2025 CVEs (page 130)
Page 130 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53533 | Medium | 6.1 | 2025-10-27 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interfa… |
CVE-2025-46602 | Medium | 4.4 | 2025-10-27 | Dell SupportAssist OS Recovery, versions prior to 5.5.15.0, contain an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerab… |
CVE-2025-36170 | Medium | 6.4 | 2025-10-27 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated us… |
CVE-2025-36138 | Medium | 6.4 | 2025-10-27 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated us… |
CVE-2025-36007 | High | 7.8 | 2025-10-27 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to privilege escalation due to improper privilege assignment to an update scr… |
CVE-2025-32785 | Medium | 5.4 | 2025-10-27 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interfa… |
CVE-2025-12365 | Medium | 5.3 | 2025-10-27 | Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12309 | High | 7.3 | 2025-10-27 | A weakness has been identified in code-projects Nero Social Networking Site 1.0. This affects an unknown part of the file /friendprofile.php. Executing manipul… |
CVE-2025-12308 | High | 7.3 | 2025-10-27 | A security flaw has been discovered in code-projects Nero Social Networking Site 1.0. Affected by this issue is some unknown functionality of the file /deletem… |
CVE-2025-12307 | High | 7.3 | 2025-10-27 | A vulnerability was identified in code-projects Nero Social Networking Site 1.0. Affected by this vulnerability is an unknown functionality of the file /addfri… |
CVE-2025-12306 | High | 7.3 | 2025-10-27 | A vulnerability was determined in code-projects Nero Social Networking Site 1.0. Affected is an unknown function of the file /acceptoffres.php. This manipulati… |
CVE-2025-12305 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in quequnlong shiyi-blog up to 1.2.1. This impacts an unknown function of the file src/main/java/com/mojian/controller/SysJobControll… |
CVE-2025-12304 | Medium | 4.3 | 2025-10-27 | A vulnerability has been found in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b. This affects the function alipayIsSucceed of the… |
CVE-2025-61795 | Medium | 5.3 | 2025-10-27 | Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart u… |
CVE-2025-61385 | Critical | 9.6 | 2025-10-27 | SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to func… |
CVE-2025-60983 | Medium | 5.4 | 2025-10-27 | Reflected Cross Site Scripting vulnerability in Rubikon Banking Solution 4.0.3 in the "Search For Customers Information" endpoints. |
CVE-2025-60982 | Medium | 5.4 | 2025-10-27 | IDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data via manipulated object references. Affected endpoints do not en… |
CVE-2025-55754 | Critical | 9.6 | 2025-10-27 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If… |
CVE-2025-55752 | High | 7.5 | 2025-10-27 | Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it w… |
CVE-2025-54965 | Medium | 6.1 | 2025-10-27 | An XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not properly sanitize the job ID parameter before using it i… |
CVE-2025-12364 | Critical | 9.8 | 2025-10-27 | Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12363 | High | 7.5 | 2025-10-27 | Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12303 | Low | 2.4 | 2025-10-27 | A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. The impacted element is an unknown function of the file admin-profile.php. Executing a… |
CVE-2025-12302 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in code-projects Simple Food Ordering System 1.0. The affected element is an unknown function of the file /editproduct.php. Perfor… |
CVE-2025-12301 | High | 7.3 | 2025-10-27 | A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /editproduct.php. Such… |
CVE-2025-12300 | Medium | 4.3 | 2025-10-27 | A weakness has been identified in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addcategory.php. This… |
CVE-2025-54970 | Medium | 6.5 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service fails to authenticate requests. In some configurations, this may allo… |
CVE-2025-54969 | Medium | 6.1 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not implement CSRF protections. An attacker who social engineers… |
CVE-2025-54968 | High | 8.8 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Service does not require authentication. In some configurations, this may allow remo… |
CVE-2025-54967 | Medium | 6.5 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able to social engineer a… |
CVE-2025-27225 | High | 7.5 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint disclo… |
CVE-2025-27224 | Critical | 9.8 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the inp… |
CVE-2025-27223 | High | 7.5 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList… |
CVE-2025-27222 | High | 8.6 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitiz… |
CVE-2025-12299 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /addproduct.php. The… |
CVE-2025-12298 | Medium | 4.3 | 2025-10-27 | A vulnerability was identified in code-projects Simple Food Ordering System 1.0. This affects an unknown part of the file /editcategory.php. The manipulation o… |
CVE-2025-12297 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in infor… |
CVE-2025-12296 | Medium | 4.7 | 2025-10-27 | A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub_4174B0 of the component Firmware Update Handle… |
CVE-2025-12295 | Medium | 6.6 | 2025-10-27 | A weakness has been identified in D-Link DAP-2695 2.00RC13. The affected element is the function sub_40C6B8 of the component Firmware Update Handler. Executing… |
CVE-2025-61247 | High | 8.2 | 2025-10-27 | indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php. |
CVE-2025-60791 | Medium | 6.2 | 2025-10-27 | Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in… |
CVE-2025-60425 | High | 8.6 | 2025-10-27 | Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attac… |
CVE-2025-60424 | High | 7.6 | 2025-10-27 | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce att… |
CVE-2025-34133 | | 2025-10-27 | Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that c… | |
CVE-2025-12294 | Medium | 4.7 | 2025-10-27 | A security flaw has been discovered in SourceCodester Point of Sales 1.0. Impacted is an unknown function of the file /delete_category.php. Performing manipula… |
CVE-2025-12293 | High | 7.3 | 2025-10-27 | A vulnerability was identified in SourceCodester Point of Sales 1.0. This issue affects some unknown processing of the file /category.php. Such manipulation of… |
CVE-2025-12292 | High | 7.3 | 2025-10-27 | A vulnerability was determined in SourceCodester Point of Sales 1.0. This vulnerability affects unknown code of the file /index.php. This manipulation of the a… |
CVE-2025-12291 | Medium | 4.7 | 2025-10-27 | A vulnerability was found in ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System up to 1.1.0. This affects an unknown part of the file /admin/index.ph… |
CVE-2025-10023 | Medium | 6.2 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Services Meta-services… |
CVE-2025-61482 | High | 7.2 | 2025-10-27 | Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two… |
CVE-2025-52268 | High | 7.5 | 2025-10-27 | StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens. |
CVE-2025-52264 | High | 8.0 | 2025-10-27 | StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a stack overflow via the cgiMain function at download.cgi. |
CVE-2025-36121 | Medium | 5.4 | 2025-10-27 | IBM OpenPages 9.1 and 9.0 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be exec… |
CVE-2025-34292 | | 2025-10-27 | Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of untrusted data. User-controlled input is p… | |
CVE-2025-26862 | | 2025-10-27 | Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may… | |
CVE-2025-12351 | Medium | 6.8 | 2025-10-27 | Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerabili… |
CVE-2025-12290 | Medium | 4.3 | 2025-10-27 | A vulnerability has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this issue is some u… |
CVE-2025-12289 | Medium | 4.3 | 2025-10-27 | A flaw has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this vulnerability is an unkn… |
CVE-2025-12288 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4. Affected is an unknown function of the file /user/edit_user/ of the component User… |
CVE-2025-12287 | Medium | 4.7 | 2025-10-27 | A security vulnerability has been detected in Bdtask Wholesale Inventory Control and Inventory Management System up to 20251013. This impacts an unknown functi… |
CVE-2025-9164 | | 2025-10-27 | Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for required DLLs in the user's Downloads… | |
CVE-2025-61481 | Critical | 10.0 | 2025-10-27 | An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to… |
CVE-2025-60291 | Critical | 9.1 | 2025-10-27 | An issue was discovered in eTimeTrackLite Web thru 12.0 (20250704). There is a permission control flaw that allows unauthorized attackers to access specific ro… |
CVE-2025-52263 | High | 8.0 | 2025-10-27 | An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to upload crafted fir… |
CVE-2025-50055 | Medium | 6.4 | 2025-10-27 | Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML… |
CVE-2025-12286 | High | 7.0 | 2025-10-27 | A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files (x86)\VeePN\avservice\avservice.exe of the c… |
CVE-2025-12283 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in code-projects Client Details System 1.0. The impacted element is an unknown function. The manipulation results in author… |
CVE-2025-12282 | Low | 2.4 | 2025-10-27 | A vulnerability was identified in code-projects Client Details System 1.0. The affected element is an unknown function of the file /admin/manage-users.php. The… |
CVE-2025-12281 | Low | 2.4 | 2025-10-27 | A vulnerability was determined in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/clientview.php. Executing manipul… |
CVE-2025-12280 | Low | 2.4 | 2025-10-27 | A vulnerability was found in code-projects Client Details System 1.0. This issue affects some unknown processing of the file /update-clients.php. Performing ma… |
CVE-2025-41384 | Medium | 6.1 | 2025-10-27 | Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP… |
CVE-2025-41068 | High | 7.5 | 2025-10-27 | Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. This is achieved b… |
CVE-2025-41067 | High | 7.5 | 2025-10-27 | Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request tha… |
CVE-2025-12279 | Low | 2.4 | 2025-10-27 | A vulnerability has been found in code-projects Client Details System 1.0. This vulnerability affects unknown code of the file /welcome.php. Such manipulation… |
CVE-2025-12277 | High | 7.3 | 2025-10-27 | A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of the file /studentL… |
CVE-2025-12276 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Affected by this issue is some unknown functionality of the componen… |
CVE-2025-12274 | High | 8.8 | 2025-10-27 | A security vulnerability has been detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListF… |
CVE-2025-12273 | High | 8.8 | 2025-10-27 | A weakness has been identified in Tenda CH22 1.0.0.1. Affected is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a m… |
CVE-2025-11248 | Low | 3.2 | 2025-10-27 | ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with acces… |
CVE-2025-41009 | | 2025-10-27 | SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the da… | |
CVE-2025-12272 | High | 8.8 | 2025-10-27 | A security flaw has been discovered in Tenda CH22 1.0.0.1. This impacts the function fromAddressNat of the file /goform/addressNat. Performing a manipulation o… |
CVE-2025-12271 | High | 8.8 | 2025-10-27 | A vulnerability was identified in Tenda CH22 1.0.0.1. This affects the function fromRouteStatic of the file /goform/RouteStatic. Such manipulation of the argum… |
CVE-2025-12270 | Medium | 4.3 | 2025-10-27 | A vulnerability was determined in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The impacted element is an unknown function of the file /api/v1/as… |
CVE-2025-12269 | Low | 3.5 | 2025-10-27 | A vulnerability was found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The affected element is an unknown function of the file /dash/org/setti… |
CVE-2025-12268 | Medium | 6.3 | 2025-10-27 | A vulnerability has been found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Impacted is an unknown function of the file /api/v1/courses/ of th… |
CVE-2025-11955 | | 2025-10-27 | Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN cl… | |
CVE-2025-59463 | Medium | 4.3 | 2025-10-27 | An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers. |
CVE-2025-59462 | Medium | 6.5 | 2025-10-27 | An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability. |
CVE-2025-59461 | High | 7.6 | 2025-10-27 | A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services. |
CVE-2025-59460 | High | 7.5 | 2025-10-27 | The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increas… |
CVE-2025-59459 | Medium | 5.5 | 2025-10-27 | An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability. |
CVE-2025-12267 | Medium | 4.3 | 2025-10-27 | A flaw has been found in abhicodebox ModernShop 20250922. This issue affects some unknown processing of the file /search. Executing manipulation of the argumen… |
CVE-2025-12266 | Medium | 6.3 | 2025-10-27 | A vulnerability was detected in Zytec Dalian Zhuoyun Technology Central Authentication Service up to 20251009. This vulnerability affects the function _empty o… |
CVE-2025-12265 | High | 8.8 | 2025-10-27 | A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation o… |
CVE-2025-12264 | Low | 3.5 | 2025-10-27 | A security flaw has been discovered in Wisencode up to 20251012. Affected by this vulnerability is an unknown functionality of the file /support-ticket/create… |
CVE-2025-12263 | Medium | 6.3 | 2025-10-27 | A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation… |
CVE-2025-12262 | Medium | 6.3 | 2025-10-27 | A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing man… |
CVE-2025-8432 | High | 8.4 | 2025-10-27 | Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on th… |
CVE-2025-46583 | Medium | 5.3 | 2025-10-27 | There is a Denial of Service（DoS）vulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the input parameters of the Short Message Servi… |
CVE-2025-12261 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performi… |