2025 CVEs (page 102)
Page 102 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55126 | Medium | 6.5 | 2025-11-20 | HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top of advertiser-related pages… |
CVE-2025-10571 | Critical | 9.6 | 2025-11-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1. |
CVE-2025-64524 | Low | 3.3 | 2025-11-20 | cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In version… |
CVE-2025-63889 | High | 7.5 | 2025-11-20 | The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template… |
CVE-2025-63888 | Critical | 9.8 | 2025-11-20 | The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability. |
CVE-2025-64428 | Critical | 9.8 | 2025-11-20 | Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for… |
CVE-2025-64185 | | 2025-11-20 | Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open On… | |
CVE-2025-64027 | Medium | 6.1 | 2025-11-20 | Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, t… |
CVE-2025-63848 | Medium | 6.1 | 2025-11-20 | Stored cross site scripting (xss) vulnerability in SWISH prolog thru 2.2.0 allowing attackers to execute arbitrary code via crafted web IDE notebook. |
CVE-2025-62724 | Medium | 4.3 | 2025-11-20 | Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) attack when downloadi… |
CVE-2025-62709 | Medium | 6.8 | 2025-11-20 | ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build… |
CVE-2025-52410 | Critical | 9.8 | 2025-11-20 | Institute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The `myds` GET parameter is no… |
CVE-2025-13437 | | 2025-11-20 | When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli… | |
CVE-2025-12121 | High | 7.3 | 2025-11-20 | Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell comma… |
CVE-2025-12120 | High | 7.3 | 2025-11-20 | Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation… |
CVE-2025-62875 | Medium | 5.5 | 2025-11-20 | An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbl… |
CVE-2025-62731 | Medium | 4.8 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /feries endpoint. Malicious attacker with access to public holidays feature is able to inject arbitrary HTML and JS i… |
CVE-2025-62730 | High | 8.8 | 2025-11-20 | SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However… |
CVE-2025-62729 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be ren… |
CVE-2025-62297 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which wil… |
CVE-2025-62296 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will… |
CVE-2025-62295 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which… |
CVE-2025-62294 | High | 7.5 | 2025-11-20 | SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is abl… |
CVE-2025-62293 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attack… |
CVE-2025-60738 | Critical | 9.8 | 2025-11-20 | An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arb… |
CVE-2025-60737 | Medium | 6.1 | 2025-11-20 | Cross Site Scripting vulnerability in Ilevia EVE X1 Server Firmware Version<= 4.7.18.0.eden:Logic Version<=6.00 - 2025_07_21 allows a remote attacker to execut… |
CVE-2025-36161 | Medium | 5.9 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-S… |
CVE-2025-34320 | | 2025-11-20 | BASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canonicalize input path segments. This allows unauthen… | |
CVE-2025-13425 | | 2025-11-20 | A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty dir… | |
CVE-2025-65226 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the deviceId parameter in /goform/saveParentControlInfo. |
CVE-2025-65223 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the urls parameter of /goform/saveParentControlInfo. |
CVE-2025-65222 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the rebootTime parameter of /goform/SetSysAutoRebbotCfg. |
CVE-2025-65221 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the list parameter of /goform/setPptpUserList. |
CVE-2025-65220 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow in: /goform/SetVirtualServerCfg via the list parameter. |
CVE-2025-64984 | Medium | 6.1 | 2025-11-20 | Kaspersky has fixed a security issue in Kaspersky Endpoint Security for Linux (any version with anti-virus databases prior to 18.11.2025), Kaspersky Industrial… |
CVE-2025-62346 | Medium | 6.8 | 2025-11-20 | A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malic… |
CVE-2025-60799 | Medium | 6.1 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of… |
CVE-2025-60798 | Medium | 6.5 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['q… |
CVE-2025-60797 | Medium | 6.5 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries… |
CVE-2025-60796 | Medium | 6.1 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parame… |
CVE-2025-60794 | Medium | 6.5 | 2025-11-20 | Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707… |
CVE-2025-5092 | Medium | 6.4 | 2025-11-20 | Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various… |
CVE-2025-41076 | Medium | 6.5 | 2025-11-20 | In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a ge… |
CVE-2025-41075 | High | 7.5 | 2025-11-20 | Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generat… |
CVE-2025-41074 | High | 7.5 | 2025-11-20 | Vulnerability in LimeSurvey 6.13.0 in the endpoint /optout that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to gener… |
CVE-2025-40605 | Medium | 5.3 | 2025-11-20 | A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted dire… |
CVE-2025-40604 | Critical | 9.8 | 2025-11-20 | Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, all… |
CVE-2025-40601 | High | 7.5 | 2025-11-20 | A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which coul… |
CVE-2025-13469 | Low | 2.4 | 2025-11-20 | A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/payme… |
CVE-2025-13468 | Medium | 5.4 | 2025-11-20 | A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete… |
CVE-2025-13451 | High | 7.3 | 2025-11-20 | A vulnerability was identified in SourceCodester Online Shop Project 1.0. The affected element is an unknown function of the file /action.php. Such manipulatio… |
CVE-2025-13450 | Low | 3.5 | 2025-11-20 | A vulnerability was determined in SourceCodester Online Shop Project 1.0. Impacted is an unknown function of the file /shop/register.php. This manipulation of… |
CVE-2025-13449 | High | 7.3 | 2025-11-20 | A vulnerability was found in code-projects Online Shop Project 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the… |
CVE-2025-13446 | High | 8.8 | 2025-11-20 | A vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The manipulation of the ar… |
CVE-2025-13445 | High | 8.8 | 2025-11-20 | A flaw has been found in Tenda AC21 16.03.08.16. This affects an unknown part of the file /goform/SetIpMacBind. Executing a manipulation of the argument list c… |
CVE-2025-13443 | Medium | 5.4 | 2025-11-20 | A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing m… |
CVE-2025-13442 | High | 7.3 | 2025-11-20 | A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. Affected by this vulnerability is the function system of the file /goform/formPdb… |
CVE-2025-13435 | Medium | 5.6 | 2025-11-20 | A security vulnerability has been detected in Dreampie Resty up to 1.3.1.SNAPSHOT. This affects the function Request of the file /resty-httpclient/src/main/jav… |
CVE-2025-13434 | Medium | 5.3 | 2025-11-20 | A weakness has been identified in jameschz Hush Framework 2.0. The impacted element is an unknown function of the file Hush\hush-lib\hush\Util.php of the compo… |
CVE-2025-13433 | High | 7.0 | 2025-11-20 | A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567. The affected element is an unknown function of the file C:\Program Files\WindowsApps\Muse… |
CVE-2025-12778 | Medium | 5.3 | 2025-11-20 | The Ultimate Member Widgets for Elementor – WordPress User Directory plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabil… |
CVE-2025-12502 | Medium | 6.8 | 2025-11-20 | The attention-bar WordPress plugin through 0.7.2.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users s… |
CVE-2025-12414 | | 2025-11-20 | An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted… | |
CVE-2025-11676 | | 2025-11-20 | Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 (UPnP modules), which allows unauthenticated adjacent attackers to perform DoS atta… | |
CVE-2025-0645 | High | 7.2 | 2025-11-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Accessing F… |
CVE-2025-0643 | High | 7.2 | 2025-11-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Narkom Communication and Software Technologies Tra… |
CVE-2025-13424 | Medium | 4.7 | 2025-11-20 | A vulnerability has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_product.php. The manipulati… |
CVE-2025-13423 | Medium | 4.7 | 2025-11-20 | A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_product.php. E… |
CVE-2025-13422 | High | 7.3 | 2025-11-20 | A vulnerability was detected in freeprojectscodes Sports Club Management System 1.0. The affected element is an unknown function of the file /dashboard/admin/c… |
CVE-2025-13421 | High | 7.3 | 2025-11-19 | A security vulnerability has been detected in itsourcecode Human Resource Management System 1.0. Impacted is an unknown function of the file /src/store/NoticeS… |
CVE-2025-13420 | High | 7.3 | 2025-11-19 | A weakness has been identified in itsourcecode Human Resource Management System 1.0. This issue affects some unknown processing of the file /src/store/EventSto… |
CVE-2025-13415 | Low | 3.5 | 2025-11-19 | A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SVG Image Handler. Th… |
CVE-2025-11884 | | 2025-11-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in opentext uCMDB allows Stored XSS. The vulnerabilit… | |
CVE-2025-11001 | High | 7.8 | 2025-11-19 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2025-63719 | High | 7.3 | 2025-11-19 | Campcodes Online Hospital Management System 1.0 is vulnerable to SQL Injection in /admin/index.php via the parameter username. |
CVE-2025-63371 | High | 7.5 | 2025-11-19 | Milos Paripovic OneCommander 3.102.0.0 is vulnerable to Directory Traversal. The vulnerability resides in the ZIP file processing component, specifically in th… |
CVE-2025-58181 | Medium | 5.3 | 2025-11-19 | SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded m… |
CVE-2025-47914 | Medium | 5.3 | 2025-11-19 | SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed… |
CVE-2025-13412 | Low | 2.4 | 2025-11-19 | A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/ad… |
CVE-2025-13411 | Medium | 4.7 | 2025-11-19 | A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/a… |
CVE-2025-13410 | High | 7.3 | 2025-11-19 | A vulnerability has been found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected is an unknown function of the file /admin/receipt.php. Such manip… |
CVE-2025-13147 | Medium | 5.3 | 2025-11-19 | Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4. |
CVE-2025-65103 | High | 8.8 | 2025-11-19 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerabili… |
CVE-2025-63932 | High | 7.3 | 2025-11-19 | D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. The HNAP service provided by cgibin d… |
CVE-2025-63214 | Medium | 6.5 | 2025-11-19 | An issue was discovered in bridgetech VBC Server & Element Manager, firmware version 6.5.0-10 , 6.5.0-9, allowing unauthorized attackers to delete and create a… |
CVE-2025-63213 | Critical | 9.8 | 2025-11-19 | The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/… |
CVE-2025-63212 | Medium | 6.5 | 2025-11-19 | GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifiers (sid) in the pub… |
CVE-2025-51663 | High | 7.5 | 2025-11-19 | A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attemp… |
CVE-2025-51662 | Medium | 5.4 | 2025-11-19 | A stored cross-site scripting (XSS) vulnerability is found in the text sharing feature of FileCodeBox version 2.2 and earlier. Insufficient input validation al… |
CVE-2025-51661 | High | 7.5 | 2025-11-19 | A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use local filesystem storag… |
CVE-2025-36371 | Medium | 6.5 | 2025-11-19 | IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 are impacted by obtaining an information vulnerability in the database plan cache implementation. A user with access to the… |
CVE-2025-65100 | | 2025-11-19 | Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the c… | |
CVE-2025-65094 | High | 8.8 | 2025-11-19 | WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by… |
CVE-2025-64759 | High | 8.1 | 2025-11-19 | Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browse… |
CVE-2025-63211 | Medium | 6.1 | 2025-11-19 | Stored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attackers to execute arbi… |
CVE-2025-65099 | Critical | 9.8 | 2025-11-19 | Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execut… |
CVE-2025-65095 | | 2025-11-19 | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.35.1, there… | |
CVE-2025-65089 | Medium | 6.8 | 2025-11-19 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights… |
CVE-2025-65034 | High | 8.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization vulnerability allows any authenticated user to re… |
CVE-2025-65033 | High | 8.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticat… |