2025 CVEs (page 133)
Page 133 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11564 | Medium | 5.3 | 2025-10-25 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2025-11269 | Medium | 5.3 | 2025-10-25 | The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'approveNotice' acti… |
CVE-2025-11244 | Low | 3.7 | 2025-10-25 | The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is… |
CVE-2025-11238 | High | 7.2 | 2025-10-25 | The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer header in versions less than, or equal to, 3.4.4 due to in… |
CVE-2025-10737 | Medium | 6.4 | 2025-10-25 | The Open Source Genesis Framework theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and includ… |
CVE-2025-10694 | Medium | 5.3 | 2025-10-25 | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to unauthorized access of data due… |
CVE-2025-11823 | Medium | 6.4 | 2025-10-25 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2025-10579 | Medium | 5.3 | 2025-10-25 | The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ba… |
CVE-2025-11760 | Medium | 5.3 | 2025-10-25 | The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all vers… |
CVE-2025-34503 | | 2025-10-24 | Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or ref… | |
CVE-2025-34502 | | 2025-10-24 | Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification… | |
CVE-2025-34500 | | 2025-10-24 | Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared ac… | |
CVE-2025-12194 | | 2025-10-24 | Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bou… | |
CVE-2025-62711 | Low | 3.1 | 2025-10-24 | Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasm… |
CVE-2025-4106 | | 2025-10-24 | An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a… | |
CVE-2025-34293 | | 2025-10-24 | GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requests to the API's o… | |
CVE-2025-62723 | Medium | 4.3 | 2025-10-24 | FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect… |
CVE-2025-62717 | Critical | 9.1 | 2025-10-24 | Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error… |
CVE-2025-60954 | High | 8.3 | 2025-10-24 | Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set… |
CVE-2025-62716 | High | 8.1 | 2025-10-24 | Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to… |
CVE-2025-60419 | Medium | 6.2 | 2025-10-24 | An issue was discovered in the NDIS Usermode IO driver (RtkIOAC60.sys, version 6.0.5600.16348) allowing local authenticated attackers to send a crafted IOCTL r… |
CVE-2025-60735 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function |
CVE-2025-60731 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function |
CVE-2025-60730 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function |
CVE-2025-60729 | Medium | 5.3 | 2025-10-24 | PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function |
CVE-2025-62714 | | 2025-10-24 | Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an au… | |
CVE-2025-60803 | Critical | 9.8 | 2025-10-24 | Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the component /api/aaa;/../… |
CVE-2025-60801 | High | 8.2 | 2025-10-24 | jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function. |
CVE-2025-60566 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetMACFilter. |
CVE-2025-60565 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSchedule. |
CVE-2025-60564 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetLog. |
CVE-2025-60563 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetPortTr. |
CVE-2025-60562 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formWlSiteSurvey. |
CVE-2025-60561 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEmail. |
CVE-2025-60559 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetDomainFilter. |
CVE-2025-60558 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formVirtualServ. |
CVE-2025-60557 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEasy_Wizard. |
CVE-2025-60556 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizard1. |
CVE-2025-60555 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizardSelectMode. |
CVE-2025-60554 | Critical | 9.8 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard. |
CVE-2025-60553 | Critical | 9.8 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard52. |
CVE-2025-60552 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formTcpipSetup. |
CVE-2025-60551 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the next_page parameter in the function formDeviceReboot. |
CVE-2025-60550 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formEasySetTimezone. |
CVE-2025-60549 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAutoDetecWAN_wizard4. |
CVE-2025-60548 | Critical | 9.8 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLanSetupRouterSettings. |
CVE-2025-60547 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard7. |
CVE-2025-12176 | Critical | 9.8 | 2025-10-24 | Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BL… |
CVE-2025-8536 | | 2025-10-24 | A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Inj… | |
CVE-2025-61430 | Medium | 6.5 | 2025-10-24 | Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying access to the DNS server to cause the server to return request p… |
CVE-2025-60938 | High | 7.5 | 2025-10-24 | Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the ta… |
CVE-2025-60936 | Medium | 6.1 | 2025-10-24 | Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism. This vulnerability allows authenticated attackers with API access to inject malicio… |
CVE-2025-60572 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvNetwork. |
CVE-2025-60571 | High | 7.5 | 2025-10-24 | D-Link DIR600LAx FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetQoS. |
CVE-2025-60570 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLogDnsquery. |
CVE-2025-60569 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetRoute. |
CVE-2025-60568 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvFirewall. |
CVE-2025-56438 | Medium | 6.8 | 2025-10-24 | An issue in the firmware update mechanism of Nous W3 Smart WiFi Camera v1.33.50.82 allows unauthenticated and physically proximate attackers to escalate privil… |
CVE-2025-43995 | Critical | 9.8 | 2025-10-24 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote ac… |
CVE-2025-43994 | High | 8.6 | 2025-10-24 | Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated… |
CVE-2025-11145 | High | 7.5 | 2025-10-24 | Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerabi… |
CVE-2025-46425 | Medium | 6.5 | 2025-10-24 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privil… |
CVE-2025-46185 | Medium | 6.2 | 2025-10-24 | An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext storage of passwords and… |
CVE-2025-46183 | High | 8.2 | 2025-10-24 | The Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted sources. If an attacker provides a specially crafted .ser file… |
CVE-2025-40024 | High | 7.8 | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhost_task. vhost_task_create() creates a t… |
CVE-2025-40023 | | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMG_PCIE_C… | |
CVE-2025-40022 | | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto… | |
CVE-2025-40021 | | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: tracing: dynevent: Add a missing lockdown check on dynevent Since dynamic_events interfac… | |
CVE-2025-40020 | | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the n… | |
CVE-2025-11576 | Medium | 4.3 | 2025-10-24 | The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versions up to, and incl… |
CVE-2025-40019 | | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check t… | |
CVE-2025-40018 | High | 7.8 | 2025-10-24 | In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_… |
CVE-2025-10861 | High | 7.5 | 2025-10-24 | The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Reques… |
CVE-2025-5605 | Medium | 4.3 | 2025-10-24 | An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate… |
CVE-2025-5350 | Medium | 5.9 | 2025-10-24 | SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users… |
CVE-2025-36361 | Medium | 6.3 | 2025-10-24 | IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user to perform unauthorized actions on cust… |
CVE-2025-12136 | Medium | 6.8 | 2025-10-24 | The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2025-12134 | Medium | 5.3 | 2025-10-24 | The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized m… |
CVE-2025-10680 | High | 8.8 | 2025-10-24 | OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown… |
CVE-2025-12096 | Medium | 6.4 | 2025-10-24 | The Simple Excel Pricelist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pricelist' shortcode in all versions up t… |
CVE-2025-12072 | Medium | 4.3 | 2025-10-24 | The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. Th… |
CVE-2025-12028 | High | 8.8 | 2025-10-24 | The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verifi… |
CVE-2025-12017 | Medium | 6.1 | 2025-10-24 | The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including… |
CVE-2025-12016 | Medium | 4.4 | 2025-10-24 | The qnotsquiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qnotsquiz_custom_start_text' parameter in all versions up to, and incl… |
CVE-2025-12014 | Medium | 4.3 | 2025-10-24 | The NGINX Cache Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nginxcacheoptimizer… |
CVE-2025-11992 | Medium | 6.1 | 2025-10-24 | The Multi Item Responsive Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to mis… |
CVE-2025-11889 | High | 7.2 | 2025-10-24 | The AIO Forms – Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import funct… |
CVE-2025-11887 | Medium | 4.3 | 2025-10-24 | The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in all versi… |
CVE-2025-11504 | High | 7.5 | 2025-10-24 | The Quickcreator – AI Blog Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 0.0.9 to 0.1.17 through the /wp-content/plug… |
CVE-2025-11257 | Medium | 4.3 | 2025-10-24 | The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_save_blog… |
CVE-2025-11253 | Critical | 9.8 | 2025-10-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection. Th… |
CVE-2025-11172 | Medium | 4.3 | 2025-10-24 | The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the chk_plag_mine_plugin_wpse… |
CVE-2025-10902 | Medium | 4.3 | 2025-10-24 | The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove'… |
CVE-2025-10901 | Medium | 4.3 | 2025-10-24 | The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ai_get_table' functio… |
CVE-2025-10749 | Medium | 5.4 | 2025-10-24 | The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5… |
CVE-2025-10748 | Medium | 6.5 | 2025-10-24 | The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficien… |
CVE-2025-10740 | Medium | 6.3 | 2025-10-24 | The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to unauthorized access to functionality provided by the API due to a missing capabili… |
CVE-2025-10701 | Medium | 6.4 | 2025-10-24 | The Time Clock – A WordPress Employee & Volunteer Time Clock Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all… |
CVE-2025-6440 | Critical | 9.8 | 2025-10-24 | The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file upl… |
CVE-2025-62868 | High | 8.1 | 2025-10-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT allows PHP Local… |