2025 CVEs (page 150)
Page 150 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62391 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62390 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62389 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62388 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62387 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62386 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62385 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62384 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62383 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62365 | Medium | 6.1 | 2025-10-13 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to 25.7.0, there is a reflected-XSS in `report_this` function in `librenms/in… |
CVE-2025-62363 | High | 7.8 | 2025-10-13 | yt-grabber-tui is a terminal user interface application for downloading videos. In versions before 1.0-rc, the application allows users to configure the path t… |
CVE-2025-62362 | | 2025-10-13 | gpp-burgerportaal is a Dutch government citizen portal application. In versions before 2.0.3, 3.0.2, and 4.0.1, the name and email address of employees who pub… | |
CVE-2025-62361 | Medium | 6.1 | 2025-10-13 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified i… |
CVE-2025-62360 | High | 8.8 | 2025-10-13 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in… |
CVE-2025-62359 | Medium | 6.1 | 2025-10-13 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, a Reflected Cross-Site Scripting (XSS) vulnerab… |
CVE-2025-62358 | Medium | 5.4 | 2025-10-13 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, the log parameter in configuracao_geral.php is… |
CVE-2025-62251 | Medium | 6.5 | 2025-10-13 | Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though up… |
CVE-2025-62179 | High | 8.8 | 2025-10-13 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in… |
CVE-2025-62178 | Low | 3.5 | 2025-10-13 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a Reflected Cross-Site Scripting (XSS) vulnerab… |
CVE-2025-62177 | High | 8.8 | 2025-10-13 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in… |
CVE-2025-11623 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-9713 | High | 8.8 | 2025-10-13 | Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction i… |
CVE-2025-62364 | Medium | 6.2 | 2025-10-13 | text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists… |
CVE-2025-62252 | Medium | 4.3 | 2025-10-13 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 thro… |
CVE-2025-62246 | Medium | 5.4 | 2025-10-13 | Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0… |
CVE-2025-62176 | Medium | 4.3 | 2025-10-13 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving… |
CVE-2025-62175 | Medium | 4.3 | 2025-10-13 | Mastodon is a free, open-source social network server based on ActivityPub. In versions before 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user accoun… |
CVE-2025-62174 | Low | 3.5 | 2025-10-13 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user… |
CVE-2025-61688 | High | 8.6 | 2025-10-13 | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API. |
CVE-2025-59836 | Medium | 5.3 | 2025-10-13 | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni… |
CVE-2025-11622 | High | 7.8 | 2025-10-13 | Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges. |
CVE-2025-62242 | Medium | 4.3 | 2025-10-13 | Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 202… |
CVE-2025-62241 | Medium | 4.3 | 2025-10-13 | Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to f… |
CVE-2025-58084 | Low | 3.5 | 2025-10-13 | Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has co… |
CVE-2025-62243 | Medium | 5.4 | 2025-10-13 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2… |
CVE-2025-62170 | High | 7.5 | 2025-10-13 | rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions pr… |
CVE-2025-61775 | | 2025-10-13 | Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be r… | |
CVE-2025-7707 | High | 7.8 | 2025-10-13 | The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user enviro… |
CVE-2025-62244 | Medium | 4.3 | 2025-10-13 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2… |
CVE-2025-11695 | High | 8.0 | 2025-10-13 | When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3… |
CVE-2025-43991 | Medium | 6.3 | 2025-10-13 | SupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain an UNIX Symbolic Link (Symlink) follow… |
CVE-2025-39965 | High | 7.8 | 2025-10-13 | In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but s… |
CVE-2025-39964 | High | 7.8 | 2025-10-13 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the s… |
CVE-2025-37729 | Critical | 9.1 | 2025-10-13 | Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltr… |
CVE-2025-9902 | High | 7.5 | 2025-10-13 | Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co. Ltd. QRMenu allows Privilege Abus… |
CVE-2025-6919 | Critical | 9.8 | 2025-10-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cats Information Technology Software Development Technolo… |
CVE-2025-9337 | | 2025-10-13 | A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a specially crafted input, which may lead to a sy… | |
CVE-2025-9336 | | 2025-10-13 | A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (… | |
CVE-2025-11184 | | 2025-10-13 | Cross-site scripting vulnerability in QGIS QWC2 Registration GUI <=v2025.03.31 allows an authorized attacker to plant arbitrary JavaScript code in the page | |
CVE-2025-11183 | | 2025-10-13 | Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page | |
CVE-2025-10720 | Medium | 6.5 | 2025-10-13 | The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based onl… |
CVE-2025-9968 | | 2025-10-13 | A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a specially crafted junct… | |
CVE-2025-9976 | Critical | 9.0 | 2025-10-13 | An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R20… |
CVE-2025-11675 | High | 7.2 | 2025-10-13 | Enterprise Cloud Database developed by Ragic has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell b… |
CVE-2025-11674 | Medium | 6.8 | 2025-10-13 | SOOP-CLM developed by PiExtract has a Server-Side Request Forgery vulnerability, allowing privileged remote attackers to read server files or probe internal ne… |
CVE-2025-11673 | High | 7.2 | 2025-10-13 | SOOP-CLM developed by PiExtract has a Hidden Functionality vulnerability, allowing privileged remote attackers to exploit a hidden functionality to execute arb… |
CVE-2025-11672 | Medium | 5.3 | 2025-10-13 | Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a speci… |
CVE-2025-11671 | Medium | 5.3 | 2025-10-13 | Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a speci… |
CVE-2025-11668 | Medium | 4.7 | 2025-10-13 | A vulnerability was determined in code-projects Automated Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/update_use… |
CVE-2025-11667 | Medium | 6.3 | 2025-10-13 | A vulnerability was found in code-projects Automated Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_candi… |
CVE-2025-10558 | High | 8.7 | 2025-10-13 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script… |
CVE-2025-10557 | High | 8.7 | 2025-10-13 | A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x throug… |
CVE-2025-10556 | High | 8.7 | 2025-10-13 | A stored Cross-site Scripting (XSS) vulnerability affecting Specification Management in ENOVIA Specification Manager from Release 3DEXPERIENCE R2023x through R… |
CVE-2025-10552 | High | 8.7 | 2025-10-13 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script co… |
CVE-2025-9265 | | 2025-10-13 | A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state… | |
CVE-2025-8915 | | 2025-10-13 | Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network | |
CVE-2025-27259 | Medium | 5.4 | 2025-10-13 | Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect victims to other sit… |
CVE-2025-27258 | Critical | 9.8 | 2025-10-13 | Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege. |
CVE-2025-11666 | Medium | 6.7 | 2025-10-13 | A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler… |
CVE-2025-11665 | Medium | 4.7 | 2025-10-13 | A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdater_main of the file rgbin of the component Firmware Update Handler… |
CVE-2025-11664 | Medium | 4.7 | 2025-10-13 | A security vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0. The impacted element is an unknown function of the file /ad… |
CVE-2025-0636 | High | 8.4 | 2025-10-13 | EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Co… |
CVE-2025-9698 | Medium | 6.8 | 2025-10-13 | The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author t… |
CVE-2025-11663 | Medium | 4.7 | 2025-10-13 | A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/manage-s… |
CVE-2025-31995 | Low | 3.5 | 2025-10-13 | HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command… |
CVE-2025-11662 | High | 7.3 | 2025-10-13 | A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. Impacted is an unknown function of the file /booking.php. The manipulat… |
CVE-2025-11661 | High | 7.3 | 2025-10-13 | A vulnerability was found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown part. Perform… |
CVE-2025-31996 | Medium | 5.3 | 2025-10-13 | HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system… |
CVE-2025-31994 | Medium | 4.3 | 2025-10-13 | HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP request, which is then… |
CVE-2025-11660 | High | 7.3 | 2025-10-13 | A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this issue is some u… |
CVE-2025-11659 | High | 7.3 | 2025-10-13 | A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unkn… |
CVE-2025-11658 | High | 7.3 | 2025-10-13 | A vulnerability was detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected is an unknown function of… |
CVE-2025-11657 | High | 7.3 | 2025-10-13 | A security vulnerability has been detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This impacts an unkn… |
CVE-2025-11656 | High | 7.3 | 2025-10-13 | A weakness has been identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown function… |
CVE-2025-11655 | Medium | 4.7 | 2025-10-13 | A security flaw has been discovered in Total.js Flow up to 673ef9144dd25d4f4fd4fdfda5af27f230198924. The impacted element is an unknown function of the compone… |
CVE-2025-36087 | High | 8.1 | 2025-10-13 | IBM Security Verify Access 10.0.0 through 10.0.9, 11.0.0, IBM Verify Identity Access Container 10.0.0 through 10.0.9, and 11.0.0, under certain configurations… |
CVE-2025-11654 | High | 7.3 | 2025-10-13 | A vulnerability was identified in yousaf530 Inferno Online Clothing Store up to 827dd42bfbe380e8de76fdc67958c24cf1246208. The affected element is an unknown fu… |
CVE-2025-11653 | High | 8.8 | 2025-10-13 | A vulnerability was determined in UTT HiPER 2620G up to 3.1.4. Impacted is the function strcpy of the file /goform/fNTP. This manipulation of the argument NTPS… |
CVE-2025-11652 | High | 8.8 | 2025-10-13 | A vulnerability was found in UTT 进取 518G up to V3v3.2.7-210919-161313. This issue affects some unknown processing of the file /goform/formTaskEdit_ap. The mani… |
CVE-2025-11651 | High | 8.8 | 2025-10-13 | A vulnerability has been found in UTT 进取 518G up to V3v3.2.7-210919-161313. This vulnerability affects the function sub_4247AC of the file /goform/formRemoteCo… |
CVE-2025-11650 | Low | 1.8 | 2025-10-12 | A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file /etc/shadow of the component Passwo… |
CVE-2025-11649 | High | 7.0 | 2025-10-12 | A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Root Account Handler. Performing ma… |
CVE-2025-11648 | Medium | 5.6 | 2025-10-12 | A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface UR… |
CVE-2025-11647 | Low | 3.1 | 2025-10-12 | A flaw has been found in Tomofun Furbo 360 and Furbo Mini. This issue affects some unknown processing of the component GATT Service. This manipulation of the a… |
CVE-2025-11646 | Medium | 6.3 | 2025-10-12 | A vulnerability was detected in Tomofun Furbo 360 and Furbo Mini. This vulnerability affects unknown code of the component GATT Service. The manipulation resul… |
CVE-2025-11645 | Low | 2.4 | 2025-10-12 | A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication T… |
CVE-2025-11644 | Low | 2.0 | 2025-10-12 | A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Execu… |
CVE-2025-11643 | Low | 3.7 | 2025-10-12 | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. Affected by this vulnerability is an unknown functionality of the file /squashfs-root/… |
CVE-2025-11642 | Medium | 4.0 | 2025-10-12 | A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected is an unknown function of the component Registration Handler. Such manipulation le… |
CVE-2025-11641 | Low | 3.9 | 2025-10-12 | A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulat… |