2025 CVEs (page 155)
Page 155 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11505 | High | 7.3 | 2025-10-08 | A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/new-appointment.php. The… |
CVE-2025-60311 | High | 8.8 | 2025-10-08 | ProjectWorlds Gym Management System1.0 is vulnerable to SQL Injection via the "id" parameter in the profile/edit.php page |
CVE-2025-11503 | High | 7.3 | 2025-10-08 | A vulnerability was determined in PHPGurukul Beauty Parlour Management System 1.1. This issue affects some unknown processing of the file /admin/manage-service… |
CVE-2025-11495 | Low | 3.3 | 2025-10-08 | A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the compone… |
CVE-2025-11494 | Low | 3.3 | 2025-10-08 | A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. T… |
CVE-2025-61524 | High | 7.2 | 2025-10-08 | An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remo… |
CVE-2025-57457 | High | 8.8 | 2025-10-08 | An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr"… |
CVE-2025-11491 | Medium | 6.3 | 2025-10-08 | A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager… |
CVE-2025-11490 | Medium | 6.3 | 2025-10-08 | A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/comman… |
CVE-2025-9868 | | 2025-10-08 | Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attac… | |
CVE-2025-61906 | Medium | 4.3 | 2025-10-08 | Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations… |
CVE-2025-61788 | Medium | 5.4 | 2025-10-08 | Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, the paella would in… |
CVE-2025-42706 | Medium | 6.5 | 2025-10-08 | A logic error exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files… |
CVE-2025-42701 | Medium | 5.6 | 2025-10-08 | A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary fi… |
CVE-2025-11489 | Medium | 4.5 | 2025-10-08 | A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file… |
CVE-2025-11488 | High | 7.3 | 2025-10-08 | A weakness has been identified in D-Link DIR-852 up to 20251002. This affects an unknown part of the file /HNAP1/. Executing manipulation can lead to command i… |
CVE-2025-11487 | Medium | 6.3 | 2025-10-08 | A security flaw has been discovered in SourceCodester Farm Management System 1.0. Affected by this issue is some unknown functionality of the file /uploadProdu… |
CVE-2025-9970 | High | 7.4 | 2025-10-08 | Cleartext Storage of Sensitive Information in Memory vulnerability in ABB MConfig.This issue affects MConfig: through 1.4.9.21. |
CVE-2025-53967 | High | 8.0 | 2025-10-08 | Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST reques… |
CVE-2025-11486 | Medium | 6.3 | 2025-10-08 | A vulnerability was identified in SourceCodester Farm Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /buyNow.php… |
CVE-2025-11485 | Low | 2.4 | 2025-10-08 | A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected is the function add_user of the file /admin.php of the componen… |
CVE-2025-11481 | Medium | 6.3 | 2025-10-08 | A flaw has been found in varunsardana004 Blood-Bank-And-Donation-Management-System up to dc9e0393d826fbc85fad9755b5bc12cba1919df2. The impacted element is an u… |
CVE-2025-60318 | Medium | 6.1 | 2025-10-08 | SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the fname (First Name) and lname (Las… |
CVE-2025-5009 | | 2025-10-08 | In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conv… | |
CVE-2025-59303 | Medium | 6.4 | 2025-10-08 | HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permi… |
CVE-2025-36636 | Medium | 4.3 | 2025-10-08 | In Tenable Security Center versions prior to 6.7.0, an improper access control vulnerability exists where an authenticated user could access areas outside of t… |
CVE-2025-61672 | | 2025-10-08 | Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attack… | |
CVE-2025-60834 | Medium | 6.5 | 2025-10-08 | A fastjson deserialization vulnerability in uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying a crafted input. |
CVE-2025-60313 | Medium | 6.1 | 2025-10-08 | Sourcecodester Link Status Checker 1.0 is vulnerable to a Cross-Site Scripting (XSS) in the Enter URLs to check input field. This allows a remote attacker to e… |
CVE-2025-43771 | Medium | 5.4 | 2025-10-08 | Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 throug… |
CVE-2025-43724 | Medium | 4.4 | 2025-10-08 | Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. A high privileged attacker with… |
CVE-2025-11480 | High | 7.3 | 2025-10-08 | A vulnerability was detected in SourceCodester Simple E-Commerce Bookstore 1.0. The affected element is an unknown function of the file /register.php. Performi… |
CVE-2025-11479 | High | 7.3 | 2025-10-08 | A security vulnerability has been detected in SourceCodester Wedding Reservation Management System 1.0. Impacted is the function insertReservation of the file… |
CVE-2025-61183 | Medium | 6.1 | 2025-10-08 | Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php |
CVE-2025-60833 | Medium | 6.5 | 2025-10-08 | An XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying cra… |
CVE-2025-60830 | Medium | 6.5 | 2025-10-08 | redragon-erp v1.0 was discovered to contain a Shiro deserialization vulnerability caused by the default Shiro key. |
CVE-2025-60828 | Medium | 6.5 | 2025-10-08 | WukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via the /OaExamine/setOaExamine interface. |
CVE-2025-60314 | Medium | 5.4 | 2025-10-08 | Configuroweb Sistema Web de Inventario 1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) due to the lack of input sanitization on the product name param… |
CVE-2025-43830 | Medium | 6.1 | 2025-10-08 | Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 thro… |
CVE-2025-43829 | Medium | 5.4 | 2025-10-08 | Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Liferay DXP 2023.Q4.0 th… |
CVE-2025-11478 | Medium | 6.3 | 2025-10-08 | A weakness has been identified in SourceCodester Farm Management System 1.0. This issue affects some unknown processing of the file /myCart.php. This manipulat… |
CVE-2025-11477 | High | 7.3 | 2025-10-08 | A security flaw has been discovered in SourceCodester Wedding Reservation Management System 1.0. This vulnerability affects unknown code of the file /global.ph… |
CVE-2025-11476 | High | 7.3 | 2025-10-08 | A vulnerability was identified in SourceCodester Simple E-Commerce Bookstore 1.0. This affects an unknown part of the file /index.php. The manipulation of the… |
CVE-2025-60299 | Medium | 5.4 | 2025-10-08 | Novel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /book/addCommentReply endpoint. An authenticated user… |
CVE-2025-60298 | Medium | 5.4 | 2025-10-08 | Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. This vulnerability… |
CVE-2025-43821 | Medium | 5.4 | 2025-10-08 | Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0 t… |
CVE-2025-11475 | High | 7.3 | 2025-10-08 | A vulnerability was determined in projectworlds Advanced Library Management System 1.0. Affected by this issue is some unknown functionality of the file /view_… |
CVE-2025-11474 | Medium | 6.3 | 2025-10-08 | A vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit… |
CVE-2025-11473 | High | 7.3 | 2025-10-08 | A vulnerability has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected is an unknown function of the file /edit_curr.php. Such manipu… |
CVE-2025-11472 | High | 7.3 | 2025-10-08 | A flaw has been found in SourceCodester Hotel and Lodge Management System 1.0. This impacts an unknown function of the file /edit_room.php. This manipulation o… |
CVE-2025-11471 | High | 7.3 | 2025-10-08 | A vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown function of the file /edit_customer.php. The mani… |
CVE-2025-10649 | Medium | 6.5 | 2025-10-08 | The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via the cookie in all versions up to, and including, 2.11.21 due to insufficient esc… |
CVE-2025-10353 | | 2025-10-08 | File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker… | |
CVE-2025-10352 | | 2025-10-08 | Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator… | |
CVE-2025-10351 | | 2025-10-08 | SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, creat… | |
CVE-2025-11470 | Medium | 4.7 | 2025-10-08 | A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to 1.0. The impacted element is an unknown function of the fi… |
CVE-2025-11469 | Medium | 6.3 | 2025-10-08 | A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The affected element is an unknown function of the file /pages/save_cus… |
CVE-2025-11445 | Medium | 6.3 | 2025-10-08 | A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component P… |
CVE-2025-11444 | High | 8.8 | 2025-10-08 | A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cs… |
CVE-2025-11443 | Low | 3.7 | 2025-10-08 | A weakness has been identified in JhumanJ OpnForm up to 1.9.3. This affects an unknown function of the file /api/password/email of the component Forgotten Pass… |
CVE-2025-11442 | Medium | 4.3 | 2025-10-08 | A security flaw has been discovered in JhumanJ OpnForm up to 1.9.3. The impacted element is an unknown function of the component API Endpoint. The manipulation… |
CVE-2025-48464 | Medium | 4.7 | 2025-10-08 | Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials… |
CVE-2025-11441 | Low | 3.7 | 2025-10-08 | A vulnerability was identified in JhumanJ OpnForm up to 1.9.3. The affected element is an unknown function of the component HTTP Header Handler. The manipulati… |
CVE-2025-11440 | Medium | 4.3 | 2025-10-08 | A vulnerability was determined in JhumanJ OpnForm up to 1.9.3. Impacted is an unknown function of the file /edit. Executing manipulation can lead to improper a… |
CVE-2025-11439 | Medium | 4.3 | 2025-10-08 | A vulnerability was found in JhumanJ OpnForm up to 1.9.3. This issue affects some unknown processing of the file /show/integrations. Performing manipulation re… |
CVE-2025-11438 | Medium | 6.3 | 2025-10-08 | A vulnerability has been found in JhumanJ OpnForm up to 1.9.3. This vulnerability affects unknown code of the file /custom-domains of the component API Endpoin… |
CVE-2025-11437 | Low | 2.4 | 2025-10-08 | A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor. This manipulation… |
CVE-2025-11436 | Medium | 6.3 | 2025-10-08 | A vulnerability was detected in JhumanJ OpnForm up to 1.9.3. Affected by this issue is some unknown functionality of the file /answer. The manipulation results… |
CVE-2025-11435 | Medium | 4.3 | 2025-10-08 | A security vulnerability has been detected in JhumanJ OpnForm up to 1.9.3. Affected by this vulnerability is an unknown functionality of the file /show/submiss… |
CVE-2025-11171 | Medium | 5.3 | 2025-10-08 | The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9… |
CVE-2025-10635 | High | 7.7 | 2025-10-08 | The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to… |
CVE-2025-11434 | High | 7.3 | 2025-10-08 | A weakness has been identified in itsourcecode Student Transcript Processing System 1.0. Affected is an unknown function of the file /login.php. Executing a ma… |
CVE-2025-11433 | Low | 3.5 | 2025-10-08 | A security flaw has been discovered in itsourcecode Leave Management System 1.0. This impacts the function redirect of the file /module/employee/controller.php… |
CVE-2025-11432 | High | 7.3 | 2025-10-08 | A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /reset.php. Such manipulation of the a… |
CVE-2025-11204 | High | 7.2 | 2025-10-08 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versio… |
CVE-2025-11431 | Medium | 6.3 | 2025-10-08 | A vulnerability was determined in code-projects Web-Based Inventory and POS System 1.0. The impacted element is an unknown function of the file /transaction.ph… |
CVE-2025-11430 | High | 7.3 | 2025-10-08 | A vulnerability was found in SourceCodester Simple E-Commerce Bookstore 1.0. The affected element is an unknown function of the file /cart.php. The manipulatio… |
CVE-2025-10587 | Critical | 9.8 | 2025-10-08 | The Community Events plugin for WordPress is vulnerable to SQL Injection via the event_category parameter in all versions up to, and including, 1.5.1 due to in… |
CVE-2025-10494 | High | 8.1 | 2025-10-08 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation… |
CVE-2025-11426 | Medium | 6.3 | 2025-10-08 | A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-11425 | Low | 2.4 | 2025-10-08 | A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /edit_admin.php. The manipu… |
CVE-2025-61787 | High | 8.1 | 2025-10-08 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when… |
CVE-2025-11424 | High | 7.3 | 2025-10-08 | A vulnerability was determined in code-projects Web-Based Inventory and POS System 1.0. This impacts an unknown function of the file /login.php. Executing mani… |
CVE-2025-11423 | Critical | 9.8 | 2025-10-08 | A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function formSafeEmailFilter of the file /goform/SafeEmailFilter. Performing a manipulation o… |
CVE-2025-11422 | High | 7.3 | 2025-10-08 | A vulnerability has been found in Campcodes Advanced Online Voting Management System 1.0. The impacted element is an unknown function of the file /admin/login… |
CVE-2025-11421 | Low | 3.5 | 2025-10-08 | A flaw has been found in code-projects Voting System 1.0. The affected element is an unknown function of the file /admin/candidates_edit.php. This manipulation… |
CVE-2025-61786 | Low | 3.3 | 2025-10-08 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statS… |
CVE-2025-61785 | Low | 3.3 | 2025-10-08 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utim… |
CVE-2025-48981 | High | 8.6 | 2025-10-08 | An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the… |
CVE-2025-11420 | High | 7.3 | 2025-10-08 | A vulnerability was detected in code-projects E-Commerce Website 1.0. Impacted is an unknown function of the file /pages/edit_order_details.php. The manipulati… |
CVE-2025-11418 | Critical | 9.8 | 2025-10-08 | A security vulnerability has been detected in Tenda CH22 up to 1.0.0.1. This issue affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of… |
CVE-2025-61999 | Medium | 4.3 | 2025-10-08 | OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedded in an SVG image used as a logo. Injected conten… |
CVE-2025-61998 | Medium | 4.3 | 2025-10-08 | OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager… |
CVE-2025-61997 | Medium | 4.3 | 2025-10-08 | OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise Banner image upload… |
CVE-2025-61996 | Medium | 4.3 | 2025-10-08 | OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. Injected content is e… |
CVE-2025-11417 | Medium | 6.3 | 2025-10-08 | A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This vulnerability affects unknown code of the file /admin/voters_add… |
CVE-2025-43822 | Medium | 5.4 | 2025-10-07 | Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1… |
CVE-2025-11416 | High | 7.3 | 2025-10-07 | A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/invoices.php. Performin… |
CVE-2025-11415 | High | 7.3 | 2025-10-07 | A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/cust… |
CVE-2025-11414 | Low | 3.3 | 2025-10-07 | A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the compon… |