2025 CVEs (page 156)
Page 156 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-61765 | Medium | 6.4 | 2025-10-06 | python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerability in python-socketio versions prior… |
CVE-2025-61687 | High | 8.3 | 2025-10-06 | Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authe… |
CVE-2025-61224 | Medium | 6.5 | 2025-10-06 | Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q parameter |
CVE-2025-59159 | Critical | 9.6 | 2025-10-06 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2025-59152 | High | 7.5 | 2025-10-06 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarde… |
CVE-2025-11338 | High | 8.8 | 2025-10-06 | A flaw has been found in D-Link DI-7100G C1 up to 20250928. This vulnerability affects the function sub_4C0990 of the file /webchat/login.cgi of the component… |
CVE-2025-52472 | | 2025-10-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versi… | |
CVE-2025-49594 | | 2025-10-06 | XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to… | |
CVE-2025-61198 | Medium | 5.4 | 2025-10-06 | A stored cross-site scripting (XSS) vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Optimod Trio - Optimod version 1.0.0.33 -… |
CVE-2025-61197 | High | 8.9 | 2025-10-06 | An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - System version 2.5.26 allows a remote att… |
CVE-2025-11337 | Medium | 5.3 | 2025-10-06 | A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. This affects an unknown part of the file /aloneReport/index.do… |
CVE-2025-11336 | Medium | 5.3 | 2025-10-06 | A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Affected by this issue is some unknown functiona… |
CVE-2025-11335 | Medium | 4.7 | 2025-10-06 | A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_46409C of the file /msp_info.htm?flag=q… |
CVE-2025-11334 | High | 7.3 | 2025-10-06 | A security flaw has been discovered in Campcodes Online Apartment Visitor Management System 1.0. Affected is an unknown function of the file /visitor-detail.ph… |
CVE-2025-11333 | Low | 2.4 | 2025-10-06 | A vulnerability was identified in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. This impacts an unknown function of the file… |
CVE-2025-11332 | Low | 3.5 | 2025-10-06 | A vulnerability was determined in CmsEasy up to 7.7.7. This affects an unknown function in the library lib/inc/view.php of the component URL Handler. Executing… |
CVE-2025-11331 | Medium | 4.7 | 2025-10-06 | A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Webs… |
CVE-2025-11330 | Medium | 6.3 | 2025-10-06 | A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown function of the file /admin/sales-reports… |
CVE-2025-0609 | Medium | 4.7 | 2025-10-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Logo Software Inc. Logo Cloud allows Cross-Site Sc… |
CVE-2025-0608 | Medium | 5.5 | 2025-10-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Logo Software Inc. Logo Cloud allows Phishing, Forceful Browsing. This issue affects Logo… |
CVE-2025-0607 | Medium | 4.3 | 2025-10-06 | Improper Encoding or Escaping of Output vulnerability in Logo Software Inc. Logo Cloud allows Phishing. This issue affects Logo Cloud: before 2.57. |
CVE-2025-11329 | High | 7.3 | 2025-10-06 | A flaw has been found in code-projects Online Course Registration 1.0. Impacted is an unknown function of the file /admin/manage-students.php. This manipulatio… |
CVE-2025-11328 | High | 8.8 | 2025-10-06 | A vulnerability was detected in Tenda AC18 15.03.05.19(6318). This issue affects some unknown processing of the file /goform/SetDDNSCfg. The manipulation of th… |
CVE-2025-0606 | Medium | 6.0 | 2025-10-06 | Authorization Bypass Through User-Controlled Key vulnerability in Logo Software Inc. Logo Cloud allows Forceful Browsing, Resource Leak Exposure. This issue a… |
CVE-2025-59734 | | 2025-10-06 | It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion <2. When a STOR chunk is present, a subse… | |
CVE-2025-59733 | | 2025-10-06 | When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels have the same pixel type (and size), a… | |
CVE-2025-59732 | | 2025-10-06 | When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height o… | |
CVE-2025-59731 | | 2025-10-06 | When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate… | |
CVE-2025-59730 | | 2025-10-06 | When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can spe… | |
CVE-2025-59729 | | 2025-10-06 | When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the all… | |
CVE-2025-59728 | | 2025-10-06 | When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call… | |
CVE-2025-11327 | High | 8.8 | 2025-10-06 | A security vulnerability has been detected in Tenda AC18 15.03.05.19(6318). This vulnerability affects unknown code of the file /goform/SetUpnpCfg. The manipul… |
CVE-2025-11326 | High | 8.8 | 2025-10-06 | A weakness has been identified in Tenda AC18 15.03.05.19(6318). This affects an unknown part of the file /goform/WifiMacFilterSet. Executing a manipulation of… |
CVE-2025-9914 | Medium | 4.3 | 2025-10-06 | The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access… |
CVE-2025-9913 | Medium | 4.5 | 2025-10-06 | JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking. |
CVE-2025-58591 | Medium | 6.5 | 2025-10-06 | A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gath… |
CVE-2025-58590 | Medium | 6.5 | 2025-10-06 | It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information. |
CVE-2025-58589 | Low | 2.7 | 2025-10-06 | When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal inform… |
CVE-2025-58587 | Medium | 6.5 | 2025-10-06 | The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an… |
CVE-2025-58586 | Medium | 5.3 | 2025-10-06 | For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existin… |
CVE-2025-58585 | Medium | 5.3 | 2025-10-06 | Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering. |
CVE-2025-58584 | Medium | 5.3 | 2025-10-06 | In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server… |
CVE-2025-58583 | Medium | 5.3 | 2025-10-06 | The application provides access to a login protected H2 database for caching purposes. The username is prefilled. |
CVE-2025-58582 | Medium | 5.3 | 2025-10-06 | If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to sen… |
CVE-2025-58581 | Medium | 4.3 | 2025-10-06 | When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal infor… |
CVE-2025-58580 | Medium | 6.5 | 2025-10-06 | An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can cr… |
CVE-2025-58579 | Medium | 5.3 | 2025-10-06 | Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enum… |
CVE-2025-58578 | Low | 3.8 | 2025-10-06 | A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, check… |
CVE-2025-11325 | High | 8.8 | 2025-10-06 | A security flaw has been discovered in Tenda AC18 15.03.05.19(6318). Affected by this issue is some unknown functionality of the file /goform/fast_setting_pppo… |
CVE-2025-11324 | High | 8.8 | 2025-10-06 | A vulnerability was identified in Tenda AC18 15.03.05.19(6318). Affected by this vulnerability is an unknown functionality of the file /goform/setNotUpgrade. S… |
CVE-2025-9710 | Medium | 6.3 | 2025-10-06 | The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticate… |
CVE-2025-9703 | Medium | 4.3 | 2025-10-06 | The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded… |
CVE-2025-57781 | High | 7.8 | 2025-10-06 | The installers of DENSO TEN drive recorder viewer contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a… |
CVE-2025-11323 | High | 8.8 | 2025-10-06 | A vulnerability was determined in UTT 1250GW up to v2v3.2.2-200710. Affected is the function strcpy of the file /goform/formUserStatusRemark. This manipulation… |
CVE-2025-11322 | Low | 3.7 | 2025-10-06 | A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creatio… |
CVE-2025-11321 | Medium | 4.3 | 2025-10-06 | A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/educat… |
CVE-2025-11320 | Medium | 6.3 | 2025-10-06 | A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Impacted is the function uploadFile of the file src/main/java/com/… |
CVE-2025-11319 | Medium | 6.3 | 2025-10-06 | A weakness has been identified in nahiduddinahammed Hospital-Management-System-Website up to e6562429e14b2f88bd2139cae16e87b965024097. This issue affects some… |
CVE-2025-11318 | High | 7.3 | 2025-10-06 | A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This vulnerability affects unknown code of the file u… |
CVE-2025-11317 | High | 7.3 | 2025-10-06 | A vulnerability was identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findRolePage of the file findSin… |
CVE-2025-11316 | High | 7.3 | 2025-10-06 | A vulnerability was determined in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this issue is the function findCategoryPage of… |
CVE-2025-50538 | High | 8.2 | 2025-10-06 | Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log. |
CVE-2025-29192 | High | 8.2 | 2025-10-06 | Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log. |
CVE-2025-11315 | High | 7.3 | 2025-10-06 | A vulnerability was found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this vulnerability is the function findUserPage of… |
CVE-2025-11314 | High | 7.3 | 2025-10-06 | A vulnerability has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected is the function findRolePage of the file findSing… |
CVE-2025-11313 | High | 7.3 | 2025-10-06 | A flaw has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This impacts the function findRolePage of the file findRolePage.do… |
CVE-2025-11312 | High | 7.3 | 2025-10-06 | A vulnerability was detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findModulePage of the file findMod… |
CVE-2025-11311 | High | 7.3 | 2025-10-06 | A security vulnerability has been detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The impacted element is the function findTenan… |
CVE-2025-11310 | High | 7.3 | 2025-10-06 | A weakness has been identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The affected element is the function findFileServerPage of… |
CVE-2025-11309 | High | 7.3 | 2025-10-05 | A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Impacted is the function doFilter of the file findDep… |
CVE-2025-11308 | Low | 3.5 | 2025-10-05 | A vulnerability was identified in Vanderlande Baggage 360 7.0.0. This issue affects some unknown processing of the file /api-addons/v1/messages. Such manipulat… |
CVE-2025-11306 | Medium | 4.3 | 2025-10-05 | A vulnerability was found in qianfox FoxCMS up to 1.2. This affects an unknown part of the file /index.php/Search of the component Search Page. The manipulatio… |
CVE-2025-11305 | High | 8.8 | 2025-10-05 | A vulnerability has been found in UTT HiPER 840G up to 3.1.1-190328. Affected by this issue is the function strcpy of the file /goform/formTaskEdit. The manipu… |
CVE-2025-11304 | Medium | 6.3 | 2025-10-05 | A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing m… |
CVE-2025-11303 | Medium | 6.3 | 2025-10-05 | A vulnerability was detected in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/mp. Performing a manipulation of the argument comma… |
CVE-2025-11302 | High | 8.8 | 2025-10-05 | A security vulnerability has been detected in Belkin F9K1015 1.00.10. This impacts an unknown function of the file /goform/formWpsStart. Such manipulation of t… |
CVE-2025-11301 | High | 8.8 | 2025-10-05 | A weakness has been identified in Belkin F9K1015 1.00.10. This affects an unknown function of the file /goform/formWlanSetupWPS. This manipulation of the argum… |
CVE-2025-11300 | High | 8.8 | 2025-10-05 | A security flaw has been discovered in Belkin F9K1015 1.00.10. The impacted element is an unknown function of the file /goform/formWlanMP. The manipulation of… |
CVE-2025-11299 | High | 8.8 | 2025-10-05 | A vulnerability was identified in Belkin F9K1015 1.00.10. The affected element is an unknown function of the file /goform/formWanTcpipSetup. The manipulation o… |
CVE-2025-11298 | Medium | 6.3 | 2025-10-05 | A vulnerability was determined in Belkin F9K1015 1.00.10. Impacted is an unknown function of the file /goform/formSetWanStatic. Executing a manipulation of the… |
CVE-2025-11297 | High | 8.8 | 2025-10-05 | A vulnerability was found in Belkin F9K1015 1.00.10. This issue affects some unknown processing of the file /goform/formSetLanguage. Performing a manipulation… |
CVE-2025-11296 | High | 8.8 | 2025-10-05 | A vulnerability has been found in Belkin F9K1015 1.00.10. This vulnerability affects unknown code of the file /goform/formPPTPSetup. Such manipulation of the a… |
CVE-2025-11295 | High | 8.8 | 2025-10-05 | A flaw has been found in Belkin F9K1015 1.00.10. This affects an unknown part of the file /goform/formPPPoESetup. This manipulation of the argument pppUserName… |
CVE-2025-11294 | High | 8.8 | 2025-10-05 | A vulnerability was detected in Belkin F9K1015 1.00.10. Affected by this issue is some unknown functionality of the file /goform/formL2TPSetup. The manipulatio… |
CVE-2025-11293 | High | 8.8 | 2025-10-05 | A security vulnerability has been detected in Belkin F9K1015 1.00.10. Affected by this vulnerability is an unknown functionality of the file /goform/formConnec… |
CVE-2025-11292 | Medium | 6.3 | 2025-10-05 | A weakness has been identified in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/formBSSetSitesurvey. Executing a manipulation of… |
CVE-2025-11291 | Medium | 4.3 | 2025-10-05 | A security flaw has been discovered in ixmaps website2017 up to 0c71cffa0162186bc057a76766bc97e9f5a3a2d0. This impacts an unknown function of the file /map.php… |
CVE-2025-11290 | Medium | 5.6 | 2025-10-05 | A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argume… |
CVE-2025-8917 | Medium | 5.8 | 2025-10-05 | A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` functio… |
CVE-2025-11289 | Low | 2.4 | 2025-10-05 | A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The impacted element is the function Save of the file src/… |
CVE-2025-8406 | High | 7.8 | 2025-10-05 | ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to vali… |
CVE-2025-11288 | Medium | 6.3 | 2025-10-05 | A security flaw has been discovered in CRMEB up to 5.6. This issue affects some unknown processing of the file /adminapi/product/product of the component GET P… |
CVE-2025-11287 | High | 7.3 | 2025-10-05 | A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file src/services/… |
CVE-2025-11286 | Medium | 4.7 | 2025-10-05 | A vulnerability was determined in samanhappy MCPHub up to 0.9.10. This affects an unknown part of the file src/controllers/serverController.ts of the component… |
CVE-2025-11285 | Medium | 6.3 | 2025-10-05 | A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController… |
CVE-2025-11284 | High | 7.3 | 2025-10-05 | A vulnerability has been found in Zytec Dalian Zhuoyun Technology Central Authentication Service 3. Affected by this vulnerability is an unknown functionality… |
CVE-2025-11283 | Low | 2.4 | 2025-10-05 | A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument D… |
CVE-2025-11282 | Low | 2.4 | 2025-10-05 | A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a… |
CVE-2025-61882 | Critical | 9.8 | 2025-10-05 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affect… |
CVE-2025-11281 | Medium | 5.0 | 2025-10-05 | A vulnerability has been found in Frappe LMS 2.35.0. The affected element is an unknown function of the file /courses/ of the component Unpublished Course Hand… |