2025 CVEs (page 121)
Page 121 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48290 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Kinsley kinsley allows PHP L… |
CVE-2025-48090 | High | 8.1 | 2025-11-06 | Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP Local File Inclusion.This issue affects Blanka -… |
CVE-2025-48089 | Critical | 9.3 | 2025-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rainbow-Themes Education WordPress Theme | HiStudy histud… |
CVE-2025-48086 | Medium | 5.5 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from… |
CVE-2025-48085 | High | 7.1 | 2025-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in ZIPANG Simple Stripe simple-stripe allows Stored XSS.This issue affects Simple Stripe: from n/a through <= 0… |
CVE-2025-48083 | High | 7.1 | 2025-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in andriassundskard wpNamedUsers wpnamedusers allows Stored XSS.This issue affects wpNamedUsers: from n/a throu… |
CVE-2025-48078 | High | 7.1 | 2025-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Norbert Slick Google Map slick-google-map allows Stored XSS.This issue affects Slick Google Map: from n/a th… |
CVE-2025-48077 | High | 7.1 | 2025-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in nitinmaurya12 Block Country block-country allows Stored XSS.This issue affects Block Country: from n/a throu… |
CVE-2025-47588 | Critical | 9.1 | 2025-11-06 | Improper Control of Generation of Code ('Code Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing… |
CVE-2025-39468 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pantherius Modal Survey modal-survey.T… |
CVE-2025-39467 | High | 8.1 | 2025-11-06 | Path Traversal: '.../...//' vulnerability in Mikado-Themes Wanderland wanderland allows PHP Local File Inclusion.This issue affects Wanderland: from n/a throug… |
CVE-2025-39466 | High | 8.1 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local… |
CVE-2025-39465 | Medium | 4.3 | 2025-11-06 | Missing Authorization vulnerability in flippercode Advanced Google Maps wp-google-map-gold allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-39463 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Dessau dessau allows PHP… |
CVE-2025-32222 | Critical | 9.9 | 2025-11-06 | Improper Control of Generation of Code ('Code Injection') vulnerability in Widgetlogic.org Widget Logic widget-logic allows Code Injection.This issue affects W… |
CVE-2025-31029 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bingu replyMail replymail allows Stored XSS.This issue af… |
CVE-2025-28953 | High | 8.5 | 2025-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axiomthemes smart SEO smartSEO allows SQL Injection.This… |
CVE-2025-22288 | Medium | 4.1 | 2025-11-06 | Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Trav… |
CVE-2025-12556 | High | 8.8 | 2025-11-06 | An argument injection vulnerability exists in the affected product that could allow an attacker to execute arbitrary code within the context of the host machin… |
CVE-2025-37735 | High | 7.0 | 2025-11-06 | Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running a… |
CVE-2025-36054 | Medium | 6.1 | 2025-11-06 | IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation W… |
CVE-2025-11956 | High | 8.9 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (Student Affairs Info… |
CVE-2025-10955 | Medium | 6.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma allows XSS Through HT… |
CVE-2025-11268 | Medium | 4.3 | 2025-11-06 | The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the so… |
CVE-2025-12360 | Medium | 4.3 | 2025-11-06 | The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtaf… |
CVE-2025-10259 | Medium | 5.3 | 2025-11-06 | Improper Validation of Specified Quantity in Input vulnerability in TCP Communication Function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module… |
CVE-2025-12471 | Medium | 6.1 | 2025-11-06 | The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dpsp_list_attentio… |
CVE-2025-9338 | | 2025-11-06 | A improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver. This vulnerability can be triggered by manually executing… | |
CVE-2025-12560 | Medium | 4.3 | 2025-11-06 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 8.6… |
CVE-2025-61994 | Medium | 5.4 | 2025-11-06 | Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be… |
CVE-2025-12563 | Medium | 4.3 | 2025-11-06 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to limited file upload due to an incorrect capability check on theupload… |
CVE-2025-11271 | Medium | 5.3 | 2025-11-06 | The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification by… |
CVE-2025-10691 | Medium | 4.3 | 2025-11-06 | The Easy Email Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing… |
CVE-2025-10683 | Medium | 4.9 | 2025-11-06 | The Easy Email Subscription plugin for WordPress is vulnerable to SQL Injection via the 'uid' parameter in all versions up to, and including, 1.3 due to insuff… |
CVE-2025-64171 | | 2025-11-06 | MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in… | |
CVE-2025-64164 | Critical | 9.8 | 2025-11-06 | Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishing JDBC connections… |
CVE-2025-64163 | Critical | 9.8 | 2025-11-06 | DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. Howeve… |
CVE-2025-64114 | Medium | 6.5 | 2025-11-06 | ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrators with plugin management privileges to… |
CVE-2025-62596 | Critical | 10.0 | 2025-11-06 | Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, an… |
CVE-2025-62161 | Critical | 10.0 | 2025-11-06 | Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container e… |
CVE-2025-55278 | High | 8.1 | 2025-11-05 | Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their… |
CVE-2025-12779 | High | 8.8 | 2025-11-05 | Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token fo… |
CVE-2025-63585 | Medium | 6.5 | 2025-11-05 | OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter. |
CVE-2025-60784 | Medium | 6.5 | 2025-11-05 | A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, ena… |
CVE-2025-63334 | Critical | 9.8 | 2025-11-05 | PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component. The applicati… |
CVE-2025-10853 | Medium | 5.2 | 2025-11-05 | A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering w… |
CVE-2025-63418 | Medium | 6.1 | 2025-11-05 | A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitrary JavaScript in the context of a logge… |
CVE-2025-63417 | High | 7.2 | 2025-11-05 | A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3 allows authenticated attackers to inject arbitrary… |
CVE-2025-63416 | Critical | 9.1 | 2025-11-05 | ** exclusively-hosted-service ** A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3 allows authenticat… |
CVE-2025-5770 | Medium | 6.1 | 2025-11-05 | A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malic… |
CVE-2025-56232 | Medium | 6.8 | 2025-11-05 | GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the local network, DNS, or a proxy can perform a man-in-the-middle… |
CVE-2025-55343 | Critical | 9.9 | 2025-11-05 | Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via busqueda/busqueda.php txt_depe_codi, busqueda/busqueda.php txt_usu… |
CVE-2025-55342 | Medium | 5.3 | 2025-11-05 | Quipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean identification number for all registered users via the Administracio… |
CVE-2025-55341 | Medium | 6.5 | 2025-11-05 | Cross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac allows anexos/anexos_nuevo.php asocImgRad. |
CVE-2025-43418 | Medium | 4.6 | 2025-11-05 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. An a… |
CVE-2025-31954 | Medium | 5.4 | 2025-11-05 | HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and includes sensitive i… |
CVE-2025-12745 | Medium | 5.3 | 2025-11-05 | A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file quickjs.c… |
CVE-2025-11093 | High | 8.4 | 2025-11-05 | An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engine… |
CVE-2025-56231 | Critical | 9.1 | 2025-11-05 | Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections. |
CVE-2025-10907 | High | 8.4 | 2025-11-05 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin servic… |
CVE-2025-10713 | Medium | 6.5 | 2025-11-05 | An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-suppli… |
CVE-2025-63248 | High | 7.5 | 2025-11-05 | DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing the questionnaire ID with the ID of another questionnaire c… |
CVE-2025-59716 | Medium | 5.3 | 2025-11-05 | ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validatio… |
CVE-2025-57244 | Medium | 5.4 | 2025-11-05 | OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field accepts script tags a… |
CVE-2025-46424 | Medium | 6.7 | 2025-11-05 | Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerability. A high privileged attacker could pot… |
CVE-2025-46366 | Medium | 6.7 | 2025-11-05 | Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation or access to the da… |
CVE-2025-46365 | Medium | 5.3 | 2025-11-05 | Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause Command Injection… |
CVE-2025-46364 | Critical | 9.1 | 2025-11-05 | Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape Vulnerability to gain control o… |
CVE-2025-45379 | High | 8.4 | 2025-11-05 | Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell… |
CVE-2025-45378 | Critical | 9.1 | 2025-11-05 | Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known password can break into command shell of Cl… |
CVE-2025-43990 | High | 7.3 | 2025-11-05 | Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local… |
CVE-2025-30479 | High | 8.4 | 2025-11-05 | Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system. |
CVE-2025-20377 | Medium | 4.3 | 2025-11-05 | A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an… |
CVE-2025-20376 | Medium | 6.5 | 2025-11-05 | A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability i… |
CVE-2025-20375 | Medium | 6.5 | 2025-11-05 | A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability i… |
CVE-2025-20374 | Medium | 4.9 | 2025-11-05 | A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resource… |
CVE-2025-20358 | Critical | 9.4 | 2025-11-05 | A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentic… |
CVE-2025-20354 | Critical | 9.8 | 2025-11-05 | A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary fil… |
CVE-2025-20343 | High | 8.6 | 2025-11-05 | A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthe… |
CVE-2025-20305 | Medium | 4.3 | 2025-11-05 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affect… |
CVE-2025-20304 | Medium | 5.4 | 2025-11-05 | Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflec… |
CVE-2025-20303 | Medium | 5.4 | 2025-11-05 | Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflec… |
CVE-2025-20289 | Medium | 4.8 | 2025-11-05 | Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflec… |
CVE-2025-63601 | Critical | 9.9 | 2025-11-05 | Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing… |
CVE-2025-61304 | Critical | 9.8 | 2025-11-05 | OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address. |
CVE-2025-60753 | Medium | 5.5 | 2025-11-05 | An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution ru… |
CVE-2025-57130 | High | 8.3 | 2025-11-05 | An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker to escalate their… |
CVE-2025-64459 | Critical | 9.1 | 2025-11-05 | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get… |
CVE-2025-64458 | High | 7.5 | 2025-11-05 | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `djan… |
CVE-2025-61084 | High | 7.1 | 2025-11-05 | MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can cra… |
CVE-2025-52602 | Medium | 4.2 | 2025-11-05 | HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application. An HTTP GET endpoint request returns discoverable responses… |
CVE-2025-47151 | Critical | 9.8 | 2025-11-05 | A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML res… |
CVE-2025-46784 | High | 7.5 | 2025-11-05 | A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML… |
CVE-2025-46705 | High | 7.5 | 2025-11-05 | A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion… |
CVE-2025-46404 | High | 7.5 | 2025-11-05 | A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML res… |
CVE-2025-3125 | Medium | 6.7 | 2025-11-05 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An au… |
CVE-2025-12497 | High | 8.1 | 2025-11-05 | The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the… |
CVE-2025-11745 | Medium | 6.4 | 2025-11-05 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field through the plugin's 'adinserter'… |
CVE-2025-58337 | Medium | 5.4 | 2025-11-05 | An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have… |
CVE-2025-12469 | Medium | 4.3 | 2025-11-05 | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all v… |