2025 CVEs (page 137)
Page 137 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-60338 | High | 7.5 | 2025-10-22 | Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the DhcpListClient function. This vulnerability allows attackers… |
CVE-2025-60335 | High | 7.5 | 2025-10-22 | A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTT… |
CVE-2025-60334 | High | 7.5 | 2025-10-22 | TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function. This vulnerability… |
CVE-2025-60333 | High | 7.5 | 2025-10-22 | TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig function. This vulnerab… |
CVE-2025-40780 | High | 8.6 | 2025-10-22 | In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source po… |
CVE-2025-40778 | High | 8.6 | 2025-10-22 | Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue aff… |
CVE-2025-23299 | Medium | 6.7 | 2025-10-22 | NVIDIA Bluefield and ConnectX contain a vulnerability in the management interface that could allow a malicious actor with high privilege access to execute arbi… |
CVE-2025-62606 | High | 8.8 | 2025-10-22 | my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to version 2.5.12, an authenticated SQL in… |
CVE-2025-62604 | High | 7.5 | 2025-10-22 | MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allo… |
CVE-2025-62526 | High | 7.9 | 2025-10-22 | OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registrati… |
CVE-2025-62525 | High | 7.9 | 2025-10-22 | OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory usin… |
CVE-2025-62073 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in Sovlix MeetingHub meetinghub.This issue affects MeetingHub: from n/a through <= 1.23.9. |
CVE-2025-62072 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through <= 3.2.33. |
CVE-2025-62071 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social… |
CVE-2025-62070 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in WPXPO WowRevenue revenue.This issue affects WowRevenue: from n/a through <= 1.2.13. |
CVE-2025-62069 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter.T… |
CVE-2025-62068 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a thro… |
CVE-2025-62063 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks.Thi… |
CVE-2025-62062 | Medium | 5.5 | 2025-10-22 | Insertion of Sensitive Information Into Sent Data vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Retrieve Embedded Sensitive Data… |
CVE-2025-62061 | Medium | 4.3 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in impleCode Product Catalog Simple post-type-x.This issue affects Product Catalog Simple: from n/a through <=… |
CVE-2025-62060 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Tab Ultimate tabs-pro.This issue affects Tab… |
CVE-2025-62058 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-func… |
CVE-2025-62054 | High | 7.5 | 2025-10-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez Theme - Functionalit… |
CVE-2025-62052 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in Horea Radu One Page Express Companion one-page-express-companion.This issue affects One Page Express Companion: from n/a… |
CVE-2025-62048 | Medium | 5.4 | 2025-10-22 | Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform SmartCrawl smartcrawl-seo.This issue affects SmartCrawl: from n/a through… |
CVE-2025-62042 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post.This issue affects Event… |
CVE-2025-62029 | High | 8.1 | 2025-10-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themesion Grevo grevo.This issue affec… |
CVE-2025-62027 | Medium | 5.4 | 2025-10-22 | Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through <= 5.26.3. |
CVE-2025-62026 | Medium | 4.3 | 2025-10-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Blockspare Blockspare blockspare allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2025-62025 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8. |
CVE-2025-62024 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar.This issue af… |
CVE-2025-62023 | Critical | 9.0 | 2025-10-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through 250… |
CVE-2025-62022 | High | 7.5 | 2025-10-22 | Missing Authorization vulnerability in BuddyPress BuddyPress buddypress.This issue affects BuddyPress: from n/a through <= 14.3.4. |
CVE-2025-62021 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in Made Neat Acknowledgify acknowledgify.This issue affects Acknowledgify: from n/a through <= 1.1.3. |
CVE-2025-62020 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak.This iss… |
CVE-2025-62019 | Medium | 6.5 | 2025-10-22 | Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects Recipe Card Blocks f… |
CVE-2025-62015 | High | 7.6 | 2025-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons ad… |
CVE-2025-62013 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in POSIMYTH UiChemy uichemy.This issue affects UiChemy: from n/a through <= 4.0.0. |
CVE-2025-62009 | Medium | 4.3 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Cross Site Re… |
CVE-2025-62008 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in acowebs Product Table For WooCommerce product-table-for-woocommerce.This issue affects Product Table For Woo… |
CVE-2025-62007 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in bPlugins Voice Feedback voice-feedback allows Privilege Escalation.This issue affects Voice Feedback: from n/a… |
CVE-2025-62006 | Medium | 5.4 | 2025-10-22 | Missing Authorization vulnerability in VeronaLabs WP SMS wp-sms.This issue affects WP SMS: from n/a through <= 7.0.1. |
CVE-2025-62005 | High | 7.1 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Cross Site Request Forgery.This iss… |
CVE-2025-60332 | High | 7.5 | 2025-10-22 | A NULL pointer dereference in the SetWLanRadioSettings function of D-Link DIR-823G A1 v1.0.2B05 allows attackers to cause a Denial of Service (DoS) via a craft… |
CVE-2025-60331 | High | 7.5 | 2025-10-22 | D-Link DIR-823G A1 v1.0.2B05 was discovered to contain a buffer overflow in the FillMacCloneMac parameter in the /EXCU_SHELL endpoint. This vulnerability allow… |
CVE-2025-60246 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weissmike Simple Finance Calculator simple-finance-calcul… |
CVE-2025-60238 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in universam UNIVERSAM universam-demo allows Object Injection.This issue affects UNIVERSAM: from n/a through <=… |
CVE-2025-60234 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in designthemes Single Property single-property allows Object Injection.This issue affects Single Property: fro… |
CVE-2025-60232 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Object Injection.This issue affects KBx Pro… |
CVE-2025-60228 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a throug… |
CVE-2025-60227 | High | 8.6 | 2025-10-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes wp-pipes allows Path Traversal.This issue af… |
CVE-2025-60226 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a throu… |
CVE-2025-60225 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in AncoraThemes BugsPatrol bugspatrol allows Object Injection.This issue affects BugsPatrol: from n/a through <… |
CVE-2025-60224 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Object Injection.This issue affects Subscribe t… |
CVE-2025-60222 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Privilege Escalation.This issue affect… |
CVE-2025-60221 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Object Injection.This issue affects Captivate Sync… |
CVE-2025-60220 | Critical | 9.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in pebas CouponXxL couponxxl allows Privilege Escalation.This issue affects CouponXxL: from n/a through <= 3.0.0. |
CVE-2025-60217 | High | 7.7 | 2025-10-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ypromo PT Luxa Addons pt-luxa-addons allows Path Traversal.This… |
CVE-2025-60216 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in BoldThemes Addison addison allows Object Injection.This issue affects Addison: from n/a through < 1.4.8. |
CVE-2025-60215 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in designthemes Kriya kriya allows Object Injection.This issue affects Kriya: from n/a through <= 3.4. |
CVE-2025-60214 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in BoldThemes Goldenblatt goldenblatt allows Object Injection.This issue affects Goldenblatt: from n/a through… |
CVE-2025-60213 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in Whitebox-Studio Scape scape allows Object Injection.This issue affects Scape: from n/a through <= 1.5.13. |
CVE-2025-60212 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in designthemes VEDA veda allows Object Injection.This issue affects VEDA: from n/a through <= 4.2. |
CVE-2025-60211 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Pr… |
CVE-2025-60210 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue… |
CVE-2025-60209 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Object Injectio… |
CVE-2025-60208 | High | 8.8 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Tusko Trush Advanced Custom Fields : CPT Options Pages acf-cpt-options-pages allows Object Injection.This is… |
CVE-2025-60206 | Critical | 10.0 | 2025-10-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a th… |
CVE-2025-60176 | Medium | 5.9 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tattersoftware WP Tesseract wp-tesseract allows Stored XS… |
CVE-2025-60168 | High | 7.1 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in integrationshotelrunner HotelRunner Booking Widget hotelrunner allows Stored XSS.This issue affects HotelRun… |
CVE-2025-60151 | Medium | 4.7 | 2025-10-22 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Phishing.This issue affects WP Gravit… |
CVE-2025-60135 | Medium | 5.9 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NIKITAS GEORGOPOULOS WeShare Buttons e-mailit allows Stor… |
CVE-2025-60134 | Medium | 4.3 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affec… |
CVE-2025-60132 | High | 7.1 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Stored XSS.This issue affects Video Blogster Lite: fr… |
CVE-2025-60131 | Medium | 5.9 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoefff Werk aan de Muur werk-aan-de-muur allows Stored XS… |
CVE-2025-60041 | High | 8.8 | 2025-10-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Iulia Cazan Emails Catch All emails-catch-all allows Password Recovery Exploitation.T… |
CVE-2025-60039 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0. |
CVE-2025-59593 | Medium | 5.9 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder a… |
CVE-2025-59580 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in GoodLayers Goodlayers Core goodlayers-core allows Privilege Escalation.This issue affects Goodlayers Core: from… |
CVE-2025-59579 | High | 7.5 | 2025-10-22 | Insertion of Sensitive Information Into Sent Data vulnerability in PressTigers Simple Job Board simple-job-board allows Retrieve Embedded Sensitive Data.This i… |
CVE-2025-59578 | Medium | 5.8 | 2025-10-22 | Insertion of Sensitive Information Into Sent Data vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issu… |
CVE-2025-59575 | Medium | 4.9 | 2025-10-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system… |
CVE-2025-59571 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected… |
CVE-2025-59566 | High | 7.7 | 2025-10-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows Path Trave… |
CVE-2025-59564 | High | 8.1 | 2025-10-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP L… |
CVE-2025-59558 | High | 8.1 | 2025-10-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Loc… |
CVE-2025-59557 | Critical | 9.3 | 2025-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Learts Addons learts-addons allows SQL Injectio… |
CVE-2025-59555 | High | 8.1 | 2025-10-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Medizin medizin allows PHP L… |
CVE-2025-59550 | High | 8.1 | 2025-10-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Xcare xcare allows PHP Lo… |
CVE-2025-59007 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in themesflat TF Woo Product Grid Addon For Elementor tf-woo-product-grid allows Object Injection.This issue af… |
CVE-2025-59006 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Easy Woocommerce Customizer easy-woocommerce-cus… |
CVE-2025-59004 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pco_58 WC Return products wc-return-product allows Reflec… |
CVE-2025-58971 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AmentoTech Doctreat doctreat allows Reflected XSS.This is… |
CVE-2025-58970 | Medium | 6.3 | 2025-10-22 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue af… |
CVE-2025-58967 | High | 8.1 | 2025-10-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Businext businext allows PHP… |
CVE-2025-58966 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms LITE nex-forms-lite allows Reflected XSS… |
CVE-2025-58963 | Critical | 10.0 | 2025-10-22 | Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity allows Upload a Web Shell to a Web Server.This issue affects Medcity: f… |
CVE-2025-58961 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav CF7 Auto Responder Addon CF7-autoresponder-a… |
CVE-2025-58959 | High | 7.7 | 2025-10-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Taskbot taskbot allows Path Traversal.This issue aff… |
CVE-2025-58958 | High | 8.1 | 2025-10-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove SmilePure smilepure allows P… |