2025 CVEs (page 105)
Page 105 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10158 | Medium | 4.3 | 2025-11-18 | A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The … |
CVE-2025-6670 | High | 8.8 | 2025-11-18 | A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within a… |
CVE-2025-41350 | Medium | 5.4 | 2025-11-18 | Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of… |
CVE-2025-41349 | Medium | 5.4 | 2025-11-18 | Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of… |
CVE-2025-41348 | Critical | 9.8 | 2025-11-18 | SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by… |
CVE-2025-13345 | Medium | 6.3 | 2025-11-18 | A security vulnerability has been detected in SourceCodester Train Station Ticketing System 1.0. Affected by this issue is some unknown functionality of the fi… |
CVE-2025-13344 | High | 7.3 | 2025-11-18 | A weakness has been identified in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is an unknown functionality of the file /aj… |
CVE-2025-13343 | Low | 3.5 | 2025-11-18 | A security flaw has been discovered in SourceCodester Interview Management System 1.0. Affected is an unknown function of the file /editQuestion.php. The manip… |
CVE-2025-41737 | High | 7.5 | 2025-11-18 | Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules. |
CVE-2025-41736 | High | 8.8 | 2025-11-18 | A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a… |
CVE-2025-41735 | High | 8.8 | 2025-11-18 | A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution. |
CVE-2025-41734 | Critical | 9.8 | 2025-11-18 | An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices. |
CVE-2025-41733 | Critical | 9.8 | 2025-11-18 | The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST… |
CVE-2025-41347 | Critical | 9.8 | 2025-11-18 | Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'web… |
CVE-2025-11427 | Medium | 5.8 | 2025-11-18 | The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and includin… |
CVE-2025-4212 | High | 7.2 | 2025-11-18 | The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and includi… |
CVE-2025-41346 | Critical | 9.8 | 2025-11-18 | Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numeric… |
CVE-2025-13196 | Medium | 5.4 | 2025-11-18 | The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Street Map widget's marker content paramet… |
CVE-2025-13133 | Medium | 6.6 | 2025-11-18 | The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' fun… |
CVE-2025-13069 | High | 8.8 | 2025-11-18 | The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3. This is due to in… |
CVE-2025-12955 | High | 7.5 | 2025-11-18 | The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39. This is d… |
CVE-2025-12691 | Medium | 6.4 | 2025-11-18 | The Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox functi… |
CVE-2025-12639 | Medium | 4.3 | 2025-11-18 | The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and includ… |
CVE-2025-12481 | Medium | 4.3 | 2025-11-18 | The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not prop… |
CVE-2025-12457 | Medium | 6.4 | 2025-11-18 | The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includin… |
CVE-2025-12392 | Medium | 5.3 | 2025-11-18 | The Cryptocurrency Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2025-12391 | Medium | 5.3 | 2025-11-18 | The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_optin_o… |
CVE-2025-12088 | Medium | 6.4 | 2025-11-18 | The Meta Display Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meta Display Block in all versions up to, and including, 1.0.0… |
CVE-2025-12079 | Medium | 6.1 | 2025-11-18 | The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.4 du… |
CVE-2025-11734 | Medium | 5.4 | 2025-11-18 | The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to unauthorized post modification due to… |
CVE-2025-9625 | Medium | 4.3 | 2025-11-18 | The Coil Web Monetization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing… |
CVE-2025-8609 | Medium | 6.4 | 2025-11-18 | The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion Block's attributes in all versions… |
CVE-2025-8605 | Medium | 6.4 | 2025-11-18 | The Gutenify – Visual Site Builder Blocks & Site Templates. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes… |
CVE-2025-40549 | Critical | 9.1 | 2025-11-18 | A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute… |
CVE-2025-40548 | Critical | 9.1 | 2025-11-18 | A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This iss… |
CVE-2025-40547 | Critical | 9.1 | 2025-11-18 | A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This… |
CVE-2025-40545 | Medium | 4.8 | 2025-11-18 | SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate t… |
CVE-2025-26391 | Medium | 5.4 | 2025-11-18 | SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. Th… |
CVE-2025-13088 | High | 8.8 | 2025-11-18 | The Category and Product Woocommerce Tabs plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0. This is due to… |
CVE-2025-12962 | Medium | 6.4 | 2025-11-18 | The Local Syndication plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5a via the `url` parameter in t… |
CVE-2025-12961 | Medium | 4.3 | 2025-11-18 | The Download Panel plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability check on the 'wp_ajax_save_settings' AJ… |
CVE-2025-12937 | Medium | 6.5 | 2025-11-18 | The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'acf_flm_upda… |
CVE-2025-12827 | Medium | 4.3 | 2025-11-18 | The Top Friends plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing nonce valida… |
CVE-2025-12823 | Medium | 6.4 | 2025-11-18 | The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to… |
CVE-2025-12775 | High | 8.8 | 2025-11-18 | The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the `ajax_upload_hand… |
CVE-2025-12528 | High | 8.1 | 2025-11-18 | The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the format_classic function. Thi… |
CVE-2025-12411 | High | 7.1 | 2025-11-18 | The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'ID' parameter in versions up to, and including, 1… |
CVE-2025-12406 | Medium | 6.1 | 2025-11-18 | The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to mi… |
CVE-2025-12404 | Medium | 6.1 | 2025-11-18 | The Like-it plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect non… |
CVE-2025-12372 | Medium | 4.3 | 2025-11-18 | The Permalinks Cascade plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.2. This is due to the plugin not pro… |
CVE-2025-12173 | Medium | 4.3 | 2025-11-18 | The WP Admin Microblog plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or… |
CVE-2025-12078 | Medium | 6.1 | 2025-11-18 | The ArtiBot Free Chat Bot for WebSites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and includin… |
CVE-2025-11868 | Medium | 6.4 | 2025-11-18 | The everviz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `everviz` shortcode attributes in versions up to, and including, 1.1. Thi… |
CVE-2025-11620 | High | 7.2 | 2025-11-18 | The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mrpu_add_multiple… |
CVE-2025-8727 | High | 7.2 | 2025-11-18 | There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially… |
CVE-2025-8404 | Medium | 5.5 | 2025-11-18 | Stack buffer overflow vulnerability exists in the Supermicro BMC Shared library. An authenticated attacker with access to the BMC exploit stack buffer via a cr… |
CVE-2025-8076 | High | 7.2 | 2025-11-18 | There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially… |
CVE-2025-11267 | Medium | 6.4 | 2025-11-18 | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_veu_custom_css' parameter in all versions up to, a… |
CVE-2025-11265 | Medium | 6.4 | 2025-11-18 | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_cta_url' and 'vkExUnit_cta_button_text' pa… |
CVE-2025-10089 | High | 7.7 | 2025-11-18 | Uncontrolled Search Path Element Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S Setting Application all versions, MILCO… |
CVE-2025-7623 | Medium | 5.4 | 2025-11-18 | Stack-based buffer overflow in the SMASH-CLP shell. An authenticated attacker with SSH access to the BMC can exploit a stack buffer overflow via a crafted SMAS… |
CVE-2025-12524 | Medium | 5.4 | 2025-11-18 | The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation… |
CVE-2025-48593 | High | 8.0 | 2025-11-18 | In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution… |
CVE-2025-64734 | Low | 2.4 | 2025-11-18 | Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-s… |
CVE-2025-52578 | Medium | 5.7 | 2025-11-18 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access… |
CVE-2025-52457 | Medium | 5.7 | 2025-11-18 | Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially c… |
CVE-2025-12974 | High | 8.1 | 2025-11-18 | The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in al… |
CVE-2025-8693 | High | 8.8 | 2025-11-18 | A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an a… |
CVE-2025-6599 | Medium | 5.3 | 2025-11-18 | An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker t… |
CVE-2025-12792 | Low | 3.2 | 2025-11-18 | The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged acces… |
CVE-2025-13325 | Medium | 6.3 | 2025-11-18 | A vulnerability was determined in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /enrollment_edit1.php. E… |
CVE-2025-13323 | High | 7.3 | 2025-11-18 | A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /listorder.php. Performing m… |
CVE-2025-13306 | Medium | 6.3 | 2025-11-18 | A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the file /boafrm/formD… |
CVE-2025-13230 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13229 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13228 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13227 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13226 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-7711 | Medium | 5.4 | 2025-11-17 | The The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up… |
CVE-2025-36553 | High | 8.8 | 2025-11-17 | A buffer overflow vulnerability exists in the CvManager functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47… |
CVE-2025-36463 | High | 7.3 | 2025-11-17 | Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior… |
CVE-2025-36462 | High | 7.3 | 2025-11-17 | Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior… |
CVE-2025-36461 | High | 7.3 | 2025-11-17 | Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior… |
CVE-2025-36460 | High | 7.3 | 2025-11-17 | Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior… |
CVE-2025-32089 | High | 8.8 | 2025-11-17 | A buffer overflow vulnerability exists in the CvManager_SBI functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36… |
CVE-2025-31649 | High | 8.7 | 2025-11-17 | A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus… |
CVE-2025-31361 | High | 8.7 | 2025-11-17 | A privilege escalation vulnerability exists in the ControlVault WBDI Driver WBIO_USH_ADD_RECORD functionality of Dell ControlVault3 prior to 5.15.14.19 and Del… |
CVE-2025-13305 | High | 8.8 | 2025-11-17 | A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown processing of the file /b… |
CVE-2025-13304 | High | 8.8 | 2025-11-17 | A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. This vulnerability affects unknown code of th… |
CVE-2025-13224 | High | 8.8 | 2025-11-17 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2025-13223 | High | 8.8 | 2025-11-17 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2025-64766 | Medium | 5.3 | 2025-11-17 | NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to befo… |
CVE-2025-13303 | Medium | 6.3 | 2025-11-17 | A vulnerability was determined in code-projects Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /search-edit.ph… |
CVE-2025-13302 | Medium | 4.7 | 2025-11-17 | A vulnerability was identified in code-projects Courier Management System 1.0. This affects an unknown part of the file /add-new-officer.php. Such manipulation… |
CVE-2025-36118 | High | 7.5 | 2025-11-17 | IBM Storage Virtualize 8.4, 8.5, 8.7, and 9.1 IKEv1 implementation allows remote attackers to obtain sensitive information from device memory via a Security As… |
CVE-2025-13301 | High | 7.3 | 2025-11-17 | A vulnerability was found in itsourcecode Web-Based Internet Laboratory Management System 1.0. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-13300 | High | 7.3 | 2025-11-17 | A vulnerability has been found in itsourcecode Web-Based Internet Laboratory Management System 1.0. Affected is an unknown function of the file /settings/contr… |
CVE-2025-36357 | High | 8.0 | 2025-11-17 | IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a speci… |
CVE-2025-36299 | Medium | 4.3 | 2025-11-17 | IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system. |
CVE-2025-13299 | High | 7.3 | 2025-11-17 | A flaw has been found in itsourcecode Web-Based Internet Laboratory Management System 1.0. This impacts an unknown function of the file /user/controller.php. E… |