2025 CVEs (page 177)
Page 177 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-35432 | Medium | 5.3 | 2025-09-17 | CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user… |
CVE-2025-35431 | Medium | 5.4 | 2025-09-17 | CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group me… |
CVE-2025-35430 | Medium | 5.0 | 2025-09-17 | CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker coul… |
CVE-2025-10603 | High | 7.3 | 2025-09-17 | A vulnerability was determined in PHPGurukul Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_forum/s… |
CVE-2025-10602 | Medium | 6.3 | 2025-09-17 | A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/dele… |
CVE-2025-10601 | High | 7.3 | 2025-09-17 | A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0. Affected is an unknown function of the file /admin/index.php. Such manipulati… |
CVE-2025-10600 | High | 7.3 | 2025-09-17 | A flaw has been found in SourceCodester Online Exam Form Submission 1.0. This impacts an unknown function of the file /register.php. This manipulation of the a… |
CVE-2025-10599 | High | 7.3 | 2025-09-17 | A security flaw has been discovered in itsourcecode Web-Based Internet Laboratory Management System 1.0. Impacted is the function User::AuthenticateUser of the… |
CVE-2025-10598 | High | 7.3 | 2025-09-17 | A vulnerability was identified in SourceCodester Pet Grooming Management Software 1.0. This issue affects some unknown processing of the file /admin/search_pro… |
CVE-2025-10597 | High | 7.3 | 2025-09-17 | A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This vulnerability affects unknown code of the f… |
CVE-2025-9862 | Medium | 6.5 | 2025-09-17 | Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, f… |
CVE-2025-57055 | Medium | 6.5 | 2025-09-17 | WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply… |
CVE-2025-54390 | Medium | 6.3 | 2025-09-17 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbraFeatureResetPasswor… |
CVE-2025-40933 | High | 7.5 | 2025-09-17 | Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely. Session ids are generated using an MD5 hash of the epoch time and a call… |
CVE-2025-10596 | High | 7.3 | 2025-09-17 | A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /index.php. The manipulation of the argum… |
CVE-2025-10595 | Medium | 6.3 | 2025-09-17 | A vulnerability has been found in SourceCodester Online Student File Management System 1.0. Affected by this issue is some unknown functionality of the file /a… |
CVE-2025-10205 | High | 8.8 | 2025-09-17 | Use of a One-Way Hash with a Predictable Salt vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. and newer versions |
CVE-2025-59476 | Medium | 5.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messag… |
CVE-2025-59475 | Medium | 4.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers wit… |
CVE-2025-59474 | Medium | 5.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Ove… |
CVE-2025-55904 | Medium | 4.0 | 2025-09-17 | Open5GS v2.7.5, prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615, is vulnerable to a NULL pointer dereference when a multipart/related HTTP POST reques… |
CVE-2025-50709 | Medium | 4.3 | 2025-09-17 | An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter |
CVE-2025-10594 | Medium | 6.3 | 2025-09-17 | A flaw has been found in SourceCodester Online Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admi… |
CVE-2025-10593 | Medium | 6.3 | 2025-09-17 | A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown function of the file /admin/update_student.php… |
CVE-2025-8463 | Medium | 5.3 | 2025-09-17 | Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This issue affects SecHar… |
CVE-2025-8077 | Critical | 9.8 | 2025-09-17 | A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account… |
CVE-2025-54467 | Medium | 5.3 | 2025-09-17 | When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector secur… |
CVE-2025-53884 | Medium | 5.3 | 2025-09-17 | NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of k… |
CVE-2025-10592 | Medium | 6.3 | 2025-09-17 | A security vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0. This impacts an unknown function of the file mysearch.php of… |
CVE-2025-0879 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shopside Software Shopside App allows Cross-Site S… |
CVE-2025-8999 | Medium | 5.3 | 2025-09-17 | The Sydney theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activate_modules' function in all v… |
CVE-2025-8411 | High | 7.1 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology E-Commerce Web Design Product… |
CVE-2025-10439 | Critical | 9.8 | 2025-09-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yordam Informatics Yordam Library Automation System allow… |
CVE-2025-10157 | High | 7.8 | 2025-09-17 | A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals… |
CVE-2025-0546 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Restriction of Rendered UI Layers or Frames vulnerability… |
CVE-2025-10591 | Low | 3.5 | 2025-09-17 | A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_funcao_cad.php of the component… |
CVE-2025-10590 | Medium | 4.3 | 2025-09-17 | A security flaw has been discovered in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educar_usuario_det.php… |
CVE-2025-10156 | Critical | 9.8 | 2025-09-17 | An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass… |
CVE-2025-10155 | High | 7.8 | 2025-09-17 | An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypas… |
CVE-2025-0420 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripti… |
CVE-2025-59458 | High | 8.3 | 2025-09-17 | In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 2… |
CVE-2025-59457 | High | 7.7 | 2025-09-17 | In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows |
CVE-2025-59456 | Medium | 5.5 | 2025-09-17 | In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload |
CVE-2025-59455 | Medium | 4.2 | 2025-09-17 | In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition |
CVE-2025-0419 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. Zirve Nova all… |
CVE-2025-9242 | Critical | 9.8 | 2025-09-17 | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vul… |
CVE-2025-9972 | Critical | 9.8 | 2025-09-17 | Certain models of Industrial Cellular Gateway developed by Planet Technology have an OS Command Injection vulnerability, allowing unauthenticated remote attack… |
CVE-2025-9971 | Critical | 9.8 | 2025-09-17 | Certain models of Industrial Cellular Gateway developed by Planet Technology have a Missing Authentication vulnerability, allowing unauthenticated remote attac… |
CVE-2025-9565 | Medium | 6.4 | 2025-09-17 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocksy_newsletter_subscribe shortcode in all versions… |
CVE-2025-9450 | High | 7.8 | 2025-09-17 | A Use of Uninitialized Variable vulnerability affecting the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 could allow an… |
CVE-2025-9449 | High | 7.8 | 2025-09-17 | A Use After Free vulnerability affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 could allow an attacker to e… |
CVE-2025-9447 | High | 7.8 | 2025-09-17 | An Out-Of-Bounds Read vulnerability affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 could allow an attacker… |
CVE-2025-9216 | High | 8.8 | 2025-09-17 | The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to arbitrary file… |
CVE-2025-9215 | Medium | 6.5 | 2025-09-17 | The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to Path Traversal… |
CVE-2025-9203 | Medium | 6.4 | 2025-09-17 | The Media Player Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtitle_ssize', 'track_title', and 'track_art… |
CVE-2025-10058 | High | 8.1 | 2025-09-17 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation… |
CVE-2025-10057 | High | 8.8 | 2025-09-17 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28… |
CVE-2025-10042 | Medium | 5.9 | 2025-09-17 | The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insufficient es… |
CVE-2025-9818 | Medium | 6.7 | 2025-09-17 | A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., wh… |
CVE-2025-59518 | High | 8.0 | 2025-09-17 | In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ during rule evaluat… |
CVE-2025-59307 | Medium | 6.7 | 2025-09-17 | RAID Manager provided by Century Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root directory of… |
CVE-2025-58116 | High | 7.2 | 2025-09-17 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is… |
CVE-2025-55075 | Medium | 4.9 | 2025-09-17 | Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled by a remote authenticated attacker. |
CVE-2025-10589 | High | 8.8 | 2025-09-17 | The N-Reporter, N-Cloud, and N-Probe developed by N-Partner has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitr… |
CVE-2025-10584 | Low | 3.5 | 2025-09-17 | A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_anotacao_cad.php. Suc… |
CVE-2025-10188 | Medium | 5.4 | 2025-09-17 | The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is… |
CVE-2025-10125 | Medium | 6.4 | 2025-09-17 | The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'row' shortcode in all versions up to, and includ… |
CVE-2025-9891 | Medium | 4.3 | 2025-09-17 | The User Sync – Remote User Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to m… |
CVE-2025-9851 | Medium | 6.4 | 2025-09-17 | The Appointmind plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appointmind_calendar' shortcode in all versions up to, and… |
CVE-2025-9629 | Medium | 4.3 | 2025-09-17 | The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect… |
CVE-2025-8394 | Medium | 6.4 | 2025-09-17 | The Productive Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_productive_breadcrumb shortcode in all versions… |
CVE-2025-8153 | | 2025-09-17 | Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, f… | |
CVE-2025-10166 | Medium | 6.4 | 2025-09-17 | The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'twitter' shortcode in all versions up to, and i… |
CVE-2025-10143 | High | 7.5 | 2025-09-17 | The Catch Dark Mode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0 via the 'catch_dark_mode' shortcode. T… |
CVE-2025-10050 | Medium | 6.6 | 2025-09-17 | The Developer Loggers for Simple History plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.5 via the enabled_l… |
CVE-2025-43804 | Medium | 6.1 | 2025-09-16 | Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4… |
CVE-2025-37131 | Medium | 4.9 | 2025-09-16 | A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files… |
CVE-2025-37130 | Medium | 6.5 | 2025-09-16 | A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful… |
CVE-2025-37129 | Medium | 6.7 | 2025-09-16 | A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilitie… |
CVE-2025-37128 | Medium | 6.8 | 2025-09-16 | A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running… |
CVE-2025-37127 | High | 7.2 | 2025-09-16 | A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell… |
CVE-2025-37126 | High | 7.2 | 2025-09-16 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary c… |
CVE-2025-37125 | High | 7.5 | 2025-09-16 | A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall… |
CVE-2025-37124 | High | 8.6 | 2025-09-16 | A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitat… |
CVE-2025-37123 | High | 8.8 | 2025-09-16 | A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate priv… |
CVE-2025-9708 | Medium | 6.8 | 2025-09-16 | A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Author… |
CVE-2025-43805 | Medium | 5.3 | 2025-09-16 | Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not… |
CVE-2025-10566 | Medium | 4.3 | 2025-09-16 | A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /index.php… |
CVE-2025-54391 | Critical | 9.1 | 2025-09-16 | A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS) allows an attacker with valid user credentials to bypass Two-Fact… |
CVE-2025-10565 | High | 7.3 | 2025-09-16 | A vulnerability was determined in Campcodes Grocery Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /aja… |
CVE-2025-10564 | High | 7.3 | 2025-09-16 | A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=delete_category. Pe… |
CVE-2025-57631 | Critical | 9.8 | 2025-09-16 | SQL Injection vulnerability in TDuckCloud v.5.1 allows a remote attacker to execute arbitrary code via the Add a file upload module |
CVE-2025-56264 | High | 7.5 | 2025-09-16 | The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability. |
CVE-2025-56263 | High | 8.8 | 2025-09-16 | by-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users can upload files of… |
CVE-2025-34187 | High | 8.8 | 2025-09-16 | Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If… |
CVE-2025-34186 | Critical | 9.8 | 2025-09-16 | Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for au… |
CVE-2025-34185 | High | 7.5 | 2025-09-16 | Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a pre-authentication file disclosure vulnerability via the 'db_log' POST parameter. Remote attackers can… |
CVE-2025-34184 | Critical | 9.8 | 2025-09-16 | Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers… |
CVE-2025-34183 | High | 7.5 | 2025-09-16 | Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retr… |
CVE-2025-10563 | High | 7.3 | 2025-09-16 | A vulnerability has been found in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=save_category… |