2025 CVEs (page 159)
Page 159 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11241 | Medium | 6.4 | 2025-10-03 | The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attrib… |
CVE-2025-61668 | | 2025-10-02 | Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0… | |
CVE-2025-61666 | | 2025-10-02 | Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and non default installs between versions 5… | |
CVE-2025-61600 | High | 7.5 | 2025-10-02 | Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP protocol parser which a… |
CVE-2025-61665 | High | 7.5 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identifie… |
CVE-2025-61606 | Medium | 6.1 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerability, identified in th… |
CVE-2025-61605 | Critical | 9.8 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerability which was identif… |
CVE-2025-54089 | Low | 3.4 | 2025-10-02 | CVE-2025-54089 is a cross-site scripting vulnerability in versions of secure access prior to 14.10. Attackers with administrative access to the console can int… |
CVE-2025-54088 | Medium | 6.1 | 2025-10-02 | CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the console can redirect victims to an arbit… |
CVE-2025-61604 | High | 7.1 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerabilit… |
CVE-2025-61603 | Critical | 9.8 | 2025-10-02 | WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the /controle/cont… |
CVE-2025-61595 | | 2025-10-02 | MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4.0.1 and below do not enforce the tx ga… | |
CVE-2025-54087 | Low | 2.6 | 2025-10-02 | CVE-2025-54087 is a server-side request forgery vulnerability in Secure Access prior to version 14.10. Attackers with administrative privileges can publish a c… |
CVE-2025-54086 | Low | 3.3 | 2025-10-02 | CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to version 14.10. Attackers with access to the… |
CVE-2025-10653 | High | 8.6 | 2025-10-02 | An unauthenticated debug port may allow access to the device file system. |
CVE-2025-59835 | | 2025-10-02 | LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/docu… | |
CVE-2025-54315 | High | 7.1 | 2025-10-02 | The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness. |
CVE-2025-49090 | High | 7.1 | 2025-10-02 | The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution. |
CVE-2025-32942 | High | 7.2 | 2025-10-02 | SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic. |
CVE-2025-56019 | Medium | 6.5 | 2025-10-02 | An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to connect via Bluetooth… |
CVE-2025-60663 | High | 7.5 | 2025-10-02 | Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanMTU parameter in the fromAdvSetMacMtuWan function. |
CVE-2025-60661 | Medium | 5.3 | 2025-10-02 | Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the cloneType parameter in the fromAdvSetMacMtuWan function. |
CVE-2025-59409 | High | 7.5 | 2025-10-02 | Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartext in production fir… |
CVE-2025-59407 | Critical | 9.8 | 2025-10-02 | The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and… |
CVE-2025-59406 | Medium | 6.2 | 2025-10-02 | The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI C… |
CVE-2025-59405 | High | 7.5 | 2025-10-02 | The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo… |
CVE-2025-59403 | Critical | 9.8 | 2025-10-02 | The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication. It is responsible for the camera f… |
CVE-2025-34210 | Medium | 5.5 | 2025-10-02 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store a large number of sensitive credentials (database passw… |
CVE-2025-34208 | High | 7.5 | 2025-10-02 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store user passwords using unsalted SHA-512 hashes with a fal… |
CVE-2025-60662 | High | 7.5 | 2025-10-02 | Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanSpeed parameter in the fromAdvSetMacMtuWan function. |
CVE-2025-60660 | High | 7.5 | 2025-10-02 | Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the mac parameter in the fromAdvSetMacMtuWan function. |
CVE-2025-57305 | Medium | 6.5 | 2025-10-02 | VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp. |
CVE-2025-56162 | Medium | 6.5 | 2025-10-02 | YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds function concatenates… |
CVE-2025-56161 | High | 7.5 | 2025-10-02 | YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User m… |
CVE-2025-56154 | Medium | 6.1 | 2025-10-02 | htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is not properly sanitize… |
CVE-2025-61096 | Medium | 6.5 | 2025-10-02 | PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname parameter. |
CVE-2025-61087 | Medium | 6.1 | 2025-10-02 | SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer Management Section. |
CVE-2025-60782 | Medium | 5.4 | 2025-10-02 | PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability in the topics management module (topics… |
CVE-2025-59774 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59773 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59772 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59771 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59770 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59769 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59768 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59767 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59766 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59765 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59764 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59763 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59762 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59761 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59760 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59759 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59758 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59757 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59756 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59755 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59754 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59753 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59752 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59751 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59750 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59749 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59748 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59747 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59746 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59745 | High | 7.5 | 2025-10-02 | Vulnerability in the cryptographic algorithm of AndSoft's e-TMS v25.03, which uses MD5 to encrypt passwords. MD5 is a cryptographically vulnerable hash algorit… |
CVE-2025-59744 | High | 7.5 | 2025-10-02 | Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only within the web root using the “docurl” param… |
CVE-2025-59743 | Critical | 9.8 | 2025-10-02 | SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending… |
CVE-2025-59742 | Critical | 9.8 | 2025-10-02 | SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending… |
CVE-2025-59741 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-57443 | Medium | 5.1 | 2025-10-02 | FrostWire 6.14.0-build-326 for macOS contains permissive entitlements (allow-dyld-environment-variables, disable-library-validation) that allow unprivileged lo… |
CVE-2025-59740 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59739 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59738 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59737 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59736 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59735 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-56381 | Medium | 6.5 | 2025-10-02 | ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and g… |
CVE-2025-56380 | Medium | 6.5 | 2025-10-02 | Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a… |
CVE-2025-56379 | Medium | 5.4 | 2025-10-02 | A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2025-53881 | | 2025-10-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This i… | |
CVE-2025-41010 | | 2025-10-02 | Incorrect Cross-Origin Resource Sharing (CORS) configuration in Hiberus Sintra. Cross-Origin Resource Sharing (CORS) allows browsers to make cross-domain reque… | |
CVE-2025-22862 | Medium | 6.7 | 2025-10-02 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and… |
CVE-2025-11240 | High | 7.2 | 2025-10-02 | An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNI… |
CVE-2025-11239 | Medium | 4.3 | 2025-10-02 | Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hu… |
CVE-2025-0642 | Medium | 6.3 | 2025-10-02 | Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allow… |
CVE-2025-41064 | | 2025-10-02 | Incorrect authentication vulnerability in OpenSIAC, which could allow an attacker to impersonate a person using Cl@ve as an authentication method. | |
CVE-2025-54293 | Medium | 6.5 | 2025-10-02 | Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host s… |
CVE-2025-40992 | | 2025-10-02 | Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/update_profile', affectin… | |
CVE-2025-40991 | Medium | 5.4 | 2025-10-02 | Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clie… |
CVE-2025-40990 | Medium | 5.4 | 2025-10-02 | Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clie… |
CVE-2025-40989 | Medium | 5.4 | 2025-10-02 | Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clie… |
CVE-2025-61735 | High | 7.3 | 2025-10-02 | Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin… |
CVE-2025-61734 | High | 7.5 | 2025-10-02 | Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well… |
CVE-2025-61733 | High | 7.5 | 2025-10-02 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are… |
CVE-2025-54468 | Medium | 4.7 | 2025-10-02 | A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.c… |
CVE-2025-54292 | Medium | 4.6 | 2025-10-02 | Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended res… |
CVE-2025-54291 | Medium | 5.3 | 2025-10-02 | Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project exist… |