2025 CVEs (page 103)
Page 103 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11771 | Medium | 5.3 | 2025-11-21 | The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modifica… |
CVE-2025-11770 | Medium | 6.4 | 2025-11-21 | The BrightTALK WordPress Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the brighttalk-tim… |
CVE-2025-11768 | Medium | 6.4 | 2025-11-21 | The Islamic Phrases plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phrases' shortcode attribute in all versions up to, and includin… |
CVE-2025-11767 | Medium | 6.4 | 2025-11-21 | The Tips Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tip' shortcode in all versions up to, and including, 0.2.1. This… |
CVE-2025-11765 | Medium | 6.4 | 2025-11-21 | The Stock Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_height' and 'image_width' shortcode attributes in all versions… |
CVE-2025-11764 | Medium | 6.4 | 2025-11-21 | The Shortcodes Bootstrap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in the [notification] shortcode in all vers… |
CVE-2025-11763 | Medium | 6.4 | 2025-11-21 | The Display Pages Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column_count' parameter in the [display-pages] shortcode… |
CVE-2025-11456 | Critical | 9.8 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… |
CVE-2025-11003 | Medium | 6.4 | 2025-11-21 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missin… |
CVE-2025-10938 | Medium | 6.5 | 2025-11-21 | The UiPress lite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.08. This is due to missing capa… |
CVE-2025-64695 | High | 7.8 | 2025-11-21 | Uncontrolled search path element issue exists in the installer of LogStare Collector (for Windows). If exploited, arbitrary code may be executed with the privi… |
CVE-2025-64299 | Low | 2.7 | 2025-11-21 | LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes. |
CVE-2025-62687 | Medium | 6.5 | 2025-11-21 | Cross-site request forgery vulnerability exists in LogStare Collector. If a user views a crafted page while logged, unintended operations may be performed. |
CVE-2025-62189 | Medium | 4.3 | 2025-11-21 | LogStare Collector contains an incorrect authorization vulnerability in UserRegistration. If exploited, a non-administrative user may create a new user account… |
CVE-2025-61949 | Medium | 5.4 | 2025-11-21 | LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitrary script may be ex… |
CVE-2025-58097 | High | 7.8 | 2025-11-21 | The installation directory of LogStare Collector is configured with incorrect access permissions. A non-administrative user may manipulate files within the ins… |
CVE-2025-9825 | Medium | 5.0 | 2025-11-21 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed a… |
CVE-2025-13499 | High | 7.8 | 2025-11-21 | Kafka dissector crash in Wireshark 4.6.0 and 4.4.0 to 4.4.10 allows denial of service |
CVE-2025-12169 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12085 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12023 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12022 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-11368 | Medium | 5.3 | 2025-11-21 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. Thi… |
CVE-2025-64310 | Critical | 9.8 | 2025-11-21 | EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrative user's password m… |
CVE-2025-64762 | Critical | 9.1 | 2025-11-21 | The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs ve… |
CVE-2025-64755 | Critical | 9.8 | 2025-11-21 | Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible to bypass the Claude Code read-only val… |
CVE-2025-64751 | High | 8.8 | 2025-11-21 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( op… |
CVE-2025-62426 | Medium | 6.5 | 2025-11-21 | vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints… |
CVE-2025-62372 | Medium | 6.5 | 2025-11-21 | vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimod… |
CVE-2025-62164 | High | 8.8 | 2025-11-21 | vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead t… |
CVE-2025-13485 | High | 7.3 | 2025-11-21 | A security flaw has been discovered in itsourcecode Online File Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=… |
CVE-2025-64660 | High | 8.0 | 2025-11-20 | Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network. |
CVE-2025-64655 | High | 8.8 | 2025-11-20 | Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-62459 | High | 8.3 | 2025-11-20 | Microsoft Defender Portal Spoofing Vulnerability |
CVE-2025-62207 | High | 8.6 | 2025-11-20 | Azure Monitor Elevation of Privilege Vulnerability |
CVE-2025-59245 | Critical | 9.8 | 2025-11-20 | Microsoft SharePoint Online Elevation of Privilege Vulnerability |
CVE-2025-49752 | Critical | 10.0 | 2025-11-20 | Azure Bastion Elevation of Privilege Vulnerability |
CVE-2025-36072 | High | 8.8 | 2025-11-20 | IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an… |
CVE-2025-13484 | Low | 2.4 | 2025-11-20 | A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/cus… |
CVE-2025-61138 | High | 7.5 | 2025-11-20 | Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory. |
CVE-2025-36160 | Medium | 5.3 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system. |
CVE-2025-36159 | Medium | 6.2 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 could allow a local user to forge log files to impersonate other users or hide their identity due to improper neutralization of… |
CVE-2025-36158 | Medium | 5.1 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 could allow a local user with specific permission to obtain sensitive information from files due to uncontrolled recursive dire… |
CVE-2025-36153 | Medium | 6.1 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code… |
CVE-2025-13087 | Medium | 6.2 | 2025-11-20 | A vulnerability exists in the Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products that allows remote code execution with root privileges. When a PO… |
CVE-2025-64770 | Medium | 6.8 | 2025-11-20 | The affected products allow unauthenticated access to Open Network Video Interface Forum (ONVIF) services, which may allow an attacker unauthorized access to c… |
CVE-2025-63807 | Critical | 9.8 | 2025-11-20 | An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code g… |
CVE-2025-63685 | Critical | 9.8 | 2025-11-20 | Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of system libraries. Specifically, the applicat… |
CVE-2025-62674 | Medium | 6.8 | 2025-11-20 | The affected product allows unauthenticated access to Real Time Streaming Protocol (RTSP) services, which may allow an attacker unauthorized access to camera c… |
CVE-2025-25613 | High | 7.5 | 2025-11-20 | FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to t… |
CVE-2025-55124 | Medium | 6.1 | 2025-11-20 | Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script. |
CVE-2025-55123 | Medium | 5.4 | 2025-11-20 | Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own a… |
CVE-2025-52671 | Medium | 4.3 | 2025-11-20 | Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information… |
CVE-2025-52670 | Medium | 6.5 | 2025-11-20 | Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts |
CVE-2025-52669 | Medium | 4.3 | 2025-11-20 | Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the con… |
CVE-2025-52668 | Medium | 5.4 | 2025-11-20 | Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosu… |
CVE-2025-52667 | Medium | 5.4 | 2025-11-20 | Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in… |
CVE-2025-52666 | Low | 2.7 | 2025-11-20 | Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable th… |
CVE-2025-48987 | Medium | 6.1 | 2025-11-20 | Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack. |
CVE-2025-48986 | High | 8.8 | 2025-11-20 | Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy t… |
CVE-2025-35029 | Low | 3.5 | 2025-11-20 | Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary conten… |
CVE-2025-55128 | Medium | 6.5 | 2025-11-20 | HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php”. An attacker with… |
CVE-2025-55127 | Medium | 5.4 | 2025-11-20 | HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username wi… |
CVE-2025-55126 | Medium | 6.5 | 2025-11-20 | HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top of advertiser-related pages… |
CVE-2025-10571 | Critical | 9.6 | 2025-11-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1. |
CVE-2025-64524 | Low | 3.3 | 2025-11-20 | cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In version… |
CVE-2025-63889 | High | 7.5 | 2025-11-20 | The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template… |
CVE-2025-63888 | Critical | 9.8 | 2025-11-20 | The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability. |
CVE-2025-64428 | Critical | 9.8 | 2025-11-20 | Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for… |
CVE-2025-64185 | | 2025-11-20 | Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open On… | |
CVE-2025-64027 | Medium | 6.1 | 2025-11-20 | Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, t… |
CVE-2025-63848 | Medium | 6.1 | 2025-11-20 | Stored cross site scripting (xss) vulnerability in SWISH prolog thru 2.2.0 allowing attackers to execute arbitrary code via crafted web IDE notebook. |
CVE-2025-62724 | Medium | 4.3 | 2025-11-20 | Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) attack when downloadi… |
CVE-2025-62709 | Medium | 6.8 | 2025-11-20 | ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build… |
CVE-2025-52410 | Critical | 9.8 | 2025-11-20 | Institute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The `myds` GET parameter is no… |
CVE-2025-13437 | | 2025-11-20 | When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli… | |
CVE-2025-12121 | High | 7.3 | 2025-11-20 | Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell comma… |
CVE-2025-12120 | High | 7.3 | 2025-11-20 | Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation… |
CVE-2025-62875 | Medium | 5.5 | 2025-11-20 | An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbl… |
CVE-2025-62731 | Medium | 4.8 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /feries endpoint. Malicious attacker with access to public holidays feature is able to inject arbitrary HTML and JS i… |
CVE-2025-62730 | High | 8.8 | 2025-11-20 | SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However… |
CVE-2025-62729 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be ren… |
CVE-2025-62297 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which wil… |
CVE-2025-62296 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will… |
CVE-2025-62295 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which… |
CVE-2025-62294 | High | 7.5 | 2025-11-20 | SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is abl… |
CVE-2025-62293 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attack… |
CVE-2025-60738 | Critical | 9.8 | 2025-11-20 | An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arb… |
CVE-2025-60737 | Medium | 6.1 | 2025-11-20 | Cross Site Scripting vulnerability in Ilevia EVE X1 Server Firmware Version<= 4.7.18.0.eden:Logic Version<=6.00 - 2025_07_21 allows a remote attacker to execut… |
CVE-2025-36161 | Medium | 5.9 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-S… |
CVE-2025-34320 | | 2025-11-20 | BASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canonicalize input path segments. This allows unauthen… | |
CVE-2025-13425 | | 2025-11-20 | A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty dir… | |
CVE-2025-65226 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the deviceId parameter in /goform/saveParentControlInfo. |
CVE-2025-65223 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the urls parameter of /goform/saveParentControlInfo. |
CVE-2025-65222 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the rebootTime parameter of /goform/SetSysAutoRebbotCfg. |
CVE-2025-65221 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the list parameter of /goform/setPptpUserList. |
CVE-2025-65220 | Medium | 4.3 | 2025-11-20 | Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow in: /goform/SetVirtualServerCfg via the list parameter. |
CVE-2025-64984 | Medium | 6.1 | 2025-11-20 | Kaspersky has fixed a security issue in Kaspersky Endpoint Security for Linux (any version with anti-virus databases prior to 18.11.2025), Kaspersky Industrial… |
CVE-2025-62346 | Medium | 6.8 | 2025-11-20 | A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malic… |
CVE-2025-60799 | Medium | 6.1 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of… |