2025 CVEs (page 166)
Page 166 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-56383 | High | 8.4 | 2025-09-26 | Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. NOTE: this is disputed by multiple parti… |
CVE-2025-55847 | High | 8.8 | 2025-09-26 | Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie paramet… |
CVE-2025-45994 | High | 7.5 | 2025-09-26 | An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdir… |
CVE-2025-11034 | Medium | 4.3 | 2025-09-26 | A vulnerability was found in Dibo Data Decision Making System up to 2.7.0. The affected element is the function downloadImpTemplet of the file /common/dep/comm… |
CVE-2025-11033 | High | 7.3 | 2025-09-26 | A vulnerability has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Impacted is an unknown function of the file /Pro… |
CVE-2025-11032 | High | 7.3 | 2025-09-26 | A flaw has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This issue affects some unknown processing of the file /P… |
CVE-2025-59844 | | 2025-09-26 | SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in Sonar… | |
CVE-2025-55848 | High | 8.8 | 2025-09-26 | An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the set_cassword settings interface, as the http_casswd parameter is not… |
CVE-2025-26258 | Medium | 6.1 | 2025-09-26 | Sourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.' |
CVE-2025-11031 | Medium | 5.3 | 2025-09-26 | A flaw has been found in DataTables up to 1.10.13. The affected element is an unknown function of the file /examples/resources/examples.php. This manipulation… |
CVE-2025-11030 | High | 7.3 | 2025-09-26 | A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60. Impacted is an unknown function of… |
CVE-2025-11029 | Medium | 4.3 | 2025-09-26 | A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cross-site request fo… |
CVE-2025-59843 | Medium | 5.3 | 2025-09-26 | Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in… |
CVE-2025-59842 | Medium | 4.3 | 2025-09-26 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links g… |
CVE-2025-59362 | Medium | 4.0 | 2025-09-26 | Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c. |
CVE-2025-58385 | High | 7.1 | 2025-09-26 | In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users (there is hard-coded and predictable data). |
CVE-2025-56463 | Medium | 6.8 | 2025-09-26 | Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure. |
CVE-2025-11028 | Medium | 5.3 | 2025-09-26 | A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. This affects an unknown part of the component Image Handler. Performing manipulation results… |
CVE-2025-11027 | Low | 2.4 | 2025-09-26 | A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such mani… |
CVE-2025-6396 | Medium | 6.1 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webbeyaz Website Design Website Software allows Cr… |
CVE-2025-57292 | Medium | 6.1 | 2025-09-26 | Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIM… |
CVE-2025-55187 | Critical | 9.9 | 2025-09-26 | In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges. |
CVE-2025-36326 | Low | 3.7 | 2025-09-26 | IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of… |
CVE-2025-36274 | High | 7.5 | 2025-09-26 | IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user. |
CVE-2025-11026 | Low | 3.5 | 2025-09-26 | A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Affected by this vulnerability is an unknown functionality of the component Configuration File Ha… |
CVE-2025-11019 | Low | 2.4 | 2025-09-26 | A vulnerability has been found in Total.js CMS up to 19.9.0. This impacts an unknown function of the component Files Menu. The manipulation leads to cross site… |
CVE-2025-11018 | Medium | 5.3 | 2025-09-26 | A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown function of the file /sysRole/index.do/../../genera… |
CVE-2025-11017 | Low | 3.3 | 2025-09-26 | A vulnerability was detected in OGRECave Ogre up to 14.4.1. The impacted element is the function Ogre::LogManager::stream of the file /ogre/OgreMain/src/OgreLo… |
CVE-2025-11016 | Medium | 4.3 | 2025-09-26 | A security vulnerability has been detected in kalcaddle kodbox up to 1.61.09. The affected element is the function fileOut of the file app/controller/explorer/… |
CVE-2025-11015 | Medium | 5.3 | 2025-09-26 | A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBIC… |
CVE-2025-9267 | | 2025-09-26 | In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current workin… | |
CVE-2025-11060 | Medium | 5.7 | 2025-09-26 | A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized recor… |
CVE-2025-11025 | Medium | 5.3 | 2025-09-26 | Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Messaging Platform al… |
CVE-2025-11014 | Medium | 5.3 | 2025-09-26 | A security flaw has been discovered in OGRECave Ogre up to 14.4.1. This issue affects the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/s… |
CVE-2025-11013 | Low | 3.3 | 2025-09-26 | A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xml_parsing… |
CVE-2025-11012 | Medium | 5.3 | 2025-09-26 | A vulnerability was determined in BehaviorTree up to 4.7.0. This affects the function ParseScript of the file /src/script_parser.cpp of the component Diagnosti… |
CVE-2025-11011 | Low | 3.3 | 2025-09-26 | A vulnerability was found in BehaviorTree up to 4.7.0. Affected by this issue is the function JsonExporter::fromJson of the file /src/json_export.cpp. Performi… |
CVE-2025-11010 | Medium | 5.3 | 2025-09-26 | A vulnerability has been found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_include_common of the file /src/ucl_util.c. S… |
CVE-2025-5069 | Low | 3.5 | 2025-09-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowe… |
CVE-2025-11042 | Medium | 4.3 | 2025-09-26 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that allows an att… |
CVE-2025-10868 | Low | 3.5 | 2025-09-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 where certain string co… |
CVE-2025-10544 | | 2025-09-26 | Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upl… | |
CVE-2025-9958 | High | 7.7 | 2025-09-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allow… |
CVE-2025-9642 | High | 8.7 | 2025-09-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an at… |
CVE-2025-7691 | Medium | 6.5 | 2025-09-26 | A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1… |
CVE-2025-60219 | Critical | 10.0 | 2025-09-26 | Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme WooCommerce Designer Pro wc-designer-pro allows Upload a Web Shell to a Web Server.T… |
CVE-2025-60186 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Google+ Comments google-plus-comments allows St… |
CVE-2025-60185 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kontur.us kontur Admin Style kontur-admin-style allows St… |
CVE-2025-60184 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. SEO Search Permalink seo-search-permalink allows… |
CVE-2025-60181 | Medium | 5.4 | 2025-09-26 | Server-Side Request Forgery (SSRF) vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Server Side Request Forgery.This issue affects Si… |
CVE-2025-60179 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Space Studio Click & Tweet allows Stored XSS. This issue… |
CVE-2025-60177 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rozx Recaptcha – wp recaptcha-wp allows Stored XSS.This i… |
CVE-2025-60173 | High | 7.1 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in Ashwani kumar GST for WooCommerce gst-for-woocommerce allows Stored XSS.This issue affects GST for WooCommer… |
CVE-2025-60172 | High | 7.1 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in flytedesk Flytedesk Digital flytedesk-digital allows Stored XSS.This issue affects Flytedesk Digital: from n… |
CVE-2025-60171 | High | 7.1 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in yourplugins Conditional Cart Messages for WooCommerce – YourPlugins.com yourplugins-wc-conditional-cart-noti… |
CVE-2025-60170 | High | 7.1 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in Taraprasad Swain HTACCESS IP Blocker htaccess-ip-blocker allows Stored XSS.This issue affects HTACCESS IP Bl… |
CVE-2025-60169 | High | 7.1 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM w3s-cf7-zoho allows Stored XSS.This issue affects W… |
CVE-2025-60167 | Medium | 4.3 | 2025-09-26 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows… |
CVE-2025-60166 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in wpshuffle WP Subscription Forms PRO wp-subscription-forms-pro allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-60165 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in HaruTheme Frames frames allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frame… |
CVE-2025-60164 | High | 7.1 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in NewsMAN NewsmanApp newsmanapp allows Stored XSS.This issue affects NewsmanApp: from n/a through <= 2.7.7. |
CVE-2025-60163 | Medium | 6.5 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin W bbp topic count bbp-topic-count allows DOM-Based… |
CVE-2025-60162 | Medium | 6.5 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows DO… |
CVE-2025-60161 | Medium | 5.4 | 2025-09-26 | Server-Side Request Forgery (SSRF) vulnerability in bdthemes ZoloBlocks zoloblocks allows Server Side Request Forgery.This issue affects ZoloBlocks: from n/a t… |
CVE-2025-60160 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sharkthemes Smart Related Products ai-related-products al… |
CVE-2025-60159 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in webmaniabr Nota Fiscal Eletrônica WooCommerce nota-fiscal-eletronica-woocommerce allows Exploiting Incorrectly Configure… |
CVE-2025-60158 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webmaniabr Nota Fiscal Eletrônica WooCommerce nota-fiscal… |
CVE-2025-60157 | Medium | 6.5 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design WP Ticket Customer Service Software & Supp… |
CVE-2025-60156 | Critical | 9.6 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects A… |
CVE-2025-60155 | Medium | 5.3 | 2025-09-26 | Missing Authorization vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-60154 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jennifer Moss MWW Disclaimer Buttons mww-disclaimer-butto… |
CVE-2025-60153 | High | 7.5 | 2025-09-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpshuffle Subscribe To Unlock subscrib… |
CVE-2025-60152 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in wpshuffle Subscribe To Unlock subscribe-to-unlock allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-60150 | High | 7.5 | 2025-09-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpshuffle Subscribe to Download subscr… |
CVE-2025-60149 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rocket Apps Notely notely allows Stored XSS.This issue af… |
CVE-2025-60148 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-60147 | Medium | 6.5 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Feed ht-instagram allows Stored XSS.This is… |
CVE-2025-60146 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amit Verma Map Categories to Pages map-categories-to-page… |
CVE-2025-60145 | Medium | 4.3 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in yonifre Lenix scss compiler lenix-scss-compiler allows Cross Site Request Forgery.This issue affects Lenix s… |
CVE-2025-60144 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Lenix scss compiler lenix-scss-compiler allows St… |
CVE-2025-60143 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netgsm… |
CVE-2025-60142 | Medium | 6.5 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DaganLev Simple Meta Tags simple-meta-tags allows DOM-Bas… |
CVE-2025-60141 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thetechtribe The Tribal the-tech-tribe allows Stored XSS… |
CVE-2025-60140 | Medium | 5.3 | 2025-09-26 | Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal the-tech-tribe allows Retrieve Embedded Sensitive Data.This issue af… |
CVE-2025-60139 | Medium | 4.3 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Cross Site Request Forgery.This issue affects… |
CVE-2025-60138 | Medium | 6.5 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This… |
CVE-2025-60137 | Medium | 4.3 | 2025-09-26 | Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Post Featured Video post-featured-video allows Cross Site Request Forgery.This issue affects… |
CVE-2025-60136 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj User Notes user-notes allows Stored XSS.This iss… |
CVE-2025-60133 | Medium | 5.9 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DJ-Extensions.com PE Easy Slider pe-easy-slider allows St… |
CVE-2025-60130 | Medium | 5.3 | 2025-09-26 | Missing Authorization vulnerability in wedos.com WEDOS Global wgpwpp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WEDOS G… |
CVE-2025-60129 | Medium | 5.3 | 2025-09-26 | Missing Authorization vulnerability in Yext Yext yext allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Yext: from n/a through… |
CVE-2025-60128 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in WP Delicious Delisho dr-widgets-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-60127 | Medium | 5.4 | 2025-09-26 | Missing Authorization vulnerability in ArtistScope CopySafe Web Protection wp-copysafe-web allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-60126 | High | 8.8 | 2025-09-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginOps Testimonial Slider testimoni… |
CVE-2025-60125 | Medium | 5.3 | 2025-09-26 | Insertion of Sensitive Information Into Sent Data vulnerability in themelooks FoodBook foodbook allows Retrieve Embedded Sensitive Data.This issue affects Food… |
CVE-2025-60124 | Medium | 6.5 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Hellyer Simple Colorbox simple-colorbox allows Store… |
CVE-2025-60123 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-60122 | Medium | 4.3 | 2025-09-26 | Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-60121 | Medium | 5.3 | 2025-09-26 | Missing Authorization vulnerability in Ex-Themes WooEvents woo-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-60120 | Medium | 5.3 | 2025-09-26 | Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.T… |