2025 CVEs (page 123)
Page 123 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-43395 | Low | 3.3 | 2025-11-04 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be… |
CVE-2025-43394 | Medium | 5.5 | 2025-11-04 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be… |
CVE-2025-43392 | Medium | 4.3 | 2025-11-04 | The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tah… |
CVE-2025-43391 | Medium | 5.5 | 2025-11-04 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14… |
CVE-2025-43390 | Medium | 5.5 | 2025-11-04 | A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.2, mac… |
CVE-2025-43389 | Medium | 5.5 | 2025-11-04 | A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15… |
CVE-2025-43387 | High | 7.8 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. A malicious app may be able to g… |
CVE-2025-43386 | High | 7.8 | 2025-11-04 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS… |
CVE-2025-43385 | Medium | 4.3 | 2025-11-04 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS… |
CVE-2025-43384 | Medium | 4.3 | 2025-11-04 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS… |
CVE-2025-43383 | Medium | 4.3 | 2025-11-04 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS… |
CVE-2025-43382 | Medium | 5.5 | 2025-11-04 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8… |
CVE-2025-43380 | Medium | 5.5 | 2025-11-04 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1… |
CVE-2025-43379 | Medium | 5.5 | 2025-11-04 | This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macO… |
CVE-2025-43378 | Medium | 5.5 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to access sen… |
CVE-2025-43377 | Medium | 5.5 | 2025-11-04 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1… |
CVE-2025-43376 | High | 7.5 | 2025-11-04 | A logic issue was addressed with improved state management. This issue is fixed in Safari 26, iOS 18.7.7 and iPadOS 18.7.7, iOS 26 and iPadOS 26, macOS Tahoe 2… |
CVE-2025-43373 | High | 7.5 | 2025-11-04 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able t… |
CVE-2025-43365 | Low | 2.8 | 2025-11-04 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26 and iPadOS 26. An unprivile… |
CVE-2025-43364 | High | 7.8 | 2025-11-04 | A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26.1. An app may be able t… |
CVE-2025-43361 | High | 7.8 | 2025-11-04 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macO… |
CVE-2025-43360 | Medium | 5.5 | 2025-11-04 | The issue was addressed with improved UI. This issue is fixed in iOS 26 and iPadOS 26. Password fields may be unintentionally revealed. |
CVE-2025-43350 | Low | 2.4 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1. An attacker may be able to view restricted con… |
CVE-2025-43348 | Medium | 5.5 | 2025-11-04 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may bypass Gat… |
CVE-2025-43345 | Medium | 5.5 | 2025-11-04 | A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma… |
CVE-2025-43338 | High | 7.1 | 2025-11-04 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26 and iPadOS 26, macOS Sonoma 14.8.2, macOS Sonoma 14.8… |
CVE-2025-43336 | Medium | 4.4 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app with… |
CVE-2025-43335 | Medium | 5.5 | 2025-11-04 | The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to a… |
CVE-2025-43334 | Medium | 5.5 | 2025-11-04 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be… |
CVE-2025-43323 | High | 8.1 | 2025-11-04 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An… |
CVE-2025-43322 | Medium | 5.5 | 2025-11-04 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to acc… |
CVE-2025-43309 | Low | 2.4 | 2025-11-04 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to… |
CVE-2025-43288 | Medium | 5.5 | 2025-11-04 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to bypass Privacy… |
CVE-2025-46556 | Medium | 6.5 | 2025-11-04 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.27.1 and below allow attackers to permanently corrupt issue activity logs by submitti… |
CVE-2025-35021 | Medium | 6.5 | 2025-11-04 | By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and fro… |
CVE-2025-36172 | Medium | 6.4 | 2025-11-03 | IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and… |
CVE-2025-34501 | | 2025-11-03 | Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet… | |
CVE-2025-11193 | Medium | 5.5 | 2025-11-03 | A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sensitive device spe… |
CVE-2025-63293 | Medium | 6.5 | 2025-11-03 | FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. A remote authenticated user can append comments or upload attachmen… |
CVE-2025-12657 | Medium | 5.0 | 2025-11-03 | The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of thi… |
CVE-2025-63593 | Medium | 6.1 | 2025-11-03 | Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS). |
CVE-2025-50735 | High | 7.5 | 2025-11-03 | Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, a… |
CVE-2025-12642 | Critical | 9.1 | 2025-11-03 | lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attac… |
CVE-2025-12531 | High | 7.1 | 2025-11-03 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote a… |
CVE-2025-8558 | Medium | 5.4 | 2025-11-03 | Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent… |
CVE-2025-63441 | High | 7.3 | 2025-11-03 | Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/friends. |
CVE-2025-50363 | Medium | 5.4 | 2025-11-03 | Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hiring.php va the name field. |
CVE-2025-12463 | Critical | 9.8 | 2025-11-03 | An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi/viewer/Param.cgi`… |
CVE-2025-11953 | Critical | 9.8 | 2025-11-03 | The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that i… |
CVE-2025-10280 | High | 7.1 | 2025-11-03 | IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows… |
CVE-2025-63453 | Critical | 9.8 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php. |
CVE-2025-63452 | Critical | 9.4 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php. |
CVE-2025-63451 | Critical | 9.8 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php. |
CVE-2025-63450 | Medium | 5.4 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php. |
CVE-2025-63449 | Medium | 5.4 | 2025-11-03 | Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php. |
CVE-2025-63448 | Medium | 6.1 | 2025-11-03 | Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1. |
CVE-2025-63447 | Medium | 6.1 | 2025-11-03 | Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_customer.php. |
CVE-2025-63446 | Medium | 6.1 | 2025-11-03 | Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_vendor.php. |
CVE-2025-60785 | High | 8.8 | 2025-11-03 | A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via a cr… |
CVE-2025-60503 | High | 8.7 | 2025-11-03 | A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase func… |
CVE-2025-36093 | Medium | 4.8 | 2025-11-03 | IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using m… |
CVE-2025-36092 | Medium | 6.5 | 2025-11-03 | IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the improper validation… |
CVE-2025-36091 | Medium | 4.3 | 2025-11-03 | IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate use… |
CVE-2025-11761 | High | 7.8 | 2025-11-03 | A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during th… |
CVE-2025-8900 | Critical | 9.8 | 2025-11-03 | The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users w… |
CVE-2025-63443 | Medium | 5.4 | 2025-11-03 | School Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter. |
CVE-2025-63442 | Medium | 4.6 | 2025-11-03 | Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via the Profile Section. The system fails to properly sanitize us… |
CVE-2025-60892 | Medium | 6.8 | 2025-11-03 | An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature. The imager's 'public-key authentication' setting unintention… |
CVE-2025-45663 | Medium | 6.5 | 2025-11-03 | An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure. |
CVE-2025-29699 | Medium | 6.5 | 2025-11-03 | NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function. |
CVE-2025-64294 | Medium | 5.3 | 2025-11-03 | Missing Authorization vulnerability in d3wp WP Snow Effect wp-snow-effect allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP… |
CVE-2025-40107 | | 2025-11-03 | In the Linux kernel, the following vulnerability has been resolved: can: hi311x: fix null pointer dereference when resuming from sleep before interface was en… | |
CVE-2025-12626 | Medium | 4.3 | 2025-11-03 | A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This affects the function getImgUrl of the file WxA… |
CVE-2025-0987 | Critical | 9.9 | 2025-11-03 | Authorization Bypass Through User-Controlled Key vulnerability in CB Project Ltd. Co. CVLand allows Parameter Injection. This issue affects CVLand: from 2.1.0… |
CVE-2025-48397 | High | 7.1 | 2025-11-03 | The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script… |
CVE-2025-48396 | High | 8.3 | 2025-11-03 | Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the lates… |
CVE-2025-12623 | Low | 3.1 | 2025-11-03 | A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the… |
CVE-2025-12622 | High | 8.8 | 2025-11-03 | A vulnerability was determined in Tenda AC10 16.03.10.13. Affected by this vulnerability is the function formSysRunCmd of the file /goform/SysRunCmd. This mani… |
CVE-2025-12619 | High | 8.8 | 2025-11-03 | A vulnerability was found in Tenda A15 15.13.07.13. Affected is the function fromSetWirelessRepeat of the file /goform/openNetworkGateway. The manipulation of… |
CVE-2025-12618 | High | 8.8 | 2025-11-03 | A vulnerability has been found in Tenda AC8 16.03.34.06. This impacts an unknown function of the file /goform/DatabaseIniSet. The manipulation of the argument… |
CVE-2025-12503 | Medium | 6.5 | 2025-11-03 | EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL comman… |
CVE-2025-12617 | High | 7.3 | 2025-11-03 | A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/login_crud.php. Executing a manipulation of t… |
CVE-2025-12616 | Low | 3.7 | 2025-11-03 | A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a manipulatio… |
CVE-2025-12615 | Medium | 5.0 | 2025-11-03 | A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manip… |
CVE-2025-12614 | Medium | 4.7 | 2025-11-03 | A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Impacted is the function delete_payment of the file /admin_class.php… |
CVE-2025-12612 | Medium | 6.3 | 2025-11-03 | A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. This issue affects some unknown processing of the file /ajax.php?ac… |
CVE-2025-12611 | High | 8.8 | 2025-11-03 | A vulnerability was identified in Tenda AC21 16.03.08.16. This vulnerability affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The m… |
CVE-2025-12610 | Medium | 4.7 | 2025-11-03 | A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.php. Executing a ma… |
CVE-2025-12609 | Medium | 4.7 | 2025-11-03 | A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-progress.php… |
CVE-2025-12608 | High | 7.3 | 2025-11-03 | A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the file /manage_user.php… |
CVE-2025-12607 | High | 7.3 | 2025-11-03 | A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Impacted is an unknown function of the file /manage_payment.php. Such manipul… |
CVE-2025-12606 | High | 7.3 | 2025-11-03 | A vulnerability was determined in itsourcecode Online Loan Management System 1.0. This issue affects some unknown processing of the file /manage_borrower.php… |
CVE-2025-12605 | High | 7.3 | 2025-11-02 | A vulnerability was found in itsourcecode Online Loan Management System 1.0. This vulnerability affects unknown code of the file /manage_loan.php. The manipula… |
CVE-2025-12604 | High | 7.3 | 2025-11-02 | A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /load_fields.php. The manipulation o… |
CVE-2025-12598 | Medium | 4.7 | 2025-11-02 | A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function save_tenant of the file /admin_class.ph… |
CVE-2025-12597 | Medium | 4.7 | 2025-11-02 | A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. Affected by this vulnerability is the function save_category of the fil… |
CVE-2025-12596 | High | 8.8 | 2025-11-02 | A security vulnerability has been detected in Tenda AC23 16.03.07.52. Affected is the function saveParentControlInfo of the file /goform/saveParentControlInfo… |
CVE-2025-12595 | High | 8.8 | 2025-11-02 | A weakness has been identified in Tenda AC23 16.03.07.52. This impacts the function formSetVirtualSer of the file /goform/SetVirtualServerCfg. This manipulatio… |
CVE-2025-12594 | Medium | 4.7 | 2025-11-02 | A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. This affects an unknown function of the file /admin/add_accoun… |
CVE-2025-12593 | Medium | 4.7 | 2025-11-02 | A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. The impacted element is an unknown function of the file /admin/edit… |