2025 CVEs (page 160)
Page 160 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9859 | Medium | 6.4 | 2025-10-03 | The Fintelligence Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fintelligence-calculator' shortcode in all ver… |
CVE-2025-9858 | Medium | 6.4 | 2025-10-03 | The Auto Bulb Finder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abf_vehicle' shortcode in all versions u… |
CVE-2025-9854 | Medium | 6.4 | 2025-10-03 | The A Simple Multilanguage Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'asmp-switcher' shortcode in all versions… |
CVE-2025-9630 | Medium | 4.3 | 2025-10-03 | The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect… |
CVE-2025-9561 | High | 8.8 | 2025-10-03 | The AP Background plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization and insufficient file validation within the advPara… |
CVE-2025-9372 | Medium | 5.5 | 2025-10-03 | The Ultimate Multi Design Video Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4 due to ins… |
CVE-2025-9333 | Medium | 5.5 | 2025-10-03 | The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insuffic… |
CVE-2025-9332 | Medium | 5.5 | 2025-10-03 | The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up… |
CVE-2025-9286 | Critical | 9.8 | 2025-10-03 | The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() R… |
CVE-2025-9213 | High | 8.8 | 2025-10-03 | The TextBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1.0.0 to 1.1.1. This is due to missing or incorrect nonce validati… |
CVE-2025-9212 | High | 7.5 | 2025-10-03 | The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wp_dispatcher_process_upload() functi… |
CVE-2025-9209 | Critical | 9.8 | 2025-10-03 | The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plug… |
CVE-2025-9206 | Medium | 6.4 | 2025-10-03 | The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This… |
CVE-2025-9204 | Medium | 6.4 | 2025-10-03 | The X Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Youtube Video ID field in all versions up to, and includin… |
CVE-2025-9200 | High | 7.5 | 2025-10-03 | The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the nh_ynaa_comments()… |
CVE-2025-9199 | Medium | 6.5 | 2025-10-03 | The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in… |
CVE-2025-9198 | Medium | 6.5 | 2025-10-03 | The Wp cycle text announcement plugin for WordPress is vulnerable to SQL Injection via the 'cycle-text' shortcode in all versions up to, and including, 8.1 due… |
CVE-2025-9194 | Medium | 4.3 | 2025-10-03 | The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean() function in all version… |
CVE-2025-9130 | Medium | 6.4 | 2025-10-03 | The Unify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's unify_checkout shortcode in all versions up to, and… |
CVE-2025-9129 | Medium | 6.4 | 2025-10-03 | The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and… |
CVE-2025-9080 | Medium | 6.4 | 2025-10-03 | The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version 1.2.8 and earlier. This is due to… |
CVE-2025-9077 | Medium | 6.4 | 2025-10-03 | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in ve… |
CVE-2025-9045 | Medium | 6.4 | 2025-10-03 | The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2… |
CVE-2025-8776 | Medium | 6.4 | 2025-10-03 | The Epic Bootstrap Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icol’ parameter in all versions up to, and including, 1.0… |
CVE-2025-8669 | Medium | 4.3 | 2025-10-03 | The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11. This is due to missing or incorrect nonce validation on the re… |
CVE-2025-7825 | Medium | 6.3 | 2025-10-03 | The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via d… |
CVE-2025-7721 | Critical | 9.8 | 2025-10-03 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includ… |
CVE-2025-49641 | Medium | 4.3 | 2025-10-03 | A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve… |
CVE-2025-40636 | | 2025-10-03 | SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cip_vvisi… | |
CVE-2025-27237 | | 2025-10-03 | In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification… | |
CVE-2025-27236 | Medium | 6.5 | 2025-10-03 | A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining… |
CVE-2025-27231 | Medium | 4.9 | 2025-10-03 | The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate t… |
CVE-2025-10726 | Critical | 9.1 | 2025-10-03 | The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insuf… |
CVE-2025-10582 | High | 8.8 | 2025-10-03 | The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient es… |
CVE-2025-10547 | Critical | 9.8 | 2025-10-03 | An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform R… |
CVE-2025-10311 | Medium | 4.3 | 2025-10-03 | The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing… |
CVE-2025-10309 | Medium | 4.3 | 2025-10-03 | The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce val… |
CVE-2025-10306 | Low | 3.8 | 2025-10-03 | The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the p… |
CVE-2025-10302 | Medium | 4.3 | 2025-10-03 | The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or i… |
CVE-2025-10212 | Medium | 5.3 | 2025-10-03 | The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in… |
CVE-2025-10192 | Medium | 6.4 | 2025-10-03 | The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect' shortcode in all versions up to, and incl… |
CVE-2025-10165 | Medium | 6.4 | 2025-10-03 | The AP Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adv_parallax_back' shortcode in all versions up to, and i… |
CVE-2025-10053 | Medium | 4.4 | 2025-10-03 | The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including… |
CVE-2025-0876 | Medium | 4.1 | 2025-10-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi Advertisement Information Technologies T… |
CVE-2025-11234 | High | 7.5 | 2025-10-03 | A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callb… |
CVE-2025-6388 | Critical | 9.8 | 2025-10-03 | The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_action… |
CVE-2025-11223 | High | 7.8 | 2025-10-03 | Installer of Panasonic AutoDownloader version 1.2.8 contains an issue with the DLL search path, which may lead to loading a crafted DLL file in the… |
CVE-2025-0616 | High | 8.2 | 2025-10-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknolojik Center Telecommunication Industry Trade Co. Lt… |
CVE-2025-61599 | Medium | 5.4 | 2025-10-03 | Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG Pro 2.5.21 and below… |
CVE-2025-61597 | High | 7.6 | 2025-10-03 | Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail… |
CVE-2025-61589 | Medium | 5.9 | 2025-10-03 | Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid (a to render diagrams) allows embedding images which then get rendere… |
CVE-2025-59536 | High | 8.8 | 2025-10-03 | Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claud… |
CVE-2025-59300 | High | 7.8 | 2025-10-03 | Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to… |
CVE-2025-59299 | High | 7.8 | 2025-10-03 | Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to… |
CVE-2025-59298 | High | 7.8 | 2025-10-03 | Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to… |
CVE-2025-59297 | High | 7.8 | 2025-10-03 | Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to… |
CVE-2025-11241 | Medium | 6.4 | 2025-10-03 | The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attrib… |
CVE-2025-61668 | | 2025-10-02 | Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0… | |
CVE-2025-61666 | | 2025-10-02 | Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and non default installs between versions 5… | |
CVE-2025-61600 | High | 7.5 | 2025-10-02 | Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP protocol parser which a… |
CVE-2025-61665 | High | 7.5 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identifie… |
CVE-2025-61606 | Medium | 6.1 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerability, identified in th… |
CVE-2025-61605 | Critical | 9.8 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerability which was identif… |
CVE-2025-54089 | Low | 3.4 | 2025-10-02 | CVE-2025-54089 is a cross-site scripting vulnerability in versions of secure access prior to 14.10. Attackers with administrative access to the console can int… |
CVE-2025-54088 | Medium | 6.1 | 2025-10-02 | CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the console can redirect victims to an arbit… |
CVE-2025-61604 | High | 7.1 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerabilit… |
CVE-2025-61603 | Critical | 9.8 | 2025-10-02 | WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the /controle/cont… |
CVE-2025-61595 | | 2025-10-02 | MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4.0.1 and below do not enforce the tx ga… | |
CVE-2025-54087 | Low | 2.6 | 2025-10-02 | CVE-2025-54087 is a server-side request forgery vulnerability in Secure Access prior to version 14.10. Attackers with administrative privileges can publish a c… |
CVE-2025-54086 | Low | 3.3 | 2025-10-02 | CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to version 14.10. Attackers with access to the… |
CVE-2025-10653 | High | 8.6 | 2025-10-02 | An unauthenticated debug port may allow access to the device file system. |
CVE-2025-59835 | | 2025-10-02 | LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/docu… | |
CVE-2025-54315 | High | 7.1 | 2025-10-02 | The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness. |
CVE-2025-49090 | High | 7.1 | 2025-10-02 | The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution. |
CVE-2025-32942 | High | 7.2 | 2025-10-02 | SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic. |
CVE-2025-56019 | Medium | 6.5 | 2025-10-02 | An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to connect via Bluetooth… |
CVE-2025-60663 | High | 7.5 | 2025-10-02 | Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanMTU parameter in the fromAdvSetMacMtuWan function. |
CVE-2025-60661 | Medium | 5.3 | 2025-10-02 | Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the cloneType parameter in the fromAdvSetMacMtuWan function. |
CVE-2025-59409 | High | 7.5 | 2025-10-02 | Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartext in production fir… |
CVE-2025-59407 | Critical | 9.8 | 2025-10-02 | The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and… |
CVE-2025-59406 | Medium | 6.2 | 2025-10-02 | The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI C… |
CVE-2025-59405 | High | 7.5 | 2025-10-02 | The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo… |
CVE-2025-59403 | Critical | 9.8 | 2025-10-02 | The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication. It is responsible for the camera f… |
CVE-2025-34210 | Medium | 5.5 | 2025-10-02 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store a large number of sensitive credentials (database passw… |
CVE-2025-34208 | High | 7.5 | 2025-10-02 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store user passwords using unsalted SHA-512 hashes with a fal… |
CVE-2025-60662 | High | 7.5 | 2025-10-02 | Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanSpeed parameter in the fromAdvSetMacMtuWan function. |
CVE-2025-60660 | High | 7.5 | 2025-10-02 | Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the mac parameter in the fromAdvSetMacMtuWan function. |
CVE-2025-57305 | Medium | 6.5 | 2025-10-02 | VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp. |
CVE-2025-56162 | Medium | 6.5 | 2025-10-02 | YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds function concatenates… |
CVE-2025-56161 | High | 7.5 | 2025-10-02 | YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User m… |
CVE-2025-56154 | Medium | 6.1 | 2025-10-02 | htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is not properly sanitize… |
CVE-2025-61096 | Medium | 6.5 | 2025-10-02 | PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname parameter. |
CVE-2025-61087 | Medium | 6.1 | 2025-10-02 | SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer Management Section. |
CVE-2025-60782 | Medium | 5.4 | 2025-10-02 | PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability in the topics management module (topics… |
CVE-2025-59774 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59773 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59772 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59771 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59770 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59769 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |