2025 CVEs (page 115)
Page 115 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13012 | High | 7.5 | 2025-11-11 | Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird… |
CVE-2025-10918 | High | 7.1 | 2025-11-11 | Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files any… |
CVE-2025-10905 | Medium | 4.4 | 2025-11-11 | Collision in MiniFilter driver in Avast Software Avast Free Antivirus before 25.9 on Windows allows a local attacker with administrative privileges to disabl… |
CVE-2025-11959 | High | 8.1 | 2025-11-11 | Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information… |
CVE-2025-9227 | Medium | 6.5 | 2025-11-11 | Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor. |
CVE-2025-9223 | High | 8.8 | 2025-11-11 | Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper config… |
CVE-2025-12101 | | 2025-11-11 | Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy… | |
CVE-2025-11862 | | 2025-11-11 | A security issue was discovered within Verve Asset Manager allowing unauthorized read-only users to read, update, and delete users via the API. | |
CVE-2025-11697 | | 2025-11-11 | A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to… | |
CVE-2025-11696 | | 2025-11-11 | A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows u… | |
CVE-2025-11085 | | 2025-11-11 | A security issue exists within DataMosaix™ Private Cloud allowing for Persistent XSS. This vulnerability can result in the execution of malicious JavaScript, a… | |
CVE-2025-11084 | | 2025-11-11 | A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing t… | |
CVE-2025-8324 | Critical | 9.8 | 2025-11-11 | Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration. |
CVE-2025-41106 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41105 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41104 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41103 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-10161 | High | 7.3 | 2025-11-11 | Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision… |
CVE-2025-41102 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41101 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-11960 | Medium | 6.1 | 2025-11-11 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology Systems Inc. KVKNET… |
CVE-2025-7633 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report. |
CVE-2025-7632 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report. |
CVE-2025-7430 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report. |
CVE-2025-12953 | Medium | 4.3 | 2025-11-11 | The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2025-12846 | High | 8.8 | 2025-11-11 | The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to in… |
CVE-2025-12788 | Medium | 5.3 | 2025-11-11 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment byp… |
CVE-2025-12787 | Medium | 5.3 | 2025-11-11 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, an… |
CVE-2025-12539 | Critical | 10.0 | 2025-11-11 | The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due… |
CVE-2025-9524 | Medium | 4.3 | 2025-11-11 | The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be explo… |
CVE-2025-9055 | Medium | 6.4 | 2025-11-11 | The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can onl… |
CVE-2025-8998 | Low | 3.1 | 2025-11-11 | It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be… |
CVE-2025-7429 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report. |
CVE-2025-5317 | Medium | 5.5 | 2025-11-11 | An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative p… |
CVE-2025-10714 | High | 8.4 | 2025-11-11 | AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating… |
CVE-2025-8108 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can on… |
CVE-2025-6779 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can o… |
CVE-2025-6571 | Medium | 6.0 | 2025-11-11 | A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it. |
CVE-2025-6298 | Medium | 6.7 | 2025-11-11 | ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be ex… |
CVE-2025-5718 | Medium | 6.8 | 2025-11-11 | The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is config… |
CVE-2025-5454 | Medium | 6.4 | 2025-11-11 | An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulner… |
CVE-2025-5452 | Medium | 6.6 | 2025-11-11 | A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege es… |
CVE-2025-4645 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the… |
CVE-2025-11855 | High | 7.5 | 2025-11-11 | The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated… |
CVE-2025-11307 | High | 8.8 | 2025-11-11 | The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated user… |
CVE-2025-11237 | Medium | 5.3 | 2025-11-11 | The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing… |
CVE-2025-12880 | Medium | 5.4 | 2025-11-11 | The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includi… |
CVE-2025-12813 | Critical | 9.8 | 2025-11-11 | The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parame… |
CVE-2025-12754 | Medium | 6.4 | 2025-11-11 | The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all versions up to, and… |
CVE-2025-12753 | Medium | 6.4 | 2025-11-11 | The Chart Expert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmzez_chart' shortcode in all versions up to, and including, 1.0. T… |
CVE-2025-12711 | Medium | 6.4 | 2025-11-11 | The Share to Google Classroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the share_to_google shortcode in all versions up to, and in… |
CVE-2025-12672 | Medium | 6.4 | 2025-11-11 | The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions… |
CVE-2025-12671 | Medium | 6.4 | 2025-11-11 | The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_iconics' shortcode in all versions up to, a… |
CVE-2025-12668 | Medium | 6.4 | 2025-11-11 | The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all… |
CVE-2025-12667 | Medium | 6.4 | 2025-11-11 | The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up t… |
CVE-2025-12665 | Medium | 4.3 | 2025-11-11 | The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja… |
CVE-2025-12663 | Medium | 6.4 | 2025-11-11 | The Jeba Cute forkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter in the 'jeba_forkit' shortcode in all versions… |
CVE-2025-12662 | Medium | 6.4 | 2025-11-11 | The Coon Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'map' shortcode in all versions up to… |
CVE-2025-12658 | Medium | 6.4 | 2025-11-11 | The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preload_progress_bar' shortco… |
CVE-2025-12652 | Medium | 6.4 | 2025-11-11 | The Ungapped Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prefillvalues' parameter in the ungapped-form shortcode in all… |
CVE-2025-12651 | Medium | 6.4 | 2025-11-11 | The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the li… |
CVE-2025-12644 | Medium | 6.4 | 2025-11-11 | The Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nonaki' shortcode i… |
CVE-2025-12637 | High | 8.8 | 2025-11-11 | The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the process_theme function in… |
CVE-2025-12632 | Medium | 5.5 | 2025-11-11 | The RandomQuotr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.4 due to insuffi… |
CVE-2025-12631 | Medium | 4.4 | 2025-11-11 | The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 d… |
CVE-2025-12590 | Medium | 6.1 | 2025-11-11 | The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is… |
CVE-2025-12589 | Medium | 6.1 | 2025-11-11 | The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. Thi… |
CVE-2025-12588 | Medium | 4.3 | 2025-11-11 | The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is d… |
CVE-2025-12538 | Medium | 4.4 | 2025-11-11 | The Fleet Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.1 due to insuf… |
CVE-2025-12526 | Medium | 4.3 | 2025-11-11 | The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgc_remove' acti… |
CVE-2025-12132 | Medium | 4.3 | 2025-11-11 | The WP Custom Admin Login Page Logo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8.4. This is due… |
CVE-2025-12126 | Medium | 5.4 | 2025-11-11 | The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functio… |
CVE-2025-12021 | Medium | 6.1 | 2025-11-11 | The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 0… |
CVE-2025-12020 | Medium | 4.9 | 2025-11-11 | The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin… |
CVE-2025-12019 | Medium | 4.4 | 2025-11-11 | The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insuff… |
CVE-2025-12010 | Medium | 6.5 | 2025-11-11 | The Authors List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.6.1 via the via arbitrary metho… |
CVE-2025-11999 | Medium | 5.3 | 2025-11-11 | The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarker_r… |
CVE-2025-11997 | Medium | 5.3 | 2025-11-11 | The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1… |
CVE-2025-11996 | Medium | 5.3 | 2025-11-11 | The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_image() and fui_dele… |
CVE-2025-11988 | Medium | 5.3 | 2025-11-11 | The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin regist… |
CVE-2025-11986 | Medium | 5.3 | 2025-11-11 | The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unau… |
CVE-2025-11894 | Medium | 5.3 | 2025-11-11 | The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in al… |
CVE-2025-11891 | Medium | 5.3 | 2025-11-11 | The Shelf Planner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.1 through publicly exposed log… |
CVE-2025-11886 | Medium | 4.3 | 2025-11-11 | The CTL Arcade Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incor… |
CVE-2025-11882 | Medium | 6.4 | 2025-11-11 | The Simple Donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's simpledonate shortcode in versions less than, or equal to… |
CVE-2025-11874 | Medium | 5.4 | 2025-11-11 | The Slippy Slider – Responsive Touch Navigation Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slippy-slider' short… |
CVE-2025-11873 | Medium | 6.4 | 2025-11-11 | The WP BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including, 1.8.1 du… |
CVE-2025-11869 | Medium | 6.4 | 2025-11-11 | The Precise Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `wrap_id` shortcode attribute in all versions up to, and includin… |
CVE-2025-11863 | Medium | 6.4 | 2025-11-11 | The My Geo Posts Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mygeo_city' shortcode in all versions up to, and including, 1… |
CVE-2025-11860 | Medium | 6.4 | 2025-11-11 | The Twitter Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ottwitter_feed' shortcode in all versions up to, and including, 1.3… |
CVE-2025-11859 | Medium | 6.4 | 2025-11-11 | The Paypal Donation Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in all versions up to, and including… |
CVE-2025-11856 | Medium | 6.4 | 2025-11-11 | The Eventbee Ticketing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eventbeeticketwidget' shortcode in all versions up to… |
CVE-2025-11829 | Medium | 6.4 | 2025-11-11 | The Five9 Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'toolbar' attribute of the [five9-chat] shortcode in all versions… |
CVE-2025-11828 | Medium | 6.4 | 2025-11-11 | The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 b… |
CVE-2025-11822 | Medium | 6.4 | 2025-11-11 | The WP Bootstrap Tabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bootstrap_tab' shortcode in all versions up to, and including… |
CVE-2025-11821 | Medium | 6.4 | 2025-11-11 | The Woocommerce – Products By Custom Tax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'woo_products_custom_tax' shortcode in all v… |
CVE-2025-11805 | Medium | 6.4 | 2025-11-11 | The Skip to Timestamp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skipto' shortcode in all versions up to, and including, 1.4.4… |
CVE-2025-11532 | Medium | 5.3 | 2025-11-11 | The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 due to missing validation on the '… |
CVE-2025-11521 | High | 8.1 | 2025-11-11 | The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient validation of remote URLs f… |
CVE-2025-11457 | Critical | 9.8 | 2025-11-11 | The EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin plugin for WordPress is vulnerable to Privilege Escalation in versions 0.9.0-beta2 t… |