2025 CVEs (page 134)
Page 134 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62897 | Medium | 5.3 | 2025-10-27 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Code Injection.Thi… |
CVE-2025-62896 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in digitaldonkey Multilang Contact Form multilang-contact-form allows Stored XSS.This issue affects Multilang C… |
CVE-2025-62895 | Medium | 5.3 | 2025-10-27 | Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This i… |
CVE-2025-62894 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magicoders ACF Recent Posts Widget acf-recent-posts-widge… |
CVE-2025-62892 | Medium | 5.3 | 2025-10-27 | Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Accessing Functionality Not Properly Constrained by ACL… |
CVE-2025-62891 | Medium | 4.3 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows Cross Site Request Forgery… |
CVE-2025-62890 | Medium | 4.3 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Brands for WooCommerce premmerce-woocommerce-brands allows Cross Site Request Forgery.Th… |
CVE-2025-62889 | Medium | 6.5 | 2025-10-27 | Missing Authorization vulnerability in KingAddons.com King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-62887 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KingAddons.com King Addons for Elementor king-addons allo… |
CVE-2025-62886 | High | 7.1 | 2025-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Pricing Table builder wpdevart-pricing-table allows Stored XSS.This issue affects Pricing Table bui… |
CVE-2025-62885 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affec… |
CVE-2025-62884 | Medium | 5.3 | 2025-10-27 | Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Accessing Functionality Not Properly Constrained by A… |
CVE-2025-62883 | Medium | 4.3 | 2025-10-27 | Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-62882 | Medium | 4.3 | 2025-10-27 | Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-62881 | Medium | 4.3 | 2025-10-27 | Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-12202 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects un… |
CVE-2025-12201 | Medium | 4.7 | 2025-10-27 | A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the fi… |
CVE-2025-6601 | Low | 2.7 | 2025-10-27 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have all… |
CVE-2025-11989 | Low | 3.7 | 2025-10-27 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowe… |
CVE-2025-11974 | Medium | 6.5 | 2025-10-27 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allow… |
CVE-2025-11971 | Medium | 6.5 | 2025-10-27 | GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed… |
CVE-2025-11447 | High | 7.5 | 2025-10-27 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allow… |
CVE-2025-10497 | High | 7.5 | 2025-10-27 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allo… |
CVE-2025-12285 | Critical | 9.8 | 2025-10-26 | Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12284 | Medium | 6.1 | 2025-10-26 | Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12278 | Medium | 6.5 | 2025-10-26 | Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12275 | Critical | 9.8 | 2025-10-26 | Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-8709 | High | 7.3 | 2025-10-26 | A SQL injection vulnerability exists in the langchain-ai/langchain repository, specifically in the LangGraph's SQLite store implementation. The affected versio… |
CVE-2025-55757 | Medium | 6.1 | 2025-10-25 | A unauthenticated reflected XSS vulnerability in VirtueMart 1.0.0-4.4.10 for Joomla was discovered. |
CVE-2025-12221 | High | 8.8 | 2025-10-25 | Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12220 | Critical | 9.8 | 2025-10-25 | Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12219 | Critical | 9.8 | 2025-10-25 | Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12218 | Critical | 9.1 | 2025-10-25 | Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12217 | Critical | 9.1 | 2025-10-25 | SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12216 | Medium | 5.5 | 2025-10-25 | Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-11897 | Medium | 6.4 | 2025-10-25 | The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7_fancy_title_css’ paramet… |
CVE-2025-9322 | High | 7.5 | 2025-10-25 | The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL Injection via the 'w… |
CVE-2025-8483 | Medium | 6.3 | 2025-10-25 | The The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.5… |
CVE-2025-8416 | High | 7.5 | 2025-10-25 | The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9… |
CVE-2025-4203 | High | 7.5 | 2025-10-25 | The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and includ… |
CVE-2025-12034 | Medium | 4.4 | 2025-10-25 | The Fast Velocity Minify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.5.1 due t… |
CVE-2025-11976 | Medium | 4.3 | 2025-10-25 | The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to… |
CVE-2025-11893 | Medium | 6.5 | 2025-10-25 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donati… |
CVE-2025-11875 | Medium | 6.4 | 2025-10-25 | The SpendeOnline.org plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spendeonline' shortcode in all versions up to, and inc… |
CVE-2025-11497 | Medium | 4.3 | 2025-10-25 | The Advanced Database Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6. This is due to miss… |
CVE-2025-11255 | Medium | 4.3 | 2025-10-25 | The Password Policy Manager | Password Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2025-10637 | Medium | 5.3 | 2025-10-25 | The Social Feed Gallery plugin for WordPress is vulnerable to Information Exposure in versions less than, or equal to, 4.9.2. This is due to the plugin not pro… |
CVE-2025-10580 | Medium | 6.4 | 2025-10-25 | The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple functions in… |
CVE-2025-10488 | High | 8.1 | 2025-10-25 | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficien… |
CVE-2025-8666 | Medium | 6.4 | 2025-10-25 | The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions less than, or equa… |
CVE-2025-8588 | Medium | 6.4 | 2025-10-25 | The Gutenberg Blocks – PublishPress Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Marker Title' and 'Marker Description' pa… |
CVE-2025-8413 | Medium | 6.4 | 2025-10-25 | The Listeo theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `soundcloud` shortcode in version less than, or equal to, 2.0.8 du… |
CVE-2025-6680 | Medium | 4.3 | 2025-10-25 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-6639 | Medium | 5.4 | 2025-10-25 | The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl… |
CVE-2025-12095 | High | 8.8 | 2025-10-25 | The Simple Registration for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.8. This is d… |
CVE-2025-12005 | Medium | 4.3 | 2025-10-25 | The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, a… |
CVE-2025-11888 | Low | 2.7 | 2025-10-25 | The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data du… |
CVE-2025-11879 | Medium | 6.5 | 2025-10-25 | The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_option_rest' function in all… |
CVE-2025-11564 | Medium | 5.3 | 2025-10-25 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2025-11269 | Medium | 5.3 | 2025-10-25 | The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'approveNotice' acti… |
CVE-2025-11244 | Low | 3.7 | 2025-10-25 | The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is… |
CVE-2025-11238 | High | 7.2 | 2025-10-25 | The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer header in versions less than, or equal to, 3.4.4 due to in… |
CVE-2025-10737 | Medium | 6.4 | 2025-10-25 | The Open Source Genesis Framework theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and includ… |
CVE-2025-10694 | Medium | 5.3 | 2025-10-25 | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to unauthorized access of data due… |
CVE-2025-11823 | Medium | 6.4 | 2025-10-25 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2025-10579 | Medium | 5.3 | 2025-10-25 | The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ba… |
CVE-2025-11760 | Medium | 5.3 | 2025-10-25 | The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all vers… |
CVE-2025-34503 | | 2025-10-24 | Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or ref… | |
CVE-2025-34502 | | 2025-10-24 | Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification… | |
CVE-2025-34500 | | 2025-10-24 | Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared ac… | |
CVE-2025-12194 | | 2025-10-24 | Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bou… | |
CVE-2025-62711 | Low | 3.1 | 2025-10-24 | Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasm… |
CVE-2025-4106 | | 2025-10-24 | An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a… | |
CVE-2025-34293 | | 2025-10-24 | GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requests to the API's o… | |
CVE-2025-62723 | Medium | 4.3 | 2025-10-24 | FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect… |
CVE-2025-62717 | Critical | 9.1 | 2025-10-24 | Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error… |
CVE-2025-60954 | High | 8.3 | 2025-10-24 | Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set… |
CVE-2025-62716 | High | 8.1 | 2025-10-24 | Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to… |
CVE-2025-60419 | Medium | 6.2 | 2025-10-24 | An issue was discovered in the NDIS Usermode IO driver (RtkIOAC60.sys, version 6.0.5600.16348) allowing local authenticated attackers to send a crafted IOCTL r… |
CVE-2025-60735 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function |
CVE-2025-60731 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function |
CVE-2025-60730 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function |
CVE-2025-60729 | Medium | 5.3 | 2025-10-24 | PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function |
CVE-2025-62714 | | 2025-10-24 | Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an au… | |
CVE-2025-60803 | Critical | 9.8 | 2025-10-24 | Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the component /api/aaa;/../… |
CVE-2025-60801 | High | 8.2 | 2025-10-24 | jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function. |
CVE-2025-60566 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetMACFilter. |
CVE-2025-60565 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSchedule. |
CVE-2025-60564 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetLog. |
CVE-2025-60563 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetPortTr. |
CVE-2025-60562 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formWlSiteSurvey. |
CVE-2025-60561 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEmail. |
CVE-2025-60559 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetDomainFilter. |
CVE-2025-60558 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formVirtualServ. |
CVE-2025-60557 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEasy_Wizard. |
CVE-2025-60556 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizard1. |
CVE-2025-60555 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizardSelectMode. |
CVE-2025-60554 | Critical | 9.8 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard. |
CVE-2025-60553 | Critical | 9.8 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard52. |
CVE-2025-60552 | High | 7.5 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formTcpipSetup. |