2025 CVEs (page 155)
Page 155 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-61772 | High | 7.5 | 2025-10-07 | Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a mul… |
CVE-2025-61771 | High | 7.5 | 2025-10-07 | Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser` stores non-file form fields (parts with… |
CVE-2025-61770 | High | 7.5 | 2025-10-07 | Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (b… |
CVE-2025-11398 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The impacted element is an unknown function of the file /profile.php of… |
CVE-2025-59425 | High | 7.5 | 2025-10-07 | vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a met… |
CVE-2025-57564 | High | 8.2 | 2025-10-07 | CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/insert/elasticsearch/_bu… |
CVE-2025-54406 | High | 8.8 | 2025-10-07 | Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP reque… |
CVE-2025-54405 | High | 8.8 | 2025-10-07 | Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP reque… |
CVE-2025-54404 | High | 8.8 | 2025-10-07 | Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead… |
CVE-2025-54403 | High | 8.8 | 2025-10-07 | Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead… |
CVE-2025-54402 | High | 8.8 | 2025-10-07 | Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTT… |
CVE-2025-54401 | High | 8.8 | 2025-10-07 | Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTT… |
CVE-2025-54400 | High | 8.8 | 2025-10-07 | Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTT… |
CVE-2025-54399 | High | 8.8 | 2025-10-07 | Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTT… |
CVE-2025-53476 | Medium | 5.3 | 2025-10-07 | A denial of service vulnerability exists in the ModbusTCP server functionality of OpenPLC _v3 a931181e8b81e36fadf7b74d5cba99b73c3f6d58. A specially crafted ser… |
CVE-2025-50505 | High | 7.8 | 2025-10-07 | Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key functions through the un… |
CVE-2025-48826 | High | 8.8 | 2025-10-07 | A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to… |
CVE-2025-37728 | Medium | 5.4 | 2025-10-07 | Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credenti… |
CVE-2025-25009 | High | 8.7 | 2025-10-07 | Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. |
CVE-2025-11397 | High | 7.3 | 2025-10-07 | A security flaw has been discovered in SourceCodester Hotel and Lodge Management System 1.0. The affected element is an unknown function of the file /login.php… |
CVE-2025-40889 | High | 8.1 | 2025-10-07 | A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authenticated user with l… |
CVE-2025-40888 | Medium | 5.3 | 2025-10-07 | A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. An authenticated user with limited priv… |
CVE-2025-40887 | Medium | 5.3 | 2025-10-07 | A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited pr… |
CVE-2025-40886 | High | 7.5 | 2025-10-07 | A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited pr… |
CVE-2025-40885 | Medium | 5.3 | 2025-10-07 | A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with li… |
CVE-2025-40676 | | 2025-10-07 | Insecure Direct Object Reference (IDOR) in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure (BBMRI-ERIC). This… | |
CVE-2025-40649 | | 2025-10-07 | Stored Cross-Site Scripting (XSS) in Biobanking and Biomolecular Resources Negotiator v3.15.2 - European Research Infrastructure (BBMRI-ERIC), consisting of a… | |
CVE-2025-3719 | High | 8.1 | 2025-10-07 | An access control vulnerability was discovered in the CLI functionality due to a specific access restriction not being properly enforced for users with limited… |
CVE-2025-3718 | High | 7.9 | 2025-10-07 | A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. An authent… |
CVE-2025-11396 | High | 7.3 | 2025-10-07 | A vulnerability was identified in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /product.php. Such manipulation of… |
CVE-2025-11390 | Medium | 4.3 | 2025-10-07 | A weakness has been identified in PHPGurukul Cyber Cafe Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /search.p… |
CVE-2025-11389 | High | 8.8 | 2025-10-07 | A security flaw has been discovered in Tenda AC15 15.03.05.18. Affected is an unknown function of the file /goform/saveAutoQos. Performing a manipulation of th… |
CVE-2025-0603 | Critical | 9.8 | 2025-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Callvision Healthcare Callvision Emergency Code allows SQ… |
CVE-2025-11388 | High | 8.8 | 2025-10-07 | A vulnerability was identified in Tenda AC15 15.03.05.18. This impacts an unknown function of the file /goform/setNotUpgrade. Such manipulation of the argument… |
CVE-2025-11387 | High | 8.8 | 2025-10-07 | A vulnerability was determined in Tenda AC15 15.03.05.18. This affects an unknown function of the file /goform/fast_setting_pppoe_set. This manipulation of the… |
CVE-2025-11386 | High | 8.8 | 2025-10-07 | A vulnerability was found in Tenda AC15 15.03.05.18. The impacted element is an unknown function of the file /goform/SetDDNSCfg of the component POST Parameter… |
CVE-2025-11385 | High | 8.8 | 2025-10-07 | A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The affected element is the function sscanf of the file /goform/fast_setting_wifi_set. The mani… |
CVE-2025-11360 | Medium | 4.3 | 2025-10-07 | A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component AP… |
CVE-2025-11359 | Medium | 6.3 | 2025-10-07 | A security vulnerability has been detected in code-projects Simple Banking System 1.0. The affected element is an unknown function of the file /transfermoney.p… |
CVE-2025-10645 | Medium | 5.3 | 2025-10-07 | The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method… |
CVE-2025-7400 | Medium | 6.4 | 2025-10-07 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions… |
CVE-2025-11358 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in code-projects Simple Banking System 1.0. Impacted is an unknown function of the file /removeuser.php. Executing manipulation… |
CVE-2025-11357 | Medium | 6.3 | 2025-10-07 | A security flaw has been discovered in code-projects Simple Banking System 1.0. This issue affects some unknown processing of the file /createuser.php. Perform… |
CVE-2025-11356 | High | 8.8 | 2025-10-07 | A vulnerability was found in Tenda AC23 up to 16.03.07.52. Affected by this issue is the function sscanf of the file /goform/SetStaticRouteCfg. The manipulatio… |
CVE-2025-11355 | High | 8.8 | 2025-10-07 | A vulnerability has been found in UTT 1250GW up to v2v3.2.2-200710. Affected by this vulnerability is the function strcpy of the file /goform/aspChangeChannel… |
CVE-2025-11354 | Medium | 6.3 | 2025-10-07 | A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.php. Executing mani… |
CVE-2025-11353 | Medium | 6.3 | 2025-10-07 | A vulnerability was detected in code-projects Online Hotel Reservation System 1.0. This impacts an unknown function of the file /admin/addgalleryexec.php. Perf… |
CVE-2025-10162 | High | 7.5 | 2025-10-07 | The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin before 14 does not validate the path of files to be downloaded, which… |
CVE-2025-11362 | High | 7.5 | 2025-10-07 | Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedl… |
CVE-2025-11352 | Medium | 6.3 | 2025-10-07 | A security vulnerability has been detected in code-projects Online Hotel Reservation System 1.0. This affects an unknown function of the file /admin/addexec.ph… |
CVE-2025-11351 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in code-projects Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/editpicexec… |
CVE-2025-11350 | High | 7.3 | 2025-10-07 | A security flaw has been discovered in Campcodes Online Apartment Visitor Management System 1.0. The affected element is an unknown function of the file /bwdat… |
CVE-2025-11349 | High | 7.3 | 2025-10-07 | A vulnerability was identified in Campcodes Online Apartment Visitor Management System 1.0. Impacted is an unknown function of the file /search-visitor.php. Th… |
CVE-2025-11348 | High | 7.3 | 2025-10-07 | A vulnerability was determined in Campcodes Online Apartment Visitor Management System 1.0. This issue affects some unknown processing of the file /index.php… |
CVE-2025-11347 | High | 7.3 | 2025-10-07 | A vulnerability was found in code-projects Student Crud Operation up to 3.3. This vulnerability affects the function move_uploaded_file of the file add.php of… |
CVE-2025-34251 | | 2025-10-07 | Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU runs the Android Debug Bridge (adbd) as… | |
CVE-2025-61774 | | 2025-10-06 | PyVista provides 3D plotting and mesh analysis through an interface for the Visualization Toolkit (VTK). Version 0.46.3 of the PyVista Project is vulnerable to… | |
CVE-2025-61768 | | 2025-10-06 | KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF (Server-Side Request Forgery) vulnerability exists in the Medi… | |
CVE-2025-43824 | Medium | 5.4 | 2025-10-06 | The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 20… |
CVE-2025-59452 | Medium | 5.8 | 2025-10-06 | The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, su… |
CVE-2025-59451 | Low | 3.5 | 2025-10-06 | The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes. |
CVE-2025-59450 | Medium | 4.3 | 2025-10-06 | The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials. |
CVE-2025-59449 | Medium | 4.9 | 2025-10-06 | The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to… |
CVE-2025-59448 | Medium | 4.7 | 2025-10-06 | Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monit… |
CVE-2025-59447 | Low | 2.2 | 2025-10-06 | The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log… |
CVE-2025-11346 | Medium | 6.3 | 2025-10-06 | A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation… |
CVE-2025-61985 | Low | 3.6 | 2025-10-06 | ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. |
CVE-2025-61984 | Low | 3.6 | 2025-10-06 | ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution… |
CVE-2025-11345 | Medium | 5.5 | 2025-10-06 | A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes… |
CVE-2025-11344 | Medium | 6.3 | 2025-10-06 | A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate Import Hand… |
CVE-2025-6985 | High | 7.5 | 2025-10-06 | The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing. This vul… |
CVE-2025-57515 | Critical | 9.8 | 2025-10-06 | A SQL injection vulnerability has been identified in Uniclare Student Portal v2. This flaw allows remote attackers to inject arbitrary SQL commands via vulnera… |
CVE-2025-56382 | Medium | 6.1 | 2025-10-06 | A stored Cross-site scripting (XSS) vulnerability exists in the Customer Management Module of LionCoders SalePro POS 5.4.8. An authenticated attacker can injec… |
CVE-2025-28129 | Medium | 5.4 | 2025-10-06 | Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking. |
CVE-2025-11343 | High | 7.3 | 2025-10-06 | A security vulnerability has been detected in code-projects Student Crud Operation 3.3. Affected is an unknown function of the file delete.php. The manipulatio… |
CVE-2025-11342 | Medium | 4.7 | 2025-10-06 | A weakness has been identified in code-projects Online Course Registration 1.0. This impacts an unknown function of the file /admin/edit-course.php. Executing… |
CVE-2025-61778 | | 2025-10-06 | Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via ou… | |
CVE-2025-61777 | Critical | 9.4 | 2025-10-06 | Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/b… |
CVE-2025-61769 | Medium | 6.1 | 2025-10-06 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including version 2.5.22 allows authenticated re… |
CVE-2025-61766 | Medium | 6.5 | 2025-10-06 | Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to version 1.0.0, infinite recursion can occur if a user queries a buc… |
CVE-2025-60969 | Medium | 5.7 | 2025-10-06 | Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive inf… |
CVE-2025-60967 | High | 7.3 | 2025-10-06 | Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensit… |
CVE-2025-60965 | Critical | 9.1 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary… |
CVE-2025-60964 | Critical | 9.1 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary… |
CVE-2025-60963 | High | 8.2 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary… |
CVE-2025-60962 | High | 8.2 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive in… |
CVE-2025-60961 | Medium | 6.1 | 2025-10-06 | Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensit… |
CVE-2025-60960 | High | 8.2 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary… |
CVE-2025-60959 | High | 8.2 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive in… |
CVE-2025-60958 | High | 7.3 | 2025-10-06 | Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensit… |
CVE-2025-60957 | Critical | 9.9 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary… |
CVE-2025-60956 | High | 8.0 | 2025-10-06 | Cross Site Request Forgery (CSRF) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to exec… |
CVE-2025-57247 | Critical | 9.1 | 2025-10-06 | The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorrect access control i… |
CVE-2025-36356 | Critical | 9.3 | 2025-10-06 | IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated us… |
CVE-2025-36355 | High | 8.5 | 2025-10-06 | IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated… |
CVE-2025-36354 | High | 7.3 | 2025-10-06 | IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow an unauthenticated use… |
CVE-2025-11341 | High | 7.3 | 2025-10-06 | A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=S… |
CVE-2025-11339 | High | 8.8 | 2025-10-06 | A vulnerability has been found in D-Link DI-7100G C1 up to 20250928. This issue affects the function sub_4BD4F8 of the file /webchat/hi_block.asp of the compon… |
CVE-2025-10363 | | 2025-10-06 | Deserialization of Untrusted Data vulnerability in Topal Solutions AG Topal Finanzbuchhaltung on Windows allows Remote Code Execution.This issue affects at lea… | |
CVE-2025-0038 | Medium | 6.6 | 2025-10-06 | In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow access to isolated or pr… |