2025 CVEs (page 125)
Page 125 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12642 | Critical | 9.1 | 2025-11-03 | lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attac… |
CVE-2025-12531 | High | 7.1 | 2025-11-03 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote a… |
CVE-2025-8558 | Medium | 5.4 | 2025-11-03 | Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent… |
CVE-2025-63441 | High | 7.3 | 2025-11-03 | Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/friends. |
CVE-2025-50363 | Medium | 5.4 | 2025-11-03 | Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hiring.php va the name field. |
CVE-2025-12463 | Critical | 9.8 | 2025-11-03 | An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi/viewer/Param.cgi`… |
CVE-2025-11953 | Critical | 9.8 | 2025-11-03 | The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that i… |
CVE-2025-10280 | High | 7.1 | 2025-11-03 | IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows… |
CVE-2025-63453 | Critical | 9.8 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php. |
CVE-2025-63452 | Critical | 9.4 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php. |
CVE-2025-63451 | Critical | 9.8 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php. |
CVE-2025-63450 | Medium | 5.4 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php. |
CVE-2025-63449 | Medium | 5.4 | 2025-11-03 | Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php. |
CVE-2025-63448 | Medium | 6.1 | 2025-11-03 | Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1. |
CVE-2025-63447 | Medium | 6.1 | 2025-11-03 | Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_customer.php. |
CVE-2025-63446 | Medium | 6.1 | 2025-11-03 | Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_vendor.php. |
CVE-2025-60785 | High | 8.8 | 2025-11-03 | A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via a cr… |
CVE-2025-60503 | High | 8.7 | 2025-11-03 | A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase func… |
CVE-2025-36093 | Medium | 4.8 | 2025-11-03 | IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using m… |
CVE-2025-36092 | Medium | 6.5 | 2025-11-03 | IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the improper validation… |
CVE-2025-36091 | Medium | 4.3 | 2025-11-03 | IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate use… |
CVE-2025-11761 | High | 7.8 | 2025-11-03 | A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during th… |
CVE-2025-8900 | Critical | 9.8 | 2025-11-03 | The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users w… |
CVE-2025-63443 | Medium | 5.4 | 2025-11-03 | School Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter. |
CVE-2025-63442 | Medium | 4.6 | 2025-11-03 | Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via the Profile Section. The system fails to properly sanitize us… |
CVE-2025-60892 | Medium | 6.8 | 2025-11-03 | An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature. The imager's 'public-key authentication' setting unintention… |
CVE-2025-45663 | Medium | 6.5 | 2025-11-03 | An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure. |
CVE-2025-29699 | Medium | 6.5 | 2025-11-03 | NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function. |
CVE-2025-64294 | Medium | 5.3 | 2025-11-03 | Missing Authorization vulnerability in d3wp WP Snow Effect wp-snow-effect allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP… |
CVE-2025-40107 | | 2025-11-03 | In the Linux kernel, the following vulnerability has been resolved: can: hi311x: fix null pointer dereference when resuming from sleep before interface was en… | |
CVE-2025-12626 | Medium | 4.3 | 2025-11-03 | A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This affects the function getImgUrl of the file WxA… |
CVE-2025-0987 | Critical | 9.9 | 2025-11-03 | Authorization Bypass Through User-Controlled Key vulnerability in CB Project Ltd. Co. CVLand allows Parameter Injection. This issue affects CVLand: from 2.1.0… |
CVE-2025-48397 | High | 7.1 | 2025-11-03 | The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script… |
CVE-2025-48396 | High | 8.3 | 2025-11-03 | Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the lates… |
CVE-2025-12623 | Low | 3.1 | 2025-11-03 | A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the… |
CVE-2025-12622 | High | 8.8 | 2025-11-03 | A vulnerability was determined in Tenda AC10 16.03.10.13. Affected by this vulnerability is the function formSysRunCmd of the file /goform/SysRunCmd. This mani… |
CVE-2025-12619 | High | 8.8 | 2025-11-03 | A vulnerability was found in Tenda A15 15.13.07.13. Affected is the function fromSetWirelessRepeat of the file /goform/openNetworkGateway. The manipulation of… |
CVE-2025-12618 | High | 8.8 | 2025-11-03 | A vulnerability has been found in Tenda AC8 16.03.34.06. This impacts an unknown function of the file /goform/DatabaseIniSet. The manipulation of the argument… |
CVE-2025-12503 | Medium | 6.5 | 2025-11-03 | EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL comman… |
CVE-2025-12617 | High | 7.3 | 2025-11-03 | A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/login_crud.php. Executing a manipulation of t… |
CVE-2025-12616 | Low | 3.7 | 2025-11-03 | A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a manipulatio… |
CVE-2025-12615 | Medium | 5.0 | 2025-11-03 | A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manip… |
CVE-2025-12614 | Medium | 4.7 | 2025-11-03 | A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Impacted is the function delete_payment of the file /admin_class.php… |
CVE-2025-12612 | Medium | 6.3 | 2025-11-03 | A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. This issue affects some unknown processing of the file /ajax.php?ac… |
CVE-2025-12611 | High | 8.8 | 2025-11-03 | A vulnerability was identified in Tenda AC21 16.03.08.16. This vulnerability affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The m… |
CVE-2025-12610 | Medium | 4.7 | 2025-11-03 | A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.php. Executing a ma… |
CVE-2025-12609 | Medium | 4.7 | 2025-11-03 | A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-progress.php… |
CVE-2025-12608 | High | 7.3 | 2025-11-03 | A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the file /manage_user.php… |
CVE-2025-12607 | High | 7.3 | 2025-11-03 | A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Impacted is an unknown function of the file /manage_payment.php. Such manipul… |
CVE-2025-12606 | High | 7.3 | 2025-11-03 | A vulnerability was determined in itsourcecode Online Loan Management System 1.0. This issue affects some unknown processing of the file /manage_borrower.php… |
CVE-2025-12605 | High | 7.3 | 2025-11-02 | A vulnerability was found in itsourcecode Online Loan Management System 1.0. This vulnerability affects unknown code of the file /manage_loan.php. The manipula… |
CVE-2025-12604 | High | 7.3 | 2025-11-02 | A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /load_fields.php. The manipulation o… |
CVE-2025-12598 | Medium | 4.7 | 2025-11-02 | A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function save_tenant of the file /admin_class.ph… |
CVE-2025-12597 | Medium | 4.7 | 2025-11-02 | A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. Affected by this vulnerability is the function save_category of the fil… |
CVE-2025-12596 | High | 8.8 | 2025-11-02 | A security vulnerability has been detected in Tenda AC23 16.03.07.52. Affected is the function saveParentControlInfo of the file /goform/saveParentControlInfo… |
CVE-2025-12595 | High | 8.8 | 2025-11-02 | A weakness has been identified in Tenda AC23 16.03.07.52. This impacts the function formSetVirtualSer of the file /goform/SetVirtualServerCfg. This manipulatio… |
CVE-2025-12594 | Medium | 4.7 | 2025-11-02 | A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. This affects an unknown function of the file /admin/add_accoun… |
CVE-2025-12593 | Medium | 4.7 | 2025-11-02 | A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. The impacted element is an unknown function of the file /admin/edit… |
CVE-2025-12603 | Critical | 9.8 | 2025-11-01 | /etc/timezone can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12602 | Critical | 9.8 | 2025-11-01 | /etc/avahi/services/z9.service can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12601 | High | 7.5 | 2025-11-01 | Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12600 | Critical | 9.8 | 2025-11-01 | Web UI Malfunction when setting unexpected locale via API.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12599 | Critical | 9.8 | 2025-11-01 | Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-36367 | High | 8.8 | 2025-11-01 | IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. A malicious actor can use… |
CVE-2025-6990 | High | 8.8 | 2025-11-01 | The kallyas theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.0 via the `TH_PhpCode` pagebuilder widget. T… |
CVE-2025-6988 | Medium | 6.4 | 2025-11-01 | The kallyas theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 4.23… |
CVE-2025-6574 | High | 8.8 | 2025-11-01 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is… |
CVE-2025-12171 | High | 8.8 | 2025-11-01 | The RESTful Content Syndication plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ingest_image() function… |
CVE-2025-12137 | Medium | 4.9 | 2025-11-01 | The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including… |
CVE-2025-11755 | High | 8.8 | 2025-11-01 | The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing rec… |
CVE-2025-11499 | Critical | 9.8 | 2025-11-01 | The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing f… |
CVE-2025-10487 | High | 7.3 | 2025-11-01 | The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select… |
CVE-2025-12180 | Medium | 4.3 | 2025-11-01 | The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.3. This is due to the plugin storing arbitr… |
CVE-2025-12090 | Medium | 6.4 | 2025-11-01 | The Employee Spotlight – Team Member Showcase & Meet the Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all v… |
CVE-2025-12038 | Medium | 4.3 | 2025-11-01 | The Folderly plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the /wp-json/folderly/v1/config… |
CVE-2025-11983 | Medium | 4.3 | 2025-11-01 | The WP Discourse plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5.9. This is due to the plugin unconditiona… |
CVE-2025-11740 | Medium | 6.5 | 2025-11-01 | The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the Subscriptions Manager in all versions up to, and including, 2.4.9 due to insuffici… |
CVE-2025-11502 | Medium | 6.4 | 2025-11-01 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcod… |
CVE-2025-5949 | High | 8.8 | 2025-11-01 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is… |
CVE-2025-12118 | Medium | 6.4 | 2025-11-01 | The Schema Scalpel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.6.1 due to insu… |
CVE-2025-11995 | High | 7.2 | 2025-11-01 | The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event details parameter in all versions up to, and including, 1.5.2… |
CVE-2025-11927 | Medium | 4.4 | 2025-11-01 | The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in… |
CVE-2025-11377 | Medium | 4.3 | 2025-11-01 | The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due… |
CVE-2025-12367 | Medium | 4.3 | 2025-11-01 | The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not… |
CVE-2025-11928 | Medium | 4.4 | 2025-11-01 | The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5… |
CVE-2025-11833 | Critical | 9.8 | 2025-11-01 | The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a m… |
CVE-2025-62275 | Medium | 5.3 | 2025-11-01 | Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7… |
CVE-2025-11922 | Medium | 6.4 | 2025-11-01 | The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up… |
CVE-2025-11920 | High | 8.8 | 2025-11-01 | The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.14 via the action parameter in one of its… |
CVE-2025-11816 | Medium | 5.3 | 2025-11-01 | The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of… |
CVE-2025-11174 | Medium | 5.3 | 2025-11-01 | The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin e… |
CVE-2025-62276 | Medium | 5.5 | 2025-11-01 | The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 throug… |
CVE-2025-12464 | Medium | 6.2 | 2025-10-31 | A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and mov… |
CVE-2025-63563 | Medium | 6.5 | 2025-10-31 | Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows a… |
CVE-2025-63562 | Medium | 6.3 | 2025-10-31 | Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. Authenticated attackers can call se… |
CVE-2025-63561 | High | 7.5 | 2025-10-31 | Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition in the HTTP connect… |
CVE-2025-60711 | Medium | 6.3 | 2025-10-31 | Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2025-10693 | | 2025-10-31 | When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-secure device. This vulnerability exist… | |
CVE-2025-64349 | High | 8.8 | 2025-10-31 | ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a password reset, and take… |
CVE-2025-64348 | High | 7.1 | 2025-10-31 | ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service. If the execute facility is specifically enable… |