2025 CVEs (page 149)
Page 149 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11668 | Medium | 4.7 | 2025-10-13 | A vulnerability was determined in code-projects Automated Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/update_use… |
CVE-2025-11667 | Medium | 6.3 | 2025-10-13 | A vulnerability was found in code-projects Automated Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_candi… |
CVE-2025-10558 | High | 8.7 | 2025-10-13 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script… |
CVE-2025-10557 | High | 8.7 | 2025-10-13 | A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x throug… |
CVE-2025-10556 | High | 8.7 | 2025-10-13 | A stored Cross-site Scripting (XSS) vulnerability affecting Specification Management in ENOVIA Specification Manager from Release 3DEXPERIENCE R2023x through R… |
CVE-2025-10552 | High | 8.7 | 2025-10-13 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script co… |
CVE-2025-9265 | | 2025-10-13 | A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state… | |
CVE-2025-8915 | | 2025-10-13 | Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network | |
CVE-2025-27259 | Medium | 5.4 | 2025-10-13 | Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect victims to other sit… |
CVE-2025-27258 | Critical | 9.8 | 2025-10-13 | Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege. |
CVE-2025-11666 | Medium | 6.7 | 2025-10-13 | A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler… |
CVE-2025-11665 | Medium | 4.7 | 2025-10-13 | A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdater_main of the file rgbin of the component Firmware Update Handler… |
CVE-2025-11664 | Medium | 4.7 | 2025-10-13 | A security vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0. The impacted element is an unknown function of the file /ad… |
CVE-2025-0636 | High | 8.4 | 2025-10-13 | EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Co… |
CVE-2025-9698 | Medium | 6.8 | 2025-10-13 | The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author t… |
CVE-2025-11663 | Medium | 4.7 | 2025-10-13 | A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/manage-s… |
CVE-2025-31995 | Low | 3.5 | 2025-10-13 | HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command… |
CVE-2025-11662 | High | 7.3 | 2025-10-13 | A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. Impacted is an unknown function of the file /booking.php. The manipulat… |
CVE-2025-11661 | High | 7.3 | 2025-10-13 | A vulnerability was found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown part. Perform… |
CVE-2025-31996 | Medium | 5.3 | 2025-10-13 | HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system… |
CVE-2025-31994 | Medium | 4.3 | 2025-10-13 | HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP request, which is then… |
CVE-2025-11660 | High | 7.3 | 2025-10-13 | A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this issue is some u… |
CVE-2025-11659 | High | 7.3 | 2025-10-13 | A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unkn… |
CVE-2025-11658 | High | 7.3 | 2025-10-13 | A vulnerability was detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected is an unknown function of… |
CVE-2025-11657 | High | 7.3 | 2025-10-13 | A security vulnerability has been detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This impacts an unkn… |
CVE-2025-11656 | High | 7.3 | 2025-10-13 | A weakness has been identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown function… |
CVE-2025-11655 | Medium | 4.7 | 2025-10-13 | A security flaw has been discovered in Total.js Flow up to 673ef9144dd25d4f4fd4fdfda5af27f230198924. The impacted element is an unknown function of the compone… |
CVE-2025-36087 | High | 8.1 | 2025-10-13 | IBM Security Verify Access 10.0.0 through 10.0.9, 11.0.0, IBM Verify Identity Access Container 10.0.0 through 10.0.9, and 11.0.0, under certain configurations… |
CVE-2025-11654 | High | 7.3 | 2025-10-13 | A vulnerability was identified in yousaf530 Inferno Online Clothing Store up to 827dd42bfbe380e8de76fdc67958c24cf1246208. The affected element is an unknown fu… |
CVE-2025-11653 | High | 8.8 | 2025-10-13 | A vulnerability was determined in UTT HiPER 2620G up to 3.1.4. Impacted is the function strcpy of the file /goform/fNTP. This manipulation of the argument NTPS… |
CVE-2025-11652 | High | 8.8 | 2025-10-13 | A vulnerability was found in UTT 进取 518G up to V3v3.2.7-210919-161313. This issue affects some unknown processing of the file /goform/formTaskEdit_ap. The mani… |
CVE-2025-11651 | High | 8.8 | 2025-10-13 | A vulnerability has been found in UTT 进取 518G up to V3v3.2.7-210919-161313. This vulnerability affects the function sub_4247AC of the file /goform/formRemoteCo… |
CVE-2025-11650 | Low | 1.8 | 2025-10-12 | A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file /etc/shadow of the component Passwo… |
CVE-2025-11649 | High | 7.0 | 2025-10-12 | A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Root Account Handler. Performing ma… |
CVE-2025-11648 | Medium | 5.6 | 2025-10-12 | A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface UR… |
CVE-2025-11647 | Low | 3.1 | 2025-10-12 | A flaw has been found in Tomofun Furbo 360 and Furbo Mini. This issue affects some unknown processing of the component GATT Service. This manipulation of the a… |
CVE-2025-11646 | Medium | 6.3 | 2025-10-12 | A vulnerability was detected in Tomofun Furbo 360 and Furbo Mini. This vulnerability affects unknown code of the component GATT Service. The manipulation resul… |
CVE-2025-11645 | Low | 2.4 | 2025-10-12 | A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication T… |
CVE-2025-11644 | Low | 2.0 | 2025-10-12 | A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Execu… |
CVE-2025-11643 | Low | 3.7 | 2025-10-12 | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. Affected by this vulnerability is an unknown functionality of the file /squashfs-root/… |
CVE-2025-11642 | Medium | 4.0 | 2025-10-12 | A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected is an unknown function of the component Registration Handler. Such manipulation le… |
CVE-2025-11641 | Low | 3.9 | 2025-10-12 | A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulat… |
CVE-2025-11640 | Low | 3.1 | 2025-10-12 | A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results… |
CVE-2025-11639 | Low | 3.3 | 2025-10-12 | A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file collect_logs.sh of the component De… |
CVE-2025-11638 | Medium | 4.3 | 2025-10-12 | A flaw has been found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Bluetooth Handler. Executing manipulati… |
CVE-2025-11637 | Medium | 4.3 | 2025-10-12 | A vulnerability was detected in Tomofun Furbo 360 up to FB0035_FW_036. Impacted is an unknown function of the component Audio Handler. Performing manipulation… |
CVE-2025-11636 | Medium | 5.6 | 2025-10-12 | A security vulnerability has been detected in Tomofun Furbo 360 up to FB0035_FW_036. This issue affects some unknown processing of the component Account Handle… |
CVE-2025-33096 | Medium | 6.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially… |
CVE-2025-2140 | Medium | 5.7 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender… |
CVE-2025-2139 | Low | 3.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users du… |
CVE-2025-2138 | Low | 3.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users… |
CVE-2025-11635 | Medium | 4.3 | 2025-10-12 | A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036. This vulnerability affects unknown code of the component File Upload. This manipulatio… |
CVE-2025-11634 | Low | 2.4 | 2025-10-12 | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. This affects an unknown part of the component UART Interface. The manipulation results… |
CVE-2025-11633 | Low | 3.7 | 2025-10-12 | A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is the function upload_file_to_s3 of the file collect_logs.sh of the… |
CVE-2025-52615 | Low | 3.5 | 2025-10-12 | HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies control… |
CVE-2025-52614 | Low | 3.5 | 2025-10-12 | HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suita… |
CVE-2025-31969 | Medium | 4.0 | 2025-10-12 | HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come ac… |
CVE-2025-11631 | Medium | 5.4 | 2025-10-12 | A vulnerability was determined in RainyGao DocSys up to 2.02.36. Affected by this vulnerability is an unknown functionality of the file /Doc/deleteDoc.do. Exec… |
CVE-2025-11630 | Medium | 6.3 | 2025-10-12 | A vulnerability was found in RainyGao DocSys up to 2.02.36. Affected is the function updateRealDoc of the file /Doc/uploadDoc.do of the component File Upload… |
CVE-2025-11629 | Medium | 6.3 | 2025-10-12 | A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation le… |
CVE-2025-31992 | Medium | 4.6 | 2025-10-12 | HCL Unica MaxAI Assistant is susceptible to a HTML injection vulnerability. An attacker could insert special characters that are processed client-side in the… |
CVE-2025-52616 | Medium | 5.3 | 2025-10-12 | HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities i… |
CVE-2025-11628 | Medium | 4.7 | 2025-10-12 | A flaw has been found in jimit105 Project-Online-Shopping-Website up to 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64. This affects an unknown function of the file… |
CVE-2025-61884 | High | 7.5 | 2025-10-12 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-31998 | Low | 3.5 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this inform… |
CVE-2025-31997 | Medium | 4.2 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in… |
CVE-2025-31993 | Low | 3.5 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by su… |
CVE-2025-11615 | High | 7.3 | 2025-10-11 | A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add_invoice.php. Perfor… |
CVE-2025-11614 | High | 7.3 | 2025-10-11 | A vulnerability was identified in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /panel/edit… |
CVE-2025-11613 | Medium | 6.3 | 2025-10-11 | A vulnerability was found in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file /addcategory.php. The manipulation of t… |
CVE-2025-11612 | Medium | 6.3 | 2025-10-11 | A vulnerability has been found in code-projects Simple Food Ordering System 1.0. This impacts an unknown function of the file /addproduct.php. The manipulation… |
CVE-2025-11611 | Medium | 6.3 | 2025-10-11 | A weakness has been identified in SourceCodester Simple Inventory System 1.0. Impacted is an unknown function of the file /user.php. This manipulation of the a… |
CVE-2025-11610 | Medium | 6.3 | 2025-10-11 | A security flaw has been discovered in SourceCodester Simple Inventory System 1.0. This issue affects some unknown processing of the file /brand.php. The manip… |
CVE-2025-11609 | Low | 3.7 | 2025-10-11 | A flaw has been found in code-projects Hospital Management System 1.0. Affected is the function session of the component express-session. This manipulation of… |
CVE-2025-11608 | High | 7.3 | 2025-10-11 | A security vulnerability has been detected in code-projects E-Banking System 1.0. This affects an unknown function of the file /register.php of the component P… |
CVE-2025-11607 | Medium | 6.3 | 2025-10-11 | A weakness has been identified in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function upload_music of the file app/controllers/v1/mus… |
CVE-2025-11606 | Medium | 6.3 | 2025-10-11 | A security flaw has been discovered in iPynch Social Network Website up to b6933b6d7f82c84819abe458ccf0e59d61119541. The affected element is an unknown functio… |
CVE-2025-11605 | Medium | 6.3 | 2025-10-11 | A vulnerability was identified in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/update-profile.php. Such manipula… |
CVE-2025-11604 | High | 7.3 | 2025-10-11 | A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This m… |
CVE-2025-11603 | Medium | 6.3 | 2025-10-11 | A vulnerability was found in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /editproduct.php. The manipulat… |
CVE-2025-11601 | High | 7.3 | 2025-10-11 | A vulnerability was detected in SourceCodester Online Student Result System 1.0. Affected by this vulnerability is an unknown functionality of the file /login… |
CVE-2025-11600 | Medium | 6.3 | 2025-10-11 | A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file editcategory.php. Such… |
CVE-2025-11599 | High | 7.3 | 2025-10-11 | A weakness has been identified in Campcodes Online Apartment Visitor Management System 1.0. This impacts an unknown function of the file /forgot-password.php… |
CVE-2025-11597 | Medium | 6.3 | 2025-10-11 | A vulnerability was identified in code-projects E-Commerce Website 1.0. The impacted element is an unknown function of the file /pages/product_add_qty.php. The… |
CVE-2025-9975 | Medium | 6.8 | 2025-10-11 | The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wp_scraper_extract_content… |
CVE-2025-9950 | Medium | 4.9 | 2025-10-11 | The Error Log Viewer by BestWebSoft plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.6 via the rrrlgvwr_get_… |
CVE-2025-9947 | Medium | 4.9 | 2025-10-11 | The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and including, 3.12.0 due to… |
CVE-2025-9626 | Medium | 4.3 | 2025-10-11 | The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorre… |
CVE-2025-9621 | Medium | 4.3 | 2025-10-11 | The WidgetPack Comment System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to miss… |
CVE-2025-8682 | Medium | 4.3 | 2025-10-11 | The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsup_admin_info_install_plugin() fu… |
CVE-2025-8606 | Low | 2.4 | 2025-10-11 | The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 1.3.23. This is due… |
CVE-2025-8593 | High | 8.8 | 2025-10-11 | The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to authorization bypass in versions less than, or equal to, 1.3.27. This is due to a m… |
CVE-2025-8484 | Medium | 5.3 | 2025-10-11 | The Code Quality Control Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in version 2.1 through publicly exposed log files. This make… |
CVE-2025-7652 | Medium | 6.4 | 2025-10-11 | The Easy Plugin Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eps' shortcode in all versions up to, and including… |
CVE-2025-6439 | Critical | 9.8 | 2025-10-11 | The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file del… |
CVE-2025-58301 | Medium | 6.2 | 2025-10-11 | Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58300 | Medium | 6.2 | 2025-10-11 | Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58293 | Medium | 5.5 | 2025-10-11 | Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58289 | Medium | 5.9 | 2025-10-11 | Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-11596 | High | 7.3 | 2025-10-11 | A vulnerability was determined in code-projects E-Commerce Website 1.0. The affected element is an unknown function of the file /pages/delete_order_details.php… |