2025 CVEs (page 164)
Page 164 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-43820 | Medium | 5.4 | 2025-09-29 | Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Lif… |
CVE-2025-43818 | Medium | 6.1 | 2025-09-29 | Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023… |
CVE-2025-43815 | Medium | 6.1 | 2025-09-29 | Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 thro… |
CVE-2025-43811 | Medium | 5.4 | 2025-09-29 | Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0… |
CVE-2025-57266 | Critical | 9.8 | 2025-09-29 | An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers to gain sensitive in… |
CVE-2025-54591 | High | 7.5 | 2025-09-29 | FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of acce… |
CVE-2025-45376 | High | 7.5 | 2025-09-29 | Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privilege… |
CVE-2025-34235 | High | 7.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) c… |
CVE-2025-34234 | High | 7.5 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34233 | Medium | 6.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34232 | Medium | 5.3 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34231 | High | 8.6 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34230 | Medium | 5.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34229 | Medium | 5.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34228 | High | 8.6 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34225 | High | 8.6 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34224 | Critical | 9.1 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose … |
CVE-2025-34223 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain… |
CVE-2025-34222 | Critical | 9.1 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose… |
CVE-2025-34221 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 25.2.1518 (VA/SaaS deployments) expose e… |
CVE-2025-34220 | Medium | 5.3 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contains… |
CVE-2025-34218 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose… |
CVE-2025-34216 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (VA deployments only) expose… |
CVE-2025-34215 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose… |
CVE-2025-34212 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.843 and Application prior to version 20.0.1923 (VA/SaaS deployments) possess … |
CVE-2025-34211 | Medium | 4.9 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA and SaaS deployments) con… |
CVE-2025-34209 | High | 7.2 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.862 and Application prior to 20.0.2014 (VA and SaaS deployments) contain Docker image… |
CVE-2025-34207 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA and SaaS deployments) configure the SSH c… |
CVE-2025-30247 | | 2025-09-29 | An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to exec… | |
CVE-2025-56764 | Medium | 5.3 | 2025-09-29 | Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error messages ("Unknown user… |
CVE-2025-35034 | Medium | 4.3 | 2025-09-29 | Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portlet_user_id' URL parameter. A remote, unauthen… |
CVE-2025-35033 | Medium | 4.1 | 2025-09-29 | Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadab… |
CVE-2025-35032 | Low | 3.4 | 2025-09-29 | Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are ac… |
CVE-2025-35031 | Low | 3.3 | 2025-09-29 | Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this out… |
CVE-2025-35030 | High | 8.1 | 2025-09-29 | Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrativ… |
CVE-2025-57879 | Medium | 6.1 | 2025-09-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2025-57878 | Medium | 6.1 | 2025-09-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2025-57877 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57876 | Medium | 4.8 | 2025-09-29 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malic… |
CVE-2025-57875 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57874 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57873 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57872 | Medium | 6.1 | 2025-09-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2025-57871 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57424 | High | 7.3 | 2025-09-29 | A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field. An attacker can insert arbitrary J… |
CVE-2025-41252 | High | 7.5 | 2025-09-29 | Description: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potent… |
CVE-2025-41251 | High | 8.1 | 2025-09-29 | VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potenti… |
CVE-2025-36099 | Medium | 4.9 | 2025-09-29 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A privileged user could explo… |
CVE-2025-34196 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application prior to 25.1.1413 (Windows client deployments) contain… |
CVE-2025-57483 | High | 8.1 | 2025-09-29 | A reflected cross-site scripting (XSS) vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary Javascript in the context of the user's… |
CVE-2025-57197 | Medium | 6.0 | 2025-09-29 | In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change feature. A local attacke… |
CVE-2025-56807 | Medium | 6.1 | 2025-09-29 | A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScript payload using… |
CVE-2025-43400 | Medium | 6.3 | 2025-09-29 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.1 and iPadOS 18.7.1, iOS 26.0.1 and iPadOS 26.0.1, ma… |
CVE-2025-41250 | High | 8.5 | 2025-09-29 | VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create sc… |
CVE-2025-7104 | High | 7.5 | 2025-09-29 | A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by… |
CVE-2025-61659 | Medium | 6.8 | 2025-09-29 | bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name. |
CVE-2025-56795 | Critical | 9.0 | 2025-09-29 | Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in the "note" and "tex… |
CVE-2025-56234 | High | 7.5 | 2025-09-29 | AT_NA2000 from Nanda Automation Technology vendor has a denial-of-service vulnerability. For the processing of TCP RST packets, PLC AT_NA2000 has a wide accept… |
CVE-2025-56233 | High | 7.5 | 2025-09-29 | Openindiana, kernel SunOS 5.11 has a denial of service vulnerability. For the processing of TCP packets with RST or SYN flag set, Openindiana has a wide accept… |
CVE-2025-51495 | High | 7.5 | 2025-09-29 | An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker ca… |
CVE-2025-41245 | Medium | 4.9 | 2025-09-29 | VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit th… |
CVE-2025-41244 | High | 7.8 | 2025-09-29 | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having a… |
CVE-2025-41246 | High | 7.6 | 2025-09-29 | VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administra… |
CVE-2025-11155 | | 2025-09-29 | The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attac… | |
CVE-2025-57516 | High | 8.2 | 2025-09-29 | OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted D… |
CVE-2025-56449 | High | 8.2 | 2025-09-29 | A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA (e.g. after… |
CVE-2025-55795 | Low | 3.5 | 2025-09-29 | The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflo… |
CVE-2025-36352 | Medium | 6.4 | 2025-09-29 | IBM License Metric Tool 9.2.0 through 9.2.40 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary J… |
CVE-2025-36351 | Medium | 4.3 | 2025-09-29 | IBM License Metric Tool 9.2.0 through 9.2.40 could allow an authenticated user to bypass access controls in the REST API interface and perform unauthorized a… |
CVE-2025-57428 | Medium | 6.5 | 2025-09-29 | Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain access to the debug shell exposed via… |
CVE-2025-9648 | | 2025-09-29 | A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a… | |
CVE-2025-8868 | Critical | 9.8 | 2025-09-29 | In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functio… |
CVE-2025-6724 | High | 8.8 | 2025-09-29 | In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functio… |
CVE-2025-11147 | Medium | 5.4 | 2025-09-29 | Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows malicious scripts (XSS) to be executed in “/html/<filename>.html”. |
CVE-2025-11146 | Medium | 5.4 | 2025-09-29 | Reflected Cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts (XSS) in the web management app… |
CVE-2025-10346 | Medium | 6.1 | 2025-09-29 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST requ… |
CVE-2025-10345 | Medium | 6.1 | 2025-09-29 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST requ… |
CVE-2025-10344 | Medium | 6.1 | 2025-09-29 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST requ… |
CVE-2025-10343 | Medium | 6.1 | 2025-09-29 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST requ… |
CVE-2025-10342 | Medium | 6.1 | 2025-09-29 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST requ… |
CVE-2025-10341 | Medium | 6.1 | 2025-09-29 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST requ… |
CVE-2025-48006 | Critical | 9.1 | 2025-09-29 | Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. If a specially crafted request is processed, arbitra… |
CVE-2025-11141 | Medium | 4.7 | 2025-09-29 | A security flaw has been discovered in Ruijie NBR2100G-E up to 20250919. Affected by this issue is the function listAction of the file /itbox_pi/branch_passw.p… |
CVE-2025-10504 | Medium | 6.1 | 2025-09-29 | Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33. |
CVE-2025-11140 | High | 7.3 | 2025-09-29 | A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient… |
CVE-2025-11139 | Medium | 6.3 | 2025-09-29 | A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioU… |
CVE-2025-11138 | Medium | 6.3 | 2025-09-29 | A vulnerability was found in mirweiye wenkucms up to 3.4. This impacts the function createPathOne of the file app/common/common.php. The manipulation results i… |
CVE-2025-11137 | Low | 3.5 | 2025-09-29 | A vulnerability has been found in Gstarsoft GstarCAD up to 9.4.0. This affects an unknown function of the component File Renaming Handler. The manipulation lea… |
CVE-2025-11136 | Medium | 4.7 | 2025-09-29 | A flaw has been found in YiFang CMS up to 2.0.2. The impacted element is the function webUploader of the file app/app/controller/File.php of the component Back… |
CVE-2025-11135 | High | 7.3 | 2025-09-29 | A vulnerability was detected in pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486. The affected element is the function loadL… |
CVE-2025-9904 | Medium | 5.3 | 2025-09-29 | Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Print… |
CVE-2025-9903 | Medium | 5.9 | 2025-09-29 | Out-of-bounds write vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer D… |
CVE-2025-7698 | Medium | 5.9 | 2025-09-29 | Out-of-bounds read vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Dr… |
CVE-2025-11134 | Low | 2.4 | 2025-09-29 | A security vulnerability has been detected in Cudy TR1200 1.16.3-20230804-164635. Impacted is an unknown function of the file /cgi-bin/luci/admin/network/wirel… |
CVE-2025-11130 | High | 8.4 | 2025-09-29 | A weakness has been identified in iHongRen pptp-vpn 1.0/1.0.1 on macOS. This issue affects the function shouldAcceptNewConnection of the file HelpTool/HelperTo… |
CVE-2025-11126 | Critical | 9.8 | 2025-09-29 | A security flaw has been discovered in Apeman ID71 218.53.203.117. This vulnerability affects unknown code of the file /system/www/system.ini. The manipulation… |
CVE-2025-11125 | Medium | 4.3 | 2025-09-29 | A vulnerability was found in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. Affected by this vulnerability is an unknown func… |
CVE-2025-11124 | Low | 3.5 | 2025-09-28 | A vulnerability has been found in code-projects Project Monitoring System 1.0. Affected is an unknown function of the file /onlineJobSearchEngine/postjob.php… |
CVE-2025-11123 | High | 8.8 | 2025-09-28 | A flaw has been found in Tenda AC18 15.03.05.19. This impacts an unknown function of the file /goform/saveAutoQos. This manipulation of the argument enable cau… |
CVE-2025-11122 | High | 8.8 | 2025-09-28 | A vulnerability was detected in Tenda AC18 15.03.05.19. This affects an unknown function of the file /goform/WizardHandle. The manipulation of the argument WAN… |