2025 CVEs (page 164)
Page 164 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11057 | High | 7.3 | 2025-09-27 | A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/… |
CVE-2025-11056 | Medium | 6.3 | 2025-09-27 | A flaw has been found in ProjectsAndPrograms School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file owner_panel/f… |
CVE-2025-11055 | High | 7.3 | 2025-09-27 | A vulnerability was detected in SourceCodester Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/updateaddress.php. The m… |
CVE-2025-11054 | Medium | 6.3 | 2025-09-27 | A security vulnerability has been detected in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/category/i… |
CVE-2025-11053 | High | 7.3 | 2025-09-27 | A weakness has been identified in PHPGurukul Small CRM 4.0. This affects an unknown function of the file /forgot-password.php. Executing manipulation of the ar… |
CVE-2025-9944 | Medium | 4.3 | 2025-09-27 | The Professional Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to miss… |
CVE-2025-9899 | Medium | 6.1 | 2025-09-27 | The Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers… |
CVE-2025-9898 | Medium | 4.3 | 2025-09-27 | The cForms – Light speed fast Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This i… |
CVE-2025-9896 | Medium | 4.3 | 2025-09-27 | The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.8. This is due to missing or incorrect… |
CVE-2025-9894 | Medium | 4.3 | 2025-09-27 | The Sync Feedly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorre… |
CVE-2025-9893 | Medium | 4.3 | 2025-09-27 | The VM Menu Reorder plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing… |
CVE-2025-11052 | High | 7.3 | 2025-09-27 | A security flaw has been discovered in kidaze CourseSelectionSystem 1.0/5.php. The impacted element is an unknown function of the file /Profilers/PriProfile/CO… |
CVE-2025-11051 | Medium | 4.3 | 2025-09-27 | A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code. The manipulation leads to cross… |
CVE-2025-9816 | High | 7.2 | 2025-09-27 | The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Hea… |
CVE-2025-3193 | High | 7.5 | 2025-09-27 | Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which… |
CVE-2025-11050 | Medium | 6.3 | 2025-09-27 | A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /periodo-lancamento. Executing manipulation can lead to impro… |
CVE-2025-10954 | Medium | 5.3 | 2025-09-27 | Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumber… |
CVE-2025-11049 | Medium | 6.3 | 2025-09-27 | A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /unificacao-aluno. Performing… |
CVE-2025-10499 | Medium | 4.3 | 2025-09-27 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl… |
CVE-2025-10498 | Medium | 4.3 | 2025-09-27 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin… |
CVE-2025-8440 | Medium | 6.4 | 2025-09-27 | The Team Members plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the first and last name fields in all versions up to, and including, 5.3… |
CVE-2025-36239 | Medium | 6.1 | 2025-09-27 | IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitr… |
CVE-2025-59945 | High | 8.1 | 2025-09-27 | SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can… |
CVE-2025-59939 | High | 8.8 | 2025-09-27 | WeGIA is a Web manager for charitable institutions. Prior to version 3.5.0, WeGIA is vulnerable to SQL Injection attacks in the control.php endpoint with the f… |
CVE-2025-59938 | Medium | 6.5 | 2025-09-27 | Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions starting from 3.8.0 to before 4.11.0, wazuh-analysisd… |
CVE-2025-59936 | Critical | 9.4 | 2025-09-27 | get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mech… |
CVE-2025-59932 | High | 8.6 | 2025-09-27 | Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests w… |
CVE-2025-36144 | Low | 3.3 | 2025-09-27 | IBM Lakehouse (watsonx.data 2.2) stores potentially sensitive information in log files that could be read by a local user. |
CVE-2025-59934 | Critical | 9.4 | 2025-09-26 | Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a t… |
CVE-2025-59845 | High | 8.2 | 2025-09-26 | Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and… |
CVE-2025-11048 | Medium | 6.3 | 2025-09-26 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /consulta-… |
CVE-2025-11047 | Medium | 6.3 | 2025-09-26 | A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /module/Api/aluno. This manipulation of the argum… |
CVE-2025-11046 | High | 7.3 | 2025-09-26 | A security flaw has been discovered in Tencent WeKnora 0.1.0. This impacts the function testEmbeddingModel of the file /api/v1/initialization/embedding/test. T… |
CVE-2025-11045 | High | 7.3 | 2025-09-26 | A vulnerability was identified in WAYOS LQ_04, LQ_05, LQ_06, LQ_07 and LQ_09 22.03.17. This affects an unknown function of the file /usb_paswd.asp. The manipul… |
CVE-2025-10657 | | 2025-09-26 | In a hardened Docker environment, with Enhanced Container Isolation ( ECI https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isola… | |
CVE-2025-57692 | Medium | 6.8 | 2025-09-26 | PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScri… |
CVE-2025-11041 | Medium | 6.3 | 2025-09-26 | A vulnerability has been found in itsourcecode Open Source Job Portal 1.0. Affected by this issue is some unknown functionality of the file /admin/user/index.p… |
CVE-2025-11040 | High | 7.3 | 2025-09-26 | A vulnerability was detected in code-projects Hostel Management System 1.0. Affected by this issue is some unknown functionality of the file /justines/admin/mo… |
CVE-2025-11039 | High | 7.3 | 2025-09-26 | A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-11038 | Medium | 6.3 | 2025-09-26 | A weakness has been identified in itsourcecode Online Clinic Management System 1.0. Affected is an unknown function of the file /details.php?action=post. Execu… |
CVE-2025-11037 | High | 7.3 | 2025-09-26 | A security flaw has been discovered in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/admin_index_search.php. Perfor… |
CVE-2025-11036 | High | 7.3 | 2025-09-26 | A vulnerability was identified in code-projects E-Commerce Website 1.0. This affects an unknown function of the file /pages/admin_account_update.php. Such mani… |
CVE-2025-11035 | Medium | 6.3 | 2025-09-26 | A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=Ge… |
CVE-2025-58384 | Critical | 10.0 | 2025-09-26 | In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc ad… |
CVE-2025-56383 | High | 8.4 | 2025-09-26 | Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. NOTE: this is disputed by multiple parti… |
CVE-2025-55847 | High | 8.8 | 2025-09-26 | Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie paramet… |
CVE-2025-45994 | High | 7.5 | 2025-09-26 | An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdir… |
CVE-2025-11034 | Medium | 4.3 | 2025-09-26 | A vulnerability was found in Dibo Data Decision Making System up to 2.7.0. The affected element is the function downloadImpTemplet of the file /common/dep/comm… |
CVE-2025-11033 | High | 7.3 | 2025-09-26 | A vulnerability has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Impacted is an unknown function of the file /Pro… |
CVE-2025-11032 | High | 7.3 | 2025-09-26 | A flaw has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This issue affects some unknown processing of the file /P… |
CVE-2025-59844 | | 2025-09-26 | SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in Sonar… | |
CVE-2025-55848 | High | 8.8 | 2025-09-26 | An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the set_cassword settings interface, as the http_casswd parameter is not… |
CVE-2025-26258 | Medium | 6.1 | 2025-09-26 | Sourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.' |
CVE-2025-11031 | Medium | 5.3 | 2025-09-26 | A flaw has been found in DataTables up to 1.10.13. The affected element is an unknown function of the file /examples/resources/examples.php. This manipulation… |
CVE-2025-11030 | High | 7.3 | 2025-09-26 | A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60. Impacted is an unknown function of… |
CVE-2025-11029 | Medium | 4.3 | 2025-09-26 | A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cross-site request fo… |
CVE-2025-59843 | Medium | 5.3 | 2025-09-26 | Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in… |
CVE-2025-59842 | Medium | 4.3 | 2025-09-26 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links g… |
CVE-2025-59362 | Medium | 4.0 | 2025-09-26 | Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c. |
CVE-2025-58385 | High | 7.1 | 2025-09-26 | In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users (there is hard-coded and predictable data). |
CVE-2025-56463 | Medium | 6.8 | 2025-09-26 | Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure. |
CVE-2025-11028 | Medium | 5.3 | 2025-09-26 | A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. This affects an unknown part of the component Image Handler. Performing manipulation results… |
CVE-2025-11027 | Low | 2.4 | 2025-09-26 | A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such mani… |
CVE-2025-6396 | Medium | 6.1 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webbeyaz Website Design Website Software allows Cr… |
CVE-2025-57292 | Medium | 6.1 | 2025-09-26 | Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIM… |
CVE-2025-55187 | Critical | 9.9 | 2025-09-26 | In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges. |
CVE-2025-36326 | Low | 3.7 | 2025-09-26 | IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of… |
CVE-2025-36274 | High | 7.5 | 2025-09-26 | IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user. |
CVE-2025-11026 | Low | 3.5 | 2025-09-26 | A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Affected by this vulnerability is an unknown functionality of the component Configuration File Ha… |
CVE-2025-11019 | Low | 2.4 | 2025-09-26 | A vulnerability has been found in Total.js CMS up to 19.9.0. This impacts an unknown function of the component Files Menu. The manipulation leads to cross site… |
CVE-2025-11018 | Medium | 5.3 | 2025-09-26 | A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown function of the file /sysRole/index.do/../../genera… |
CVE-2025-11017 | Low | 3.3 | 2025-09-26 | A vulnerability was detected in OGRECave Ogre up to 14.4.1. The impacted element is the function Ogre::LogManager::stream of the file /ogre/OgreMain/src/OgreLo… |
CVE-2025-11016 | Medium | 4.3 | 2025-09-26 | A security vulnerability has been detected in kalcaddle kodbox up to 1.61.09. The affected element is the function fileOut of the file app/controller/explorer/… |
CVE-2025-11015 | Medium | 5.3 | 2025-09-26 | A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBIC… |
CVE-2025-9267 | | 2025-09-26 | In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current workin… | |
CVE-2025-11060 | Medium | 5.7 | 2025-09-26 | A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized recor… |
CVE-2025-11025 | Medium | 5.3 | 2025-09-26 | Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Messaging Platform al… |
CVE-2025-11014 | Medium | 5.3 | 2025-09-26 | A security flaw has been discovered in OGRECave Ogre up to 14.4.1. This issue affects the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/s… |
CVE-2025-11013 | Low | 3.3 | 2025-09-26 | A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xml_parsing… |
CVE-2025-11012 | Medium | 5.3 | 2025-09-26 | A vulnerability was determined in BehaviorTree up to 4.7.0. This affects the function ParseScript of the file /src/script_parser.cpp of the component Diagnosti… |
CVE-2025-11011 | Low | 3.3 | 2025-09-26 | A vulnerability was found in BehaviorTree up to 4.7.0. Affected by this issue is the function JsonExporter::fromJson of the file /src/json_export.cpp. Performi… |
CVE-2025-11010 | Medium | 5.3 | 2025-09-26 | A vulnerability has been found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_include_common of the file /src/ucl_util.c. S… |
CVE-2025-5069 | Low | 3.5 | 2025-09-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowe… |
CVE-2025-11042 | Medium | 4.3 | 2025-09-26 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that allows an att… |
CVE-2025-10868 | Low | 3.5 | 2025-09-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 where certain string co… |
CVE-2025-10544 | | 2025-09-26 | Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upl… | |
CVE-2025-9958 | High | 7.7 | 2025-09-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allow… |
CVE-2025-9642 | High | 8.7 | 2025-09-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an at… |
CVE-2025-7691 | Medium | 6.5 | 2025-09-26 | A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1… |
CVE-2025-60219 | Critical | 10.0 | 2025-09-26 | Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme WooCommerce Designer Pro wc-designer-pro allows Upload a Web Shell to a Web Server.T… |
CVE-2025-60186 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Google+ Comments google-plus-comments allows St… |
CVE-2025-60185 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kontur.us kontur Admin Style kontur-admin-style allows St… |
CVE-2025-60184 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. SEO Search Permalink seo-search-permalink allows… |
CVE-2025-60181 | Medium | 5.4 | 2025-09-26 | Server-Side Request Forgery (SSRF) vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Server Side Request Forgery.This issue affects Si… |
CVE-2025-60179 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Space Studio Click & Tweet allows Stored XSS. This issue… |
CVE-2025-60177 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rozx Recaptcha – wp recaptcha-wp allows Stored XSS.This i… |
CVE-2025-60173 | High | 7.1 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in Ashwani kumar GST for WooCommerce gst-for-woocommerce allows Stored XSS.This issue affects GST for WooCommer… |
CVE-2025-60172 | High | 7.1 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in flytedesk Flytedesk Digital flytedesk-digital allows Stored XSS.This issue affects Flytedesk Digital: from n… |
CVE-2025-60171 | High | 7.1 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in yourplugins Conditional Cart Messages for WooCommerce – YourPlugins.com yourplugins-wc-conditional-cart-noti… |
CVE-2025-60170 | High | 7.1 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in Taraprasad Swain HTACCESS IP Blocker htaccess-ip-blocker allows Stored XSS.This issue affects HTACCESS IP Bl… |