2025 CVEs (page 150)
Page 150 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11595 | Medium | 4.7 | 2025-10-11 | A vulnerability was found in Campcodes Online Apartment Visitor Management System 1.0. Impacted is an unknown function of the file /admin-profile.php. Performi… |
CVE-2025-10376 | Medium | 4.3 | 2025-10-11 | The Course Redirects for Learndash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4. This is due to m… |
CVE-2025-10375 | Medium | 4.3 | 2025-10-11 | The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10. This is due to… |
CVE-2025-10190 | Medium | 6.4 | 2025-10-11 | The WP Easy Toggles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggles' shortcode in all versions up to, and including… |
CVE-2025-10175 | Medium | 6.5 | 2025-10-11 | The WP Links Page plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 4.9.6 due to insufficient es… |
CVE-2025-10167 | Medium | 6.4 | 2025-10-11 | The Stock History & Reports Manager for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_stock_snapshot_r… |
CVE-2025-10129 | Medium | 6.4 | 2025-10-11 | The WordPress Live Webcam Widget & Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versi… |
CVE-2025-6553 | Critical | 9.8 | 2025-10-11 | The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function… |
CVE-2025-58299 | High | 8.4 | 2025-10-11 | Use After Free (UAF) vulnerability in the storage management module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58298 | High | 7.3 | 2025-10-11 | Data processing error vulnerability in the package management module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58297 | Medium | 5.9 | 2025-10-11 | Buffer overflow vulnerability in the sensor service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58295 | Medium | 5.9 | 2025-10-11 | Buffer overflow vulnerability in the development framework module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58292 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58291 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58290 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58288 | Medium | 5.5 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58287 | High | 7.8 | 2025-10-11 | Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58286 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-11594 | Medium | 5.3 | 2025-10-11 | A vulnerability has been found in ywxbear PHP-Bookstore-Website-Example and PHP Basic BookStore Website up to 0e0b9f542f7a2d90a8d7f8c83caca69294e234e4. This is… |
CVE-2025-11518 | Medium | 5.3 | 2025-10-11 | The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via s… |
CVE-2025-11254 | Medium | 4.3 | 2025-10-11 | The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0… |
CVE-2025-11167 | Medium | 4.7 | 2025-10-11 | The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions u… |
CVE-2025-9496 | Medium | 6.4 | 2025-10-11 | The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and… |
CVE-2025-9196 | Medium | 5.3 | 2025-10-11 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve… |
CVE-2025-11533 | Critical | 9.8 | 2025-10-11 | The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() fu… |
CVE-2025-11197 | Medium | 6.4 | 2025-10-11 | The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6… |
CVE-2025-10185 | Medium | 4.9 | 2025-10-11 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in the action nf_load_form… |
CVE-2025-10048 | Medium | 4.9 | 2025-10-11 | The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 3.6.31 due to insuf… |
CVE-2025-11593 | Medium | 6.3 | 2025-10-11 | A flaw has been found in CodeAstro Gym Management System 1.0. This vulnerability affects unknown code of the file /admin/actions/delete-equipment.php. This man… |
CVE-2025-11592 | Medium | 6.3 | 2025-10-11 | A vulnerability was detected in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/edit-equipmentform.php. The manipulation o… |
CVE-2025-11591 | Medium | 6.3 | 2025-10-11 | A security vulnerability has been detected in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/acti… |
CVE-2025-58285 | Medium | 5.3 | 2025-10-11 | Permission control vulnerability in the media module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58284 | Medium | 5.9 | 2025-10-11 | Permission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58283 | Medium | 5.5 | 2025-10-11 | Permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58282 | Low | 2.8 | 2025-10-11 | Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58278 | Medium | 6.2 | 2025-10-11 | Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58277 | Medium | 4.0 | 2025-10-11 | Permission verification bypass vulnerability in the Camera app. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-9560 | Medium | 6.4 | 2025-10-11 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in all versions up to… |
CVE-2025-11380 | Medium | 5.9 | 2025-10-11 | The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a mis… |
CVE-2025-54654 | Medium | 6.2 | 2025-10-11 | Permission control vulnerability in the Gallery module. Successful exploitation of this vulnerability may affect service confidentiality |
CVE-2025-31718 | High | 7.5 | 2025-10-11 | In modem, there is a possible system crash due to improper input validation. This could lead to remote escalation of privilege with no additional execution pri… |
CVE-2025-31717 | High | 7.5 | 2025-10-11 | In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privilege… |
CVE-2025-11590 | Medium | 6.3 | 2025-10-11 | A weakness has been identified in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/equipment-… |
CVE-2025-9554 | Medium | 5.3 | 2025-10-10 | Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*. |
CVE-2025-9553 | Medium | 5.3 | 2025-10-10 | Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*. |
CVE-2025-9552 | Medium | 5.3 | 2025-10-10 | Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.*. |
CVE-2025-9551 | Medium | 6.5 | 2025-10-10 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0… |
CVE-2025-9550 | Medium | 6.1 | 2025-10-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issu… |
CVE-2025-9549 | Medium | 6.5 | 2025-10-10 | Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1. |
CVE-2025-8093 | High | 8.8 | 2025-10-10 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authentica… |
CVE-2025-62162 | High | 7.5 | 2025-10-10 | cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL exp… |
CVE-2025-62159 | | 2025-10-10 | External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. A vulnerability was discover… | |
CVE-2025-52885 | | 2025-10-10 | Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions… | |
CVE-2025-52647 | Medium | 6.1 | 2025-10-10 | The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks. |
CVE-2025-11626 | Medium | 5.5 | 2025-10-10 | MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service |
CVE-2025-61912 | Medium | 5.3 | 2025-10-10 | python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorre… |
CVE-2025-61911 | Medium | 6.5 | 2025-10-10 | python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_fi… |
CVE-2025-11589 | Medium | 6.3 | 2025-10-10 | A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/user-payment.php. Performing a m… |
CVE-2025-11588 | Medium | 6.3 | 2025-10-10 | A vulnerability was identified in CodeAstro Gym Management System 1.0. This impacts an unknown function of the file /customer/index.php. Such manipulation of t… |
CVE-2025-11586 | High | 8.8 | 2025-10-10 | A vulnerability was determined in Tenda AC7 15.03.06.44. This affects an unknown function of the file /goform/setNotUpgrade. This manipulation of the argument… |
CVE-2025-11585 | High | 7.3 | 2025-10-10 | A vulnerability was found in code-projects Project Monitoring System 1.0. The impacted element is an unknown function of the file /useredit.php. The manipulati… |
CVE-2025-11584 | High | 7.3 | 2025-10-10 | A vulnerability has been found in code-projects Online Job Search Engine 1.0. The affected element is an unknown function of the file /searchjob.php. The manip… |
CVE-2025-62245 | Medium | 4.3 | 2025-10-10 | Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023… |
CVE-2025-62158 | Medium | 5.3 | 2025-10-10 | Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by t… |
CVE-2025-61930 | High | 8.1 | 2025-10-10 | Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password chan… |
CVE-2025-61929 | Critical | 9.6 | 2025-10-10 | Cherry Studio is a desktop client that supports for multiple LLM providers. Cherry Studio registers a custom protocol called `cherrystudio://`. When handling t… |
CVE-2025-61927 | | 2025-10-10 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that… | |
CVE-2025-61925 | Medium | 6.5 | 2025-10-10 | Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `Astro.url` without any validation. It i… |
CVE-2025-61921 | High | 7.5 | 2025-10-10 | Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-… |
CVE-2025-61920 | High | 7.5 | 2025-10-10 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT head… |
CVE-2025-61919 | High | 7.5 | 2025-10-10 | Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `C… |
CVE-2025-55903 | High | 8.3 | 2025-10-10 | A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field within the estimate mod… |
CVE-2025-11583 | High | 7.3 | 2025-10-10 | A flaw has been found in code-projects Online Job Search Engine 1.0. Impacted is an unknown function of the file /postjob.php. Executing manipulation of the ar… |
CVE-2025-11582 | High | 7.3 | 2025-10-10 | A vulnerability was detected in code-projects Online Job Search Engine 1.0. This issue affects some unknown processing of the file /registration.php. Performin… |
CVE-2025-61505 | Medium | 6.5 | 2025-10-10 | e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled input in the `previous_steps`… |
CVE-2025-60880 | High | 8.3 | 2025-10-10 | An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file co… |
CVE-2025-11581 | Medium | 5.3 | 2025-10-10 | A security vulnerability has been detected in PowerJob up to 5.1.2. This vulnerability affects unknown code of the file /openApi/runJob of the component OpenAP… |
CVE-2025-60838 | Medium | 6.5 | 2025-10-10 | An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2025-60268 | Medium | 6.5 | 2025-10-10 | An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in /jeewms/cgUploadCon… |
CVE-2025-23309 | High | 8.2 | 2025-10-10 | NVIDIA Display Driver contains a vulnerability where an uncontrolled DLL loading path might lead to arbitrary denial of service, escalation of privileges, code… |
CVE-2025-23282 | High | 7.0 | 2025-10-10 | NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to use a race condition to escalate privileges. A successful exploit o… |
CVE-2025-23280 | High | 7.0 | 2025-10-10 | NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead… |
CVE-2025-11618 | Medium | 4.3 | 2025-10-10 | A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving a UDP/IPv6 packet w… |
CVE-2025-11617 | Medium | 5.4 | 2025-10-10 | A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving a IPv6 packet with incorrect pay… |
CVE-2025-11616 | Medium | 5.4 | 2025-10-10 | A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 packets of certain mess… |
CVE-2025-11580 | Medium | 5.3 | 2025-10-10 | A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization… |
CVE-2025-61780 | Medium | 5.8 | 2025-10-10 | Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in `Rack::Sen… |
CVE-2025-61689 | | 2025-10-10 | HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values f… | |
CVE-2025-60308 | Medium | 4.1 | 2025-10-10 | code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room function of the online hotel reservatio… |
CVE-2025-60306 | Critical | 9.9 | 2025-10-10 | code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive oper… |
CVE-2025-60269 | Critical | 9.4 | 2025-10-10 | JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExport… |
CVE-2025-60307 | Critical | 9.8 | 2025-10-10 | code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in the Password field on the login page can… |
CVE-2025-60305 | High | 8.8 | 2025-10-10 | SourceCodester Online Student Clearance System 1.0 is vulnerable to Incorrect Access Control. The application contains a logic flaw which allows low privilege… |
CVE-2025-59530 | High | 7.5 | 2025-10-10 | quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-… |
CVE-2025-48043 | | 2025-10-10 | Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/autho… | |
CVE-2025-60869 | High | 7.3 | 2025-10-10 | Publii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsanitized input in configuration fields such as "Site Description" and "Foo… |
CVE-2025-60378 | High | 8.1 | 2025-10-10 | Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content r… |
CVE-2025-8887 | Medium | 6.1 | 2025-10-10 | Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Infor… |
CVE-2025-8886 | Medium | 6.7 | 2025-10-10 | Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorizati… |
CVE-2025-61319 | Medium | 6.1 | 2025-10-10 | ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module. When scanning a target with an XSS payload… |