2025 CVEs (page 116)
Page 116 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9334 | High | 8.8 | 2025-11-08 | The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7… |
CVE-2025-7663 | Medium | 6.5 | 2025-11-08 | The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovae… |
CVE-2025-12353 | Medium | 5.3 | 2025-11-08 | The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized… |
CVE-2025-12193 | Medium | 6.1 | 2025-11-08 | The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mp' parameter in all versions up to, and including, 2.3.1 due t… |
CVE-2025-12177 | Medium | 5.3 | 2025-11-08 | The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron(… |
CVE-2025-12167 | Medium | 4.3 | 2025-11-08 | The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_a… |
CVE-2025-12161 | High | 8.8 | 2025-11-08 | The Smart Auto Upload Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the auto-image creation functi… |
CVE-2025-12125 | Medium | 4.4 | 2025-11-08 | The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and… |
CVE-2025-12112 | Medium | 6.4 | 2025-11-08 | The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and… |
CVE-2025-12064 | Medium | 6.1 | 2025-11-08 | The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 2.4.7 due… |
CVE-2025-12042 | Medium | 5.3 | 2025-11-08 | The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all… |
CVE-2025-12000 | Medium | 6.5 | 2025-11-08 | The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all… |
CVE-2025-11972 | Medium | 4.9 | 2025-11-08 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all v… |
CVE-2025-11748 | Medium | 4.3 | 2025-11-08 | The Groups plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0 via the 'group_id' parameter of t… |
CVE-2025-12583 | Medium | 6.4 | 2025-11-08 | The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_neofix_sdl_… |
CVE-2025-11452 | High | 7.5 | 2025-11-08 | The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and inclu… |
CVE-2025-64496 | High | 7.3 | 2025-11-08 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerab… |
CVE-2025-64495 | High | 8.7 | 2025-11-08 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts… |
CVE-2025-64494 | Medium | 4.6 | 2025-11-08 | Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names… |
CVE-2025-64493 | Medium | 6.5 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenti… |
CVE-2025-64492 | High | 8.8 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind S… |
CVE-2025-64491 | Medium | 6.1 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and below allow unauthenticated refle… |
CVE-2025-64490 | High | 8.3 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0… |
CVE-2025-64489 | High | 8.3 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0… |
CVE-2025-64488 | High | 8.8 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through… |
CVE-2025-64486 | | 2025-11-08 | calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker… | |
CVE-2025-64485 | | 2025-11-08 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1, a malicious CVAT user with at least t… | |
CVE-2025-12911 | Medium | 4.3 | 2025-11-08 | Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-12910 | Medium | 6.2 | 2025-11-08 | Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local attacker to obtain potentially sensitive information via debug… |
CVE-2025-12909 | Medium | 5.3 | 2025-11-08 | Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium… |
CVE-2025-12908 | Medium | 5.4 | 2025-11-08 | Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform domain spoofing… |
CVE-2025-12907 | High | 8.8 | 2025-11-08 | Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user act… |
CVE-2025-12906 | Medium | 5.4 | 2025-11-08 | Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-12905 | Medium | 5.4 | 2025-11-08 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted… |
CVE-2025-64437 | Medium | 5.0 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock… |
CVE-2025-64436 | Medium | 5.3 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the… |
CVE-2025-64435 | Medium | 5.3 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the co… |
CVE-2025-64434 | Medium | 4.7 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCer… |
CVE-2025-64433 | Medium | 6.5 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary fil… |
CVE-2025-37736 | High | 8.8 | 2025-11-07 | Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed… |
CVE-2025-63420 | Medium | 4.1 | 2025-11-07 | CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execu… |
CVE-2025-60574 | High | 7.5 | 2025-11-07 | A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the "/styles/" path, which fails to properly saniti… |
CVE-2025-12418 | | 2025-11-07 | Potential Denial of Service issue in all supported versions of Revenera InstallShield version 2025 R1, 2024 R2, 2023 R2, and prior. When e.g., a local administ… | |
CVE-2025-64481 | | 2025-11-07 | Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasett… | |
CVE-2025-64442 | Medium | 6.1 | 2025-11-07 | HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to b… |
CVE-2025-64439 | | 2025-11-07 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 2.1.2 and b… | |
CVE-2025-63544 | Medium | 6.1 | 2025-11-07 | TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in /order_notes via the id parameter. |
CVE-2025-63543 | Medium | 6.1 | 2025-11-07 | TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in the /search_results endpoint via the q parameter. |
CVE-2025-12902 | Medium | 4.4 | 2025-11-07 | Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authorized access to a loc… |
CVE-2025-12896 | Medium | 4.4 | 2025-11-07 | Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authorized access to a loc… |
CVE-2025-12875 | Medium | 5.3 | 2025-11-07 | A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing… |
CVE-2025-63640 | Medium | 6.1 | 2025-11-07 | Sourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields when creating an "Up… |
CVE-2025-63639 | Medium | 6.1 | 2025-11-07 | The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to improper handling of user-… |
CVE-2025-63638 | Medium | 6.1 | 2025-11-07 | Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fields when creating… |
CVE-2025-10230 | Critical | 10.0 | 2025-11-07 | A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or esca… |
CVE-2025-7700 | Medium | 5.3 | 2025-11-07 | A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when p… |
CVE-2025-64432 | Medium | 4.7 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggrega… |
CVE-2025-64431 | | 2025-11-07 | Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks throu… | |
CVE-2025-63717 | Medium | 6.5 | 2025-11-07 | The change password functionality at /pet_grooming/admin/change_pass.php in SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross-Site Req… |
CVE-2025-61261 | Medium | 5.4 | 2025-11-07 | A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user'… |
CVE-2025-36186 | High | 7.4 | 2025-11-07 | IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malic… |
CVE-2025-36185 | Medium | 6.2 | 2025-11-07 | IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper n… |
CVE-2025-36136 | Medium | 5.1 | 2025-11-07 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial o… |
CVE-2025-36135 | Medium | 5.4 | 2025-11-07 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 th… |
CVE-2025-36131 | Medium | 4.6 | 2025-11-07 | IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exp… |
CVE-2025-36008 | Medium | 6.5 | 2025-11-07 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a… |
CVE-2025-36006 | Medium | 6.5 | 2025-11-07 | IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Ser… |
CVE-2025-33012 | Medium | 6.3 | 2025-11-07 | IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain… |
CVE-2025-2534 | Medium | 5.3 | 2025-11-07 | IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a… |
CVE-2025-12890 | Medium | 6.5 | 2025-11-07 | Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The… |
CVE-2025-9458 | High | 7.8 | 2025-11-07 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this… |
CVE-2025-64430 | High | 7.5 | 2025-11-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions 4.2.0 through 7.5.3, and 8.0.0 through 8.3… |
CVE-2025-64347 | High | 7.5 | 2025-11-07 | Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8… |
CVE-2025-63718 | Medium | 6.5 | 2025-11-07 | A SQL injection vulnerability exists in the SourceCodester PQMS (Patient Queue Management System) 1.0 in the api_patient_schedule.php endpoint. The appointment… |
CVE-2025-63716 | Medium | 6.5 | 2025-11-07 | The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthorized state-changing operations. The ap… |
CVE-2025-63714 | Medium | 6.1 | 2025-11-07 | Cross-Site Scripting (XSS) vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the conte… |
CVE-2025-63713 | Medium | 6.1 | 2025-11-07 | Cross-Site Scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input i… |
CVE-2025-57697 | Medium | 6.5 | 2025-11-07 | AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64. Since the _encode_image_bs64 function defined in entities.py o… |
CVE-2025-12873 | Medium | 4.7 | 2025-11-07 | A security flaw has been discovered in Campcodes School File Management 1.0. This affects an unknown part of the file /admin/update_user.php. Performing manipu… |
CVE-2025-12829 | Medium | 6.2 | 2025-11-07 | An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a wa… |
CVE-2025-7719 | | 2025-11-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GE Vernova Smallworld on Windows, Linux allows File Manipulatio… | |
CVE-2025-63785 | Medium | 6.1 | 2025-11-07 | A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because… |
CVE-2025-63784 | Medium | 6.5 | 2025-11-07 | An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2… |
CVE-2025-57698 | High | 7.5 | 2025-11-07 | AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface '/plugin/install-upload' pars… |
CVE-2025-3222 | | 2025-11-07 | Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects Smallworld: 5.3.3 and prior ver… | |
CVE-2025-12862 | Medium | 6.3 | 2025-11-07 | A vulnerability was identified in projectworlds Online Notes Sharing Platform 1.0. Affected by this issue is some unknown functionality of the file /dashboard/… |
CVE-2025-63783 | High | 7.6 | 2025-11-07 | A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web ap… |
CVE-2025-63691 | Critical | 9.6 | 2025-11-07 | In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-… |
CVE-2025-63690 | Critical | 9.1 | 2025-11-07 | In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible… |
CVE-2025-63689 | Critical | 10.0 | 2025-11-07 | Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote attacke… |
CVE-2025-63687 | Medium | 6.5 | 2025-11-07 | An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/service/security/Auth… |
CVE-2025-63686 | Medium | 6.5 | 2025-11-07 | There is an arbitrary file download vulnerability in GuoMinJim PersonManage thru commit 5a02b1ab208feacf3a34fc123c9381162afbaa95 (2020-11-23) in the document q… |
CVE-2025-58469 | High | 8.8 | 2025-11-07 | A cross-site request forgery (CSRF) vulnerability has been reported to affect QuLog Center. The remote attackers can then exploit the vulnerability to gain pri… |
CVE-2025-58465 | Medium | 5.4 | 2025-11-07 | A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the v… |
CVE-2025-58464 | High | 7.5 | 2025-11-07 | A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker, they can then exploit the vulnerability to read the contents… |
CVE-2025-58463 | Medium | 4.9 | 2025-11-07 | A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploi… |
CVE-2025-57712 | Medium | 6.5 | 2025-11-07 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-57706 | Medium | 5.4 | 2025-11-07 | A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vul… |
CVE-2025-54168 | Medium | 4.8 | 2025-11-07 | A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If a remote attacker gains an administrator account, they can then exploit… |
CVE-2025-54167 | | 2025-11-07 | A cross-site scripting (XSS) vulnerability has been reported to affect Notification Center. If a remote attacker gains an administrator account, they can then… |