2025 CVEs (page 175)
Page 175 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-51006 | High | 7.8 | 2025-09-22 | Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxsll2/linuxsll2.c. Th… |
CVE-2025-10801 | High | 7.3 | 2025-09-22 | A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown function of the file /admin/edit_tax… |
CVE-2025-10800 | High | 7.3 | 2025-09-22 | A weakness has been identified in itsourcecode Online Discussion Forum 1.0. The impacted element is an unknown function of the file /index.php. Executing manip… |
CVE-2025-59797 | Medium | 5.8 | 2025-09-22 | Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, the user-management p… |
CVE-2025-10854 | High | 8.1 | 2025-09-22 | The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerab… |
CVE-2025-10799 | High | 7.3 | 2025-09-22 | A security flaw has been discovered in code-projects Hostel Management System 1.0. The affected element is an unknown function of the file /justines/admin/mod_… |
CVE-2025-10798 | High | 7.3 | 2025-09-22 | A vulnerability was identified in code-projects Hostel Management System 1.0. Impacted is an unknown function of the file /justines/admin/mod_roomtype/index.ph… |
CVE-2025-10797 | High | 7.3 | 2025-09-22 | A vulnerability was determined in code-projects Hostel Management System 1.0. This issue affects some unknown processing of the file /justines/index.php. This… |
CVE-2025-10796 | High | 7.3 | 2025-09-22 | A vulnerability was found in code-projects Hostel Management System 1.0. This vulnerability affects unknown code of the file /justines/admin/login.php. The man… |
CVE-2025-9983 | | 2025-09-22 | GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials ar… | |
CVE-2025-46711 | Medium | 5.5 | 2025-09-22 | Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger NULL pointer dereference kernel exceptions. |
CVE-2025-10795 | High | 7.3 | 2025-09-22 | A vulnerability has been found in code-projects Online Bidding System 1.0. This affects an unknown part of the file /administrator/bidupdate.php. The manipulat… |
CVE-2025-10794 | Medium | 4.3 | 2025-09-22 | A flaw has been found in PHPGurukul Car Rental Project 3.0. Affected by this issue is some unknown functionality of the file /carrental/search.php. Executing m… |
CVE-2025-9035 | Medium | 5.4 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Horato Internet Technologies Ind. And Trade Inc. V… |
CVE-2025-25177 | Medium | 5.1 | 2025-09-22 | Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions. |
CVE-2025-10793 | High | 7.3 | 2025-09-22 | A vulnerability was detected in code-projects E-Commerce Website 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/admin_accou… |
CVE-2025-10792 | High | 8.8 | 2025-09-22 | A security vulnerability has been detected in D-Link DIR-513 A1FW110. Affected is an unknown function of the file /goform/formWPS. Such manipulation of the arg… |
CVE-2025-10009 | | 2025-09-22 | Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary c… | |
CVE-2025-8079 | Medium | 4.6 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. Smar… |
CVE-2025-10791 | High | 7.3 | 2025-09-22 | A weakness has been identified in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/index.php. This manipula… |
CVE-2025-10790 | Medium | 6.3 | 2025-09-22 | A security flaw has been discovered in SourceCodester Simple Forum Discussion System 1.0. This affects an unknown function of the file /ajax.php?action=save_ca… |
CVE-2025-5962 | High | 7.7 | 2025-09-22 | A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of… |
CVE-2025-10789 | High | 7.3 | 2025-09-22 | A vulnerability was identified in SourceCodester Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file deleteslide.php… |
CVE-2025-10788 | High | 7.3 | 2025-09-22 | A vulnerability was determined in SourceCodester Online Hotel Reservation System 1.0. The affected element is an unknown function of the file deleteroominvento… |
CVE-2025-0875 | Medium | 6.5 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information Sys… |
CVE-2025-10787 | Medium | 6.3 | 2025-09-22 | A vulnerability was found in MuYuCMS up to 2.7. Impacted is an unknown function of the file /index/index.html of the component Add Fiend Link Handler. Performi… |
CVE-2025-10786 | High | 7.3 | 2025-09-22 | A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=delete_user. Th… |
CVE-2025-9541 | Medium | 4.7 | 2025-09-22 | The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform S… |
CVE-2025-9540 | Medium | 4.7 | 2025-09-22 | The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform S… |
CVE-2025-9487 | Medium | 4.7 | 2025-09-22 | The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, whi… |
CVE-2025-9115 | Medium | 5.6 | 2025-09-22 | The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead t… |
CVE-2025-10785 | High | 7.3 | 2025-09-22 | A vulnerability was detected in Campcodes Grocery Sales and Inventory System 1.0. This affects an unknown part of the file /manage_user.php. The manipulation o… |
CVE-2025-10784 | High | 7.3 | 2025-09-22 | A security vulnerability has been detected in Campcodes Online Learning Management System 1.0. Affected by this issue is some unknown functionality of the file… |
CVE-2025-10783 | High | 7.3 | 2025-09-22 | A weakness has been identified in Campcodes Online Learning Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admi… |
CVE-2025-10782 | High | 7.3 | 2025-09-22 | A security flaw has been discovered in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/class.php. Performin… |
CVE-2025-59801 | Medium | 4.3 | 2025-09-22 | In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked. |
CVE-2025-59800 | Medium | 4.3 | 2025-09-22 | In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8. |
CVE-2025-59799 | Medium | 4.3 | 2025-09-22 | Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value. |
CVE-2025-59798 | Medium | 4.3 | 2025-09-22 | Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c. |
CVE-2025-10781 | High | 7.3 | 2025-09-22 | A vulnerability was identified in Campcodes Online Learning Management System 1.0. This impacts an unknown function of the file /admin/edit_class.php. Such man… |
CVE-2025-10780 | Medium | 6.3 | 2025-09-22 | A vulnerability was determined in CodeAstro Simple Pharmacy Management 1.0. This affects an unknown function of the file /view.php. This manipulation of the ar… |
CVE-2025-10779 | High | 8.8 | 2025-09-22 | A vulnerability was found in D-Link DCS-935L up to 1.13.01. The impacted element is the function sub_402280 of the file /HNAP1/. The manipulation of the argume… |
CVE-2025-10778 | Low | 3.1 | 2025-09-22 | A vulnerability has been found in Smartstore up to 6.2.0. The affected element is an unknown function of the file /checkout/confirm/ of the component Gift Vouc… |
CVE-2025-10777 | Medium | 6.3 | 2025-09-22 | A flaw has been found in JSC R7 R7-Office Document Server up to 20250820. Impacted is an unknown function of the file /downloadas/. Executing manipulation of t… |
CVE-2025-10776 | Low | 3.7 | 2025-09-22 | A vulnerability was detected in LionCoders SalePro POS up to 5.5.0. This issue affects some unknown processing of the component Login. Performing manipulation… |
CVE-2025-10775 | Medium | 4.7 | 2025-09-22 | A security vulnerability has been detected in Wavlink WL-NU516U1 240425. This vulnerability affects the function sub_4012A0 of the file /cgi-bin/login.cgi. Suc… |
CVE-2025-10774 | Medium | 4.7 | 2025-09-22 | A weakness has been identified in Ruijie 6000-E10 up to 2.4.3.6-20171117. This affects an unknown part of the file /view/vpn/autovpn/sub_commit.php. This manip… |
CVE-2025-10773 | High | 8.8 | 2025-09-22 | A security flaw has been discovered in B-Link BL-AC2100 up to 1.0.3. Affected by this issue is the function delshrpath of the file /goform/set_delshrpath_cfg o… |
CVE-2025-10772 | Medium | 6.3 | 2025-09-22 | A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_… |
CVE-2025-10771 | Medium | 6.3 | 2025-09-21 | A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the c… |
CVE-2025-10770 | Medium | 6.3 | 2025-09-21 | A vulnerability was found in jeecgboot JimuReport up to 2.1.2. This impacts an unknown function of the file /drag/onlDragDataSource/testConnection of the compo… |
CVE-2025-10767 | Medium | 4.5 | 2025-09-21 | A vulnerability was detected in CosmodiumCS OnlyRAT up to 3.2. The affected element is the function connect/remote_upload/remote_download of the file main.py o… |
CVE-2025-53692 | High | 7.1 | 2025-09-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecor… |
CVE-2025-10769 | Medium | 6.3 | 2025-09-21 | A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. S… |
CVE-2025-10768 | Medium | 6.3 | 2025-09-21 | A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Dri… |
CVE-2025-6544 | Critical | 9.8 | 2025-09-21 | A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The v… |
CVE-2025-10766 | Medium | 4.3 | 2025-09-21 | A weakness has been identified in SeriaWei ZKEACMS up to 4.3. This issue affects the function Download of the file EventViewerController.cs. Executing manipula… |
CVE-2025-10765 | Medium | 4.7 | 2025-09-21 | A security flaw has been discovered in SeriaWei ZKEACMS up to 4.3. This vulnerability affects the function CheckPage/Suggestions in the library cms-v4.3\wwwroo… |
CVE-2025-10764 | Medium | 6.3 | 2025-09-21 | A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskControl… |
CVE-2025-10763 | Medium | 6.3 | 2025-09-21 | A vulnerability was determined in academico-sis academico up to d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab. Affected by this issue is some unknown functionality… |
CVE-2025-10762 | Medium | 6.3 | 2025-09-21 | A vulnerability was found in kuaifan DooTask up to 1.2.49. Affected by this vulnerability is an unknown functionality of the file app/Http/Controllers/Api/User… |
CVE-2025-10761 | Low | 3.7 | 2025-09-21 | A vulnerability has been found in Harness 3.3.0. Affected is an unknown function of the file /api/v1/login of the component Login Endpoint. The manipulation le… |
CVE-2025-10760 | Medium | 6.3 | 2025-09-21 | A flaw has been found in Harness 3.3.0. This impacts the function LookupRepo of the file app/api/controller/gitspace/lookup_repo.go. Executing manipulation of… |
CVE-2025-10759 | Medium | 5.3 | 2025-09-21 | A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of th… |
CVE-2025-10758 | Low | 2.4 | 2025-09-21 | A security vulnerability has been detected in htmly up to 3.1.0. The impacted element is an unknown function of the file /htmly/admin/field/post of the compone… |
CVE-2025-10757 | High | 8.8 | 2025-09-21 | A weakness has been identified in UTT 1200GW up to 3.0.0-170831. The affected element is an unknown function of the file /goform/formConfigDnsFilterGlobal. Thi… |
CVE-2025-10756 | High | 8.8 | 2025-09-20 | A security flaw has been discovered in UTT HiPER 840G up to 3.1.1-190328. Impacted is an unknown function of the file /goform/getOneApConfTempEntry. The manipu… |
CVE-2025-10755 | Medium | 6.3 | 2025-09-20 | A vulnerability was detected in Selleo Mentingo 2025.08.27. The impacted element is an unknown function of the component Content-Type Handler. The manipulation… |
CVE-2025-40925 | Critical | 9.1 | 2025-09-20 | Starch versions 0.14 and earlier generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with a counter, the epoch time… |
CVE-2025-10741 | Medium | 6.3 | 2025-09-20 | A security vulnerability has been detected in Selleo Mentingo up to 2025.08.27. The affected element is an unknown function of the component Profile Picture Ha… |
CVE-2025-9887 | Medium | 4.3 | 2025-09-20 | The Custom Login And Signup Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to m… |
CVE-2025-9883 | Medium | 6.1 | 2025-09-20 | The Browser Sniff plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorre… |
CVE-2025-9882 | Medium | 6.1 | 2025-09-20 | The osTicket WP Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or… |
CVE-2025-10658 | Medium | 6.5 | 2025-09-20 | The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including… |
CVE-2025-9949 | Medium | 4.3 | 2025-09-20 | The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing… |
CVE-2025-10489 | Medium | 4.3 | 2025-09-20 | The SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more plugin for WordPress is vulnerable to unauthorized creatio… |
CVE-2025-10305 | Medium | 5.3 | 2025-09-20 | The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_passkey() and passkeys_list() fun… |
CVE-2025-10181 | Medium | 6.4 | 2025-09-20 | The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6… |
CVE-2025-10002 | Medium | 4.9 | 2025-09-20 | The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the ex… |
CVE-2025-10652 | Medium | 6.5 | 2025-09-20 | The Robcore Netatmo plugin for WordPress is vulnerable to SQL Injection via the ‘module_id’ attribute of the robcore-netatmo shortcode in all versions up to, a… |
CVE-2025-43808 | Medium | 5.3 | 2025-09-19 | The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through upd… |
CVE-2025-9081 | Low | 3.1 | 2025-09-19 | Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive fil… |
CVE-2025-9079 | High | 8.0 | 2025-09-19 | Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configur… |
CVE-2025-59689 | Medium | 6.1 | 2025-09-19 | Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ES… |
CVE-2025-59431 | Critical | 9.8 | 2025-09-19 | MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL… |
CVE-2025-57396 | Medium | 6.5 | 2025-09-19 | Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User… |
CVE-2025-56762 | Medium | 6.1 | 2025-09-19 | Paracrawl KeOPs v2 is vulnerable to Cross Site Scripting (XSS) in error.php. |
CVE-2025-54815 | High | 8.8 | 2025-09-19 | Server-side template injection (SSTI) vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes. |
CVE-2025-54761 | High | 8.0 | 2025-09-19 | An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie. |
CVE-2025-52159 | High | 8.8 | 2025-09-19 | Hardcoded credentials in default configuration of PPress 0.0.9. |
CVE-2025-43809 | Medium | 4.3 | 2025-09-19 | Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported vers… |
CVE-2025-10568 | Critical | 9.8 | 2025-09-19 | HyperX NGENUITY software is potentially vulnerable to arbitrary code execution. HP is releasing updated software to address the potential vulnerability. |
CVE-2025-43803 | Medium | 4.3 | 2025-09-19 | Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions… |
CVE-2025-34206 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/w… |
CVE-2025-34205 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (VA and SaaS deployments) contains da… |
CVE-2025-34204 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) contains multiple Docker containers that run primary appl… |
CVE-2025-34203 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1002 and Application versions prior to 20.0.2614 (VA and SaaS deployments) c… |
CVE-2025-34202 | High | 8.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker intern… |
CVE-2025-34201 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) run many Docker containers on shared internal networks wi… |
CVE-2025-34200 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) provision the appliance with the network account credent… |