2025 CVEs (page 132)
Page 132 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-60424 | High | 7.6 | 2025-10-27 | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce att… |
CVE-2025-34133 | | 2025-10-27 | Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that c… | |
CVE-2025-12294 | Medium | 4.7 | 2025-10-27 | A security flaw has been discovered in SourceCodester Point of Sales 1.0. Impacted is an unknown function of the file /delete_category.php. Performing manipula… |
CVE-2025-12293 | High | 7.3 | 2025-10-27 | A vulnerability was identified in SourceCodester Point of Sales 1.0. This issue affects some unknown processing of the file /category.php. Such manipulation of… |
CVE-2025-12292 | High | 7.3 | 2025-10-27 | A vulnerability was determined in SourceCodester Point of Sales 1.0. This vulnerability affects unknown code of the file /index.php. This manipulation of the a… |
CVE-2025-12291 | Medium | 4.7 | 2025-10-27 | A vulnerability was found in ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System up to 1.1.0. This affects an unknown part of the file /admin/index.ph… |
CVE-2025-10023 | Medium | 6.2 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Services Meta-services… |
CVE-2025-61482 | High | 7.2 | 2025-10-27 | Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two… |
CVE-2025-52268 | High | 7.5 | 2025-10-27 | StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens. |
CVE-2025-52264 | High | 8.0 | 2025-10-27 | StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a stack overflow via the cgiMain function at download.cgi. |
CVE-2025-36121 | Medium | 5.4 | 2025-10-27 | IBM OpenPages 9.1 and 9.0 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be exec… |
CVE-2025-34292 | | 2025-10-27 | Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of untrusted data. User-controlled input is p… | |
CVE-2025-26862 | | 2025-10-27 | Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may… | |
CVE-2025-12351 | Medium | 6.8 | 2025-10-27 | Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerabili… |
CVE-2025-12290 | Medium | 4.3 | 2025-10-27 | A vulnerability has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this issue is some u… |
CVE-2025-12289 | Medium | 4.3 | 2025-10-27 | A flaw has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this vulnerability is an unkn… |
CVE-2025-12288 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4. Affected is an unknown function of the file /user/edit_user/ of the component User… |
CVE-2025-12287 | Medium | 4.7 | 2025-10-27 | A security vulnerability has been detected in Bdtask Wholesale Inventory Control and Inventory Management System up to 20251013. This impacts an unknown functi… |
CVE-2025-9164 | | 2025-10-27 | Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for required DLLs in the user's Downloads… | |
CVE-2025-61481 | Critical | 10.0 | 2025-10-27 | An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to… |
CVE-2025-60291 | Critical | 9.1 | 2025-10-27 | An issue was discovered in eTimeTrackLite Web thru 12.0 (20250704). There is a permission control flaw that allows unauthorized attackers to access specific ro… |
CVE-2025-52263 | High | 8.0 | 2025-10-27 | An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to upload crafted fir… |
CVE-2025-50055 | Medium | 6.4 | 2025-10-27 | Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML… |
CVE-2025-12286 | High | 7.0 | 2025-10-27 | A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files (x86)\VeePN\avservice\avservice.exe of the c… |
CVE-2025-12283 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in code-projects Client Details System 1.0. The impacted element is an unknown function. The manipulation results in author… |
CVE-2025-12282 | Low | 2.4 | 2025-10-27 | A vulnerability was identified in code-projects Client Details System 1.0. The affected element is an unknown function of the file /admin/manage-users.php. The… |
CVE-2025-12281 | Low | 2.4 | 2025-10-27 | A vulnerability was determined in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/clientview.php. Executing manipul… |
CVE-2025-12280 | Low | 2.4 | 2025-10-27 | A vulnerability was found in code-projects Client Details System 1.0. This issue affects some unknown processing of the file /update-clients.php. Performing ma… |
CVE-2025-41384 | Medium | 6.1 | 2025-10-27 | Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP… |
CVE-2025-41068 | High | 7.5 | 2025-10-27 | Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. This is achieved b… |
CVE-2025-41067 | High | 7.5 | 2025-10-27 | Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request tha… |
CVE-2025-12279 | Low | 2.4 | 2025-10-27 | A vulnerability has been found in code-projects Client Details System 1.0. This vulnerability affects unknown code of the file /welcome.php. Such manipulation… |
CVE-2025-12277 | High | 7.3 | 2025-10-27 | A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of the file /studentL… |
CVE-2025-12276 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Affected by this issue is some unknown functionality of the componen… |
CVE-2025-12274 | High | 8.8 | 2025-10-27 | A security vulnerability has been detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListF… |
CVE-2025-12273 | High | 8.8 | 2025-10-27 | A weakness has been identified in Tenda CH22 1.0.0.1. Affected is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a m… |
CVE-2025-11248 | Low | 3.2 | 2025-10-27 | ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with acces… |
CVE-2025-41009 | | 2025-10-27 | SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the da… | |
CVE-2025-12272 | High | 8.8 | 2025-10-27 | A security flaw has been discovered in Tenda CH22 1.0.0.1. This impacts the function fromAddressNat of the file /goform/addressNat. Performing a manipulation o… |
CVE-2025-12271 | High | 8.8 | 2025-10-27 | A vulnerability was identified in Tenda CH22 1.0.0.1. This affects the function fromRouteStatic of the file /goform/RouteStatic. Such manipulation of the argum… |
CVE-2025-12270 | Medium | 4.3 | 2025-10-27 | A vulnerability was determined in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The impacted element is an unknown function of the file /api/v1/as… |
CVE-2025-12269 | Low | 3.5 | 2025-10-27 | A vulnerability was found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The affected element is an unknown function of the file /dash/org/setti… |
CVE-2025-12268 | Medium | 6.3 | 2025-10-27 | A vulnerability has been found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Impacted is an unknown function of the file /api/v1/courses/ of th… |
CVE-2025-11955 | | 2025-10-27 | Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN cl… | |
CVE-2025-59463 | Medium | 4.3 | 2025-10-27 | An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers. |
CVE-2025-59462 | Medium | 6.5 | 2025-10-27 | An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability. |
CVE-2025-59461 | High | 7.6 | 2025-10-27 | A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services. |
CVE-2025-59460 | High | 7.5 | 2025-10-27 | The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increas… |
CVE-2025-59459 | Medium | 5.5 | 2025-10-27 | An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability. |
CVE-2025-12267 | Medium | 4.3 | 2025-10-27 | A flaw has been found in abhicodebox ModernShop 20250922. This issue affects some unknown processing of the file /search. Executing manipulation of the argumen… |
CVE-2025-12266 | Medium | 6.3 | 2025-10-27 | A vulnerability was detected in Zytec Dalian Zhuoyun Technology Central Authentication Service up to 20251009. This vulnerability affects the function _empty o… |
CVE-2025-12265 | High | 8.8 | 2025-10-27 | A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation o… |
CVE-2025-12264 | Low | 3.5 | 2025-10-27 | A security flaw has been discovered in Wisencode up to 20251012. Affected by this vulnerability is an unknown functionality of the file /support-ticket/create… |
CVE-2025-12263 | Medium | 6.3 | 2025-10-27 | A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation… |
CVE-2025-12262 | Medium | 6.3 | 2025-10-27 | A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing man… |
CVE-2025-8432 | High | 8.4 | 2025-10-27 | Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on th… |
CVE-2025-46583 | Medium | 5.3 | 2025-10-27 | There is a Denial of Service（DoS）vulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the input parameters of the Short Message Servi… |
CVE-2025-12261 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performi… |
CVE-2025-12260 | High | 8.8 | 2025-10-27 | A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2025-12259 | High | 8.8 | 2025-10-27 | A flaw has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The affected element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2025-12258 | High | 8.8 | 2025-10-27 | A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. Impacted is the function setOpModeCfg of the file /cgi-bin/cstecgi.cg of the component… |
CVE-2025-12257 | High | 7.3 | 2025-10-27 | A security vulnerability has been detected in SourceCodester Online Student Result System 1.0. This issue affects some unknown processing of the file /view_res… |
CVE-2025-12256 | Medium | 6.3 | 2025-10-27 | A weakness has been identified in code-projects Online Event Judging System 1.0. This vulnerability affects unknown code of the file /edit_contestant.php. Exec… |
CVE-2025-46582 | High | 7.7 | 2025-10-27 | A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the device's communicat… |
CVE-2025-12255 | Medium | 6.3 | 2025-10-27 | A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown part of the file /add_contestant.php. Performing… |
CVE-2025-12254 | Medium | 6.3 | 2025-10-27 | A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected by this issue is some unknown functionality of the file /add_judge.ph… |
CVE-2025-12253 | High | 7.3 | 2025-10-27 | A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/porta… |
CVE-2025-12252 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /ajax/action.php. The manipulation of t… |
CVE-2025-12251 | Low | 3.5 | 2025-10-27 | A vulnerability has been found in OpenWGA 7.11.12 Build 737. This impacts an unknown function of the component Admin UI. The manipulation leads to cross site s… |
CVE-2025-12250 | Medium | 4.7 | 2025-10-27 | A flaw has been found in OpenWGA 7.11.12 Build 737. This affects an unknown function of the file WGA.File of the component TMLScript API. Executing manipulatio… |
CVE-2025-12080 | | 2025-10-27 | On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto… | |
CVE-2025-12249 | Medium | 6.3 | 2025-10-27 | A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Per… |
CVE-2025-12248 | High | 7.3 | 2025-10-27 | A security vulnerability has been detected in CLTPHP 3.0. The affected element is an unknown function of the file /home/search.html. Such manipulation of the a… |
CVE-2025-12247 | High | 7.0 | 2025-10-27 | A weakness has been identified in Hasleo Backup Suite up to 5.2. Impacted is an unknown function of the component HasleoImageMountService/HasleoBackupSuiteServ… |
CVE-2025-12246 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in chatwoot up to 4.7.0. This issue affects some unknown processing of the file app/javascript/shared/components/IframeLoad… |
CVE-2025-12245 | Medium | 5.3 | 2025-10-27 | A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFr… |
CVE-2025-12244 | Medium | 4.3 | 2025-10-27 | A vulnerability was determined in code-projects Simple E-Banking System 1.0. This affects an unknown part of the file /eBank/register.php. Executing manipulati… |
CVE-2025-11682 | | 2025-10-27 | Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to exe… | |
CVE-2025-12243 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.ph… |
CVE-2025-12242 | Medium | 6.3 | 2025-10-27 | A vulnerability has been found in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/actions/ch… |
CVE-2025-12241 | High | 8.8 | 2025-10-27 | A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This impacts the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the compon… |
CVE-2025-12240 | High | 8.8 | 2025-10-27 | A security vulnerability has been detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The… |
CVE-2025-12239 | High | 8.8 | 2025-10-27 | A weakness has been identified in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi. Exe… |
CVE-2025-12238 | Medium | 6.3 | 2025-10-27 | A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Perf… |
CVE-2025-12237 | High | 7.3 | 2025-10-27 | A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /index.php. Such manipulati… |
CVE-2025-12236 | High | 8.8 | 2025-10-27 | A vulnerability was determined in Tenda CH22 1.0.0.1. This issue affects the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation… |
CVE-2025-12235 | High | 8.0 | 2025-10-27 | A vulnerability was found in Tenda CH22 1.0.0.1. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the a… |
CVE-2025-12234 | High | 8.8 | 2025-10-27 | A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the ar… |
CVE-2025-12233 | High | 8.8 | 2025-10-27 | A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulati… |
CVE-2025-12232 | High | 8.8 | 2025-10-27 | A vulnerability was detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter. P… |
CVE-2025-12055 | High | 7.5 | 2025-10-27 | HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 w… |
CVE-2025-12231 | Low | 2.4 | 2025-10-27 | A security vulnerability has been detected in projectworlds Expense Management System 1.0. Affected is an unknown function of the file /public/admin/expense_ca… |
CVE-2025-12230 | Low | 2.4 | 2025-10-27 | A weakness has been identified in projectworlds Expense Management System 1.0. This impacts an unknown function of the file /public/admin/currencies/create of… |
CVE-2025-12229 | Low | 2.4 | 2025-10-27 | A security flaw has been discovered in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of… |
CVE-2025-12228 | Low | 2.4 | 2025-10-27 | A vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/crea… |
CVE-2025-12227 | Low | 3.5 | 2025-10-27 | A vulnerability was determined in projectworlds Gate Pass Management System 1.0. The affected element is an unknown function of the file /add-pass.php. Executi… |
CVE-2025-11154 | Medium | 5.4 | 2025-10-27 | The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers… |
CVE-2025-12226 | Medium | 4.7 | 2025-10-27 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0. Impacted is the function save_house of the file /admin_class.php. Performi… |
CVE-2025-12225 | High | 8.8 | 2025-10-27 | A vulnerability has been found in Tenda AC6 15.03.06.50. This issue affects some unknown processing of the file /goform/WifiGuestSet of the component HTTP Requ… |
CVE-2025-12224 | Low | 3.5 | 2025-10-27 | A flaw has been found in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This vulnerability affects unknown code of the file adm… |