2025 CVEs (page 152)
Page 152 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11558 | High | 7.3 | 2025-10-09 | A vulnerability was found in code-projects E-Commerce Website 1.0. Impacted is an unknown function of the file /pages/user_index_search.php. Performing manipul… |
CVE-2025-11557 | High | 7.3 | 2025-10-09 | A vulnerability has been found in projectworlds Gate Pass Management System 1.0. This issue affects some unknown processing of the file /add-pass.php. Such man… |
CVE-2025-11556 | High | 7.3 | 2025-10-09 | A flaw has been found in code-projects Simple Leave Manager 1.0. This vulnerability affects unknown code of the file /user.php. This manipulation of the argume… |
CVE-2025-11555 | High | 7.3 | 2025-10-09 | A vulnerability was detected in Campcodes Online Learning Management System 1.0. This affects an unknown part of the file /admin/calendar_of_events.php. The ma… |
CVE-2025-60316 | Critical | 9.4 | 2025-10-09 | SourceCodester Pet Grooming Management Software 1.0 is vulnerable to SQL Injection in admin/view_customer.php via the ID parameter. |
CVE-2025-11554 | Medium | 6.3 | 2025-10-09 | A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Contr… |
CVE-2025-11553 | Medium | 6.3 | 2025-10-09 | A weakness has been identified in code-projects Courier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-cour… |
CVE-2025-59146 | High | 8.5 | 2025-10-09 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. An authenticated Server-Side Request Forgery (SSRF) vu… |
CVE-2025-55200 | High | 7.1 | 2025-10-09 | BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the "Shared Notes" feature contains a Stored Cross-Site Scripting (XSS) vulnera… |
CVE-2025-4615 | High | 7.2 | 2025-10-09 | An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrato… |
CVE-2025-4614 | Low | 2.7 | 2025-10-09 | An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authentic… |
CVE-2025-11552 | Medium | 6.3 | 2025-10-09 | A vulnerability was identified in code-projects Online Complaint Site 1.0. This impacts an unknown function of the file /admin/category.php. Such manipulation… |
CVE-2025-60267 | Medium | 6.5 | 2025-10-09 | In xckk v9.6, there is a SQL injection vulnerability in which the cond parameter in notice/list is not securely filtered, resulting in a SQL injection vulnerab… |
CVE-2025-11573 | High | 7.5 | 2025-10-09 | An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a specially crafted text inpu… |
CVE-2025-11551 | Medium | 6.3 | 2025-10-09 | A vulnerability was determined in code-projects Student Result Manager 1.0. This affects an unknown function of the file src/students/Database.java. This manip… |
CVE-2025-11550 | Medium | 6.5 | 2025-10-09 | A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP R… |
CVE-2025-60304 | Medium | 6.1 | 2025-10-09 | code-projects Simple Scheduling System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Subject Description field. |
CVE-2025-60266 | Medium | 6.5 | 2025-10-09 | In xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in address/list is not securely filtered, resulting in a SQL injection vuln… |
CVE-2025-60010 | Medium | 5.4 | 2025-10-09 | A password aging vulnerability in the RADIUS client of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to access… |
CVE-2025-60009 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-60006 | Medium | 5.3 | 2025-10-09 | Multiple instances of an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Netwo… |
CVE-2025-60004 | High | 7.5 | 2025-10-09 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2025-60002 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-60001 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-60000 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59999 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59998 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59997 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59996 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59995 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59994 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59993 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59992 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59991 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59990 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59989 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59988 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59987 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59986 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59985 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59984 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59983 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59982 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59981 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59980 | Medium | 6.5 | 2025-10-09 | An Authentication Bypass by Primary Weakness in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited r… |
CVE-2025-59978 | Critical | 9.0 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to sto… |
CVE-2025-11549 | High | 8.8 | 2025-10-09 | A vulnerability has been found in Tenda W12 3.0.0.6(3948). The affected element is the function wifiMacFilterSet of the file /goform/modules of the component H… |
CVE-2025-11371 | High | 7.5 | 2025-10-09 | In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended… |
CVE-2025-61577 | High | 7.5 | 2025-10-09 | D-Link DIR-816A2_FWv1.10CNB05 was discovered to contain a stack overflow via the statuscheckpppoeuser parameter in the dir_setWanWifi function. This vulnerabil… |
CVE-2025-61532 | Medium | 6.1 | 2025-10-09 | Cross Site Scripting vulnerability in SVX Portal v.2.7A to execute arbitrary code via the TG parameter on last_heard_page.php component |
CVE-2025-60302 | Medium | 6.1 | 2025-10-09 | code-projects Client Details System 1.0 is vulnerable to Cross Site Scripting (XSS). When adding customer information, the client details system fills in malic… |
CVE-2025-60265 | Medium | 6.5 | 2025-10-09 | In xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in user/list is not securely filtered, resulting in a SQL injection vulnera… |
CVE-2025-59976 | Medium | 6.5 | 2025-10-09 | An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET… |
CVE-2025-59975 | High | 7.5 | 2025-10-09 | An Uncontrolled Resource Consumption vulnerability in the HTTP daemon (httpd) of Juniper Networks Junos Space allows an unauthenticated network-based attacker… |
CVE-2025-59974 | High | 8.4 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Junos Space Security Director allows an attacker to in… |
CVE-2025-59968 | High | 8.6 | 2025-10-09 | A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify… |
CVE-2025-59967 | Medium | 6.5 | 2025-10-09 | A NULL Pointer Dereference vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX… |
CVE-2025-59964 | High | 7.5 | 2025-10-09 | A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700 devices allows an unauthenticated… |
CVE-2025-59962 | Medium | 5.3 | 2025-10-09 | An Access of Uninitialized Pointer vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved with BGP sharding confi… |
CVE-2025-59958 | Medium | 6.5 | 2025-10-09 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on PTX Series… |
CVE-2025-59957 | Medium | 6.8 | 2025-10-09 | An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthent… |
CVE-2025-56426 | Medium | 6.5 | 2025-10-09 | An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logi… |
CVE-2025-52961 | Medium | 6.5 | 2025-10-09 | An Uncontrolled Resource Consumption vulnerability in the Connectivity Fault Management (CFM) daemon and the Connectivity Fault Management Manager (cfmman) of… |
CVE-2025-52960 | Medium | 5.9 | 2025-10-09 | A Buffer Copy without Checking Size of Input vulnerability in the Session Initialization Protocol (SIP) ALG of Juniper Networks Junos OS on MX Series and SRX… |
CVE-2025-11198 | High | 7.4 | 2025-10-09 | A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based att… |
CVE-2025-10284 | Critical | 9.6 | 2025-10-09 | BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote… |
CVE-2025-10283 | Critical | 9.6 | 2025-10-09 | BBOT's gitdumper module could be abused to execute commands through a malicious git repository. |
CVE-2025-10282 | Medium | 4.7 | 2025-10-09 | BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL. |
CVE-2025-10281 | Medium | 4.7 | 2025-10-09 | BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL. |
CVE-2025-56683 | Critical | 9.6 | 2025-10-09 | A cross-site scripting (XSS) vulnerability in the component /app/marketplace.html of Logseq v0.10.9 allows attackers to execute arbitrary code via injecting ar… |
CVE-2025-45095 | High | 7.3 | 2025-10-09 | Lavasoft Web Companion (also known as Ad-Aware WebCompanion) versions 8.9.0.1091 through 12.1.3.1037 installs the DCIService.exe service with an unquoted servi… |
CVE-2025-39664 | Medium | 6.5 | 2025-10-09 | Insufficient escaping in the report scheduler within Checkmk <2.4.0p13, <2.3.0p38, <2.2.0p46 and 2.1.0 (EOL) allows authenticated attackers to define the stora… |
CVE-2025-32919 | High | 7.8 | 2025-10-09 | Use of an insecure temporary directory in the Windows License plugin for the Checkmk Windows Agent allows Privilege Escalation. This issue affects Checkmk: fro… |
CVE-2025-32916 | Medium | 4.3 | 2025-10-09 | Potential use of sensitive information in GET requests in Checkmk GmbH's Checkmk versions <2.4.0p13, <2.3.0p38, <2.2.0p46, and 2.1.0 (EOL) may cause sensitive… |
CVE-2025-62228 | High | 8.8 | 2025-10-09 | Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even thro… |
CVE-2025-36225 | Medium | 4.3 | 2025-10-09 | IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of retu… |
CVE-2025-36171 | Medium | 4.9 | 2025-10-09 | IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resour… |
CVE-2025-11561 | High | 8.8 | 2025-10-09 | A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerbero… |
CVE-2025-39963 | High | 7.8 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function, there… |
CVE-2025-39962 | High | 7.5 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix untrusted unsigned subtract Fix the following Smatch static checker warning: … |
CVE-2025-39961 | High | 8.8 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host pag… |
CVE-2025-39960 | High | 7.3 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: gpiolib: acpi: initialize acpi_gpio_info struct Since commit 7c010d463372 ("gpiolib: acpi… |
CVE-2025-10240 | High | 8.8 | 2025-10-09 | A vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may… |
CVE-2025-10239 | High | 7.2 | 2025-10-09 | In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interfac… |
CVE-2025-9371 | Medium | 6.4 | 2025-10-09 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_title’ parameter in all versions up to, and including, 28.1.6 due to… |
CVE-2025-2934 | Medium | 4.3 | 2025-10-09 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 that could have… |
CVE-2025-11340 | High | 7.7 | 2025-10-09 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authe… |
CVE-2025-10249 | Medium | 6.5 | 2025-10-09 | The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions… |
CVE-2025-10004 | High | 7.5 | 2025-10-09 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab insta… |
CVE-2025-39959 | Medium | 5.5 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp: Fix incorrect retrival of acp_chip_info Use dev_get_drvdata(dev->parent)… |
CVE-2025-39958 | High | 7.8 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Make attach succeed when the device was surprise removed When a PCI device is… |
CVE-2025-39957 | High | 7.1 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: increase scan_ies_len for S1G Currently the S1G capability element is not… |
CVE-2025-39956 | High | 7.8 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: igc: don't fail igc_probe() on LED setup error When igc_led_setup() fails, igc_probe() fa… |
CVE-2025-39955 | High | 7.8 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported the splat below… |
CVE-2025-39954 | Medium | 5.5 | 2025-10-09 | In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: mp: Fix dual-divider clock rate readback When dual-divider clock support w… |
CVE-2025-10862 | High | 7.5 | 2025-10-09 | The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in a… |
CVE-2025-11539 | Critical | 9.9 | 2025-10-09 | Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoi… |
CVE-2025-11522 | Critical | 9.8 | 2025-10-09 | The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and includin… |
CVE-2025-7634 | Critical | 9.8 | 2025-10-09 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and inclu… |
CVE-2025-7526 | Critical | 9.8 | 2025-10-09 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insuffi… |