2025 CVEs (page 175)
Page 175 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8664 | Medium | 6.3 | 2025-09-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities… |
CVE-2025-8532 | Medium | 6.4 | 2025-09-19 | Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Managem… |
CVE-2025-57528 | High | 7.7 | 2025-09-19 | An issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara… |
CVE-2025-10717 | Medium | 5.3 | 2025-09-19 | A vulnerability has been found in intsig CamScanner App 6.91.1.5.250711 on Android. Affected by this issue is some unknown functionality of the file AndroidMan… |
CVE-2025-10716 | Medium | 5.3 | 2025-09-19 | A flaw has been found in Creality Cloud App up to 6.1.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml… |
CVE-2025-58114 | Medium | 4.8 | 2025-09-19 | Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects… |
CVE-2025-57880 | Medium | 5.4 | 2025-09-19 | Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS). This is… |
CVE-2025-48007 | Medium | 6.4 | 2025-09-19 | Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS). This issue… |
CVE-2025-46703 | Medium | 6.4 | 2025-09-19 | Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS). This issue affect… |
CVE-2025-10715 | Medium | 5.3 | 2025-09-19 | A security flaw has been discovered in APEUni PTE Exam Practice App up to 10.8.0 on Android. The impacted element is an unknown function of the file AndroidMan… |
CVE-2025-10712 | High | 7.3 | 2025-09-19 | A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This issue affects some unknown processing of the file /index.php/Login/login. Pe… |
CVE-2025-7665 | High | 8.1 | 2025-09-19 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handle_mofir… |
CVE-2025-10711 | Medium | 4.3 | 2025-09-19 | A vulnerability has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This vulnerability affects unknown code of the file /index.php/sysmanage/Log… |
CVE-2025-10710 | Medium | 4.3 | 2025-09-19 | A flaw has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This affects an unknown part of the file /index.php. This manipulation of the argumen… |
CVE-2025-9969 | High | 7.1 | 2025-09-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vizly Web Design Real Estate Packages allows Conte… |
CVE-2025-10709 | Medium | 5.3 | 2025-09-19 | A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functionality of the file /hi… |
CVE-2025-10708 | Medium | 5.3 | 2025-09-19 | A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2025-10707 | Medium | 6.3 | 2025-09-19 | A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulatio… |
CVE-2025-10468 | High | 7.5 | 2025-09-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Beyaz Computer CityPlus allows Path Traversal. This issue affe… |
CVE-2025-8531 | Medium | 6.8 | 2025-09-19 | Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU… |
CVE-2025-10719 | Medium | 4.3 | 2025-09-19 | Tronclass developed by WisdomGarden has an Insecure Direct object Reference vulnerability, allowing remote attackers with regular privilege to modify a specifi… |
CVE-2025-10630 | Medium | 4.3 | 2025-09-19 | Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix a… |
CVE-2025-9906 | High | 7.3 | 2025-09-19 | The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .keras mo… |
CVE-2025-9905 | High | 7.3 | 2025-09-19 | The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5… |
CVE-2025-10647 | High | 8.8 | 2025-09-19 | The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_handler_download_pdf_med… |
CVE-2025-7702 | Medium | 4.7 | 2025-09-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Pusula Communication Information Internet Industry and Trade Ltd. Co. Manageable Email Sen… |
CVE-2025-7403 | High | 7.6 | 2025-09-19 | Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precis… |
CVE-2025-5948 | Critical | 9.8 | 2025-09-19 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is… |
CVE-2025-10458 | High | 7.6 | 2025-09-19 | Parameters are not validated or sanitized, and are later used in various internal operations. |
CVE-2025-10457 | Medium | 4.3 | 2025-09-19 | The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a conne… |
CVE-2025-10456 | High | 7.1 | 2025-09-19 | A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a fla… |
CVE-2025-5955 | High | 8.1 | 2025-09-19 | The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugi… |
CVE-2025-10146 | Medium | 6.1 | 2025-09-19 | The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘user_ids’ parameter in all versions up to, and including, 3… |
CVE-2025-8487 | Medium | 5.4 | 2025-09-19 | The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-insta… |
CVE-2025-59717 | Medium | 5.4 | 2025-09-19 | In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedCl… |
CVE-2025-7937 | High | 7.2 | 2025-09-19 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW . An attacker can update the system firmware with a specially… |
CVE-2025-59715 | Medium | 4.8 | 2025-09-19 | SMSEagle before 6.11 allows reflected XSS via a username or contact phone number. |
CVE-2025-59714 | Medium | 6.5 | 2025-09-19 | In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs. |
CVE-2025-59713 | Medium | 6.8 | 2025-09-19 | Snipe-IT before 8.1.18 allows unsafe deserialization. |
CVE-2025-59712 | Medium | 6.4 | 2025-09-19 | Snipe-IT before 8.1.18 allows XSS. |
CVE-2025-10690 | Critical | 9.8 | 2025-09-19 | The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the… |
CVE-2025-6198 | High | 7.2 | 2025-09-19 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a special… |
CVE-2025-30755 | Medium | 6.1 | 2025-09-19 | OpenGrok 1.14.1 has a reflected Cross-Site Scripting (XSS) issue when producing the cross reference page. This happens through improper handling of the revisio… |
CVE-2025-59692 | Low | 3.7 | 2025-09-18 | PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply default ACCEPT pol… |
CVE-2025-59691 | Low | 3.7 | 2025-09-18 | PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi-Fi reconnect or sy… |
CVE-2025-59220 | High | 7.0 | 2025-09-18 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to eleva… |
CVE-2025-59216 | High | 7.0 | 2025-09-18 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2025-59215 | High | 7.0 | 2025-09-18 | Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2025-54860 | High | 7.7 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 in order to allow management operations on the device such as f… |
CVE-2025-54818 | High | 8.0 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying syst… |
CVE-2025-54810 | High | 8.0 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying syst… |
CVE-2025-54497 | High | 8.1 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and … |
CVE-2025-53969 | High | 8.8 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a service implementing a proprietary protocol on TCP port 1069 to allow the client-side software… |
CVE-2025-52873 | High | 8.1 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and d… |
CVE-2025-10035 | Critical | 10.0 | 2025-09-18 | A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deseriali… |
CVE-2025-57295 | High | 8.0 | 2025-09-18 | H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no passw… |
CVE-2025-57293 | High | 8.8 | 2025-09-18 | A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt… |
CVE-2025-55068 | High | 8.2 | 2025-09-18 | Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point. An attacker can manually change the system time t… |
CVE-2025-54807 | Critical | 9.8 | 2025-09-18 | The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypas… |
CVE-2025-54754 | High | 8.0 | 2025-09-18 | An attacker with adjacent access, without authentication, can exploit this vulnerability to retrieve a hard-coded password embedded in publicly available sof… |
CVE-2025-53947 | High | 7.7 | 2025-09-18 | A local attacker with low privileges on the Windows system where the software is installed can exploit this vulnerability to corrupt sensitive data. A data f… |
CVE-2025-47698 | | 2025-09-18 | An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentials are present duri… | |
CVE-2025-30519 | Critical | 9.8 | 2025-09-18 | Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An attacker w… |
CVE-2025-10689 | Medium | 6.3 | 2025-09-18 | A vulnerability was identified in D-Link DIR-645 105B01. This issue affects the function soapcgi_main of the file /soap.cgi. Such manipulation of the argument… |
CVE-2025-59424 | High | 7.3 | 2025-09-18 | LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting (XSS) vulnerability has been identified on the /system… |
CVE-2025-10688 | High | 7.3 | 2025-09-18 | A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/operation/pai… |
CVE-2025-47906 | Medium | 6.5 | 2025-09-18 | If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and "..")… |
CVE-2025-26503 | Medium | 6.7 | 2025-09-18 | A crafted system call argument can cause memory corruption. |
CVE-2025-10650 | | 2025-09-18 | SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unautho… | |
CVE-2025-10687 | High | 7.3 | 2025-09-18 | A vulnerability was found in SourceCodester Responsive E-Learning System 1.0. This affects an unknown part of the file /admin/add_teacher.php. The manipulation… |
CVE-2025-55912 | High | 7.3 | 2025-09-18 | An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary… |
CVE-2025-50255 | High | 7.8 | 2025-09-18 | Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22 via crafted GET request. |
CVE-2025-36146 | Medium | 4.3 | 2025-09-18 | IBM Lakehouse (watsonx.data 2.2) could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks… |
CVE-2025-36143 | Medium | 4.7 | 2025-09-18 | IBM Lakehouse (watsonx.data 2.2) could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user su… |
CVE-2025-36139 | Medium | 5.5 | 2025-09-18 | IBM Lakehouse (watsonx.data 2.2) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code i… |
CVE-2025-10676 | Medium | 4.3 | 2025-09-18 | A weakness has been identified in fuyang_lipengjun platform 1.0. Affected is the function BrandController of the file /brand/queryAll. Executing manipulation c… |
CVE-2025-10675 | Medium | 4.3 | 2025-09-18 | A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/queryAll. Performing… |
CVE-2025-10674 | Medium | 4.3 | 2025-09-18 | A vulnerability was identified in fuyang_lipengjun platform 1.0. This affects the function AttributeCategoryController of the file /attributecategory/queryAll… |
CVE-2025-59421 | | 2025-09-18 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). A bad actor can flood t… | |
CVE-2025-59417 | Medium | 6.1 | 2025-09-18 | Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.129.4, there is a a cross-site scripting (XSS) vulnerability when handli… |
CVE-2025-59040 | Medium | 4.3 | 2025-09-18 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of… |
CVE-2025-57452 | Medium | 6.1 | 2025-09-18 | In realme BackupRestore app v15.1.12_2810c08_250314, improper URI scheme handling in com.coloros.pc.PcToolMainActivity allows local attackers to cause a crash… |
CVE-2025-55911 | Medium | 6.5 | 2025-09-18 | An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter |
CVE-2025-10673 | High | 7.3 | 2025-09-18 | A vulnerability was determined in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the file /admin/module… |
CVE-2025-10672 | High | 7.8 | 2025-09-18 | A vulnerability was found in whuan132 AIBattery up to 1.0.9. The affected element is an unknown function of the file AIBatteryHelper/XPC/BatteryXPCService.swif… |
CVE-2025-10671 | Low | 3.7 | 2025-09-18 | A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Impacted is the function encryptSecret of the file e-learning-master\exam-api\src\… |
CVE-2025-4444 | Low | 3.7 | 2025-09-18 | A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performi… |
CVE-2025-10670 | High | 7.3 | 2025-09-18 | A flaw has been found in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /check_p… |
CVE-2025-10669 | Medium | 6.3 | 2025-09-18 | A vulnerability was detected in Airsonic-Advanced up to 10.6.0. This vulnerability affects unknown code of the component Playlist Upload Handler. Performing ma… |
CVE-2025-10668 | High | 7.3 | 2025-09-18 | A security vulnerability has been detected in itsourcecode Online Discussion Forum 1.0. This affects an unknown part of the file /members/compose_msg_admin.php… |
CVE-2025-10667 | High | 7.3 | 2025-09-18 | A weakness has been identified in itsourcecode Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /members/compose_m… |
CVE-2025-10666 | High | 8.8 | 2025-09-18 | A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipula… |
CVE-2025-40678 | | 2025-09-18 | Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability allows an attacker to upload a dangerou… | |
CVE-2025-40677 | | 2025-09-18 | SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the databas… | |
CVE-2025-10665 | Medium | 6.3 | 2025-09-18 | A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Affected is an unknown function of the file /Pro… |
CVE-2025-10664 | High | 7.3 | 2025-09-18 | A vulnerability was determined in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /create-ticket.php. Executing manipulation of the argu… |
CVE-2025-10207 | High | 7.2 | 2025-09-18 | Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. |
CVE-2025-10663 | High | 7.3 | 2025-09-18 | A vulnerability was found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /my-profile.php. Performing manipulation o… |
CVE-2025-10662 | Medium | 4.7 | 2025-09-18 | A vulnerability has been found in SeaCMS up to 13.3. The impacted element is an unknown function of the file /admin_members.php?ac=editsave. Such manipulation… |
CVE-2025-9992 | Medium | 6.4 | 2025-09-18 | The Ghost Kit – Page Builder Blocks, Motion Effects & Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS field in a… |