2025 CVEs (page 118)
Page 118 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27916 | High | 7.5 | 2025-11-06 | An issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0. When the connection between two clients is established via an… |
CVE-2025-12815 | Medium | 4.3 | 2025-11-06 | An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an aut… |
CVE-2025-63589 | High | 7.1 | 2025-11-06 | A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being ins… |
CVE-2025-63588 | High | 7.1 | 2025-11-06 | An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary Jav… |
CVE-2025-63560 | High | 7.5 | 2025-11-06 | An issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware v.1.20.0006 allows a remote attacker to cause a denial of service via the system… |
CVE-2025-12808 | Medium | 6.5 | 2025-11-06 | Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting… |
CVE-2025-12485 | High | 8.8 | 2025-11-06 | Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by… |
CVE-2025-10885 | High | 7.8 | 2025-11-06 | A maliciously crafted file, when executed on the victim's machine, can lead to privilege escalation to NT AUTHORITY/SYSTEM due to an insufficient validation of… |
CVE-2025-6327 | Critical | 10.0 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in KingAddons.com King Addons for Elementor king-addons allows Upload a Web Shell to a Web Server… |
CVE-2025-6325 | Critical | 9.8 | 2025-11-06 | Incorrect Privilege Assignment vulnerability in KingAddons.com King Addons for Elementor king-addons allows Privilege Escalation.This issue affects King Addons… |
CVE-2025-64287 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Alloggio - Hotel Booking a… |
CVE-2025-64232 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Import from YML import-from-yml allows Reflected… |
CVE-2025-64224 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandc… |
CVE-2025-64198 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appscreo Easy Social Share Buttons easy-social-share-butt… |
CVE-2025-64196 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allo… |
CVE-2025-63307 | High | 8.1 | 2025-11-06 | alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files t… |
CVE-2025-62950 | Medium | 4.3 | 2025-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Cross Site Request Forger… |
CVE-2025-62914 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in anibalwainstein Effect Maker effect-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-62076 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue… |
CVE-2025-62075 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ido Kobelkowsky Simple Payment simple-… |
CVE-2025-62074 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobil… |
CVE-2025-62067 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Savory savory.This issue… |
CVE-2025-62066 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes Revolution revolution.This… |
CVE-2025-62065 | Critical | 9.9 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.6.5. |
CVE-2025-62064 | Critical | 9.8 | 2025-11-06 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This is… |
CVE-2025-62059 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank.This issue affects Sur… |
CVE-2025-62057 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-func… |
CVE-2025-62055 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist academist.This… |
CVE-2025-62053 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez.This issue af… |
CVE-2025-62051 | Medium | 6.5 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign Core u-design-core.This issue affects… |
CVE-2025-62049 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through <=… |
CVE-2025-62047 | Critical | 9.9 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Case Addons case-addons.This issue affects Case Addons: from n/a through < 1.3.0. |
CVE-2025-62046 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in CodexThemes TheGem Demo Import (for WPBakery) thegem-importer.This issue affects TheGem Demo Import (for WPBakery): from… |
CVE-2025-62045 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for… |
CVE-2025-62044 | Medium | 6.5 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-e… |
CVE-2025-62041 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.This issu… |
CVE-2025-62040 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YOP YOP Poll yop-poll.This issue affects YOP Poll: from n… |
CVE-2025-62039 | High | 7.5 | 2025-11-06 | Insertion of Sensitive Information Into Sent Data vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Re… |
CVE-2025-62038 | Medium | 6.5 | 2025-11-06 | Insertion of Sensitive Information Into Sent Data vulnerability in Sovlix MeetingHub meetinghub allows Retrieve Embedded Sensitive Data.This issue affects Meet… |
CVE-2025-62037 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. |
CVE-2025-62036 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Togo togo.This issue affects Togo: from n/a through… |
CVE-2025-62035 | High | 8.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. |
CVE-2025-62034 | High | 8.8 | 2025-11-06 | Incorrect Privilege Assignment vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. |
CVE-2025-62033 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. |
CVE-2025-62032 | Medium | 6.5 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-B… |
CVE-2025-62031 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tag… |
CVE-2025-62030 | Medium | 6.5 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tag… |
CVE-2025-62028 | Medium | 4.3 | 2025-11-06 | Missing Authorization vulnerability in ThemeNectar Salient salient.This issue affects Salient: from n/a through < 17.4.0. |
CVE-2025-62018 | Medium | 5.3 | 2025-11-06 | Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0. |
CVE-2025-62017 | Medium | 5.4 | 2025-11-06 | Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0. |
CVE-2025-62016 | Critical | 9.9 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0. |
CVE-2025-62014 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme ITok itok.This issue affects… |
CVE-2025-62012 | Medium | 6.5 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.This issu… |
CVE-2025-62011 | Medium | 6.5 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem thegem.This issue affects TheGem: from… |
CVE-2025-62010 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Famita famita allows PHP Loc… |
CVE-2025-60248 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPClever WPC Product Options for WooCo… |
CVE-2025-60247 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in Bux Bux Woocommerce bux-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects B… |
CVE-2025-60245 | Critical | 9.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager… |
CVE-2025-60244 | High | 7.1 | 2025-11-06 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RealMag777 TableOn posts-table-filterable allows Code Injection… |
CVE-2025-60243 | Critical | 9.8 | 2025-11-06 | Incorrect Privilege Assignment vulnerability in Holest Engineering Selling Commander for WooCommerce selling-commander-connector allows Privilege Escalation.Th… |
CVE-2025-60242 | High | 7.5 | 2025-11-06 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Anatoly Download Counter download-counter allows Path Traversal… |
CVE-2025-60241 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce premmerce allows P… |
CVE-2025-60240 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alexander AnyComment anycomment allows… |
CVE-2025-60239 | High | 8.5 | 2025-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codexpert, Inc CoSchool LMS coschool allows Blind SQL Inj… |
CVE-2025-60235 | Critical | 10.0 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Plugify Support Ticket System for WooCommerce (Premium) support-ticket-system-for-woocommerce… |
CVE-2025-60207 | Critical | 10.0 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerc… |
CVE-2025-60204 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach WooCommerce Store Toolki… |
CVE-2025-60203 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach Store Exporter woocommer… |
CVE-2025-60202 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Kyle Phillips Favorites favorites allo… |
CVE-2025-60201 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in aguilatechnologies WP Customer Area cu… |
CVE-2025-60200 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress LearnPress Export Import lea… |
CVE-2025-60199 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx InHype - Blog & Magazine WordPr… |
CVE-2025-60198 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx Saxon - Viral Content Blog & Ma… |
CVE-2025-60197 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in owenr88 Simple Contact Forms simple-co… |
CVE-2025-60196 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Clearblue Clearblue® Ovulation Calcula… |
CVE-2025-60195 | Critical | 9.8 | 2025-11-06 | Incorrect Privilege Assignment vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Privilege Escalation.This issue affects Atarim: from n/a t… |
CVE-2025-60194 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Product Search for… |
CVE-2025-60193 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce User Roles premmer… |
CVE-2025-60192 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Wholesale Pricing… |
CVE-2025-60191 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Wishlist for WooCo… |
CVE-2025-60190 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hinnerk Altenburg Immocaster WordPress… |
CVE-2025-60189 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PoloPag PoloPag – Pix Automático para… |
CVE-2025-60188 | High | 7.5 | 2025-11-06 | Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This i… |
CVE-2025-60187 | Medium | 4.8 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Using Malicious Files.This issue affects… |
CVE-2025-60074 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Lazy Load Optimizer lazy-loa… |
CVE-2025-60073 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Responsive Sidebar responsiv… |
CVE-2025-5803 | Medium | 5.3 | 2025-11-06 | Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking.This issue affects VikBooking Hotel Booking Engine & PMS: from… |
CVE-2025-59556 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup GoStore gostore allows Reflected XSS.This issue… |
CVE-2025-59392 | Medium | 6.8 | 2025-11-06 | On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive (containing a publicly… |
CVE-2025-58998 | Critical | 9.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <=… |
CVE-2025-58996 | Critical | 9.1 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Upload a Web Shell to a Web Server.Thi… |
CVE-2025-58995 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Leblix leblix allows… |
CVE-2025-58994 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Greenify greenify allows… |
CVE-2025-58986 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in ganddser Jock On Air Now (JOAN) joan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-58972 | High | 7.2 | 2025-11-06 | Path Traversal: '.../...//' vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manag… |
CVE-2025-58964 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Enzy enzy allows Reflected XSS.This issue affect… |
CVE-2025-58638 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Institutions Directory institutions-directory a… |
CVE-2025-58636 | Critical | 9.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP G… |
CVE-2025-58629 | High | 7.5 | 2025-11-06 | Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-58627 | Critical | 9.8 | 2025-11-06 | Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured A… |