2025 CVEs (page 104)
Page 104 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-60798 | Medium | 6.5 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['q… |
CVE-2025-60797 | Medium | 6.5 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries… |
CVE-2025-60796 | Medium | 6.1 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parame… |
CVE-2025-60794 | Medium | 6.5 | 2025-11-20 | Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707… |
CVE-2025-5092 | Medium | 6.4 | 2025-11-20 | Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various… |
CVE-2025-41076 | Medium | 6.5 | 2025-11-20 | In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a ge… |
CVE-2025-41075 | High | 7.5 | 2025-11-20 | Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generat… |
CVE-2025-41074 | High | 7.5 | 2025-11-20 | Vulnerability in LimeSurvey 6.13.0 in the endpoint /optout that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to gener… |
CVE-2025-40605 | Medium | 5.3 | 2025-11-20 | A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted dire… |
CVE-2025-40604 | Critical | 9.8 | 2025-11-20 | Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, all… |
CVE-2025-40601 | High | 7.5 | 2025-11-20 | A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which coul… |
CVE-2025-13469 | Low | 2.4 | 2025-11-20 | A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/payme… |
CVE-2025-13468 | Medium | 5.4 | 2025-11-20 | A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete… |
CVE-2025-13451 | High | 7.3 | 2025-11-20 | A vulnerability was identified in SourceCodester Online Shop Project 1.0. The affected element is an unknown function of the file /action.php. Such manipulatio… |
CVE-2025-13450 | Low | 3.5 | 2025-11-20 | A vulnerability was determined in SourceCodester Online Shop Project 1.0. Impacted is an unknown function of the file /shop/register.php. This manipulation of… |
CVE-2025-13449 | High | 7.3 | 2025-11-20 | A vulnerability was found in code-projects Online Shop Project 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the… |
CVE-2025-13446 | High | 8.8 | 2025-11-20 | A vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The manipulation of the ar… |
CVE-2025-13445 | High | 8.8 | 2025-11-20 | A flaw has been found in Tenda AC21 16.03.08.16. This affects an unknown part of the file /goform/SetIpMacBind. Executing a manipulation of the argument list c… |
CVE-2025-13443 | Medium | 5.4 | 2025-11-20 | A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing m… |
CVE-2025-13442 | High | 7.3 | 2025-11-20 | A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. Affected by this vulnerability is the function system of the file /goform/formPdb… |
CVE-2025-13435 | Medium | 5.6 | 2025-11-20 | A security vulnerability has been detected in Dreampie Resty up to 1.3.1.SNAPSHOT. This affects the function Request of the file /resty-httpclient/src/main/jav… |
CVE-2025-13434 | Medium | 5.3 | 2025-11-20 | A weakness has been identified in jameschz Hush Framework 2.0. The impacted element is an unknown function of the file Hush\hush-lib\hush\Util.php of the compo… |
CVE-2025-13433 | High | 7.0 | 2025-11-20 | A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567. The affected element is an unknown function of the file C:\Program Files\WindowsApps\Muse… |
CVE-2025-12778 | Medium | 5.3 | 2025-11-20 | The Ultimate Member Widgets for Elementor – WordPress User Directory plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabil… |
CVE-2025-12502 | Medium | 6.8 | 2025-11-20 | The attention-bar WordPress plugin through 0.7.2.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users s… |
CVE-2025-12414 | | 2025-11-20 | An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted… | |
CVE-2025-11676 | | 2025-11-20 | Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 (UPnP modules), which allows unauthenticated adjacent attackers to perform DoS atta… | |
CVE-2025-0645 | High | 7.2 | 2025-11-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Accessing F… |
CVE-2025-0643 | High | 7.2 | 2025-11-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Narkom Communication and Software Technologies Tra… |
CVE-2025-13424 | Medium | 4.7 | 2025-11-20 | A vulnerability has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_product.php. The manipulati… |
CVE-2025-13423 | Medium | 4.7 | 2025-11-20 | A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_product.php. E… |
CVE-2025-13422 | High | 7.3 | 2025-11-20 | A vulnerability was detected in freeprojectscodes Sports Club Management System 1.0. The affected element is an unknown function of the file /dashboard/admin/c… |
CVE-2025-13421 | High | 7.3 | 2025-11-19 | A security vulnerability has been detected in itsourcecode Human Resource Management System 1.0. Impacted is an unknown function of the file /src/store/NoticeS… |
CVE-2025-13420 | High | 7.3 | 2025-11-19 | A weakness has been identified in itsourcecode Human Resource Management System 1.0. This issue affects some unknown processing of the file /src/store/EventSto… |
CVE-2025-13415 | Low | 3.5 | 2025-11-19 | A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SVG Image Handler. Th… |
CVE-2025-11884 | | 2025-11-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in opentext uCMDB allows Stored XSS. The vulnerabilit… | |
CVE-2025-11001 | High | 7.8 | 2025-11-19 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2025-63719 | High | 7.3 | 2025-11-19 | Campcodes Online Hospital Management System 1.0 is vulnerable to SQL Injection in /admin/index.php via the parameter username. |
CVE-2025-63371 | High | 7.5 | 2025-11-19 | Milos Paripovic OneCommander 3.102.0.0 is vulnerable to Directory Traversal. The vulnerability resides in the ZIP file processing component, specifically in th… |
CVE-2025-58181 | Medium | 5.3 | 2025-11-19 | SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded m… |
CVE-2025-47914 | Medium | 5.3 | 2025-11-19 | SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed… |
CVE-2025-13412 | Low | 2.4 | 2025-11-19 | A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/ad… |
CVE-2025-13411 | Medium | 4.7 | 2025-11-19 | A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/a… |
CVE-2025-13410 | High | 7.3 | 2025-11-19 | A vulnerability has been found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected is an unknown function of the file /admin/receipt.php. Such manip… |
CVE-2025-13147 | Medium | 5.3 | 2025-11-19 | Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4. |
CVE-2025-65103 | High | 8.8 | 2025-11-19 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerabili… |
CVE-2025-63932 | High | 7.3 | 2025-11-19 | D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. The HNAP service provided by cgibin d… |
CVE-2025-63214 | Medium | 6.5 | 2025-11-19 | An issue was discovered in bridgetech VBC Server & Element Manager, firmware version 6.5.0-10 , 6.5.0-9, allowing unauthorized attackers to delete and create a… |
CVE-2025-63213 | Critical | 9.8 | 2025-11-19 | The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/… |
CVE-2025-63212 | Medium | 6.5 | 2025-11-19 | GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifiers (sid) in the pub… |
CVE-2025-51663 | High | 7.5 | 2025-11-19 | A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attemp… |
CVE-2025-51662 | Medium | 5.4 | 2025-11-19 | A stored cross-site scripting (XSS) vulnerability is found in the text sharing feature of FileCodeBox version 2.2 and earlier. Insufficient input validation al… |
CVE-2025-51661 | High | 7.5 | 2025-11-19 | A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use local filesystem storag… |
CVE-2025-36371 | Medium | 6.5 | 2025-11-19 | IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 are impacted by obtaining an information vulnerability in the database plan cache implementation. A user with access to the… |
CVE-2025-65100 | | 2025-11-19 | Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the c… | |
CVE-2025-65094 | High | 8.8 | 2025-11-19 | WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by… |
CVE-2025-64759 | High | 8.1 | 2025-11-19 | Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browse… |
CVE-2025-63211 | Medium | 6.1 | 2025-11-19 | Stored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attackers to execute arbi… |
CVE-2025-65099 | Critical | 9.8 | 2025-11-19 | Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execut… |
CVE-2025-65095 | | 2025-11-19 | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.35.1, there… | |
CVE-2025-65089 | Medium | 6.8 | 2025-11-19 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights… |
CVE-2025-65034 | High | 8.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization vulnerability allows any authenticated user to re… |
CVE-2025-65033 | High | 8.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticat… |
CVE-2025-65032 | Medium | 6.5 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability allows any authent… |
CVE-2025-65031 | Medium | 6.5 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows auth… |
CVE-2025-65030 | High | 7.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the comment deletion API allows any authenticated… |
CVE-2025-65029 | High | 8.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authent… |
CVE-2025-65028 | Medium | 6.5 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authent… |
CVE-2025-65026 | Medium | 6.1 | 2025-11-19 | esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injectio… |
CVE-2025-65025 | High | 8.2 | 2025-11-19 | esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal duri… |
CVE-2025-65021 | Critical | 9.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability exists in the poll… |
CVE-2025-65020 | Medium | 6.5 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplic… |
CVE-2025-63210 | Critical | 9.8 | 2025-11-19 | The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit t… |
CVE-2025-63209 | High | 7.5 | 2025-11-19 | The ELCA Star Transmitter Remote Control firmware 1.25 for STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500, and possibly other models, contains an inform… |
CVE-2025-63208 | High | 7.5 | 2025-11-19 | An issue was discovered in bridgetech VB288 Objective QoE Content Extractor, firmware version 5.6.0-8, allowing attackers to gain sensitive information such as… |
CVE-2025-63207 | Critical | 9.8 | 2025-11-19 | The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on t… |
CVE-2025-63206 | Critical | 9.8 | 2025-11-19 | An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing attackers to gain esc… |
CVE-2025-63205 | High | 7.5 | 2025-11-19 | An issue was discovered in bridgetech probes VB220 IP Network Probe,VB120 Embedded IP + RF Probe, VB330 High-Capacity Probe, VB440 ST 2110 Production Analytics… |
CVE-2025-13316 | High | 8.1 | 2025-11-19 | Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypt… |
CVE-2025-13315 | Critical | 9.8 | 2025-11-19 | Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication control… |
CVE-2025-65019 | Medium | 5.4 | 2025-11-19 | Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization en… |
CVE-2025-64765 | Medium | 5.3 | 2025-11-19 | Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s… |
CVE-2025-64764 | High | 7.1 | 2025-11-19 | Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application… |
CVE-2025-64757 | Low | 3.5 | 2025-11-19 | Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local… |
CVE-2025-64708 | Medium | 5.8 | 2025-11-19 | authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid rega… |
CVE-2025-64521 | Medium | 4.8 | 2025-11-19 | authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provi… |
CVE-2025-34337 | | 2025-11-19 | eGovFramework/egovframe-common-components versions up to and including 4.3.1 includes Web Editor image upload and related file delivery functionality that uses… | |
CVE-2025-34336 | | 2025-11-19 | eGovFramework/egovframe-common-components versions up to and including 4.3.1 contain an unauthenticated file upload vulnerability via the /utl/wed/insertImage… | |
CVE-2025-34335 | High | 8.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the lice… |
CVE-2025-34334 | High | 8.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax tes… |
CVE-2025-34333 | High | 7.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly pe… |
CVE-2025-34332 | High | 7.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windo… |
CVE-2025-34331 | High | 7.5 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 contain an unauthenticated file read vulnerability via the download… |
CVE-2025-34330 | Medium | 5.3 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an u… |
CVE-2025-34329 | Critical | 9.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_file… |
CVE-2025-34328 | Critical | 9.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an u… |
CVE-2025-13400 | High | 8.8 | 2025-11-19 | A vulnerability was detected in Tenda CH22 1.0.0.1. Affected is the function formWrlExtraGet of the file /goform/WrlExtraGet. Performing a manipulation of the… |
CVE-2025-12766 | Medium | 5.0 | 2025-11-19 | An Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of BlackBerry® AtHoc® (OnPrem) version 7.21 could allow an attacker to poten… |
CVE-2025-12743 | | 2025-11-19 | The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a reserved internal n… | |
CVE-2025-65024 | High | 7.2 | 2025-11-19 | i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the… |