2025 CVEs (page 139)
Page 139 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62249 | Medium | 6.1 | 2025-10-21 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 thro… |
CVE-2025-61457 | Medium | 6.1 | 2025-10-21 | code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php. |
CVE-2025-61255 | Medium | 6.1 | 2025-10-21 | Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting (XSS) vulnerability via the /search parameter, where unsanitized input allows… |
CVE-2025-56802 | Medium | 5.1 | 2025-10-21 | The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access t… |
CVE-2025-56801 | Medium | 5.1 | 2025-10-21 | The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementation allowing atta… |
CVE-2025-56800 | Medium | 5.1 | 2025-10-21 | Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entir… |
CVE-2025-56799 | Medium | 6.5 | 2025-10-21 | Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name. NOTE: this… |
CVE-2025-8050 | Medium | 6.5 | 2025-10-21 | External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to access files hosted on… |
CVE-2025-60790 | Medium | 6.5 | 2025-10-21 | ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to… |
CVE-2025-60507 | High | 8.9 | 2025-10-21 | Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded J… |
CVE-2025-60427 | Medium | 6.5 | 2025-10-21 | LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI an… |
CVE-2025-12031 | Medium | 5.3 | 2025-10-21 | HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the javascript contextThis issue affects BL… |
CVE-2025-11757 | | 2025-10-21 | The CloudEdge Cloud does not sanitize the MQTT topic input, which could allow an attacker to leverage the MQTT wildcard to receive all the messages that should… | |
CVE-2025-62763 | Medium | 5.0 | 2025-10-21 | Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy. |
CVE-2025-62605 | Medium | 4.3 | 2025-10-21 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was… |
CVE-2025-62598 | Medium | 6.1 | 2025-10-21 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS)… |
CVE-2025-62597 | Medium | 6.1 | 2025-10-21 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS)… |
CVE-2025-62595 | Medium | 4.3 | 2025-10-21 | Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129… |
CVE-2025-62518 | High | 8.1 | 2025-10-21 | astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability… |
CVE-2025-60772 | Critical | 9.8 | 2025-10-21 | Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to escalate privileges… |
CVE-2025-60511 | Medium | 4.3 | 2025-10-21 | Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient validation of the… |
CVE-2025-60506 | Medium | 5.4 | 2025-10-21 | Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An attacker with a low-privileged account… |
CVE-2025-60500 | High | 7.2 | 2025-10-21 | QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media up… |
CVE-2025-11534 | | 2025-10-21 | The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could allow attackers to gain shell access with… | |
CVE-2025-62250 | Medium | 6.5 | 2025-10-21 | Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4… |
CVE-2025-61220 | High | 7.5 | 2025-10-21 | The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to… |
CVE-2025-61194 | Medium | 6.5 | 2025-10-21 | daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php. |
CVE-2025-61181 | Medium | 6.5 | 2025-10-21 | daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature. |
CVE-2025-60751 | High | 7.5 | 2025-10-21 | GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode. |
CVE-2025-60280 | Medium | 6.1 | 2025-10-21 | Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application's web pages. This… |
CVE-2025-22166 | High | 7.5 | 2025-10-21 | This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability… |
CVE-2025-60934 | Medium | 6.1 | 2025-10-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Performance Pro v3.19.17 allows attackers to… |
CVE-2025-60933 | Medium | 6.1 | 2025-10-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers t… |
CVE-2025-60932 | Medium | 6.1 | 2025-10-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Current Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers… |
CVE-2025-60344 | High | 8.6 | 2025-10-21 | A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used f… |
CVE-2025-59438 | Medium | 5.3 | 2025-10-21 | Mbed TLS through 3.6.4 has an Observable Timing Discrepancy. |
CVE-2025-57521 | Medium | 6.1 | 2025-10-21 | Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup. The application loads a netwo… |
CVE-2025-56450 | Medium | 6.5 | 2025-10-21 | Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the `lead_id` parameter in the `/l2s/api/selfcareLeadHistory` e… |
CVE-2025-9339 | | 2025-10-21 | SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potent… | |
CVE-2025-11625 | Critical | 9.8 | 2025-10-21 | Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials. |
CVE-2025-11624 | Critical | 9.8 | 2025-10-21 | Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger than the system handle or file descrip… |
CVE-2025-11151 | High | 8.2 | 2025-10-21 | Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beyaz B… |
CVE-2025-6239 | Medium | 6.5 | 2025-10-21 | Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor. |
CVE-2025-10020 | High | 8.5 | 2025-10-21 | Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component. |
CVE-2025-9428 | High | 8.3 | 2025-10-21 | Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api. |
CVE-2025-10641 | High | 7.1 | 2025-10-21 | All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the ne… |
CVE-2025-10640 | Critical | 9.8 | 2025-10-21 | An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login… |
CVE-2025-10639 | High | 8.8 | 2025-10-21 | The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network… |
CVE-2025-7473 | Medium | 5.2 | 2025-10-21 | Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection. |
CVE-2025-5496 | Low | 3.3 | 2025-10-21 | ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerabil… |
CVE-2025-10612 | Medium | 6.1 | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in giSoft Information Technologies City Guide allows… |
CVE-2025-26392 | Medium | 5.4 | 2025-10-21 | SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerabilit… |
CVE-2025-12004 | | 2025-10-21 | Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in… | |
CVE-2025-11949 | High | 7.5 | 2025-10-21 | EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain databas… |
CVE-2025-10916 | Critical | 9.1 | 2025-10-21 | The FormGent WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unaut… |
CVE-2025-62702 | | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Ex… | |
CVE-2025-62701 | | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories a… | |
CVE-2025-62694 | | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Exte… | |
CVE-2025-62699 | | 2025-10-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Trans… | |
CVE-2025-62696 | | 2025-10-21 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboar… | |
CVE-2025-62695 | | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Ex… | |
CVE-2025-9133 | High | 8.1 | 2025-10-21 | A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.4… |
CVE-2025-8078 | High | 7.2 | 2025-10-21 | A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4… |
CVE-2025-7851 | Critical | 9.8 | 2025-10-21 | An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways. |
CVE-2025-7850 | High | 7.2 | 2025-10-21 | A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways. |
CVE-2025-6542 | Critical | 9.8 | 2025-10-21 | An arbitrary OS command may be executed on the product by a remote unauthenticated attacker. |
CVE-2025-6541 | High | 8.8 | 2025-10-21 | An arbitrary OS command may be executed on the product by the user who can log in to the web management interface. |
CVE-2025-54764 | Medium | 6.2 | 2025-10-20 | Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd. |
CVE-2025-12001 | Medium | 6.1 | 2025-10-20 | Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-11536 | Medium | 5.0 | 2025-10-20 | The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 8.2.5 via t… |
CVE-2025-62658 | | 2025-10-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extensi… | |
CVE-2025-62657 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PageForms exten… | |
CVE-2025-62656 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki GlobalBlocking… | |
CVE-2025-61303 | Critical | 9.8 | 2025-10-20 | Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a vulnerability in its Windows behavioral analysis eng… |
CVE-2025-61301 | High | 7.5 | 2025-10-20 | Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows attackers who can submit samples to cause… |
CVE-2025-60783 | Medium | 6.5 | 2025-10-20 | There is a SQL injection vulnerability in Restaurant Management System DBMS Project v1.0 via login.php. The vulnerability allows attackers to manipulate the ap… |
CVE-2025-60781 | Medium | 6.1 | 2025-10-20 | PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) in the worksheet.php file via the participant_name parameter. |
CVE-2025-8053 | Critical | 9.1 | 2025-10-20 | Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulne… |
CVE-2025-8052 | High | 8.8 | 2025-10-20 | SQL Injection vulnerability in opentext Flipper allows SQL Injection. The vulnerability could allow a low privilege user to interact with the database in uni… |
CVE-2025-8051 | Medium | 6.5 | 2025-10-20 | Path Traversal vulnerability in opentext Flipper allows Absolute Path Traversal. The vulnerability could allow a user to access files hosted on the server. … |
CVE-2025-8049 | High | 8.8 | 2025-10-20 | Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulne… |
CVE-2025-8048 | Medium | 6.5 | 2025-10-20 | External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to submit a stored local fi… |
CVE-2025-62697 | | 2025-10-20 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The Wikimedia Foundation Mediawiki - Langua… | |
CVE-2025-62528 | Medium | 5.4 | 2025-10-20 | Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to… |
CVE-2025-62527 | High | 7.1 | 2025-10-20 | Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to requ… |
CVE-2025-62522 | | 2025-10-20 | Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4… | |
CVE-2025-61488 | High | 7.6 | 2025-10-20 | An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrap_image.php component and… |
CVE-2025-5517 | Medium | 6.8 | 2025-10-20 | Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (MID/ CE) -Terra AC MID, ABB Te… |
CVE-2025-62700 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - MultiBoilerpl… | |
CVE-2025-62698 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuida… | |
CVE-2025-62693 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - LastModified… | |
CVE-2025-62510 | High | 8.1 | 2025-10-20 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibilit… |
CVE-2025-62509 | High | 8.1 | 2025-10-20 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version 1.4.0, a business logic flaw in FileRi… |
CVE-2025-55086 | Critical | 9.8 | 2025-10-20 | In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the s… |
CVE-2025-47902 | High | 8.8 | 2025-10-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This is… |
CVE-2025-47901 | High | 8.8 | 2025-10-20 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Inje… |
CVE-2025-47900 | High | 8.8 | 2025-10-20 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Inje… |
CVE-2025-3465 | High | 7.1 | 2025-10-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB CoreSense™ M10.This issue affects CoreSe… |
CVE-2025-11979 | Medium | 5.3 | 2025-10-20 | An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under… |
CVE-2025-9574 | Critical | 10.0 | 2025-10-20 | Missing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects . All firmware versions with the Seri… |