2025 CVEs (page 124)
Page 124 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12603 | Critical | 9.8 | 2025-11-01 | /etc/timezone can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12602 | Critical | 9.8 | 2025-11-01 | /etc/avahi/services/z9.service can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12601 | High | 7.5 | 2025-11-01 | Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12600 | Critical | 9.8 | 2025-11-01 | Web UI Malfunction when setting unexpected locale via API.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12599 | Critical | 9.8 | 2025-11-01 | Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-36367 | High | 8.8 | 2025-11-01 | IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. A malicious actor can use… |
CVE-2025-6990 | High | 8.8 | 2025-11-01 | The kallyas theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.0 via the `TH_PhpCode` pagebuilder widget. T… |
CVE-2025-6988 | Medium | 6.4 | 2025-11-01 | The kallyas theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 4.23… |
CVE-2025-6574 | High | 8.8 | 2025-11-01 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is… |
CVE-2025-12171 | High | 8.8 | 2025-11-01 | The RESTful Content Syndication plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ingest_image() function… |
CVE-2025-12137 | Medium | 4.9 | 2025-11-01 | The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including… |
CVE-2025-11755 | High | 8.8 | 2025-11-01 | The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing rec… |
CVE-2025-11499 | Critical | 9.8 | 2025-11-01 | The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing f… |
CVE-2025-10487 | High | 7.3 | 2025-11-01 | The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select… |
CVE-2025-12180 | Medium | 4.3 | 2025-11-01 | The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.3. This is due to the plugin storing arbitr… |
CVE-2025-12090 | Medium | 6.4 | 2025-11-01 | The Employee Spotlight – Team Member Showcase & Meet the Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all v… |
CVE-2025-12038 | Medium | 4.3 | 2025-11-01 | The Folderly plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the /wp-json/folderly/v1/config… |
CVE-2025-11983 | Medium | 4.3 | 2025-11-01 | The WP Discourse plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5.9. This is due to the plugin unconditiona… |
CVE-2025-11740 | Medium | 6.5 | 2025-11-01 | The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the Subscriptions Manager in all versions up to, and including, 2.4.9 due to insuffici… |
CVE-2025-11502 | Medium | 6.4 | 2025-11-01 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcod… |
CVE-2025-5949 | High | 8.8 | 2025-11-01 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is… |
CVE-2025-12118 | Medium | 6.4 | 2025-11-01 | The Schema Scalpel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.6.1 due to insu… |
CVE-2025-11995 | High | 7.2 | 2025-11-01 | The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event details parameter in all versions up to, and including, 1.5.2… |
CVE-2025-11927 | Medium | 4.4 | 2025-11-01 | The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in… |
CVE-2025-11377 | Medium | 4.3 | 2025-11-01 | The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due… |
CVE-2025-12367 | Medium | 4.3 | 2025-11-01 | The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not… |
CVE-2025-11928 | Medium | 4.4 | 2025-11-01 | The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5… |
CVE-2025-11833 | Critical | 9.8 | 2025-11-01 | The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a m… |
CVE-2025-62275 | Medium | 5.3 | 2025-11-01 | Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7… |
CVE-2025-11922 | Medium | 6.4 | 2025-11-01 | The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up… |
CVE-2025-11920 | High | 8.8 | 2025-11-01 | The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.14 via the action parameter in one of its… |
CVE-2025-11816 | Medium | 5.3 | 2025-11-01 | The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of… |
CVE-2025-11174 | Medium | 5.3 | 2025-11-01 | The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin e… |
CVE-2025-62276 | Medium | 5.5 | 2025-11-01 | The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 throug… |
CVE-2025-12464 | Medium | 6.2 | 2025-10-31 | A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and mov… |
CVE-2025-63563 | Medium | 6.5 | 2025-10-31 | Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows a… |
CVE-2025-63562 | Medium | 6.3 | 2025-10-31 | Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. Authenticated attackers can call se… |
CVE-2025-63561 | High | 7.5 | 2025-10-31 | Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition in the HTTP connect… |
CVE-2025-60711 | Medium | 6.3 | 2025-10-31 | Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2025-10693 | | 2025-10-31 | When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-secure device. This vulnerability exist… | |
CVE-2025-64349 | High | 8.8 | 2025-10-31 | ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a password reset, and take… |
CVE-2025-64348 | High | 7.1 | 2025-10-31 | ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service. If the execute facility is specifically enable… |
CVE-2025-63458 | High | 7.5 | 2025-10-31 | Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the form_fast_setting_wifi_set function. This vulnerability all… |
CVE-2025-63454 | High | 7.5 | 2025-10-31 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the deviceId parameter in the get_parentControl_list_Info function. This vulnerabilit… |
CVE-2025-62618 | High | 8.0 | 2025-10-31 | ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because E… |
CVE-2025-62267 | Medium | 6.1 | 2025-10-31 | Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay D… |
CVE-2025-12547 | Low | 3.7 | 2025-10-31 | A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Adm… |
CVE-2025-12546 | Low | 3.5 | 2025-10-31 | A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation UI. This manipulatio… |
CVE-2025-63459 | High | 7.5 | 2025-10-31 | Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_421CF0 function. This vulnerability allow… |
CVE-2025-62264 | Medium | 6.1 | 2025-10-31 | Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4… |
CVE-2025-6075 | Medium | 5.5 | 2025-10-31 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. |
CVE-2025-63465 | High | 7.5 | 2025-10-31 | Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_422880 function. This vulnerability allows a… |
CVE-2025-63464 | High | 7.5 | 2025-10-31 | Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_42396C function. This vulnerability allows a… |
CVE-2025-63463 | High | 7.5 | 2025-10-31 | Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the wifiOff parameter in the sub_4232EC function. This vulnerability allow… |
CVE-2025-63462 | High | 7.5 | 2025-10-31 | Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub_421A04 function. This vulnerability allo… |
CVE-2025-63461 | High | 7.5 | 2025-10-31 | Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the urldecode function. This vulnerability allows… |
CVE-2025-63460 | High | 7.5 | 2025-10-31 | Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_4222E0 function. This vulnerability allow… |
CVE-2025-59501 | Medium | 4.8 | 2025-10-31 | Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent network. |
CVE-2025-63469 | High | 7.5 | 2025-10-31 | Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_421BAC function. This vulnerability allows a… |
CVE-2025-63468 | High | 7.5 | 2025-10-31 | Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the sub_426EF8 function. This vulnerability all… |
CVE-2025-63467 | High | 7.5 | 2025-10-31 | Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_425400 function. This vulnerability allows a… |
CVE-2025-63466 | High | 7.5 | 2025-10-31 | Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the sub_426EF8 function. This vulnerability allo… |
CVE-2025-29270 | Critical | 10.0 | 2025-10-31 | Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin pan… |
CVE-2025-12554 | Critical | 9.8 | 2025-10-31 | Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12553 | Critical | 9.8 | 2025-10-31 | Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12552 | Critical | 9.8 | 2025-10-31 | Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12509 | High | 8.4 | 2025-10-31 | On a client with an admin user, a Global_Shipping script can be implemented. The script could later be executed on the BRAIN2 server with administrator rights. |
CVE-2025-12508 | High | 8.4 | 2025-10-31 | When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data… |
CVE-2025-12507 | High | 8.8 | 2025-10-31 | The service Bizerba Communication Server (BCS) has an unquoted service path. Due to the way Windows searches the executable for the BCS service, malicious prog… |
CVE-2025-12357 | Medium | 6.3 | 2025-10-31 | By manipulating the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack bet… |
CVE-2025-64389 | | 2025-10-31 | The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol. | |
CVE-2025-64388 | | 2025-10-31 | Denial of service of the web server through specific requests to this protocol | |
CVE-2025-64387 | | 2025-10-31 | The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page controlled by the a… | |
CVE-2025-64385 | | 2025-10-31 | The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manu… | |
CVE-2025-64168 | High | 7.1 | 2025-10-31 | Agno is a multi-agent framework, runtime and control plane. From 2.0.0 to before 2.2.2, under high concurrency, when session_state is passed to Agent or Team d… |
CVE-2025-61427 | Medium | 6.1 | 2025-10-31 | A reflected cross-site scripting (XSS) vulnerability in BEO GmbH BEO Atlas Einfuhr Ausfuhr 3.0 allows attackers to execute arbitrary code in the context of a u… |
CVE-2025-60749 | High | 7.8 | 2025-10-31 | DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup_webhelper.exe. |
CVE-2025-57108 | Critical | 9.8 | 2025-10-31 | Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mes… |
CVE-2025-57107 | High | 7.1 | 2025-10-31 | Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLT… |
CVE-2025-57106 | High | 7.5 | 2025-10-31 | Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BufferDataExtraction… |
CVE-2025-12501 | High | 7.5 | 2025-10-31 | Integer overflow in GameMaker IDE below 2024.14.0 version can lead to can lead to application crashes through denial-of-service attacks (DoS). GameMaker users… |
CVE-2025-64386 | | 2025-10-31 | The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow… | |
CVE-2025-12521 | Medium | 5.3 | 2025-10-31 | The Analytify Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0.3 via the Analytify Tag HTML d… |
CVE-2025-12460 | | 2025-10-31 | An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript… | |
CVE-2025-4952 | | 2025-10-31 | Tampering of the registry entries might have led to preventing the ESET security products from starting correctly on the next system startup or to unauthorized… | |
CVE-2025-36249 | Low | 3.7 | 2025-10-31 | IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to… |
CVE-2025-33003 | High | 7.8 | 2025-10-31 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a non-root user to gain higher privileges/capabilities within the scope of a container… |
CVE-2025-64368 | Medium | 5.4 | 2025-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes Bard bardwp allows Cross Site Request Forgery.This issue affects Bard: from n/a through <= 1.6. |
CVE-2025-64367 | Medium | 6.5 | 2025-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey Groundhogg groundhogg allows Stored XSS.This… |
CVE-2025-64366 | High | 7.6 | 2025-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-managem… |
CVE-2025-64365 | Medium | 6.5 | 2025-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in colabrio Ohio Extra ohio-extra allows DOM-Based XSS.This… |
CVE-2025-64364 | High | 7.5 | 2025-10-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Masterstudy masterstudy… |
CVE-2025-64363 | High | 7.5 | 2025-10-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeventhQueen Kleo kleo allows PHP Loca… |
CVE-2025-64362 | Medium | 6.5 | 2025-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen K Elements k-elements allows DOM-Based XSS.T… |
CVE-2025-64361 | Medium | 6.5 | 2025-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-el… |
CVE-2025-64360 | High | 7.5 | 2025-10-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting Elementor Wi… |
CVE-2025-64359 | High | 7.5 | 2025-10-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting consulting a… |
CVE-2025-64358 | Medium | 4.3 | 2025-10-31 | Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce wt-smart-coupons-for-woocommerce allows Exploiting Incorrectly Configured Access… |
CVE-2025-64357 | Medium | 4.3 | 2025-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in Younes JFR. Advanced Database Cleaner advanced-database-cleaner allows Cross Site Request Forgery.This issue… |
CVE-2025-64356 | Medium | 4.3 | 2025-10-31 | Missing Authorization vulnerability in f1logic Insert PHP Code Snippet insert-php-code-snippet allows Exploiting Incorrectly Configured Access Control Security… |