2025 CVEs (page 158)
Page 158 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-44012 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-44011 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-44010 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-44009 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-44008 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-61593 | High | 7.1 | 2025-10-03 | Cursor is a code editor built for programming with AI. In versions 1.7 and below, a vulnerability in the way Cursor CLI Agent protects its sensitive files (i.e… |
CVE-2025-61592 | High | 8.8 | 2025-10-03 | Cursor is a code editor built for programming with AI. In versions 1.7 and below, automatic loading of project-specific CLI configuration from the current work… |
CVE-2025-52653 | High | 7.6 | 2025-10-03 | HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentia… |
CVE-2025-46817 | High | 7.0 | 2025-10-03 | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script t… |
CVE-2025-44007 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-44006 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-33040 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-33039 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-33034 | Medium | 6.5 | 2025-10-03 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-61591 | High | 8.8 | 2025-10-03 | Cursor is a code editor built for programming with AI. In versions 1.7 and below, when MCP uses OAuth authentication with an untrusted MCP server, an attacker… |
CVE-2025-61590 | High | 7.5 | 2025-10-03 | Cursor is a code editor built for programming with AI. Versions 1.6 and below are vulnerable to Remote Code Execution (RCE) attacks through Visual Studio Code… |
CVE-2025-56551 | High | 8.2 | 2025-10-03 | An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-c… |
CVE-2025-60787 | High | 7.2 | 2025-10-03 | MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to… |
CVE-2025-57423 | Medium | 6.5 | 2025-10-03 | A SQL injection vulnerability was discovered in the /articles endpoint of MyClub 0.5, affecting the query parameters Content, GroupName, PersonName, lastUpdate… |
CVE-2025-55972 | High | 7.5 | 2025-10-03 | A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS) condition. By sendi… |
CVE-2025-55971 | Medium | 4.7 | 2025-10-03 | TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Re… |
CVE-2025-34226 | | 2025-10-03 | OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program uploads is not valida… | |
CVE-2025-10729 | | 2025-10-03 | The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading t… | |
CVE-2025-10728 | | 2025-10-03 | When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading to stack overflow DoS | |
CVE-2025-60454 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image management module, spec… |
CVE-2025-60453 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column management module, spe… |
CVE-2025-60452 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download management module, s… |
CVE-2025-60451 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and s… |
CVE-2025-60450 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and s… |
CVE-2025-60449 | Medium | 4.9 | 2025-10-03 | An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ di… |
CVE-2025-60448 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file… |
CVE-2025-60447 | Medium | 5.9 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration compone… |
CVE-2025-60445 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1. The vulnerability exists due to insufficient validation of SV… |
CVE-2025-59489 | High | 7.4 | 2025-10-03 | Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended l… |
CVE-2025-10609 | Medium | 5.9 | 2025-10-03 | Use of Hard-coded Credentials vulnerability in Logo Software Inc. TigerWings ERP allows Read Sensitive Constants Within an Executable. This issue affects Tige… |
CVE-2025-9945 | Medium | 4.3 | 2025-10-03 | The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing o… |
CVE-2025-9897 | Medium | 4.3 | 2025-10-03 | The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incor… |
CVE-2025-9895 | Medium | 4.3 | 2025-10-03 | The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or inco… |
CVE-2025-9892 | Medium | 5.3 | 2025-10-03 | The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to mis… |
CVE-2025-9889 | Medium | 4.3 | 2025-10-03 | The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to mi… |
CVE-2025-9885 | Medium | 4.3 | 2025-10-03 | The MPWizard – Create Mercado Pago Payment Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1… |
CVE-2025-9884 | Medium | 6.1 | 2025-10-03 | The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing o… |
CVE-2025-9876 | Medium | 6.4 | 2025-10-03 | The Ird Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irdslider' shortcode in all versions up to, and including, 1… |
CVE-2025-9875 | Medium | 6.4 | 2025-10-03 | The Event Tickets, RSVPs, Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticket_spot' shortcode in all versions u… |
CVE-2025-9859 | Medium | 6.4 | 2025-10-03 | The Fintelligence Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fintelligence-calculator' shortcode in all ver… |
CVE-2025-9858 | Medium | 6.4 | 2025-10-03 | The Auto Bulb Finder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abf_vehicle' shortcode in all versions u… |
CVE-2025-9854 | Medium | 6.4 | 2025-10-03 | The A Simple Multilanguage Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'asmp-switcher' shortcode in all versions… |
CVE-2025-9630 | Medium | 4.3 | 2025-10-03 | The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect… |
CVE-2025-9561 | High | 8.8 | 2025-10-03 | The AP Background plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization and insufficient file validation within the advPara… |
CVE-2025-9372 | Medium | 5.5 | 2025-10-03 | The Ultimate Multi Design Video Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4 due to ins… |
CVE-2025-9333 | Medium | 5.5 | 2025-10-03 | The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insuffic… |
CVE-2025-9332 | Medium | 5.5 | 2025-10-03 | The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up… |
CVE-2025-9286 | Critical | 9.8 | 2025-10-03 | The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() R… |
CVE-2025-9213 | High | 8.8 | 2025-10-03 | The TextBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1.0.0 to 1.1.1. This is due to missing or incorrect nonce validati… |
CVE-2025-9212 | High | 7.5 | 2025-10-03 | The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wp_dispatcher_process_upload() functi… |
CVE-2025-9209 | Critical | 9.8 | 2025-10-03 | The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plug… |
CVE-2025-9206 | Medium | 6.4 | 2025-10-03 | The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This… |
CVE-2025-9204 | Medium | 6.4 | 2025-10-03 | The X Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Youtube Video ID field in all versions up to, and includin… |
CVE-2025-9200 | High | 7.5 | 2025-10-03 | The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the nh_ynaa_comments()… |
CVE-2025-9199 | Medium | 6.5 | 2025-10-03 | The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in… |
CVE-2025-9198 | Medium | 6.5 | 2025-10-03 | The Wp cycle text announcement plugin for WordPress is vulnerable to SQL Injection via the 'cycle-text' shortcode in all versions up to, and including, 8.1 due… |
CVE-2025-9194 | Medium | 4.3 | 2025-10-03 | The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean() function in all version… |
CVE-2025-9130 | Medium | 6.4 | 2025-10-03 | The Unify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's unify_checkout shortcode in all versions up to, and… |
CVE-2025-9129 | Medium | 6.4 | 2025-10-03 | The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and… |
CVE-2025-9080 | Medium | 6.4 | 2025-10-03 | The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version 1.2.8 and earlier. This is due to… |
CVE-2025-9077 | Medium | 6.4 | 2025-10-03 | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in ve… |
CVE-2025-9045 | Medium | 6.4 | 2025-10-03 | The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2… |
CVE-2025-8776 | Medium | 6.4 | 2025-10-03 | The Epic Bootstrap Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icol’ parameter in all versions up to, and including, 1.0… |
CVE-2025-8669 | Medium | 4.3 | 2025-10-03 | The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11. This is due to missing or incorrect nonce validation on the re… |
CVE-2025-7825 | Medium | 6.3 | 2025-10-03 | The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via d… |
CVE-2025-7721 | Critical | 9.8 | 2025-10-03 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includ… |
CVE-2025-49641 | Medium | 4.3 | 2025-10-03 | A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve… |
CVE-2025-40636 | | 2025-10-03 | SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cip_vvisi… | |
CVE-2025-27237 | | 2025-10-03 | In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification… | |
CVE-2025-27236 | Medium | 6.5 | 2025-10-03 | A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining… |
CVE-2025-27231 | Medium | 4.9 | 2025-10-03 | The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate t… |
CVE-2025-10726 | Critical | 9.1 | 2025-10-03 | The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insuf… |
CVE-2025-10582 | High | 8.8 | 2025-10-03 | The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient es… |
CVE-2025-10547 | Critical | 9.8 | 2025-10-03 | An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform R… |
CVE-2025-10311 | Medium | 4.3 | 2025-10-03 | The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing… |
CVE-2025-10309 | Medium | 4.3 | 2025-10-03 | The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce val… |
CVE-2025-10306 | Low | 3.8 | 2025-10-03 | The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the p… |
CVE-2025-10302 | Medium | 4.3 | 2025-10-03 | The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or i… |
CVE-2025-10212 | Medium | 5.3 | 2025-10-03 | The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in… |
CVE-2025-10192 | Medium | 6.4 | 2025-10-03 | The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect' shortcode in all versions up to, and incl… |
CVE-2025-10165 | Medium | 6.4 | 2025-10-03 | The AP Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adv_parallax_back' shortcode in all versions up to, and i… |
CVE-2025-10053 | Medium | 4.4 | 2025-10-03 | The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including… |
CVE-2025-0876 | Medium | 4.1 | 2025-10-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi Advertisement Information Technologies T… |
CVE-2025-11234 | High | 7.5 | 2025-10-03 | A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callb… |
CVE-2025-6388 | Critical | 9.8 | 2025-10-03 | The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_action… |
CVE-2025-11223 | High | 7.8 | 2025-10-03 | Installer of Panasonic AutoDownloader version 1.2.8 contains an issue with the DLL search path, which may lead to loading a crafted DLL file in the… |
CVE-2025-0616 | High | 8.2 | 2025-10-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknolojik Center Telecommunication Industry Trade Co. Lt… |
CVE-2025-61599 | Medium | 5.4 | 2025-10-03 | Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG Pro 2.5.21 and below… |
CVE-2025-61597 | High | 7.6 | 2025-10-03 | Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail… |
CVE-2025-61589 | Medium | 5.9 | 2025-10-03 | Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid (a to render diagrams) allows embedding images which then get rendere… |
CVE-2025-59536 | High | 8.8 | 2025-10-03 | Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claud… |
CVE-2025-59300 | High | 7.8 | 2025-10-03 | Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to… |
CVE-2025-59299 | High | 7.8 | 2025-10-03 | Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to… |
CVE-2025-59298 | High | 7.8 | 2025-10-03 | Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to… |
CVE-2025-59297 | High | 7.8 | 2025-10-03 | Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to… |