medium | 4.3 | 2025-12-11 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious a… |
CVE-2025-44016 | High | 8.8 | 2025-12-11 | A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious a… |
CVE-2025-12687 | Medium | 6.5 | 2025-12-11 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious a… |
CVE-2025-61822 | Medium | 6.2 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system wr… |
CVE-2025-61812 | High | 8.4 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could allow a high privileged attacker… |
CVE-2025-61809 | Critical | 9.1 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature byp… |
CVE-2025-64666 | High | 7.5 | 2025-12-09 | Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-62571 | High | 7.8 | 2025-12-09 | Improper input validation in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-62455 | High | 7.8 | 2025-12-09 | Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally. |
CVE-2025-12946 | High | 7.5 | 2025-12-09 | A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN si… |
CVE-2025-12945 | High | 7.2 | 2025-12-09 | A vulnerability in NETGEAR Nighthawk R7000P routers lets an authenticated admin execute OS command injections due to improper input validation. This issue… |
CVE-2025-40935 | Medium | 4.3 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.1), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.10.1), RUGGEDCOM RS416v2 V5… |
CVE-2025-40831 | Medium | 6.5 | 2025-12-09 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of date parameter in re… |
CVE-2025-2296 | | 2025-12-09 | EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability c… | |
CVE-2025-13428 | High | 7.2 | 2025-12-09 | A vulnerability exists in the SecOps SOAR server. The custom integrations feature allowed an authenticated user with an "IDE role" to achieve Remote Code Execu… |
CVE-2025-48638 | High | 7.8 | 2025-12-08 | In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege w… |
CVE-2025-48632 | High | 7.8 | 2025-12-08 | In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the user has disassociated them due to imprope… |
CVE-2025-48624 | High | 7.8 | 2025-12-08 | In multiple functions of arm-smmu-v3.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privil… |
CVE-2025-48623 | High | 7.8 | 2025-12-08 | In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege wit… |
CVE-2025-48612 | High | 7.8 | 2025-12-08 | In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper… |
CVE-2025-48601 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible permanent denial of service due to improper input validation. This could lead to local escalation of privilege with… |
CVE-2025-48594 | High | 7.3 | 2025-12-08 | In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper inp… |
CVE-2025-48566 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible bypass of user profile boundary with a forwarded intent due to improper input validation. This could lead to local e… |
CVE-2025-48525 | High | 7.8 | 2025-12-08 | In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications when not associated to a companion device… |
CVE-2025-22432 | Medium | 6.7 | 2025-12-08 | In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalat… |
CVE-2025-26489 | Medium | 6.5 | 2025-12-08 | Improper input validation in the Netconf service in Infinera MTC-9 allows remote authenticated users to crash the service and reboot the appliance, thus causi… |
CVE-2025-26488 | High | 7.5 | 2025-12-08 | Improper Input Validation vulnerability in Infinera MTC-9 allows remote unauthenticated users to crash the service and cause a reboot of the appliance, thus c… |
CVE-2025-54306 | High | 7.2 | 2025-12-04 | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote code execution vulnerability exists in the network configuration… |
CVE-2024-3884 | High | 7.5 | 2025-12-03 | A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) m… |
CVE-2025-20389 | Medium | 4.3 | 2025-12-03 | In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of the Splunk Secure Gateway app on Splunk C… |
CVE-2025-66400 | Medium | 5.3 | 2025-12-01 | mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source b… |
CVE-2025-63095 | Medium | 6.5 | 2025-12-01 | Improper input validation in the BitstreamWriter::write_bits() function of Tempus Ex hello-video-codec v0.1.0 allows attackers to cause a Denial of Service (Do… |
CVE-2025-26858 | High | 8.6 | 2025-12-01 | A buffer overflow vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted set of network packets can lea… |
CVE-2025-13805 | Low | 3.7 | 2025-12-01 | A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/ma… |
CVE-2025-66225 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username su… |
CVE-2025-53939 | Medium | 6.3 | 2025-11-29 | Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly… |
CVE-2025-66201 | High | 8.1 | 2025-11-29 | LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (SSRF), by passing sp… |
CVE-2025-13762 | | 2025-11-27 | Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to starting new… | |
CVE-2025-0658 | | 2025-11-27 | A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol causes the device to crash. The device enters a fault state; after a reset… | |
CVE-2025-66259 | Critical | 9.8 | 2025-11-26 | Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 10… |
CVE-2025-33191 | Medium | 5.7 | 2025-11-25 | NVIDIA DGX Spark GB10 contains a vulnerability in OSROOT firmware, where an attacker could cause an invalid memory read. A successful exploit of this vulnerabi… |
CVE-2025-0248 | High | 8.1 | 2025-11-25 | HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticat… |
CVE-2025-12741 | | 2025-11-24 | A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execute a malicious comma… | |
CVE-2025-12740 | | 2025-11-24 | A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious co… | |
CVE-2025-12889 | Medium | 5.4 | 2025-11-22 | With TLS 1.2 connections a client can use any digest, specifically a weaker digest that is supported, rather than those in the CertificateRequest. |
CVE-2025-65946 | High | 8.1 | 2025-11-21 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo… |
CVE-2025-11936 | Medium | 5.3 | 2025-11-21 | Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a deni… |
CVE-2025-11934 | Low | 2.7 | 2025-11-21 | Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier on multiple platforms allows for downgr… |
CVE-2025-11933 | Medium | 6.5 | 2025-11-21 | Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to p… |
CVE-2025-62164 | High | 8.8 | 2025-11-21 | vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead t… |
CVE-2025-11676 | | 2025-11-20 | Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 (UPnP modules), which allows unauthenticated adjacent attackers to perform DoS atta… | |
CVE-2025-63213 | Critical | 9.8 | 2025-11-19 | The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/… |
CVE-2025-64759 | High | 8.1 | 2025-11-19 | Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browse… |
CVE-2025-12842 | Medium | 5.3 | 2025-11-19 | The Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress is vulnerable to unauthorized email sending in versions up to, and including, 1… |
CVE-2025-64515 | Medium | 4.3 | 2025-11-18 | Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/… |
CVE-2025-55058 | Medium | 4.5 | 2025-11-17 | CWE-20 Improper Input Validation |