2025 CVEs (page 131)
Page 131 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12347 | Medium | 6.3 | 2025-10-28 | A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/editor_files/save-file… |
CVE-2025-12346 | Medium | 6.3 | 2025-10-28 | A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-… |
CVE-2025-12344 | Medium | 6.3 | 2025-10-28 | A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the com… |
CVE-2025-12342 | High | 7.3 | 2025-10-28 | A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014. The affected element is an unknown function of the file /Auth.php of the component Login… |
CVE-2025-12341 | High | 7.8 | 2025-10-28 | A vulnerability was detected in ermig1979 AntiDupl up to 2.3.12. Impacted is an unknown function of the file AntiDupl.NET.WinForms.exe of the component Delete… |
CVE-2025-12339 | High | 7.3 | 2025-10-28 | A security vulnerability has been detected in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file /admin/… |
CVE-2025-12338 | High | 7.3 | 2025-10-28 | A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file /admin/admin_product.p… |
CVE-2025-12337 | High | 7.3 | 2025-10-28 | A security flaw has been discovered in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file /admin/admin_feature.php. Pe… |
CVE-2025-12336 | High | 7.3 | 2025-10-28 | A vulnerability was identified in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/ad… |
CVE-2025-43024 | High | 7.5 | 2025-10-28 | A GUI dialog of an application allows to view what files are in the file system without proper authorization. |
CVE-2025-33133 | Medium | 6.5 | 2025-10-28 | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to cr… |
CVE-2025-33132 | Medium | 6.5 | 2025-10-28 | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to cr… |
CVE-2025-33131 | Medium | 6.5 | 2025-10-28 | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to cr… |
CVE-2025-33126 | Medium | 6.5 | 2025-10-28 | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1… |
CVE-2025-12335 | Medium | 4.3 | 2025-10-28 | A vulnerability was determined in code-projects E-Commerce Website 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/supplier_… |
CVE-2025-12332 | Low | 2.4 | 2025-10-28 | A flaw has been found in SourceCodester Student Grades Management System 1.0. This affects the function delete_user of the file /admin.php. Executing manipulat… |
CVE-2025-62259 | Medium | 5.4 | 2025-10-27 | Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through u… |
CVE-2025-62258 | Medium | 6.5 | 2025-10-27 | CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA thr… |
CVE-2025-12334 | Medium | 4.3 | 2025-10-27 | A vulnerability was found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/product_add.php. The manipulation of the… |
CVE-2025-12333 | Medium | 4.3 | 2025-10-27 | A vulnerability has been found in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/supplier_add.php. The manipulation… |
CVE-2025-62793 | Medium | 6.8 | 2025-10-27 | eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an… |
CVE-2025-62781 | Medium | 5.0 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password whi… |
CVE-2025-62779 | Medium | 5.4 | 2025-10-27 | Frappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML through input… |
CVE-2025-62778 | Medium | 5.3 | 2025-10-27 | Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the… |
CVE-2025-62261 | Medium | 6.5 | 2025-10-27 | Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through up… |
CVE-2025-62260 | High | 7.5 | 2025-10-27 | Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported v… |
CVE-2025-12331 | Medium | 4.7 | 2025-10-27 | A weakness has been identified in Willow CMS up to 1.4.0. Impacted is an unknown function of the file /admin/images/add. This manipulation causes unrestricted… |
CVE-2025-12330 | Low | 2.4 | 2025-10-27 | A security flaw has been discovered in Willow CMS up to 1.4.0. This issue affects some unknown processing of the file /admin/articles/add of the component Add… |
CVE-2025-12329 | Medium | 6.3 | 2025-10-27 | A security flaw has been discovered in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The affected element is an unknown function of the fil… |
CVE-2025-12328 | Medium | 6.3 | 2025-10-27 | A vulnerability was identified in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. Impacted is an unknown function of the file /contestproblem… |
CVE-2025-62784 | Medium | 5.3 | 2025-10-27 | InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions before 1.6.5 contain a vulnerability where any plugin using a GUI with th… |
CVE-2025-62783 | Medium | 5.0 | 2025-10-27 | InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.1-SNAPSHOT and earlier contain a vulnerability where any plugin using… |
CVE-2025-62782 | Medium | 5.3 | 2025-10-27 | InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.3-SNAPSHOT and earlier contain a vulnerability where GUIs using GuiSt… |
CVE-2025-62725 | | 2025-10-27 | Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.do… | |
CVE-2025-62524 | Medium | 5.3 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header… |
CVE-2025-62523 | Medium | 6.3 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misco… |
CVE-2025-62262 | Medium | 4.4 | 2025-10-27 | Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Lifera… |
CVE-2025-12327 | Medium | 6.3 | 2025-10-27 | A vulnerability was determined in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This issue affects some unknown processing of the file /des… |
CVE-2025-12326 | High | 7.3 | 2025-10-27 | A vulnerability was found in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This vulnerability affects unknown code of the file /process.php… |
CVE-2025-12325 | High | 7.3 | 2025-10-27 | A vulnerability has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/forgot-password.php. The man… |
CVE-2025-12322 | High | 8.8 | 2025-10-27 | A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromNatStaticSetting of the file /goform/NatStaticSetting. Executing a mani… |
CVE-2025-12316 | High | 7.3 | 2025-10-27 | A vulnerability was identified in code-projects Courier Management System 1.0. This impacts an unknown function of the file /courier/edit-courier.php. The mani… |
CVE-2025-62594 | Medium | 4.7 | 2025-10-27 | ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service d… |
CVE-2025-62263 | Medium | 5.4 | 2025-10-27 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through upda… |
CVE-2025-61105 | High | 7.5 | 2025-10-27 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_link_info function at ospf_ext.c. This vulnerabil… |
CVE-2025-61102 | High | 7.5 | 2025-10-27 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_adj_sid function at ospf_ext.c. This vul… |
CVE-2025-61101 | High | 7.5 | 2025-10-27 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_rmt_itf_addr function at ospf_ext.c. Thi… |
CVE-2025-59151 | High | 8.2 | 2025-10-27 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interfa… |
CVE-2025-58356 | | 2025-10-27 | Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted… | |
CVE-2025-12315 | Medium | 4.7 | 2025-10-27 | A vulnerability was determined in code-projects Food Ordering System 1.0. This affects an unknown function of the file /admin/menu.php. Executing a manipulatio… |
CVE-2025-12314 | Medium | 4.7 | 2025-10-27 | A vulnerability was found in code-projects Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/deleteitem.php. Performing… |
CVE-2025-12313 | Medium | 6.3 | 2025-10-27 | A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipu… |
CVE-2025-12312 | Low | 2.4 | 2025-10-27 | A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. Impacted is an unknown function of the file view-pass-detail.php. This manipulation of… |
CVE-2025-12311 | Low | 2.4 | 2025-10-27 | A vulnerability was detected in PHPGurukul Curfew e-Pass Management System 1.0. This issue affects some unknown processing of the file edit-category-detail.php… |
CVE-2025-12310 | Medium | 5.3 | 2025-10-27 | A security vulnerability has been detected in VirtFusion up to 6.0.2. This vulnerability affects unknown code of the file /account/_settings of the component E… |
CVE-2025-62253 | Medium | 6.1 | 2025-10-27 | Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3… |
CVE-2025-61100 | High | 7.5 | 2025-10-27 | FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the ospf_opaque_lsa_dump function at ospf_opaque.c. This vulne… |
CVE-2025-61099 | High | 7.5 | 2025-10-27 | FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the opaque_info_detail function at ospf_opaque.c. This vulnera… |
CVE-2025-53533 | Medium | 6.1 | 2025-10-27 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interfa… |
CVE-2025-46602 | Medium | 4.4 | 2025-10-27 | Dell SupportAssist OS Recovery, versions prior to 5.5.15.0, contain an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerab… |
CVE-2025-36170 | Medium | 6.4 | 2025-10-27 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated us… |
CVE-2025-36138 | Medium | 6.4 | 2025-10-27 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated us… |
CVE-2025-36007 | High | 7.8 | 2025-10-27 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to privilege escalation due to improper privilege assignment to an update scr… |
CVE-2025-32785 | Medium | 5.4 | 2025-10-27 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interfa… |
CVE-2025-12365 | Medium | 5.3 | 2025-10-27 | Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12309 | High | 7.3 | 2025-10-27 | A weakness has been identified in code-projects Nero Social Networking Site 1.0. This affects an unknown part of the file /friendprofile.php. Executing manipul… |
CVE-2025-12308 | High | 7.3 | 2025-10-27 | A security flaw has been discovered in code-projects Nero Social Networking Site 1.0. Affected by this issue is some unknown functionality of the file /deletem… |
CVE-2025-12307 | High | 7.3 | 2025-10-27 | A vulnerability was identified in code-projects Nero Social Networking Site 1.0. Affected by this vulnerability is an unknown functionality of the file /addfri… |
CVE-2025-12306 | High | 7.3 | 2025-10-27 | A vulnerability was determined in code-projects Nero Social Networking Site 1.0. Affected is an unknown function of the file /acceptoffres.php. This manipulati… |
CVE-2025-12305 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in quequnlong shiyi-blog up to 1.2.1. This impacts an unknown function of the file src/main/java/com/mojian/controller/SysJobControll… |
CVE-2025-12304 | Medium | 4.3 | 2025-10-27 | A vulnerability has been found in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b. This affects the function alipayIsSucceed of the… |
CVE-2025-61795 | Medium | 5.3 | 2025-10-27 | Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart u… |
CVE-2025-61385 | Critical | 9.6 | 2025-10-27 | SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to func… |
CVE-2025-60983 | Medium | 5.4 | 2025-10-27 | Reflected Cross Site Scripting vulnerability in Rubikon Banking Solution 4.0.3 in the "Search For Customers Information" endpoints. |
CVE-2025-60982 | Medium | 5.4 | 2025-10-27 | IDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data via manipulated object references. Affected endpoints do not en… |
CVE-2025-55754 | Critical | 9.6 | 2025-10-27 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If… |
CVE-2025-55752 | High | 7.5 | 2025-10-27 | Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it w… |
CVE-2025-54965 | Medium | 6.1 | 2025-10-27 | An XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not properly sanitize the job ID parameter before using it i… |
CVE-2025-12364 | Critical | 9.8 | 2025-10-27 | Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12363 | High | 7.5 | 2025-10-27 | Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12303 | Low | 2.4 | 2025-10-27 | A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. The impacted element is an unknown function of the file admin-profile.php. Executing a… |
CVE-2025-12302 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in code-projects Simple Food Ordering System 1.0. The affected element is an unknown function of the file /editproduct.php. Perfor… |
CVE-2025-12301 | High | 7.3 | 2025-10-27 | A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /editproduct.php. Such… |
CVE-2025-12300 | Medium | 4.3 | 2025-10-27 | A weakness has been identified in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addcategory.php. This… |
CVE-2025-54970 | Medium | 6.5 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service fails to authenticate requests. In some configurations, this may allo… |
CVE-2025-54969 | Medium | 6.1 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not implement CSRF protections. An attacker who social engineers… |
CVE-2025-54968 | High | 8.8 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Service does not require authentication. In some configurations, this may allow remo… |
CVE-2025-54967 | Medium | 6.5 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able to social engineer a… |
CVE-2025-27225 | High | 7.5 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint disclo… |
CVE-2025-27224 | Critical | 9.8 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the inp… |
CVE-2025-27223 | High | 7.5 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList… |
CVE-2025-27222 | High | 8.6 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitiz… |
CVE-2025-12299 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /addproduct.php. The… |
CVE-2025-12298 | Medium | 4.3 | 2025-10-27 | A vulnerability was identified in code-projects Simple Food Ordering System 1.0. This affects an unknown part of the file /editcategory.php. The manipulation o… |
CVE-2025-12297 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in infor… |
CVE-2025-12296 | Medium | 4.7 | 2025-10-27 | A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub_4174B0 of the component Firmware Update Handle… |
CVE-2025-12295 | Medium | 6.6 | 2025-10-27 | A weakness has been identified in D-Link DAP-2695 2.00RC13. The affected element is the function sub_40C6B8 of the component Firmware Update Handler. Executing… |
CVE-2025-61247 | High | 8.2 | 2025-10-27 | indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php. |
CVE-2025-60791 | Medium | 6.2 | 2025-10-27 | Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in… |
CVE-2025-60425 | High | 8.6 | 2025-10-27 | Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attac… |