2025 CVEs (page 173)
Page 173 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-52367 | Medium | 5.4 | 2025-09-22 | Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field. |
CVE-2025-36064 | Medium | 5.9 | 2025-09-22 | IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to br… |
CVE-2025-10811 | High | 7.3 | 2025-09-22 | A flaw has been found in code-projects Hostel Management System 1.0. This affects an unknown function of the file /justines/admin/mod_comments/index.php?view=v… |
CVE-2025-10810 | High | 7.3 | 2025-09-22 | A vulnerability was detected in Campcodes Online Learning Management System 1.0. The impacted element is an unknown function of the file /admin/edit_user.php… |
CVE-2025-59420 | High | 7.5 | 2025-09-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unkno… |
CVE-2025-59418 | Medium | 5.5 | 2025-09-22 | BunnyPad is a note taking software. Prior to version 11.0.27000.0915, opening files greater than or equal to 20MB causes buffer overflow to occur. This issue h… |
CVE-2025-57441 | Critical | 9.8 | 2025-09-22 | The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Telnet service on port 9990. Upon connect… |
CVE-2025-57440 | High | 7.5 | 2025-09-22 | The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands for controlling stre… |
CVE-2025-57439 | High | 8.8 | 2025-09-22 | Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint. An authenticated attacker can inje… |
CVE-2025-57438 | Medium | 6.8 | 2025-09-22 | The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain sensitive endpoints are intended to be accessible only after the admi… |
CVE-2025-57437 | Critical | 9.8 | 2025-09-22 | The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977. When connected, the serv… |
CVE-2025-55888 | High | 7.3 | 2025-09-22 | Cross-Site Scripting (XSS) vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject… |
CVE-2025-55886 | Medium | 6.5 | 2025-09-22 | An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD. The flaw exists in the `fe_uid` parameter of the payment history API endpoint… |
CVE-2025-55885 | Medium | 6.3 | 2025-09-22 | SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate privileges via the GET… |
CVE-2025-43953 | High | 8.8 | 2025-09-22 | In 2wcom IP-4c 2.16, the web interface allows admin and manager users to execute arbitrary code as root via a ping or traceroute field on the TCP/IP screen. |
CVE-2025-10809 | High | 7.3 | 2025-09-22 | A security vulnerability has been detected in Campcodes Online Learning Management System 1.0. The affected element is an unknown function of the file /admin/d… |
CVE-2025-10808 | High | 7.3 | 2025-09-22 | A weakness has been identified in Campcodes Farm Management System 1.0. Impacted is an unknown function of the file /uploadProduct.php. This manipulation of th… |
CVE-2025-59413 | Medium | 6.5 | 2025-09-22 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to uns… |
CVE-2025-59412 | Medium | 5.4 | 2025-09-22 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not pro… |
CVE-2025-59411 | Medium | 5.4 | 2025-09-22 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in th… |
CVE-2025-59335 | High | 7.1 | 2025-09-22 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. Th… |
CVE-2025-57434 | High | 8.8 | 2025-09-22 | Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username… |
CVE-2025-57431 | High | 8.8 | 2025-09-22 | The Sound4 PULSE-ECO AES67 1.22 web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update… |
CVE-2025-43807 | Medium | 5.4 | 2025-09-22 | Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q… |
CVE-2025-10807 | Medium | 6.3 | 2025-09-22 | A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/edit… |
CVE-2025-10806 | Medium | 6.3 | 2025-09-22 | A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/bwdates-repo… |
CVE-2025-57682 | Medium | 6.5 | 2025-09-22 | Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket through its CloudF… |
CVE-2025-57605 | High | 8.8 | 2025-09-22 | Lack of server-side authorisation on department admin assignment APIs in AiKaan IoT Platform allows authenticated users to elevate their privileges by assignin… |
CVE-2025-57602 | Critical | 9.8 | 2025-09-22 | Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH private key, allows rem… |
CVE-2025-57601 | Critical | 9.8 | 2025-09-22 | AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When a… |
CVE-2025-57433 | Medium | 6.5 | 2025-09-22 | The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability. By sending a crafted POST request to a specific endpoint (/cwi/… |
CVE-2025-57432 | Critical | 9.8 | 2025-09-22 | Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands. This service allows remote attackers to manip… |
CVE-2025-57430 | High | 7.5 | 2025-09-22 | Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When accessed, this endpoint returns internal conf… |
CVE-2025-36202 | High | 7.5 | 2025-09-22 | IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the imprope… |
CVE-2025-36037 | Medium | 5.4 | 2025-09-22 | IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized… |
CVE-2025-35042 | Critical | 9.8 | 2025-09-22 | Airship AI Acropolis includes a default administrative account that uses the same credentials on every installation. Instances of Airship AI that do not change… |
CVE-2025-35041 | High | 7.5 | 2025-09-22 | Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials c… |
CVE-2025-10805 | Medium | 6.3 | 2025-09-22 | A vulnerability was determined in Campcodes Online Beauty Parlor Management System 1.0. This affects an unknown part of the file /admin/add-services.php. Execu… |
CVE-2025-10804 | Medium | 6.3 | 2025-09-22 | A vulnerability was found in Campcodes Online Beauty Parlor Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/add-… |
CVE-2025-9038 | | 2025-09-22 | Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue affects S1 Agile Co… | |
CVE-2025-10803 | High | 8.8 | 2025-09-22 | A vulnerability has been found in Tenda AC23 up to 16.03.07.52. Affected by this vulnerability is the function sscanf of the file /goform/SetPptpServerCfg of t… |
CVE-2025-10802 | High | 7.3 | 2025-09-22 | A flaw has been found in code-projects Online Bidding System 1.0. Affected is an unknown function of the file /administrator/remove.php. This manipulation of t… |
CVE-2025-56075 | Medium | 5.4 | 2025-09-22 | A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerabi… |
CVE-2025-56074 | Critical | 9.8 | 2025-09-22 | A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulner… |
CVE-2025-51006 | High | 7.8 | 2025-09-22 | Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxsll2/linuxsll2.c. Th… |
CVE-2025-10801 | High | 7.3 | 2025-09-22 | A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown function of the file /admin/edit_tax… |
CVE-2025-10800 | High | 7.3 | 2025-09-22 | A weakness has been identified in itsourcecode Online Discussion Forum 1.0. The impacted element is an unknown function of the file /index.php. Executing manip… |
CVE-2025-59797 | Medium | 5.8 | 2025-09-22 | Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, the user-management p… |
CVE-2025-10854 | High | 8.1 | 2025-09-22 | The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerab… |
CVE-2025-10799 | High | 7.3 | 2025-09-22 | A security flaw has been discovered in code-projects Hostel Management System 1.0. The affected element is an unknown function of the file /justines/admin/mod_… |
CVE-2025-10798 | High | 7.3 | 2025-09-22 | A vulnerability was identified in code-projects Hostel Management System 1.0. Impacted is an unknown function of the file /justines/admin/mod_roomtype/index.ph… |
CVE-2025-10797 | High | 7.3 | 2025-09-22 | A vulnerability was determined in code-projects Hostel Management System 1.0. This issue affects some unknown processing of the file /justines/index.php. This… |
CVE-2025-10796 | High | 7.3 | 2025-09-22 | A vulnerability was found in code-projects Hostel Management System 1.0. This vulnerability affects unknown code of the file /justines/admin/login.php. The man… |
CVE-2025-9983 | | 2025-09-22 | GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials ar… | |
CVE-2025-46711 | Medium | 5.5 | 2025-09-22 | Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger NULL pointer dereference kernel exceptions. |
CVE-2025-10795 | High | 7.3 | 2025-09-22 | A vulnerability has been found in code-projects Online Bidding System 1.0. This affects an unknown part of the file /administrator/bidupdate.php. The manipulat… |
CVE-2025-10794 | Medium | 4.3 | 2025-09-22 | A flaw has been found in PHPGurukul Car Rental Project 3.0. Affected by this issue is some unknown functionality of the file /carrental/search.php. Executing m… |
CVE-2025-9035 | Medium | 5.4 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Horato Internet Technologies Ind. And Trade Inc. V… |
CVE-2025-25177 | Medium | 5.1 | 2025-09-22 | Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions. |
CVE-2025-10793 | High | 7.3 | 2025-09-22 | A vulnerability was detected in code-projects E-Commerce Website 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/admin_accou… |
CVE-2025-10792 | High | 8.8 | 2025-09-22 | A security vulnerability has been detected in D-Link DIR-513 A1FW110. Affected is an unknown function of the file /goform/formWPS. Such manipulation of the arg… |
CVE-2025-10009 | | 2025-09-22 | Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary c… | |
CVE-2025-8079 | Medium | 4.6 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. Smar… |
CVE-2025-10791 | High | 7.3 | 2025-09-22 | A weakness has been identified in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/index.php. This manipula… |
CVE-2025-10790 | Medium | 6.3 | 2025-09-22 | A security flaw has been discovered in SourceCodester Simple Forum Discussion System 1.0. This affects an unknown function of the file /ajax.php?action=save_ca… |
CVE-2025-5962 | High | 7.7 | 2025-09-22 | A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of… |
CVE-2025-10789 | High | 7.3 | 2025-09-22 | A vulnerability was identified in SourceCodester Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file deleteslide.php… |
CVE-2025-10788 | High | 7.3 | 2025-09-22 | A vulnerability was determined in SourceCodester Online Hotel Reservation System 1.0. The affected element is an unknown function of the file deleteroominvento… |
CVE-2025-0875 | Medium | 6.5 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information Sys… |
CVE-2025-10787 | Medium | 6.3 | 2025-09-22 | A vulnerability was found in MuYuCMS up to 2.7. Impacted is an unknown function of the file /index/index.html of the component Add Fiend Link Handler. Performi… |
CVE-2025-10786 | High | 7.3 | 2025-09-22 | A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=delete_user. Th… |
CVE-2025-9541 | Medium | 4.7 | 2025-09-22 | The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform S… |
CVE-2025-9540 | Medium | 4.7 | 2025-09-22 | The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform S… |
CVE-2025-9487 | Medium | 4.7 | 2025-09-22 | The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, whi… |
CVE-2025-9115 | Medium | 5.6 | 2025-09-22 | The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead t… |
CVE-2025-10785 | High | 7.3 | 2025-09-22 | A vulnerability was detected in Campcodes Grocery Sales and Inventory System 1.0. This affects an unknown part of the file /manage_user.php. The manipulation o… |
CVE-2025-10784 | High | 7.3 | 2025-09-22 | A security vulnerability has been detected in Campcodes Online Learning Management System 1.0. Affected by this issue is some unknown functionality of the file… |
CVE-2025-10783 | High | 7.3 | 2025-09-22 | A weakness has been identified in Campcodes Online Learning Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admi… |
CVE-2025-10782 | High | 7.3 | 2025-09-22 | A security flaw has been discovered in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/class.php. Performin… |
CVE-2025-59801 | Medium | 4.3 | 2025-09-22 | In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked. |
CVE-2025-59800 | Medium | 4.3 | 2025-09-22 | In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8. |
CVE-2025-59799 | Medium | 4.3 | 2025-09-22 | Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value. |
CVE-2025-59798 | Medium | 4.3 | 2025-09-22 | Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c. |
CVE-2025-10781 | High | 7.3 | 2025-09-22 | A vulnerability was identified in Campcodes Online Learning Management System 1.0. This impacts an unknown function of the file /admin/edit_class.php. Such man… |
CVE-2025-10780 | Medium | 6.3 | 2025-09-22 | A vulnerability was determined in CodeAstro Simple Pharmacy Management 1.0. This affects an unknown function of the file /view.php. This manipulation of the ar… |
CVE-2025-10779 | High | 8.8 | 2025-09-22 | A vulnerability was found in D-Link DCS-935L up to 1.13.01. The impacted element is the function sub_402280 of the file /HNAP1/. The manipulation of the argume… |
CVE-2025-10778 | Low | 3.1 | 2025-09-22 | A vulnerability has been found in Smartstore up to 6.2.0. The affected element is an unknown function of the file /checkout/confirm/ of the component Gift Vouc… |
CVE-2025-10777 | Medium | 6.3 | 2025-09-22 | A flaw has been found in JSC R7 R7-Office Document Server up to 20250820. Impacted is an unknown function of the file /downloadas/. Executing manipulation of t… |
CVE-2025-10776 | Low | 3.7 | 2025-09-22 | A vulnerability was detected in LionCoders SalePro POS up to 5.5.0. This issue affects some unknown processing of the component Login. Performing manipulation… |
CVE-2025-10775 | Medium | 4.7 | 2025-09-22 | A security vulnerability has been detected in Wavlink WL-NU516U1 240425. This vulnerability affects the function sub_4012A0 of the file /cgi-bin/login.cgi. Suc… |
CVE-2025-10774 | Medium | 4.7 | 2025-09-22 | A weakness has been identified in Ruijie 6000-E10 up to 2.4.3.6-20171117. This affects an unknown part of the file /view/vpn/autovpn/sub_commit.php. This manip… |
CVE-2025-10773 | High | 8.8 | 2025-09-22 | A security flaw has been discovered in B-Link BL-AC2100 up to 1.0.3. Affected by this issue is the function delshrpath of the file /goform/set_delshrpath_cfg o… |
CVE-2025-10772 | Medium | 6.3 | 2025-09-22 | A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_… |
CVE-2025-10771 | Medium | 6.3 | 2025-09-21 | A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the c… |
CVE-2025-10770 | Medium | 6.3 | 2025-09-21 | A vulnerability was found in jeecgboot JimuReport up to 2.1.2. This impacts an unknown function of the file /drag/onlDragDataSource/testConnection of the compo… |
CVE-2025-10767 | Medium | 4.5 | 2025-09-21 | A vulnerability was detected in CosmodiumCS OnlyRAT up to 3.2. The affected element is the function connect/remote_upload/remote_download of the file main.py o… |
CVE-2025-53692 | High | 7.1 | 2025-09-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecor… |
CVE-2025-10769 | Medium | 6.3 | 2025-09-21 | A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. S… |
CVE-2025-10768 | Medium | 6.3 | 2025-09-21 | A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Dri… |
CVE-2025-6544 | Critical | 9.8 | 2025-09-21 | A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The v… |