2025 CVEs (page 151)
Page 151 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11640 | Low | 3.1 | 2025-10-12 | A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results… |
CVE-2025-11639 | Low | 3.3 | 2025-10-12 | A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file collect_logs.sh of the component De… |
CVE-2025-11638 | Medium | 4.3 | 2025-10-12 | A flaw has been found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Bluetooth Handler. Executing manipulati… |
CVE-2025-11637 | Medium | 4.3 | 2025-10-12 | A vulnerability was detected in Tomofun Furbo 360 up to FB0035_FW_036. Impacted is an unknown function of the component Audio Handler. Performing manipulation… |
CVE-2025-11636 | Medium | 5.6 | 2025-10-12 | A security vulnerability has been detected in Tomofun Furbo 360 up to FB0035_FW_036. This issue affects some unknown processing of the component Account Handle… |
CVE-2025-33096 | Medium | 6.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially… |
CVE-2025-2140 | Medium | 5.7 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender… |
CVE-2025-2139 | Low | 3.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users du… |
CVE-2025-2138 | Low | 3.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users… |
CVE-2025-11635 | Medium | 4.3 | 2025-10-12 | A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036. This vulnerability affects unknown code of the component File Upload. This manipulatio… |
CVE-2025-11634 | Low | 2.4 | 2025-10-12 | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. This affects an unknown part of the component UART Interface. The manipulation results… |
CVE-2025-11633 | Low | 3.7 | 2025-10-12 | A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is the function upload_file_to_s3 of the file collect_logs.sh of the… |
CVE-2025-52615 | Low | 3.5 | 2025-10-12 | HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies control… |
CVE-2025-52614 | Low | 3.5 | 2025-10-12 | HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suita… |
CVE-2025-31969 | Medium | 4.0 | 2025-10-12 | HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come ac… |
CVE-2025-11631 | Medium | 5.4 | 2025-10-12 | A vulnerability was determined in RainyGao DocSys up to 2.02.36. Affected by this vulnerability is an unknown functionality of the file /Doc/deleteDoc.do. Exec… |
CVE-2025-11630 | Medium | 6.3 | 2025-10-12 | A vulnerability was found in RainyGao DocSys up to 2.02.36. Affected is the function updateRealDoc of the file /Doc/uploadDoc.do of the component File Upload… |
CVE-2025-11629 | Medium | 6.3 | 2025-10-12 | A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation le… |
CVE-2025-31992 | Medium | 4.6 | 2025-10-12 | HCL Unica MaxAI Assistant is susceptible to a HTML injection vulnerability. An attacker could insert special characters that are processed client-side in the… |
CVE-2025-52616 | Medium | 5.3 | 2025-10-12 | HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities i… |
CVE-2025-11628 | Medium | 4.7 | 2025-10-12 | A flaw has been found in jimit105 Project-Online-Shopping-Website up to 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64. This affects an unknown function of the file… |
CVE-2025-61884 | High | 7.5 | 2025-10-12 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-31998 | Low | 3.5 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this inform… |
CVE-2025-31997 | Medium | 4.2 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in… |
CVE-2025-31993 | Low | 3.5 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by su… |
CVE-2025-11615 | High | 7.3 | 2025-10-11 | A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add_invoice.php. Perfor… |
CVE-2025-11614 | High | 7.3 | 2025-10-11 | A vulnerability was identified in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /panel/edit… |
CVE-2025-11613 | Medium | 6.3 | 2025-10-11 | A vulnerability was found in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file /addcategory.php. The manipulation of t… |
CVE-2025-11612 | Medium | 6.3 | 2025-10-11 | A vulnerability has been found in code-projects Simple Food Ordering System 1.0. This impacts an unknown function of the file /addproduct.php. The manipulation… |
CVE-2025-11611 | Medium | 6.3 | 2025-10-11 | A weakness has been identified in SourceCodester Simple Inventory System 1.0. Impacted is an unknown function of the file /user.php. This manipulation of the a… |
CVE-2025-11610 | Medium | 6.3 | 2025-10-11 | A security flaw has been discovered in SourceCodester Simple Inventory System 1.0. This issue affects some unknown processing of the file /brand.php. The manip… |
CVE-2025-11609 | Low | 3.7 | 2025-10-11 | A flaw has been found in code-projects Hospital Management System 1.0. Affected is the function session of the component express-session. This manipulation of… |
CVE-2025-11608 | High | 7.3 | 2025-10-11 | A security vulnerability has been detected in code-projects E-Banking System 1.0. This affects an unknown function of the file /register.php of the component P… |
CVE-2025-11607 | Medium | 6.3 | 2025-10-11 | A weakness has been identified in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function upload_music of the file app/controllers/v1/mus… |
CVE-2025-11606 | Medium | 6.3 | 2025-10-11 | A security flaw has been discovered in iPynch Social Network Website up to b6933b6d7f82c84819abe458ccf0e59d61119541. The affected element is an unknown functio… |
CVE-2025-11605 | Medium | 6.3 | 2025-10-11 | A vulnerability was identified in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/update-profile.php. Such manipula… |
CVE-2025-11604 | High | 7.3 | 2025-10-11 | A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This m… |
CVE-2025-11603 | Medium | 6.3 | 2025-10-11 | A vulnerability was found in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /editproduct.php. The manipulat… |
CVE-2025-11601 | High | 7.3 | 2025-10-11 | A vulnerability was detected in SourceCodester Online Student Result System 1.0. Affected by this vulnerability is an unknown functionality of the file /login… |
CVE-2025-11600 | Medium | 6.3 | 2025-10-11 | A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file editcategory.php. Such… |
CVE-2025-11599 | High | 7.3 | 2025-10-11 | A weakness has been identified in Campcodes Online Apartment Visitor Management System 1.0. This impacts an unknown function of the file /forgot-password.php… |
CVE-2025-11597 | Medium | 6.3 | 2025-10-11 | A vulnerability was identified in code-projects E-Commerce Website 1.0. The impacted element is an unknown function of the file /pages/product_add_qty.php. The… |
CVE-2025-9975 | Medium | 6.8 | 2025-10-11 | The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wp_scraper_extract_content… |
CVE-2025-9950 | Medium | 4.9 | 2025-10-11 | The Error Log Viewer by BestWebSoft plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.6 via the rrrlgvwr_get_… |
CVE-2025-9947 | Medium | 4.9 | 2025-10-11 | The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and including, 3.12.0 due to… |
CVE-2025-9626 | Medium | 4.3 | 2025-10-11 | The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorre… |
CVE-2025-9621 | Medium | 4.3 | 2025-10-11 | The WidgetPack Comment System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to miss… |
CVE-2025-8682 | Medium | 4.3 | 2025-10-11 | The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsup_admin_info_install_plugin() fu… |
CVE-2025-8606 | Low | 2.4 | 2025-10-11 | The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 1.3.23. This is due… |
CVE-2025-8593 | High | 8.8 | 2025-10-11 | The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to authorization bypass in versions less than, or equal to, 1.3.27. This is due to a m… |
CVE-2025-8484 | Medium | 5.3 | 2025-10-11 | The Code Quality Control Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in version 2.1 through publicly exposed log files. This make… |
CVE-2025-7652 | Medium | 6.4 | 2025-10-11 | The Easy Plugin Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eps' shortcode in all versions up to, and including… |
CVE-2025-6439 | Critical | 9.8 | 2025-10-11 | The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file del… |
CVE-2025-58301 | Medium | 6.2 | 2025-10-11 | Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58300 | Medium | 6.2 | 2025-10-11 | Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58293 | Medium | 5.5 | 2025-10-11 | Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58289 | Medium | 5.9 | 2025-10-11 | Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-11596 | High | 7.3 | 2025-10-11 | A vulnerability was determined in code-projects E-Commerce Website 1.0. The affected element is an unknown function of the file /pages/delete_order_details.php… |
CVE-2025-11595 | Medium | 4.7 | 2025-10-11 | A vulnerability was found in Campcodes Online Apartment Visitor Management System 1.0. Impacted is an unknown function of the file /admin-profile.php. Performi… |
CVE-2025-10376 | Medium | 4.3 | 2025-10-11 | The Course Redirects for Learndash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4. This is due to m… |
CVE-2025-10375 | Medium | 4.3 | 2025-10-11 | The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10. This is due to… |
CVE-2025-10190 | Medium | 6.4 | 2025-10-11 | The WP Easy Toggles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggles' shortcode in all versions up to, and including… |
CVE-2025-10175 | Medium | 6.5 | 2025-10-11 | The WP Links Page plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 4.9.6 due to insufficient es… |
CVE-2025-10167 | Medium | 6.4 | 2025-10-11 | The Stock History & Reports Manager for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_stock_snapshot_r… |
CVE-2025-10129 | Medium | 6.4 | 2025-10-11 | The WordPress Live Webcam Widget & Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versi… |
CVE-2025-6553 | Critical | 9.8 | 2025-10-11 | The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function… |
CVE-2025-58299 | High | 8.4 | 2025-10-11 | Use After Free (UAF) vulnerability in the storage management module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58298 | High | 7.3 | 2025-10-11 | Data processing error vulnerability in the package management module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58297 | Medium | 5.9 | 2025-10-11 | Buffer overflow vulnerability in the sensor service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58295 | Medium | 5.9 | 2025-10-11 | Buffer overflow vulnerability in the development framework module. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58292 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58291 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58290 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58288 | Medium | 5.5 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58287 | High | 7.8 | 2025-10-11 | Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58286 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-11594 | Medium | 5.3 | 2025-10-11 | A vulnerability has been found in ywxbear PHP-Bookstore-Website-Example and PHP Basic BookStore Website up to 0e0b9f542f7a2d90a8d7f8c83caca69294e234e4. This is… |
CVE-2025-11518 | Medium | 5.3 | 2025-10-11 | The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via s… |
CVE-2025-11254 | Medium | 4.3 | 2025-10-11 | The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0… |
CVE-2025-11167 | Medium | 4.7 | 2025-10-11 | The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions u… |
CVE-2025-9496 | Medium | 6.4 | 2025-10-11 | The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and… |
CVE-2025-9196 | Medium | 5.3 | 2025-10-11 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve… |
CVE-2025-11533 | Critical | 9.8 | 2025-10-11 | The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() fu… |
CVE-2025-11197 | Medium | 6.4 | 2025-10-11 | The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6… |
CVE-2025-10185 | Medium | 4.9 | 2025-10-11 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in the action nf_load_form… |
CVE-2025-10048 | Medium | 4.9 | 2025-10-11 | The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 3.6.31 due to insuf… |
CVE-2025-11593 | Medium | 6.3 | 2025-10-11 | A flaw has been found in CodeAstro Gym Management System 1.0. This vulnerability affects unknown code of the file /admin/actions/delete-equipment.php. This man… |
CVE-2025-11592 | Medium | 6.3 | 2025-10-11 | A vulnerability was detected in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/edit-equipmentform.php. The manipulation o… |
CVE-2025-11591 | Medium | 6.3 | 2025-10-11 | A security vulnerability has been detected in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/acti… |
CVE-2025-58285 | Medium | 5.3 | 2025-10-11 | Permission control vulnerability in the media module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58284 | Medium | 5.9 | 2025-10-11 | Permission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58283 | Medium | 5.5 | 2025-10-11 | Permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58282 | Low | 2.8 | 2025-10-11 | Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58278 | Medium | 6.2 | 2025-10-11 | Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58277 | Medium | 4.0 | 2025-10-11 | Permission verification bypass vulnerability in the Camera app. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-9560 | Medium | 6.4 | 2025-10-11 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in all versions up to… |
CVE-2025-11380 | Medium | 5.9 | 2025-10-11 | The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a mis… |
CVE-2025-54654 | Medium | 6.2 | 2025-10-11 | Permission control vulnerability in the Gallery module. Successful exploitation of this vulnerability may affect service confidentiality |
CVE-2025-31718 | High | 7.5 | 2025-10-11 | In modem, there is a possible system crash due to improper input validation. This could lead to remote escalation of privilege with no additional execution pri… |
CVE-2025-31717 | High | 7.5 | 2025-10-11 | In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privilege… |