2025 CVEs (page 117)
Page 117 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-63710 | Medium | 6.5 | 2025-11-10 | The send_message.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to Cross-Site Request Forgery (CSRF). The application does not implem… |
CVE-2025-63709 | Medium | 5.4 | 2025-11-10 | A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticated user can submi… |
CVE-2025-12480 | Critical | 9.1 | 2025-11-10 | Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is com… |
CVE-2025-64685 | High | 8.1 | 2025-11-10 | In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure |
CVE-2025-64684 | Medium | 4.3 | 2025-11-10 | In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form |
CVE-2025-64683 | Medium | 5.3 | 2025-11-10 | In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API |
CVE-2025-64682 | Low | 2.7 | 2025-11-10 | In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit |
CVE-2025-64681 | Low | 2.7 | 2025-11-10 | In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations |
CVE-2025-64457 | Medium | 4.2 | 2025-11-10 | In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition |
CVE-2025-64456 | High | 8.4 | 2025-11-10 | In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation |
CVE-2025-12939 | Medium | 6.3 | 2025-11-10 | A security flaw has been discovered in SourceCodester Interview Management System up to 1.0. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-12938 | High | 7.3 | 2025-11-10 | A vulnerability was identified in projectworlds Online Admission System 1.0. Affected by this vulnerability is an unknown functionality of the file /process_lo… |
CVE-2025-41001 | Medium | 5.4 | 2025-11-10 | Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sendi… |
CVE-2025-12405 | | 2025-11-10 | An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors. A Looker Studio user with report view access… | |
CVE-2025-41107 | Medium | 5.4 | 2025-11-10 | Stored Cross Site Scripting (XSS) vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/online_admi… |
CVE-2025-12409 | | 2025-11-10 | A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources. By creating a malicious report w… | |
CVE-2025-12397 | | 2025-11-10 | A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject malicious SQL that would execute with the… | |
CVE-2025-12155 | | 2025-11-10 | A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission… | |
CVE-2025-41731 | High | 7.4 | 2025-11-10 | A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the… |
CVE-2025-12933 | Medium | 6.3 | 2025-11-10 | A vulnerability was identified in SourceCodester Baby Care System 1.0. This affects an unknown part of the file /updatewelcome.php?id=siteoptions&action=welcom… |
CVE-2025-62689 | High | 7.5 | 2025-11-10 | NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of th… |
CVE-2025-59777 | High | 7.5 | 2025-11-10 | NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of th… |
CVE-2025-12932 | Medium | 4.7 | 2025-11-10 | A vulnerability was determined in SourceCodester Baby Care System 1.0. Affected by this issue is some unknown functionality of the file /admin.php?id=inbox. Th… |
CVE-2025-12931 | Medium | 6.3 | 2025-11-10 | A vulnerability was found in SourceCodester Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/edit-orde… |
CVE-2025-12613 | High | 8.6 | 2025-11-10 | Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampers… |
CVE-2025-12930 | Medium | 6.3 | 2025-11-10 | A vulnerability has been found in SourceCodester Food Ordering System 1.0. Affected is an unknown function of the file /view-ticket.php. The manipulation of th… |
CVE-2025-12929 | High | 7.3 | 2025-11-10 | A flaw has been found in SourceCodester Survey Application System 1.0. This impacts the function save_user/update_user of the file /LoginRegistration.php. Exec… |
CVE-2025-12928 | High | 7.3 | 2025-11-10 | A vulnerability was detected in code-projects Online Job Search Engine 1.0. This affects an unknown function of the file /login.php. Performing manipulation of… |
CVE-2025-12868 | Critical | 9.8 | 2025-11-10 | New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend… |
CVE-2025-12867 | High | 7.2 | 2025-11-10 | EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors… |
CVE-2025-12927 | Medium | 4.7 | 2025-11-10 | A security vulnerability has been detected in DedeBIZ up to 6.3.2. The impacted element is an unknown function of the file /admin/archives_add.php. Such manipu… |
CVE-2025-12926 | Medium | 6.3 | 2025-11-10 | A weakness has been identified in SourceCodester Farm Management System 1.0. The affected element is an unknown function of the file /review.php. This manipula… |
CVE-2025-12866 | Critical | 9.8 | 2025-11-10 | EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the… |
CVE-2025-12865 | High | 8.8 | 2025-11-10 | U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, mo… |
CVE-2025-12864 | High | 8.8 | 2025-11-10 | U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, mo… |
CVE-2025-12925 | High | 7.3 | 2025-11-10 | A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic… |
CVE-2025-12924 | Medium | 4.3 | 2025-11-10 | A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/mai… |
CVE-2025-12923 | Low | 2.7 | 2025-11-10 | A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/downloa… |
CVE-2025-12922 | Medium | 6.3 | 2025-11-10 | A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the com… |
CVE-2025-12921 | Medium | 4.3 | 2025-11-10 | A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of the file /ImportCRFD… |
CVE-2025-12920 | Low | 2.4 | 2025-11-09 | A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. Thi… |
CVE-2025-12919 | Low | 3.7 | 2025-11-09 | A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of th… |
CVE-2025-12918 | Low | 3.1 | 2025-11-09 | A security flaw has been discovered in yungifez Skuul School Management System up to 2.6.5. The impacted element is an unknown function of the file /dashboard/… |
CVE-2025-12917 | Medium | 4.3 | 2025-11-09 | A vulnerability was identified in TOZED ZLT T10 T10PLUS_3.04.15. The affected element is an unknown function of the file /reqproc/proc_post of the component Re… |
CVE-2025-40109 | | 2025-11-09 | In the Linux kernel, the following vulnerability has been resolved: crypto: rng - Ensure set_ent is always present Ensure that set_ent is always set since on… | |
CVE-2025-40108 | | 2025-11-09 | In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: Fix blocked task Revert commit 1afa70632c39 ("serial: qcom-geni: Enabl… | |
CVE-2025-12916 | Medium | 6.3 | 2025-11-09 | A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_lo… |
CVE-2025-12915 | Medium | 6.4 | 2025-11-08 | A vulnerability was found in 70mai X200 up to 20251019. This issue affects some unknown processing of the component Init Script Handler. The manipulation resul… |
CVE-2025-12914 | Medium | 4.7 | 2025-11-08 | A vulnerability has been found in aaPanel BaoTa up to 11.2.x. This vulnerability affects unknown code of the file /database?action=GetDatabaseAccess of the com… |
CVE-2025-12913 | Medium | 4.7 | 2025-11-08 | A flaw has been found in code-projects Responsive Hotel Site 1.0. This affects an unknown part of the file /admin/roomdel.php. Executing manipulation of the ar… |
CVE-2025-12837 | Medium | 6.4 | 2025-11-08 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in versions up to, and includi… |
CVE-2025-12643 | Medium | 6.4 | 2025-11-08 | The Saphali LiqPay for donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saphali_liqpay' shortcode in all versions up to, and i… |
CVE-2025-12399 | High | 7.2 | 2025-11-08 | The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-jso… |
CVE-2025-12092 | Medium | 6.5 | 2025-11-08 | The CYAN Backup plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' functionality in all ver… |
CVE-2025-11980 | Medium | 4.9 | 2025-11-08 | The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to, and including, 13.7.3 d… |
CVE-2025-11967 | High | 7.2 | 2025-11-08 | The Mail Mint plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_contact_attribute_import function… |
CVE-2025-11448 | Medium | 4.3 | 2025-11-08 | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12099 | High | 7.2 | 2025-11-08 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and in… |
CVE-2025-12098 | Medium | 5.3 | 2025-11-08 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… |
CVE-2025-12621 | Medium | 5.3 | 2025-11-08 | The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability… |
CVE-2025-12498 | Medium | 4.3 | 2025-11-08 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability che… |
CVE-2025-9334 | High | 8.8 | 2025-11-08 | The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7… |
CVE-2025-7663 | Medium | 6.5 | 2025-11-08 | The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovae… |
CVE-2025-12353 | Medium | 5.3 | 2025-11-08 | The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized… |
CVE-2025-12193 | Medium | 6.1 | 2025-11-08 | The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mp' parameter in all versions up to, and including, 2.3.1 due t… |
CVE-2025-12177 | Medium | 5.3 | 2025-11-08 | The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron(… |
CVE-2025-12167 | Medium | 4.3 | 2025-11-08 | The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_a… |
CVE-2025-12161 | High | 8.8 | 2025-11-08 | The Smart Auto Upload Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the auto-image creation functi… |
CVE-2025-12125 | Medium | 4.4 | 2025-11-08 | The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and… |
CVE-2025-12112 | Medium | 6.4 | 2025-11-08 | The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and… |
CVE-2025-12064 | Medium | 6.1 | 2025-11-08 | The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 2.4.7 due… |
CVE-2025-12042 | Medium | 5.3 | 2025-11-08 | The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all… |
CVE-2025-12000 | Medium | 6.5 | 2025-11-08 | The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all… |
CVE-2025-11972 | Medium | 4.9 | 2025-11-08 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all v… |
CVE-2025-11748 | Medium | 4.3 | 2025-11-08 | The Groups plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0 via the 'group_id' parameter of t… |
CVE-2025-12583 | Medium | 6.4 | 2025-11-08 | The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_neofix_sdl_… |
CVE-2025-11452 | High | 7.5 | 2025-11-08 | The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and inclu… |
CVE-2025-64496 | High | 7.3 | 2025-11-08 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerab… |
CVE-2025-64495 | High | 8.7 | 2025-11-08 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts… |
CVE-2025-64494 | Medium | 4.6 | 2025-11-08 | Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names… |
CVE-2025-64493 | Medium | 6.5 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenti… |
CVE-2025-64492 | High | 8.8 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind S… |
CVE-2025-64491 | Medium | 6.1 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and below allow unauthenticated refle… |
CVE-2025-64490 | High | 8.3 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0… |
CVE-2025-64489 | High | 8.3 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0… |
CVE-2025-64488 | High | 8.8 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through… |
CVE-2025-64486 | | 2025-11-08 | calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker… | |
CVE-2025-64485 | | 2025-11-08 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1, a malicious CVAT user with at least t… | |
CVE-2025-12911 | Medium | 4.3 | 2025-11-08 | Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-12910 | Medium | 6.2 | 2025-11-08 | Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local attacker to obtain potentially sensitive information via debug… |
CVE-2025-12909 | Medium | 5.3 | 2025-11-08 | Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium… |
CVE-2025-12908 | Medium | 5.4 | 2025-11-08 | Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform domain spoofing… |
CVE-2025-12907 | High | 8.8 | 2025-11-08 | Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user act… |
CVE-2025-12906 | Medium | 5.4 | 2025-11-08 | Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-12905 | Medium | 5.4 | 2025-11-08 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted… |
CVE-2025-64437 | Medium | 5.0 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock… |
CVE-2025-64436 | Medium | 5.3 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the… |
CVE-2025-64435 | Medium | 5.3 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the co… |
CVE-2025-64434 | Medium | 4.7 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCer… |
CVE-2025-64433 | Medium | 6.5 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary fil… |