2025 CVEs (page 141)
Page 141 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6239 | Medium | 6.5 | 2025-10-21 | Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor. |
CVE-2025-10020 | High | 8.5 | 2025-10-21 | Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component. |
CVE-2025-9428 | High | 8.3 | 2025-10-21 | Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api. |
CVE-2025-10641 | High | 7.1 | 2025-10-21 | All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the ne… |
CVE-2025-10640 | Critical | 9.8 | 2025-10-21 | An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login… |
CVE-2025-10639 | High | 8.8 | 2025-10-21 | The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network… |
CVE-2025-7473 | Medium | 5.2 | 2025-10-21 | Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection. |
CVE-2025-5496 | Low | 3.3 | 2025-10-21 | ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerabil… |
CVE-2025-10612 | Medium | 6.1 | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in giSoft Information Technologies City Guide allows… |
CVE-2025-26392 | Medium | 5.4 | 2025-10-21 | SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerabilit… |
CVE-2025-12004 | | 2025-10-21 | Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in… | |
CVE-2025-11949 | High | 7.5 | 2025-10-21 | EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain databas… |
CVE-2025-10916 | Critical | 9.1 | 2025-10-21 | The FormGent WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unaut… |
CVE-2025-62702 | | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Ex… | |
CVE-2025-62701 | | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories a… | |
CVE-2025-62694 | | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Exte… | |
CVE-2025-62699 | | 2025-10-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Trans… | |
CVE-2025-62696 | | 2025-10-21 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboar… | |
CVE-2025-62695 | | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Ex… | |
CVE-2025-9133 | High | 8.1 | 2025-10-21 | A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.4… |
CVE-2025-8078 | High | 7.2 | 2025-10-21 | A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4… |
CVE-2025-7851 | Critical | 9.8 | 2025-10-21 | An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways. |
CVE-2025-7850 | High | 7.2 | 2025-10-21 | A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways. |
CVE-2025-6542 | Critical | 9.8 | 2025-10-21 | An arbitrary OS command may be executed on the product by a remote unauthenticated attacker. |
CVE-2025-6541 | High | 8.8 | 2025-10-21 | An arbitrary OS command may be executed on the product by the user who can log in to the web management interface. |
CVE-2025-54764 | Medium | 6.2 | 2025-10-20 | Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd. |
CVE-2025-12001 | Medium | 6.1 | 2025-10-20 | Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-11536 | Medium | 5.0 | 2025-10-20 | The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 8.2.5 via t… |
CVE-2025-62658 | | 2025-10-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extensi… | |
CVE-2025-62657 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PageForms exten… | |
CVE-2025-62656 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki GlobalBlocking… | |
CVE-2025-61303 | Critical | 9.8 | 2025-10-20 | Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a vulnerability in its Windows behavioral analysis eng… |
CVE-2025-61301 | High | 7.5 | 2025-10-20 | Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows attackers who can submit samples to cause… |
CVE-2025-60783 | Medium | 6.5 | 2025-10-20 | There is a SQL injection vulnerability in Restaurant Management System DBMS Project v1.0 via login.php. The vulnerability allows attackers to manipulate the ap… |
CVE-2025-60781 | Medium | 6.1 | 2025-10-20 | PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) in the worksheet.php file via the participant_name parameter. |
CVE-2025-8053 | Critical | 9.1 | 2025-10-20 | Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulne… |
CVE-2025-8052 | High | 8.8 | 2025-10-20 | SQL Injection vulnerability in opentext Flipper allows SQL Injection. The vulnerability could allow a low privilege user to interact with the database in uni… |
CVE-2025-8051 | Medium | 6.5 | 2025-10-20 | Path Traversal vulnerability in opentext Flipper allows Absolute Path Traversal. The vulnerability could allow a user to access files hosted on the server. … |
CVE-2025-8049 | High | 8.8 | 2025-10-20 | Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulne… |
CVE-2025-8048 | Medium | 6.5 | 2025-10-20 | External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to submit a stored local fi… |
CVE-2025-62697 | | 2025-10-20 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The Wikimedia Foundation Mediawiki - Langua… | |
CVE-2025-62528 | Medium | 5.4 | 2025-10-20 | Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to… |
CVE-2025-62527 | High | 7.1 | 2025-10-20 | Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to requ… |
CVE-2025-62522 | | 2025-10-20 | Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4… | |
CVE-2025-61488 | High | 7.6 | 2025-10-20 | An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrap_image.php component and… |
CVE-2025-5517 | Medium | 6.8 | 2025-10-20 | Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (MID/ CE) -Terra AC MID, ABB Te… |
CVE-2025-62700 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - MultiBoilerpl… | |
CVE-2025-62698 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuida… | |
CVE-2025-62693 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - LastModified… | |
CVE-2025-62510 | High | 8.1 | 2025-10-20 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibilit… |
CVE-2025-62509 | High | 8.1 | 2025-10-20 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version 1.4.0, a business logic flaw in FileRi… |
CVE-2025-55086 | Critical | 9.8 | 2025-10-20 | In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the s… |
CVE-2025-47902 | High | 8.8 | 2025-10-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This is… |
CVE-2025-47901 | High | 8.8 | 2025-10-20 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Inje… |
CVE-2025-47900 | High | 8.8 | 2025-10-20 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Inje… |
CVE-2025-3465 | High | 7.1 | 2025-10-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB CoreSense™ M10.This issue affects CoreSe… |
CVE-2025-11979 | Medium | 5.3 | 2025-10-20 | An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under… |
CVE-2025-9574 | Critical | 10.0 | 2025-10-20 | Missing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects . All firmware versions with the Seri… |
CVE-2025-6515 | Medium | 6.8 | 2025-10-20 | The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attacker… |
CVE-2025-62429 | High | 7.2 | 2025-10-20 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/ad… |
CVE-2025-60856 | Medium | 6.8 | 2025-10-20 | Reolink Video Doorbell WiFi DB_566128M5MP_W allows root shell access through an unsecured UART/serial console. An attacker with physical access can connect to… |
CVE-2025-48025 | Medium | 4.3 | 2025-10-20 | In Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000, there is an improper access control vu… |
CVE-2025-40017 | | 2025-10-20 | In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix memory leak by freeing untracked persist buffer One internal buffer whic… | |
CVE-2025-40016 | | 2025-10-20 | In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Per UVC 1.1+ specifi… | |
CVE-2025-40015 | | 2025-10-20 | In the Linux kernel, the following vulnerability has been resolved: media: stm32-csi: Fix dereference before NULL check In 'stm32_csi_start', 'csidev->s_subd… | |
CVE-2025-40013 | | 2025-10-20 | In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: audioreach: fix potential null pointer dereference It is possible that the to… | |
CVE-2025-40012 | High | 7.8 | 2025-10-20 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix warning in smc_rx_splice() when calling get_page() smc_lo_register_dmb() all… |
CVE-2025-40011 | | 2025-10-20 | In the Linux kernel, the following vulnerability has been resolved: drm/gma500: Fix null dereference in hdmi teardown pci_set_drvdata sets the value of pdev-… | |
CVE-2025-40010 | | 2025-10-20 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix potential null pointer dereference in afs_put_server afs_put_server() accessed s… | |
CVE-2025-40009 | | 2025-10-20 | In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: check p->vec_buf for NULL When the PAGEMAP_SCAN ioctl is invoked with v… | |
CVE-2025-40008 | | 2025-10-20 | In the Linux kernel, the following vulnerability has been resolved: kmsan: fix out-of-bounds access to shadow memory Running sha224_kunit on a KMSAN-enabled… | |
CVE-2025-40007 | | 2025-10-20 | In the Linux kernel, the following vulnerability has been resolved: netfs: fix reference leak Commit 20d72b00ca81 ("netfs: Fix the request's work item to not… | |
CVE-2025-40006 | High | 7.8 | 2025-10-20 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when deleted Migration may be raced with fallocatin… |
CVE-2025-40005 | Medium | 5.5 | 2025-10-20 | In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: Implement refcount to handle unbind during busy driver support indi… |
CVE-2025-26782 | High | 7.5 | 2025-10-20 | An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 9110… |
CVE-2025-26781 | High | 7.5 | 2025-10-20 | An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 9110… |
CVE-2025-10678 | | 2025-10-20 | NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL. This issue affect… | |
CVE-2025-8884 | Medium | 5.5 | 2025-10-20 | Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted I… |
CVE-2025-61456 | Medium | 6.1 | 2025-10-20 | A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index para… |
CVE-2025-61417 | High | 8.8 | 2025-10-20 | Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Attackers can upload a malicious SVG file… |
CVE-2025-57738 | High | 7.2 | 2025-10-20 | Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java inter… |
CVE-2025-54957 | Critical | 9.8 | 2025-10-20 | An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution… |
CVE-2025-41390 | High | 7.8 | 2025-10-20 | An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repository can lead to… |
CVE-2025-61455 | Critical | 9.8 | 2025-10-20 | SQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the signup.inc.php endpoint. The application directly incorporates unsa… |
CVE-2025-11680 | | 2025-10-20 | Out-of-bounds Write in unfilter_scanline in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack… | |
CVE-2025-11679 | | 2025-10-20 | Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display s… | |
CVE-2025-11678 | | 2025-10-20 | Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to ove… | |
CVE-2025-11677 | | 2025-10-20 | Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the… | |
CVE-2025-61454 | Medium | 6.1 | 2025-10-20 | A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search pa… |
CVE-2025-56224 | High | 8.1 | 2025-10-20 | A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce atta… |
CVE-2025-56223 | High | 7.5 | 2025-10-20 | A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a Denial of Service (DoS) via uploading an e… |
CVE-2025-56219 | High | 7.1 | 2025-10-20 | Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiting. This can lead to a resource exhausti… |
CVE-2025-8349 | | 2025-10-20 | Cross-site Scripting (XSS) stored vulnerability in Tawk Live Chat. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by… | |
CVE-2025-57837 | Low | 2.9 | 2025-10-20 | Tileservice module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-41028 | | 2025-10-20 | A SQL Injection vulnerability has been found in Epsilon RH by Grupo Castilla. This vulnerability allows an attacker to retrieve, create, update and delete data… | |
CVE-2025-61932 | Critical | 9.8 | 2025-10-20 | Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacke… |
CVE-2025-57839 | Medium | 4.0 | 2025-10-20 | Photo module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-57838 | Medium | 4.0 | 2025-10-20 | Some Honor products are affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-31342 | | 2025-10-20 | An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module th… | |
CVE-2025-62577 | High | 8.8 | 2025-10-20 | ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged user with access to the management serv… |