2025 CVEs (page 131)
Page 131 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12260 | High | 8.8 | 2025-10-27 | A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2025-12259 | High | 8.8 | 2025-10-27 | A flaw has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The affected element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2025-12258 | High | 8.8 | 2025-10-27 | A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. Impacted is the function setOpModeCfg of the file /cgi-bin/cstecgi.cg of the component… |
CVE-2025-12257 | High | 7.3 | 2025-10-27 | A security vulnerability has been detected in SourceCodester Online Student Result System 1.0. This issue affects some unknown processing of the file /view_res… |
CVE-2025-12256 | Medium | 6.3 | 2025-10-27 | A weakness has been identified in code-projects Online Event Judging System 1.0. This vulnerability affects unknown code of the file /edit_contestant.php. Exec… |
CVE-2025-46582 | High | 7.7 | 2025-10-27 | A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the device's communicat… |
CVE-2025-12255 | Medium | 6.3 | 2025-10-27 | A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown part of the file /add_contestant.php. Performing… |
CVE-2025-12254 | Medium | 6.3 | 2025-10-27 | A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected by this issue is some unknown functionality of the file /add_judge.ph… |
CVE-2025-12253 | High | 7.3 | 2025-10-27 | A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/porta… |
CVE-2025-12252 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /ajax/action.php. The manipulation of t… |
CVE-2025-12251 | Low | 3.5 | 2025-10-27 | A vulnerability has been found in OpenWGA 7.11.12 Build 737. This impacts an unknown function of the component Admin UI. The manipulation leads to cross site s… |
CVE-2025-12250 | Medium | 4.7 | 2025-10-27 | A flaw has been found in OpenWGA 7.11.12 Build 737. This affects an unknown function of the file WGA.File of the component TMLScript API. Executing manipulatio… |
CVE-2025-12080 | | 2025-10-27 | On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto… | |
CVE-2025-12249 | Medium | 6.3 | 2025-10-27 | A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Per… |
CVE-2025-12248 | High | 7.3 | 2025-10-27 | A security vulnerability has been detected in CLTPHP 3.0. The affected element is an unknown function of the file /home/search.html. Such manipulation of the a… |
CVE-2025-12247 | High | 7.0 | 2025-10-27 | A weakness has been identified in Hasleo Backup Suite up to 5.2. Impacted is an unknown function of the component HasleoImageMountService/HasleoBackupSuiteServ… |
CVE-2025-12246 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in chatwoot up to 4.7.0. This issue affects some unknown processing of the file app/javascript/shared/components/IframeLoad… |
CVE-2025-12245 | Medium | 5.3 | 2025-10-27 | A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFr… |
CVE-2025-12244 | Medium | 4.3 | 2025-10-27 | A vulnerability was determined in code-projects Simple E-Banking System 1.0. This affects an unknown part of the file /eBank/register.php. Executing manipulati… |
CVE-2025-11682 | | 2025-10-27 | Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to exe… | |
CVE-2025-12243 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.ph… |
CVE-2025-12242 | Medium | 6.3 | 2025-10-27 | A vulnerability has been found in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/actions/ch… |
CVE-2025-12241 | High | 8.8 | 2025-10-27 | A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This impacts the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the compon… |
CVE-2025-12240 | High | 8.8 | 2025-10-27 | A security vulnerability has been detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The… |
CVE-2025-12239 | High | 8.8 | 2025-10-27 | A weakness has been identified in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi. Exe… |
CVE-2025-12238 | Medium | 6.3 | 2025-10-27 | A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Perf… |
CVE-2025-12237 | High | 7.3 | 2025-10-27 | A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /index.php. Such manipulati… |
CVE-2025-12236 | High | 8.8 | 2025-10-27 | A vulnerability was determined in Tenda CH22 1.0.0.1. This issue affects the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation… |
CVE-2025-12235 | High | 8.0 | 2025-10-27 | A vulnerability was found in Tenda CH22 1.0.0.1. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the a… |
CVE-2025-12234 | High | 8.8 | 2025-10-27 | A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the ar… |
CVE-2025-12233 | High | 8.8 | 2025-10-27 | A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulati… |
CVE-2025-12232 | High | 8.8 | 2025-10-27 | A vulnerability was detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter. P… |
CVE-2025-12055 | High | 7.5 | 2025-10-27 | HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 w… |
CVE-2025-12231 | Low | 2.4 | 2025-10-27 | A security vulnerability has been detected in projectworlds Expense Management System 1.0. Affected is an unknown function of the file /public/admin/expense_ca… |
CVE-2025-12230 | Low | 2.4 | 2025-10-27 | A weakness has been identified in projectworlds Expense Management System 1.0. This impacts an unknown function of the file /public/admin/currencies/create of… |
CVE-2025-12229 | Low | 2.4 | 2025-10-27 | A security flaw has been discovered in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of… |
CVE-2025-12228 | Low | 2.4 | 2025-10-27 | A vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/crea… |
CVE-2025-12227 | Low | 3.5 | 2025-10-27 | A vulnerability was determined in projectworlds Gate Pass Management System 1.0. The affected element is an unknown function of the file /add-pass.php. Executi… |
CVE-2025-11154 | Medium | 5.4 | 2025-10-27 | The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers… |
CVE-2025-12226 | Medium | 4.7 | 2025-10-27 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0. Impacted is the function save_house of the file /admin_class.php. Performi… |
CVE-2025-12225 | High | 8.8 | 2025-10-27 | A vulnerability has been found in Tenda AC6 15.03.06.50. This issue affects some unknown processing of the file /goform/WifiGuestSet of the component HTTP Requ… |
CVE-2025-12224 | Low | 3.5 | 2025-10-27 | A flaw has been found in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This vulnerability affects unknown code of the file adm… |
CVE-2025-12223 | Medium | 6.3 | 2025-10-27 | A vulnerability was detected in Bdtask Flight Booking Software up to 3.1. This affects an unknown part of the file /b2c/package-information of the component Pa… |
CVE-2025-12222 | Medium | 6.3 | 2025-10-27 | A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. Affected by this issue is some unknown functionality of the file /admin… |
CVE-2025-12215 | High | 7.3 | 2025-10-27 | A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing a manipulation of t… |
CVE-2025-12214 | High | 8.8 | 2025-10-27 | A vulnerability was detected in Tenda O3 1.0.0.10(2478). This issue affects the function SetValue/GetValue of the file /goform/sysAutoReboot. Performing a mani… |
CVE-2025-12213 | High | 8.8 | 2025-10-27 | A security vulnerability has been detected in Tenda O3 1.0.0.10(2478). This vulnerability affects the function SetValue/GetValue of the file /goform/setVlanCon… |
CVE-2025-12212 | High | 8.8 | 2025-10-27 | A weakness has been identified in Tenda O3 1.0.0.10(2478). This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation… |
CVE-2025-12211 | High | 8.8 | 2025-10-27 | A security flaw has been discovered in Tenda O3 1.0.0.10(2478). Affected by this issue is the function SetValue/GetValue of the file /goform/setDmzInfo. The ma… |
CVE-2025-58918 | Medium | 4.3 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Waituk Entrada theme allows Cross Site Request Forgery.This issue affects Entrada: from n/a through 5.7.7. |
CVE-2025-48088 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builde… |
CVE-2025-12210 | High | 8.8 | 2025-10-27 | A vulnerability was identified in Tenda O3 1.0.0.10(2478). Affected by this vulnerability is the function SetValue/GetValue of the file /goform/AdvSetLanip. Th… |
CVE-2025-12209 | High | 8.8 | 2025-10-27 | A vulnerability was determined in Tenda O3 1.0.0.10(2478). Affected is the function SetValue/GetValue of the file /goform/setDhcpConfig. Executing a manipulati… |
CVE-2025-12208 | High | 7.3 | 2025-10-27 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0. This impacts the function login2 of the file /admin_class.php. Performing… |
CVE-2025-12207 | Low | 3.3 | 2025-10-27 | A vulnerability has been found in Kamailio 5.5. This affects the function yyerror_at of the file src/core/cfg.y of the component Grammar Rule Handler. Such man… |
CVE-2025-12206 | Low | 3.3 | 2025-10-27 | A flaw has been found in Kamailio 5.5. The impacted element is the function rve_is_constant of the file src/core/rvalue.c. This manipulation causes null pointe… |
CVE-2025-12205 | Medium | 5.3 | 2025-10-27 | A vulnerability was detected in Kamailio 5.5. The affected element is the function sr_push_yy_state of the file src/core/cfg.lex of the component Configuration… |
CVE-2025-12204 | Medium | 5.3 | 2025-10-27 | A security vulnerability has been detected in Kamailio 5.5. Impacted is the function rve_destroy of the file src/core/rvalue.c of the component Configuration F… |
CVE-2025-12203 | Medium | 6.3 | 2025-10-27 | A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the componen… |
CVE-2025-62988 | Medium | 4.9 | 2025-10-27 | Server-Side Request Forgery (SSRF) vulnerability in Codeless Slider Templates slider-templates allows Server Side Request Forgery.This issue affects Slider Tem… |
CVE-2025-62987 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Builderall Builderall Builder for WordPress builderall-ch… |
CVE-2025-62986 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in FanBridge FanBridge signup fanbridge-signup allows Stored XSS.This issue affects FanBridge signup: from n/a… |
CVE-2025-62985 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in llamaman Simple Pull Quote simple-pull-quote allows Store… |
CVE-2025-62984 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue… |
CVE-2025-62983 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sudar Muthu Posts By Tag posts-by-tag allows Stored XSS.T… |
CVE-2025-62982 | Medium | 5.9 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory… |
CVE-2025-62981 | Medium | 4.7 | 2025-10-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Phishing.This issue affects W… |
CVE-2025-62980 | Medium | 5.4 | 2025-10-27 | Missing Authorization vulnerability in MDZ Persian Admnin Fonts persian-admin-fonts allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-62979 | Medium | 5.3 | 2025-10-27 | Insertion of Sensitive Information Into Sent Data vulnerability in airesvsg ACF to REST API acf-to-rest-api allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2025-62978 | Medium | 4.3 | 2025-10-27 | Missing Authorization vulnerability in Kiotviet KiotViet Sync kiotvietsync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-62977 | Medium | 5.3 | 2025-10-27 | Missing Authorization vulnerability in 沃之涛 百度站长SEO合集(支持百度/神马/Bing/头条推送) baiduseo allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2025-62976 | Medium | 5.3 | 2025-10-27 | Missing Authorization vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Accessing Functionality Not Properly Constrained by ACLs.T… |
CVE-2025-62975 | Medium | 4.3 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in raychat Raychat raychat allows Cross Site Request Forgery.This issue affects Raychat: from n/a through <= 2… |
CVE-2025-62974 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoSchedule Headline Analyzer headline-analyzer allows Sto… |
CVE-2025-62973 | Medium | 5.3 | 2025-10-27 | Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Budd… |
CVE-2025-62972 | Medium | 4.3 | 2025-10-27 | Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-62971 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrestaProject Attesa Extra attesa-extra allows Stored XSS… |
CVE-2025-62970 | Medium | 5.3 | 2025-10-27 | Missing Authorization vulnerability in Spencer Haws Link Whisper Free link-whisper allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-62969 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite… |
CVE-2025-62968 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayan Datta WP Last Modified Info wp-last-modified-info a… |
CVE-2025-62967 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress directorypress allows DOM-Ba… |
CVE-2025-62966 | Medium | 5.4 | 2025-10-27 | Missing Authorization vulnerability in Apiki GoCache gocache-cdn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoC… |
CVE-2025-62965 | Medium | 5.5 | 2025-10-27 | Missing Authorization vulnerability in wpseek Admin Management Xtended admin-management-xtended allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-62964 | Medium | 5.3 | 2025-10-27 | Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-62963 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Estatik estatik allows DOM-Based XSS.This issue a… |
CVE-2025-62962 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Andrea Landonio CloudSearch cloud-search allows Stored XSS.This issue affects CloudSearch: from n/a through… |
CVE-2025-62959 | Critical | 9.1 | 2025-10-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Remote Code Inclusi… |
CVE-2025-62958 | Medium | 4.3 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Clifton Griffin Simple Content Templates for Blog Posts & Pages simple-post-template allows Cross Site Reque… |
CVE-2025-62957 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in NikanWP NikanWP WooCommerce Reporting wc-reports-lite allows Stored XSS.This issue affects NikanWP WooCommer… |
CVE-2025-62956 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in iseremet Reloadly reloadly-topup-widget allows Stored XSS.This issue affects Reloadly: from n/a through <= 2… |
CVE-2025-62954 | Medium | 4.3 | 2025-10-27 | Missing Authorization vulnerability in rsocial Revive Old Posts tweet-old-post allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-62953 | Medium | 4.3 | 2025-10-27 | Missing Authorization vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-62952 | Medium | 4.3 | 2025-10-27 | Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-62951 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icc0rz H5P h5p allows Stored XSS.This issue affects H5P… |
CVE-2025-62949 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activit… |
CVE-2025-62948 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Konstantin Pankratov Date counter date-counter allows Sto… |
CVE-2025-62947 | Medium | 5.0 | 2025-10-27 | Insertion of Sensitive Information Into Sent Data vulnerability in publitio Publitio publitio allows Retrieve Embedded Sensitive Data.This issue affects Publit… |
CVE-2025-62946 | Medium | 5.3 | 2025-10-27 | Missing Authorization vulnerability in everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-62945 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Eduard Pinuaga Linares Did Prestashop Display did-prestashop-display allows Stored XSS.This issue affects Di… |
CVE-2025-62944 | Medium | 5.3 | 2025-10-27 | Missing Authorization vulnerability in Mark O'Donnell MSTW CSV EXPORTER mstw-csv-exporter allows Exploiting Incorrectly Configured Access Control Security Leve… |