2025 CVEs (page 107)
Page 107 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13208 | Medium | 6.3 | 2025-11-15 | A security flaw has been discovered in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. The impacted element is an unknown function o… |
CVE-2025-13203 | High | 7.3 | 2025-11-15 | A weakness has been identified in code-projects Simple Cafe Ordering System 1.0. This vulnerability affects unknown code of the file /addmem.php. Executing man… |
CVE-2025-13202 | Low | 3.5 | 2025-11-15 | A security flaw has been discovered in code-projects Simple Cafe Ordering System 1.0. This affects an unknown part of the file /add_to_cart. Performing manipul… |
CVE-2025-13201 | High | 7.3 | 2025-11-15 | A vulnerability was identified in code-projects Simple Cafe Ordering System 1.0. Affected by this issue is some unknown functionality of the file /login.php. S… |
CVE-2025-13200 | Medium | 5.3 | 2025-11-15 | A vulnerability was determined in SourceCodester Farm Management System 1.0. Affected by this vulnerability is an unknown functionality. This manipulation caus… |
CVE-2025-13199 | Medium | 5.3 | 2025-11-15 | A vulnerability was found in code-projects Email Logging Interface 2.0. Affected is an unknown function of the file signup.cpp. The manipulation of the argumen… |
CVE-2025-13198 | Medium | 4.7 | 2025-11-15 | A vulnerability has been found in DouPHP up to 1.8 Release 20251022. This impacts an unknown function of the file upload/include/file.class.php. The manipulati… |
CVE-2025-12983 | Low | 3.5 | 2025-11-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allow… |
CVE-2025-7736 | Low | 3.1 | 2025-11-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allow… |
CVE-2025-7000 | Medium | 4.3 | 2025-11-15 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that, under specific… |
CVE-2025-6945 | Low | 3.5 | 2025-11-15 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed… |
CVE-2025-6171 | Medium | 5.3 | 2025-11-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allow… |
CVE-2025-2615 | Medium | 4.3 | 2025-11-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have all… |
CVE-2025-11990 | Low | 3.1 | 2025-11-15 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated use… |
CVE-2025-11865 | Medium | 4.3 | 2025-11-15 | An issue has been discovered in GitLab EE affecting all versions from 18.1 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that, under certain circum… |
CVE-2025-13191 | High | 8.8 | 2025-11-15 | A vulnerability was determined in D-Link DIR-816L 2_06_b09_beta. This issue affects the function soapcgi_main of the file /soap.cgi. This manipulation causes s… |
CVE-2025-13190 | High | 8.8 | 2025-11-15 | A vulnerability was found in D-Link DIR-816L 2_06_b09_beta. This vulnerability affects the function scandir_main of the file /portal/__ajax_exporer.sgi. The ma… |
CVE-2025-12849 | Medium | 5.3 | 2025-11-15 | The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin register… |
CVE-2025-8994 | Medium | 6.5 | 2025-11-15 | The Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager plugin for WordPress is vulnerable to time-b… |
CVE-2025-13189 | High | 8.8 | 2025-11-15 | A vulnerability has been found in D-Link DIR-816L 2_06_b09_beta. This affects the function genacgi_main of the file gena.cgi. The manipulation of the argument… |
CVE-2025-12847 | Medium | 4.3 | 2025-11-15 | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment… |
CVE-2025-12494 | Medium | 4.3 | 2025-11-15 | The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the aj… |
CVE-2025-12182 | Medium | 4.3 | 2025-11-15 | The Qi Blocks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the `resize_image_callback()` function in all vers… |
CVE-2025-9317 | High | 8.4 | 2025-11-15 | The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' a… |
CVE-2025-8386 | Medium | 6.9 | 2025-11-15 | The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persis… |
CVE-2025-64309 | High | 7.4 | 2025-11-15 | The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a… |
CVE-2025-64308 | Medium | 6.5 | 2025-11-15 | The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal. |
CVE-2025-64307 | Medium | 6.5 | 2025-11-15 | The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to m… |
CVE-2025-62765 | High | 7.5 | 2025-11-15 | General Industrial Controls Lynx+ Gateway is vulnerable to a cleartext transmission vulnerability that could allow an attacker to observe network traffic to o… |
CVE-2025-59780 | High | 7.5 | 2025-11-15 | General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to send GET requests to… |
CVE-2025-58083 | Critical | 10.0 | 2025-11-15 | General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the d… |
CVE-2025-55034 | High | 8.2 | 2025-11-15 | General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force att… |
CVE-2025-13188 | Critical | 9.8 | 2025-11-14 | A vulnerability was detected in D-Link DIR-816L 2_06_b09_beta. Affected by this vulnerability is the function authenticationcgi_main of the file /authenticatio… |
CVE-2025-13187 | Medium | 5.3 | 2025-11-14 | A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/sistema/acessodeusuario.xml. Such manipul… |
CVE-2025-13186 | Low | 2.4 | 2025-11-14 | A weakness has been identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0. This impacts an unknown function of the file… |
CVE-2025-64084 | Medium | 5.4 | 2025-11-14 | An authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. The vucc_details_ajax function in application/controllers/Awards.php does no… |
CVE-2025-63891 | High | 7.5 | 2025-11-14 | Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attacker to disclose ful… |
CVE-2025-63745 | Medium | 5.5 | 2025-11-14 | A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. A crafted binary input can trigger… |
CVE-2025-63744 | Medium | 4.3 | 2025-11-14 | A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Processing a crafted file c… |
CVE-2025-13185 | Medium | 4.7 | 2025-11-14 | A security flaw has been discovered in Bdtask/CodeCanyon News365 up to 7.0.3. This affects an unknown function of the file /admin/dashboard/profile. The manipu… |
CVE-2025-13182 | Low | 3.5 | 2025-11-14 | A vulnerability was identified in pojoin h3blog 1.0. The impacted element is an unknown function of the file /admin/cms/category/addtitle. The manipulation of… |
CVE-2025-63701 | Medium | 6.8 | 2025-11-14 | A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) when DocumentPropertiesW() is called… |
CVE-2025-13181 | Low | 3.5 | 2025-11-14 | A vulnerability was determined in pojoin h3blog 1.0. The affected element is an unknown function of the file /admin/cms/material/add. Executing a manipulation… |
CVE-2025-13180 | Low | 3.5 | 2025-11-14 | A vulnerability was found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. Impacted is an unknown function of t… |
CVE-2025-13179 | Medium | 4.3 | 2025-11-14 | A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. This issue affects some unknown… |
CVE-2025-13033 | High | 7.5 | 2025-11-14 | A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit… |
CVE-2025-63680 | High | 8.6 | 2025-11-14 | Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw (CWE-22) that, in combination with Windows ShellExecuteW fallback exten… |
CVE-2025-63291 | Medium | 5.4 | 2025-11-14 | When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object IDs to uniquely identify the data being requested by the caller… |
CVE-2025-13178 | Low | 3.5 | 2025-11-14 | A flaw has been found in Bdtask/CodeCanyon SalesERP up to 20250728. This vulnerability affects unknown code of the file /edit_profile of the component User Pro… |
CVE-2025-13177 | Medium | 4.3 | 2025-11-14 | A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. This affects an unknown part. The manipulation results in cross-site request forgery… |
CVE-2025-13174 | Medium | 6.3 | 2025-11-14 | A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function do_job of the file /rachelos/we-mp-rss/b… |
CVE-2025-63830 | Medium | 6.1 | 2025-11-14 | CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content. |
CVE-2025-63725 | Medium | 6.1 | 2025-11-14 | Reflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php. |
CVE-2025-63724 | Medium | 6.0 | 2025-11-14 | SQL injection (SQL-i) vulnerability in SVX Portal 2.7A via crafted POST request to admin/update_setings.php. |
CVE-2025-54562 | Medium | 4.3 | 2025-11-14 | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Technical Information to be Disclosed t… |
CVE-2025-54561 | Medium | 4.3 | 2025-11-14 | An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote access… |
CVE-2025-54560 | Low | 3.8 | 2025-11-14 | A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Probing of… |
CVE-2025-54559 | Low | 3.7 | 2025-11-14 | An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for loading arbitrary ex… |
CVE-2025-54348 | Medium | 6.5 | 2025-11-14 | A Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an at… |
CVE-2025-54346 | High | 7.6 | 2025-11-14 | A Reflected Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an… |
CVE-2025-54345 | High | 7.5 | 2025-11-14 | An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. Sensitive Information is exposed to an Unauthorized Actor. |
CVE-2025-54343 | Critical | 9.6 | 2025-11-14 | An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for E… |
CVE-2025-54342 | Low | 3.3 | 2025-11-14 | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There is Exposure of Sensitive Information because… |
CVE-2025-54340 | Medium | 4.1 | 2025-11-14 | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There is a Broken or Risky Cryptographic Algorithm. |
CVE-2025-54339 | Critical | 10.0 | 2025-11-14 | An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for E… |
CVE-2025-4618 | | 2025-11-14 | A sensitive information disclosure vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to retrieve sensitive data… | |
CVE-2025-4617 | | 2025-11-14 | An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin user to bypass the s… | |
CVE-2025-4616 | | 2025-11-14 | An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert th… | |
CVE-2025-13172 | Medium | 6.3 | 2025-11-14 | A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/view-member-report.php. Performi… |
CVE-2025-13171 | Medium | 6.3 | 2025-11-14 | A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkan_list.php. Such manipulation of the argument keyword l… |
CVE-2025-13204 | High | 7.3 | 2025-11-14 | npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance… |
CVE-2025-8870 | Medium | 4.9 | 2025-11-14 | On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153 |
CVE-2025-64446 | Critical | 9.8 | 2025-11-14 | A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 th… |
CVE-2025-13170 | High | 7.3 | 2025-11-14 | A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0. This issue affects some unknown processing of the file /admin/edit_ac… |
CVE-2025-13169 | High | 7.3 | 2025-11-14 | A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /ad… |
CVE-2025-13168 | Medium | 6.3 | 2025-11-14 | A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This mani… |
CVE-2025-9982 | High | 7.5 | 2025-11-14 | A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allow… |
CVE-2025-12149 | | 2025-11-14 | In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signal… | |
CVE-2025-11918 | High | 7.3 | 2025-11-14 | Rockwell Automation Arena® suffers from a stack-based buffer overflow vulnerability. The specific flaw exists within the parsing of DOE files. Local attackers… |
CVE-2025-10018 | Medium | 4.8 | 2025-11-14 | QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Malicious attacker with admin privileges can inject arbitrary HTML… |
CVE-2025-8855 | High | 8.1 | 2025-11-14 | Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vuln… |
CVE-2025-11981 | Medium | 4.9 | 2025-11-14 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'SCodes' parameter in all versions up to, and includin… |
CVE-2025-11794 | Medium | 4.9 | 2025-11-14 | Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password… |
CVE-2025-55073 | Medium | 5.4 | 2025-11-14 | Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams… |
CVE-2025-55070 | Medium | 6.5 | 2025-11-14 | Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information… |
CVE-2025-41436 | Low | 3.1 | 2025-11-14 | Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel co… |
CVE-2025-11776 | Medium | 4.3 | 2025-11-14 | Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `… |
CVE-2025-64444 | High | 7.2 | 2025-11-14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a rem… |
CVE-2025-10686 | High | 7.2 | 2025-11-14 | The Creta Testimonial Showcase WordPress plugin before 1.2.4 is vulnerable to Local File Inclusion. This makes it possible for authenticated attackers, with ed… |
CVE-2025-13161 | High | 7.5 | 2025-11-14 | IQ-Support developed by IQ Service International has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path T… |
CVE-2025-13160 | Medium | 5.3 | 2025-11-14 | IQ-Support developed by IQ Service International has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access spe… |
CVE-2025-9479 | Medium | 4.3 | 2025-11-14 | Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2025-13107 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-13102 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a craft… |
CVE-2025-13097 | Medium | 5.4 | 2025-11-14 | Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafte… |
CVE-2025-12904 | High | 7.2 | 2025-11-14 | The SNORDIAN's H5PxAPIkatchu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'insert_data' AJAX endpoint in all versions up to, and i… |
CVE-2025-64530 | High | 7.5 | 2025-11-13 | Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logi… |
CVE-2025-64754 | | 2025-11-13 | Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authen… | |
CVE-2025-64753 | Medium | 5.3 | 2025-11-13 | grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing has… |
CVE-2025-64752 | Medium | 6.8 | 2025-11-13 | grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching f… |