2025 CVEs (page 106)
Page 106 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13298 | High | 7.3 | 2025-11-17 | A vulnerability was detected in itsourcecode Web-Based Internet Laboratory Management System 1.0. This affects an unknown function of the file /enrollment/cont… |
CVE-2025-63292 | Low | 3.5 | 2025-11-17 | Freebox v5 HD (firmware = 1.7.20), Freebox v5 Crystal (firmware = 1.7.20), Freebox v6 Révolution r1–r3 (firmware = 4.7.x), Freebox Mini 4K (firmware = 4.7.x)… |
CVE-2025-64758 | Medium | 4.8 | 2025-11-17 | @dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to… |
CVE-2025-64756 | High | 7.5 | 2025-11-17 | Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection… |
CVE-2025-64342 | | 2025-11-17 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. When the ESP32 is in advertising mode, if it receives a connection request containing… | |
CVE-2025-58407 | High | 7.4 | 2025-11-17 | Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trigger a read and/or w… |
CVE-2025-55059 | Medium | 4.8 | 2025-11-17 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-55058 | Medium | 4.5 | 2025-11-17 | CWE-20 Improper Input Validation |
CVE-2025-55057 | Medium | 4.5 | 2025-11-17 | Multiple CWE-352 Cross-Site Request Forgery (CSRF) |
CVE-2025-55056 | Medium | 4.8 | 2025-11-17 | Multiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-55055 | Medium | 6.8 | 2025-11-17 | CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2025-34323 | High | 7.8 | 2025-11-17 | Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable ap… |
CVE-2025-34322 | High | 7.2 | 2025-11-17 | Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature… |
CVE-2025-13297 | High | 7.3 | 2025-11-17 | A security vulnerability has been detected in itsourcecode Web-Based Internet Laboratory Management System 1.0. The impacted element is an unknown function of… |
CVE-2025-63918 | Medium | 6.2 | 2025-11-17 | PDFPatcher executable does not validate user-supplied file paths, allowing directory traversal attacks allowing attackers to upload arbitrary files to arbitrar… |
CVE-2025-63917 | High | 7.1 | 2025-11-17 | PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. The application uses .NET's X… |
CVE-2025-62519 | High | 7.2 | 2025-11-17 | phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update function… |
CVE-2025-58410 | High | 7.5 | 2025-11-17 | Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exported as read-only. T… |
CVE-2025-13319 | High | 8.8 | 2025-11-17 | An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted… |
CVE-2025-13291 | High | 7.3 | 2025-11-17 | A vulnerability was found in Campcodes Supplier Management System 1.0. This affects an unknown part of the file /manufacturer/confirm_order.php. Performing a m… |
CVE-2025-13290 | Medium | 6.3 | 2025-11-17 | A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /saveorder.ph… |
CVE-2025-13193 | Medium | 5.5 | 2025-11-17 | A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users… |
CVE-2025-65083 | Low | 3.2 | 2025-11-17 | GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server. This can be problematic if the GoSign Desktop user sele… |
CVE-2025-64046 | Medium | 6.1 | 2025-11-17 | OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /system/update-run.php. |
CVE-2025-63916 | High | 8.1 | 2025-11-17 | MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properly sanitize user-supp… |
CVE-2025-63748 | High | 8.8 | 2025-11-17 | QaTraq 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment" feature in the "Test Script" module. The application fails to restri… |
CVE-2025-63747 | Critical | 9.8 | 2025-11-17 | QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login… |
CVE-2025-63708 | Medium | 6.1 | 2025-11-17 | Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to execute arbitrary Jav… |
CVE-2025-13289 | Medium | 6.3 | 2025-11-17 | A vulnerability was detected in 1000projects Design & Development of Student Database Management System 1.0. Affected is an unknown function of the file /Teach… |
CVE-2025-13288 | High | 8.8 | 2025-11-17 | A security vulnerability has been detected in Tenda CH22 1.0.0.1. This impacts the function fromPptpUserSetting of the file /goform/PPTPUserSetting. The manipu… |
CVE-2025-4321 | | 2025-11-17 | In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard reset will bring the dev… | |
CVE-2025-13287 | Medium | 6.3 | 2025-11-17 | A weakness has been identified in itsourcecode Online Voting System 1.0. This affects an unknown function of the file /index.php?page=categories. Executing man… |
CVE-2025-13286 | Medium | 6.3 | 2025-11-17 | A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_use… |
CVE-2025-13285 | High | 7.3 | 2025-11-17 | A vulnerability was identified in itsourcecode Online Voting System 1.0. The affected element is an unknown function of the file /login.php. Such manipulation… |
CVE-2025-13280 | High | 7.3 | 2025-11-17 | A vulnerability was determined in CodeAstro Simple Inventory System 1.0. The impacted element is an unknown function of the file /index.php of the component Lo… |
CVE-2025-13279 | Medium | 6.3 | 2025-11-17 | A vulnerability was found in code-projects Nero Social Networking Site 1.0. The affected element is an unknown function of the file /profilefriends.php. Perfor… |
CVE-2025-13278 | Medium | 6.3 | 2025-11-17 | A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrowed_book_search.php… |
CVE-2025-40936 | High | 7.8 | 2025-11-17 | A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V29.0.258), Simcenter Femap (All versions < V2512.0003), Solid Ed… |
CVE-2025-40834 | Medium | 5.7 | 2025-11-17 | A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the input. This could al… |
CVE-2025-13277 | High | 7.3 | 2025-11-17 | A flaw has been found in code-projects Nero Social Networking Site 1.0. This issue affects some unknown processing of the file /friendsphoto.php. This manipula… |
CVE-2025-11681 | Medium | 6.5 | 2025-11-17 | Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to cause… |
CVE-2025-13276 | High | 7.3 | 2025-11-17 | A vulnerability was detected in g33kyrash Online-Banking-System up to 12dbfa690e5af649fb72d2e5d3674e88d6743455. This vulnerability affects unknown code of the… |
CVE-2025-13275 | Medium | 4.7 | 2025-11-17 | A security vulnerability has been detected in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This affects an unknown part of th… |
CVE-2025-13274 | Medium | 6.3 | 2025-11-17 | A weakness has been identified in Campcodes School Fees Payment Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.p… |
CVE-2025-13273 | Medium | 6.3 | 2025-11-17 | A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2025-13272 | High | 7.3 | 2025-11-17 | A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Affected is an unknown function of the file /manage_course.php. Such man… |
CVE-2025-13271 | High | 7.3 | 2025-11-17 | A vulnerability was determined in Campcodes School Fees Payment Management System 1.0. This impacts an unknown function of the file /ajax.php?action=login. Thi… |
CVE-2025-65073 | High | 7.5 | 2025-11-17 | OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorizatio… |
CVE-2025-13270 | Medium | 6.3 | 2025-11-17 | A vulnerability was found in Campcodes School Fees Payment Management System 1.0. This affects an unknown function of the file /ajax.php?action=save_course. Th… |
CVE-2025-13269 | Medium | 6.3 | 2025-11-17 | A vulnerability has been found in Campcodes School Fees Payment Management System 1.0. The impacted element is an unknown function of the file /ajax.php?action… |
CVE-2025-13268 | Medium | 6.3 | 2025-11-17 | A flaw has been found in Dromara dataCompare up to 1.0.1. The affected element is the function DbConfig of the file src/main/java/com/vince/xq/project/system/d… |
CVE-2025-13267 | Medium | 6.3 | 2025-11-17 | A vulnerability was detected in SourceCodester Dental Clinic Appointment Reservation System 1.0. Impacted is an unknown function of the file /success.php. Perf… |
CVE-2025-13165 | High | 7.5 | 2025-11-17 | EasyFlow GP developed by Digiwin has a Denial of service vulnerability, allowing unauthenticated remote attackers to send specific requests that result in deni… |
CVE-2025-13164 | Medium | 4.9 | 2025-11-17 | EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credential… |
CVE-2025-13163 | Medium | 4.9 | 2025-11-17 | EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext database a… |
CVE-2025-9501 | Critical | 9.0 | 2025-11-17 | The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to e… |
CVE-2025-60022 | Medium | 4.8 | 2025-11-17 | Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a man-in-the-middle att… |
CVE-2025-13266 | Medium | 5.3 | 2025-11-17 | A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike… |
CVE-2025-13265 | Medium | 6.3 | 2025-11-17 | A weakness has been identified in lsfusion platform up to 6.1. This vulnerability affects the function unpackFile of the file server/src/main/java/lsfusion/ser… |
CVE-2025-13264 | Medium | 6.3 | 2025-11-17 | A security flaw has been discovered in SourceCodester Online Magazine Management System 1.0. This affects an unknown part of the file /view_magazine.php. The m… |
CVE-2025-13263 | Medium | 6.3 | 2025-11-17 | A vulnerability was identified in SourceCodester Online Magazine Management System 1.0. Affected by this issue is some unknown functionality of the file /categ… |
CVE-2025-13262 | High | 7.3 | 2025-11-17 | A vulnerability was determined in lsfusion platform up to 6.1. Affected by this vulnerability is the function UploadFileRequestHandler of the file platform/web… |
CVE-2025-13284 | Critical | 9.8 | 2025-11-17 | ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute… |
CVE-2025-13283 | High | 7.1 | 2025-11-17 | TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provi… |
CVE-2025-13282 | High | 8.1 | 2025-11-17 | TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs… |
CVE-2025-13261 | Medium | 5.3 | 2025-11-17 | A vulnerability was found in lsfusion platform up to 6.1. Affected is the function DownloadFileRequestHandler of the file web-client/src/main/java/lsfusion/htt… |
CVE-2025-13260 | Medium | 6.3 | 2025-11-17 | A vulnerability has been found in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /manufacturer/edit_product.php. Such m… |
CVE-2025-13259 | Medium | 6.3 | 2025-11-17 | A flaw has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /manufacturer/edit_unit.php. This manipulation… |
CVE-2025-13258 | High | 8.8 | 2025-11-17 | A vulnerability was detected in Tenda AC20 up to 16.03.08.12. The impacted element is an unknown function of the file /goform/WifiExtraSet. The manipulation of… |
CVE-2025-10460 | | 2025-11-17 | A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unautho… | |
CVE-2025-13257 | High | 7.3 | 2025-11-17 | A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. The affected element is an unknown function of the file /admin/user… |
CVE-2025-13256 | Medium | 6.3 | 2025-11-17 | A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing a ma… |
CVE-2025-13255 | Medium | 6.3 | 2025-11-17 | A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. This issue affects some unknown processing of the file /book_searc… |
CVE-2025-13254 | Medium | 6.3 | 2025-11-17 | A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file /add_member.php. Su… |
CVE-2025-13253 | Medium | 6.3 | 2025-11-17 | A vulnerability was determined in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /add_librarian.php. This manip… |
CVE-2025-13252 | High | 7.3 | 2025-11-16 | A vulnerability was found in shsuishang ShopSuite ModulithShop up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. Affected by this issue is some unknown functiona… |
CVE-2025-13251 | Medium | 6.3 | 2025-11-16 | A flaw has been found in WeiYe-Jing datax-web up to 2.1.2. Affected is an unknown function. Executing manipulation can lead to sql injection. The attack may be… |
CVE-2025-13250 | Medium | 6.3 | 2025-11-16 | A vulnerability was detected in WeiYe-Jing datax-web up to 2.1.2. This impacts the function remove/update/pause/start/triggerJob of the component Job Handler… |
CVE-2025-13249 | Medium | 6.3 | 2025-11-16 | A security vulnerability has been detected in Jiusi OA up to 20251102. This affects an unknown function of the file /OfficeServer?isAjaxDownloadTemplate=false… |
CVE-2025-13248 | High | 7.3 | 2025-11-16 | A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is an unknown function of the file /ph… |
CVE-2025-13247 | High | 7.3 | 2025-11-16 | A security flaw has been discovered in PHPGurukul Tourism Management System 1.0. The affected element is an unknown function of the file /admin/user-bookings.p… |
CVE-2025-13246 | Medium | 6.3 | 2025-11-16 | A vulnerability was identified in shsuishang ShopSuite ModulithShop up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. Impacted is the function JwtAuthenticationF… |
CVE-2025-13245 | Low | 3.5 | 2025-11-16 | A vulnerability was identified in code-projects Student Information System 2.0. The impacted element is an unknown function of the file /editprofile.php. Such… |
CVE-2025-13244 | Medium | 4.3 | 2025-11-16 | A vulnerability was determined in code-projects Student Information System 2.0. The affected element is an unknown function of the file /register.php. This man… |
CVE-2025-13243 | Medium | 6.3 | 2025-11-16 | A vulnerability was found in code-projects Student Information System 2.0. Impacted is an unknown function of the file /editprofile.php. The manipulation resul… |
CVE-2025-13242 | High | 7.3 | 2025-11-16 | A vulnerability has been found in code-projects Student Information System 2.0. This issue affects some unknown processing of the file /register.php. The manip… |
CVE-2025-13241 | High | 7.3 | 2025-11-16 | A flaw has been found in code-projects Student Information System 2.0. This vulnerability affects unknown code of the file /index.php. Executing manipulation o… |
CVE-2025-13240 | High | 7.3 | 2025-11-16 | A vulnerability was detected in code-projects Student Information System 2.0. This affects an unknown part of the file /searchquery.php. Performing manipulatio… |
CVE-2025-13239 | Medium | 4.3 | 2025-11-16 | A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5. Affected by this issue is some unknown f… |
CVE-2025-13238 | Medium | 6.3 | 2025-11-16 | A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit… |
CVE-2025-13237 | High | 7.3 | 2025-11-16 | A security flaw has been discovered in itsourcecode Inventory Management System 1.0. Affected is an unknown function of the file /LogSignModal.PHP. The manipul… |
CVE-2025-12482 | High | 7.5 | 2025-11-16 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to… |
CVE-2025-13236 | Medium | 6.3 | 2025-11-16 | A vulnerability was identified in itsourcecode Inventory Management System 1.0. This impacts an unknown function of the file /admin/products/index.php?view=edi… |
CVE-2025-13235 | High | 7.3 | 2025-11-16 | A vulnerability was determined in itsourcecode Inventory Management System 1.0. This affects an unknown function of the file /admin/login.php. Executing manipu… |
CVE-2025-13234 | Medium | 6.3 | 2025-11-16 | A vulnerability was found in itsourcecode Inventory Management System 1.0. The impacted element is an unknown function of the file /index.php?q=product. Perfor… |
CVE-2025-13233 | High | 7.3 | 2025-11-16 | A vulnerability has been found in itsourcecode Inventory Management System 1.0. The affected element is an unknown function of the file /index.php?q=single-ite… |
CVE-2025-13232 | Low | 3.5 | 2025-11-16 | A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation cause… |
CVE-2025-13221 | Medium | 5.3 | 2025-11-15 | A weakness has been identified in Intelbras UnniTI 24.07.11. The affected element is an unknown function of the file /xml/sistema/usuarios.xml. Executing manip… |
CVE-2025-13210 | Medium | 4.7 | 2025-11-15 | A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. This impacts an unknown function of the file /admin/products/index… |
CVE-2025-13209 | Medium | 6.3 | 2025-11-15 | A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\server\c-flow\src\main\jav… |