2025 CVEs (page 115)
Page 115 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12447 | Medium | 4.2 | 2025-11-10 | Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI ges… |
CVE-2025-12446 | Medium | 4.2 | 2025-11-10 | Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2025-12445 | Medium | 6.5 | 2025-11-10 | Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to leak cross-ori… |
CVE-2025-12444 | Medium | 4.2 | 2025-11-10 | Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2025-12443 | Medium | 4.3 | 2025-11-10 | Out of bounds read in WebXR in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2025-12441 | Medium | 4.3 | 2025-11-10 | Out of bounds read in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Ch… |
CVE-2025-12440 | Medium | 5.3 | 2025-11-10 | Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-12439 | Medium | 5.5 | 2025-11-10 | Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitiv… |
CVE-2025-12438 | High | 8.8 | 2025-11-10 | Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit object corruption via a… |
CVE-2025-12437 | High | 7.5 | 2025-11-10 | Use after free in PageInfo in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentia… |
CVE-2025-12436 | Medium | 5.9 | 2025-11-10 | Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potenti… |
CVE-2025-12435 | Medium | 5.4 | 2025-11-10 | Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-12434 | Medium | 4.2 | 2025-11-10 | Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform… |
CVE-2025-12433 | Medium | 4.3 | 2025-11-10 | Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access via a crafted HTML… |
CVE-2025-12432 | High | 8.8 | 2025-11-10 | Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security… |
CVE-2025-12431 | Medium | 6.5 | 2025-11-10 | Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2025-12430 | High | 7.5 | 2025-11-10 | Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium sec… |
CVE-2025-12429 | High | 8.8 | 2025-11-10 | Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (… |
CVE-2025-12428 | High | 8.8 | 2025-11-10 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium secur… |
CVE-2025-63288 | High | 7.5 | 2025-11-10 | In Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in denial of service. |
CVE-2025-47773 | High | 8.8 | 2025-11-10 | Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is edited vi… |
CVE-2025-47286 | High | 7.2 | 2025-11-10 | Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop i… |
CVE-2025-43723 | Medium | 5.9 | 2025-11-10 | Dell PowerScale OneFS, versions prior to 9.10.1.3 and versions 9.11.0.0 through 9.12.0.0, contains a use of a broken or risky cryptographic algorithm vulnerabi… |
CVE-2025-43079 | Medium | 6.3 | 2025-11-10 | The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system com… |
CVE-2025-12967 | High | 8.0 | 2025-11-10 | An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a… |
CVE-2025-63835 | High | 8.8 | 2025-11-10 | A stack-based buffer overflow vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the guestSsid parameter of the /goform… |
CVE-2025-63834 | Medium | 5.4 | 2025-11-10 | A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the ssid parameter of the wirele… |
CVE-2025-63497 | High | 7.1 | 2025-11-10 | The patient prescription viewing functionality in his_doc_view_single_patient.php of rickxy Hospital Management System version 1.0 contains an SQL injection vu… |
CVE-2025-63457 | High | 7.5 | 2025-11-10 | Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the sub_4F55C function. This vulnerability allows attackers to ca… |
CVE-2025-63456 | High | 7.5 | 2025-11-10 | Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the SetSysTimeCfg function. This vulnerability allows attackers to… |
CVE-2025-63455 | High | 7.5 | 2025-11-10 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. This vulnerability al… |
CVE-2025-63147 | High | 7.5 | 2025-11-10 | Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function. This vulnerability allows… |
CVE-2025-63154 | High | 7.5 | 2025-11-10 | TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function. This vulnerability allo… |
CVE-2025-63153 | High | 7.5 | 2025-11-10 | TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the ssid parameter of the urldecode function. This vulnerability allows at… |
CVE-2025-63152 | High | 7.5 | 2025-11-10 | Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto parameter of the wlSetExternParameter function. This vulnerability al… |
CVE-2025-46430 | High | 7.3 | 2025-11-10 | Dell Display and Peripheral Manager, versions prior to 2.1.2.12, contains an Execution with Unnecessary Privileges vulnerability in the Installer. A low privil… |
CVE-2025-63712 | High | 8.8 | 2025-11-10 | Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System. The User Management module (delete-user.php) allows remote attackers to d… |
CVE-2025-63711 | High | 7.1 | 2025-11-10 | A Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated admi… |
CVE-2025-63710 | Medium | 6.5 | 2025-11-10 | The send_message.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to Cross-Site Request Forgery (CSRF). The application does not implem… |
CVE-2025-63709 | Medium | 5.4 | 2025-11-10 | A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticated user can submi… |
CVE-2025-12480 | Critical | 9.1 | 2025-11-10 | Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is com… |
CVE-2025-64685 | High | 8.1 | 2025-11-10 | In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure |
CVE-2025-64684 | Medium | 4.3 | 2025-11-10 | In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form |
CVE-2025-64683 | Medium | 5.3 | 2025-11-10 | In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API |
CVE-2025-64682 | Low | 2.7 | 2025-11-10 | In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit |
CVE-2025-64681 | Low | 2.7 | 2025-11-10 | In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations |
CVE-2025-64457 | Medium | 4.2 | 2025-11-10 | In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition |
CVE-2025-64456 | High | 8.4 | 2025-11-10 | In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation |
CVE-2025-12939 | Medium | 6.3 | 2025-11-10 | A security flaw has been discovered in SourceCodester Interview Management System up to 1.0. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-12938 | High | 7.3 | 2025-11-10 | A vulnerability was identified in projectworlds Online Admission System 1.0. Affected by this vulnerability is an unknown functionality of the file /process_lo… |
CVE-2025-41001 | Medium | 5.4 | 2025-11-10 | Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sendi… |
CVE-2025-12405 | | 2025-11-10 | An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors. A Looker Studio user with report view access… | |
CVE-2025-41107 | Medium | 5.4 | 2025-11-10 | Stored Cross Site Scripting (XSS) vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/online_admi… |
CVE-2025-12409 | | 2025-11-10 | A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources. By creating a malicious report w… | |
CVE-2025-12397 | | 2025-11-10 | A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject malicious SQL that would execute with the… | |
CVE-2025-12155 | | 2025-11-10 | A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission… | |
CVE-2025-41731 | High | 7.4 | 2025-11-10 | A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the… |
CVE-2025-12933 | Medium | 6.3 | 2025-11-10 | A vulnerability was identified in SourceCodester Baby Care System 1.0. This affects an unknown part of the file /updatewelcome.php?id=siteoptions&action=welcom… |
CVE-2025-62689 | High | 7.5 | 2025-11-10 | NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of th… |
CVE-2025-59777 | High | 7.5 | 2025-11-10 | NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of th… |
CVE-2025-12932 | Medium | 4.7 | 2025-11-10 | A vulnerability was determined in SourceCodester Baby Care System 1.0. Affected by this issue is some unknown functionality of the file /admin.php?id=inbox. Th… |
CVE-2025-12931 | Medium | 6.3 | 2025-11-10 | A vulnerability was found in SourceCodester Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/edit-orde… |
CVE-2025-12613 | High | 8.6 | 2025-11-10 | Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampers… |
CVE-2025-12930 | Medium | 6.3 | 2025-11-10 | A vulnerability has been found in SourceCodester Food Ordering System 1.0. Affected is an unknown function of the file /view-ticket.php. The manipulation of th… |
CVE-2025-12929 | High | 7.3 | 2025-11-10 | A flaw has been found in SourceCodester Survey Application System 1.0. This impacts the function save_user/update_user of the file /LoginRegistration.php. Exec… |
CVE-2025-12928 | High | 7.3 | 2025-11-10 | A vulnerability was detected in code-projects Online Job Search Engine 1.0. This affects an unknown function of the file /login.php. Performing manipulation of… |
CVE-2025-12868 | Critical | 9.8 | 2025-11-10 | New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend… |
CVE-2025-12867 | High | 7.2 | 2025-11-10 | EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors… |
CVE-2025-12927 | Medium | 4.7 | 2025-11-10 | A security vulnerability has been detected in DedeBIZ up to 6.3.2. The impacted element is an unknown function of the file /admin/archives_add.php. Such manipu… |
CVE-2025-12926 | Medium | 6.3 | 2025-11-10 | A weakness has been identified in SourceCodester Farm Management System 1.0. The affected element is an unknown function of the file /review.php. This manipula… |
CVE-2025-12866 | Critical | 9.8 | 2025-11-10 | EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the… |
CVE-2025-12865 | High | 8.8 | 2025-11-10 | U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, mo… |
CVE-2025-12864 | High | 8.8 | 2025-11-10 | U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, mo… |
CVE-2025-12925 | High | 7.3 | 2025-11-10 | A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic… |
CVE-2025-12924 | Medium | 4.3 | 2025-11-10 | A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/mai… |
CVE-2025-12923 | Low | 2.7 | 2025-11-10 | A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/downloa… |
CVE-2025-12922 | Medium | 6.3 | 2025-11-10 | A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the com… |
CVE-2025-12921 | Medium | 4.3 | 2025-11-10 | A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of the file /ImportCRFD… |
CVE-2025-12920 | Low | 2.4 | 2025-11-09 | A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. Thi… |
CVE-2025-12919 | Low | 3.7 | 2025-11-09 | A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of th… |
CVE-2025-12918 | Low | 3.1 | 2025-11-09 | A security flaw has been discovered in yungifez Skuul School Management System up to 2.6.5. The impacted element is an unknown function of the file /dashboard/… |
CVE-2025-12917 | Medium | 4.3 | 2025-11-09 | A vulnerability was identified in TOZED ZLT T10 T10PLUS_3.04.15. The affected element is an unknown function of the file /reqproc/proc_post of the component Re… |
CVE-2025-40109 | | 2025-11-09 | In the Linux kernel, the following vulnerability has been resolved: crypto: rng - Ensure set_ent is always present Ensure that set_ent is always set since on… | |
CVE-2025-40108 | | 2025-11-09 | In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: Fix blocked task Revert commit 1afa70632c39 ("serial: qcom-geni: Enabl… | |
CVE-2025-12916 | Medium | 6.3 | 2025-11-09 | A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_lo… |
CVE-2025-12915 | Medium | 6.4 | 2025-11-08 | A vulnerability was found in 70mai X200 up to 20251019. This issue affects some unknown processing of the component Init Script Handler. The manipulation resul… |
CVE-2025-12914 | Medium | 4.7 | 2025-11-08 | A vulnerability has been found in aaPanel BaoTa up to 11.2.x. This vulnerability affects unknown code of the file /database?action=GetDatabaseAccess of the com… |
CVE-2025-12913 | Medium | 4.7 | 2025-11-08 | A flaw has been found in code-projects Responsive Hotel Site 1.0. This affects an unknown part of the file /admin/roomdel.php. Executing manipulation of the ar… |
CVE-2025-12837 | Medium | 6.4 | 2025-11-08 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in versions up to, and includi… |
CVE-2025-12643 | Medium | 6.4 | 2025-11-08 | The Saphali LiqPay for donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saphali_liqpay' shortcode in all versions up to, and i… |
CVE-2025-12399 | High | 7.2 | 2025-11-08 | The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-jso… |
CVE-2025-12092 | Medium | 6.5 | 2025-11-08 | The CYAN Backup plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' functionality in all ver… |
CVE-2025-11980 | Medium | 4.9 | 2025-11-08 | The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to, and including, 13.7.3 d… |
CVE-2025-11967 | High | 7.2 | 2025-11-08 | The Mail Mint plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_contact_attribute_import function… |
CVE-2025-11448 | Medium | 4.3 | 2025-11-08 | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12099 | High | 7.2 | 2025-11-08 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and in… |
CVE-2025-12098 | Medium | 5.3 | 2025-11-08 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… |
CVE-2025-12621 | Medium | 5.3 | 2025-11-08 | The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability… |
CVE-2025-12498 | Medium | 4.3 | 2025-11-08 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability che… |
CVE-2025-9334 | High | 8.8 | 2025-11-08 | The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7… |