2025 CVEs (page 13)
Page 13 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-41029 | | 2026-04-21 | SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by… | |
CVE-2025-41011 | Medium | 6.1 | 2026-04-21 | HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper v… |
CVE-2025-15638 | Critical | 10.0 | 2026-04-21 | Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net::Dropbear versions before 0.14 includes versions of Dropbear 201… |
CVE-2025-31981 | Medium | 5.3 | 2026-04-21 | HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker… |
CVE-2025-31958 | Low | 3.7 | 2026-04-21 | HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through… |
CVE-2025-1241 | Medium | 5.8 | 2026-04-21 | Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users t… |
CVE-2025-14362 | High | 7.3 | 2026-04-21 | The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to l… |
CVE-2025-10354 | | 2026-04-21 | Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's brow… | |
CVE-2025-13826 | | 2026-04-21 | Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate val… | |
CVE-2025-66954 | Medium | 6.5 | 2026-04-20 | A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid usernames and their as… |
CVE-2025-66335 | Medium | 5.3 | 2026-04-20 | Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unint… |
CVE-2025-13480 | Medium | 6.5 | 2026-04-20 | Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API en… |
CVE-2025-65104 | High | 7.9 | 2026-04-17 | Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields… |
CVE-2025-70795 | Medium | 5.5 | 2026-04-17 | STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that… |
CVE-2025-46641 | Medium | 6.6 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper authentication vulnerab… |
CVE-2025-46607 | Medium | 6.6 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper authentication vulnerab… |
CVE-2025-46606 | Medium | 6.2 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper restriction of excessiv… |
CVE-2025-46605 | Medium | 6.2 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain a session fixation vulnerability. A… |
CVE-2025-36568 | High | 7.8 | 2026-04-17 | Dell PowerProtect Data Domain BoostFS for client of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 rel… |
CVE-2025-15625 | Critical | 9.8 | 2026-04-17 | Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases. |
CVE-2025-15624 | High | 7.5 | 2026-04-17 | Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authe… |
CVE-2025-15623 | High | 7.5 | 2026-04-17 | Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability i… |
CVE-2025-15622 | | 2026-04-17 | Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop c… | |
CVE-2025-54502 | High | 7.5 | 2026-04-16 | Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (Ring 0) to achieve… |
CVE-2025-54510 | | 2026-04-16 | A missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally authenticated attacker with administrative privileges to alter MMIO rou… | |
CVE-2025-43937 | Medium | 6.6 | 2026-04-16 | Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerability. A low privileged attacker with l… |
CVE-2025-43935 | Medium | 4.4 | 2026-04-16 | Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or release vulnerability. A high privileged attacker with local acces… |
CVE-2025-43883 | Medium | 4.1 | 2026-04-16 | Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper check for unusual or exceptional conditions vulnerability. A high privileged attacker w… |
CVE-2025-36579 | Medium | 5.1 | 2026-04-16 | Dell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability. An unauthenticated attacker with physical access to the system could poten… |
CVE-2025-15621 | Medium | 6.0 | 2026-04-16 | Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during Ope… |
CVE-2025-12624 | Medium | 6.0 | 2026-04-16 | Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previo… |
CVE-2025-6024 | Medium | 6.1 | 2026-04-16 | The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage th… |
CVE-2025-14868 | High | 8.8 | 2026-04-16 | The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to… |
CVE-2025-13364 | Medium | 6.4 | 2026-04-16 | The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2025-41118 | Critical | 9.1 | 2026-04-15 | Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If th… |
CVE-2025-63029 | High | 7.6 | 2026-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace all… |
CVE-2025-15636 | Medium | 6.5 | 2026-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design YouTube Showcase youtube-showcase allows S… |
CVE-2025-15635 | Medium | 4.3 | 2026-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Cross Site Request Forgery.This issue affe… |
CVE-2025-15610 | | 2026-04-15 | The .NET Remoting framework used by OpenText Fax (RightFax) includes known security vulnerabilities that could be exploited if the service is exposed in enviro… | |
CVE-2025-67841 | High | 7.5 | 2026-04-15 | Nordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+17 has an Algorithmic complexity issue. |
CVE-2025-53444 | Medium | 4.3 | 2026-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in DeluxeThemes Userpro userpro allows Cross Site Request Forgery.This issue affects Userpro: from n/a through… |
CVE-2025-12141 | Medium | 6.5 | 2026-04-15 | In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications… |
CVE-2025-14813 | High | 7.5 | 2026-04-15 | : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability… |
CVE-2025-52641 | Low | 2.9 | 2026-04-15 | HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information m… |
CVE-2025-40899 | High | 8.9 | 2026-04-15 | A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authentic… |
CVE-2025-40897 | High | 8.1 | 2026-04-15 | An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for us… |
CVE-2025-54550 | High | 8.1 | 2026-04-15 | The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to… |
CVE-2025-15470 | Medium | 6.5 | 2026-04-15 | The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in the akd_required_plugin_callback function… |
CVE-2025-15565 | Medium | 5.3 | 2026-04-14 | The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versi… |
CVE-2025-70023 | Critical | 9.8 | 2026-04-14 | An issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6. |
CVE-2025-68649 | Medium | 6.0 | 2026-04-14 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7… |
CVE-2025-65136 | Medium | 6.1 | 2026-04-14 | In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter. |
CVE-2025-65135 | Critical | 9.8 | 2026-04-14 | In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through… |
CVE-2025-65134 | Medium | 6.1 | 2026-04-14 | In manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.php via the email POS… |
CVE-2025-65133 | Critical | 9.8 | 2026-04-14 | A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated or authenticated remote attacker can su… |
CVE-2025-65132 | Medium | 6.1 | 2026-04-14 | alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting (XSS) in /public/admin/edit_room.php which allows an attacker to inject and execute… |
CVE-2025-63939 | Critical | 9.8 | 2026-04-14 | Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitem_name P… |
CVE-2025-61886 | Medium | 5.4 | 2026-04-14 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 thr… |
CVE-2025-61848 | High | 7.2 | 2026-04-14 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnaly… |
CVE-2025-61624 | Medium | 6.0 | 2026-04-14 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0… |
CVE-2025-59809 | Medium | 4.3 | 2026-04-14 | A server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR PaaS 7.6.4, FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS… |
CVE-2025-53847 | Medium | 6.5 | 2026-04-14 | A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11… |
CVE-2025-69993 | Medium | 6.1 | 2026-04-14 | Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as… |
CVE-2025-69893 | Medium | 4.6 | 2026-04-14 | A side-channel vulnerability exists in the implementation of BIP-39 mnemonic processing, as observed in Trezor One v1.13.0 to v1.14.0, Trezor T v1.13.0 to v1.1… |
CVE-2025-61260 | Critical | 9.8 | 2026-04-14 | A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration… |
CVE-2025-8095 | | 2026-04-14 | The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for st… | |
CVE-2025-7389 | | 2026-04-14 | A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the ad… | |
CVE-2025-13822 | Medium | 5.3 | 2026-04-14 | MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthentica… |
CVE-2025-40745 | Low | 3.7 | 2026-04-14 | A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versio… |
CVE-2025-70936 | Medium | 5.4 | 2026-04-13 | Vtiger CRM 8.4.0 contains a reflected cross-site scripting (XSS) vulnerability in the MailManager module. Improper handling of user-controlled input in the _fo… |
CVE-2025-51414 | High | 8.8 | 2026-04-13 | In Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was discovered within the profile picture upload functionality on the /my… |
CVE-2025-3756 | Medium | 6.5 | 2026-04-13 | A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed as affected in this CVE. An attack… |
CVE-2025-69627 | High | 8.4 | 2026-04-13 | Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During executio… |
CVE-2025-69624 | High | 7.5 | 2026-04-13 | Nitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert(). When app.alert() is c… |
CVE-2025-66769 | High | 7.5 | 2026-04-13 | A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service (DoS) via a crafted XFA packet. |
CVE-2025-63743 | Medium | 5.4 | 2026-04-13 | Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowes… |
CVE-2025-31991 | Medium | 6.8 | 2026-04-13 | Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful l… |
CVE-2025-66236 | High | 7.5 | 2026-04-13 | Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security d… |
CVE-2025-15632 | Low | 3.5 | 2026-04-13 | A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component MdPreview. Such man… |
CVE-2025-15441 | Medium | 6.8 | 2026-04-13 | The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL… |
CVE-2025-66447 | Unrated | | 2026-04-10 | Chamilo LMS is a learning management system. From 1.11.0 to 2.0-beta.1, anyone can trigger a malicious redirect through the use of the redirect parameter to /l… |
CVE-2025-44560 | Critical | 9.8 | 2026-04-10 | owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking. |
CVE-2025-5804 | High | 7.5 | 2026-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case Themes Case Theme User case-theme… |
CVE-2025-58920 | High | 7.1 | 2026-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zootemplate Cerato cerato allows Reflected XSS.This issue… |
CVE-2025-58913 | High | 8.1 | 2026-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CactusThemes VideoPro videopro allows… |
CVE-2025-14545 | Medium | 6.5 | 2026-04-10 | The YML for Yandex Market WordPress plugin before 5.0.26 is vulnerable to Remote Code Execution via the feed generation process. |
CVE-2025-59969 | Medium | 6.5 | 2026-04-09 | A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the advanced forwarding toolkit (evo-aftmand/evo-pfemand) of Juniper… |
CVE-2025-13914 | High | 8.7 | 2026-04-09 | A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM attacker to im… |
CVE-2025-13926 | Critical | 9.8 | 2026-04-09 | An attacker could use data obtained by sniffing the network traffic to forge packets in order to make arbitrary requests to Contemporary Controls BASC 20T. |
CVE-2025-70797 | Medium | 6.1 | 2026-04-09 | Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and box[url] parameters. |
CVE-2025-63238 | Medium | 6.1 | 2026-04-09 | A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance() fun… |
CVE-2025-70365 | Medium | 5.4 | 2026-04-09 | A stored cross-site scripting (XSS) vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interface… |
CVE-2025-70364 | High | 8.8 | 2026-04-09 | An issue was discovered in Kiamo before 8.4 allowing authenticated administrative attackers to execute arbitrary PHP code on the server. NOTE: the Supplier's p… |
CVE-2025-15480 | Critical | 9.1 | 2026-04-09 | In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitte… |
CVE-2025-14551 | High | 8.1 | 2026-04-09 | In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report… |
CVE-2025-70811 | Medium | 4.3 | 2026-04-09 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management… |
CVE-2025-70810 | High | 8.8 | 2026-04-09 | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authenticatio… |
CVE-2025-62718 | Critical | 9.9 | 2026-04-09 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when check… |
CVE-2025-50228 | Critical | 9.1 | 2026-04-09 | Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules. |
CVE-2025-45806 | Medium | 6.1 | 2026-04-09 | A cross-site scripting (XSS) vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted pay… |