2025 CVEs (page 180)
Page 180 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6947 | | 2025-09-15 | A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An authe… | |
CVE-2025-57118 | Critical | 9.8 | 2025-09-15 | An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php |
CVE-2025-57117 | Medium | 5.4 | 2025-09-15 | A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScript on the departmen… |
CVE-2025-56274 | High | 8.1 | 2025-09-15 | SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, which allows low-privileged users to forge high priv… |
CVE-2025-43802 | Medium | 6.1 | 2025-09-15 | Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay… |
CVE-2025-43797 | Medium | 5.4 | 2025-09-15 | In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and olde… |
CVE-2025-10482 | High | 7.3 | 2025-09-15 | A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown function of the file /admin/index.php. The man… |
CVE-2025-10481 | Medium | 6.3 | 2025-09-15 | A security vulnerability has been detected in SourceCodester Online Student File Management System 1.0. This impacts an unknown function of the file /remove_fi… |
CVE-2025-10480 | Medium | 6.3 | 2025-09-15 | A weakness has been identified in SourceCodester Online Student File Management System 1.0. This affects an unknown function of the file /save_file.php. Execut… |
CVE-2025-59145 | | 2025-09-15 | color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1… | |
CVE-2025-59056 | High | 7.5 | 2025-09-15 | FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface… |
CVE-2025-55211 | High | 8.8 | 2025-09-15 | FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel (ACP) c… |
CVE-2025-43799 | Medium | 6.5 | 2025-09-15 | Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7… |
CVE-2025-43798 | Medium | 6.5 | 2025-09-15 | Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be us… |
CVE-2025-10479 | High | 7.3 | 2025-09-15 | A security flaw has been discovered in SourceCodester Online Student File Management System 1.0. The impacted element is an unknown function of the file /index… |
CVE-2025-10477 | Medium | 6.3 | 2025-09-15 | A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The affected element is an unknown function of t… |
CVE-2025-59332 | High | 8.6 | 2025-09-15 | 3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the <3d> parser tag and the {{#3d}} parser function allow users to provide custom attri… |
CVE-2025-59331 | | 2025-09-15 | is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attac… | |
CVE-2025-59330 | | 2025-09-15 | error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack… | |
CVE-2025-59162 | | 2025-09-15 | color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was taken over after a… | |
CVE-2025-59154 | Medium | 5.9 | 2025-09-15 | Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerabi… |
CVE-2025-59144 | | 2025-09-15 | debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was pu… | |
CVE-2025-59143 | | 2025-09-15 | color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was taken over after a phishing atta… | |
CVE-2025-59142 | | 2025-09-15 | color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken over after a phishing… | |
CVE-2025-59141 | | 2025-09-15 | simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version… | |
CVE-2025-59140 | | 2025-09-15 | backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0… | |
CVE-2025-56448 | Medium | 6.8 | 2025-09-15 | The Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling code security. The alarm system does n… |
CVE-2025-45091 | Medium | 5.4 | 2025-09-15 | Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. An authenticated attacker can exploit this… |
CVE-2025-10475 | Medium | 5.5 | 2025-09-15 | A weakness has been identified in SpyShelter up to 15.4.0.1015. Affected is an unknown function in the library SpyShelter.sys of the component IOCTL Handler. T… |
CVE-2025-59399 | Low | 3.1 | 2025-09-15 | libocpp before 0.28.0 allows a denial of service (EVerest crash) because a secondary exception is thrown during error message generation. |
CVE-2025-59398 | Low | 3.1 | 2025-09-15 | The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest crash) via JSON input larger than 255 characters, because a CiString<255>… |
CVE-2025-43800 | Medium | 6.1 | 2025-09-15 | Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7… |
CVE-2025-10473 | Medium | 6.3 | 2025-09-15 | A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil… |
CVE-2025-10472 | Medium | 5.3 | 2025-09-15 | A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function download_video/stream_video of the file app/con… |
CVE-2025-52344 | Medium | 6.1 | 2025-09-15 | Multiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript code on the user's… |
CVE-2025-43791 | Medium | 6.1 | 2025-09-15 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA t… |
CVE-2025-59328 | Medium | 6.5 | 2025-09-15 | A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). The issue stems from the insecure deserialization of untrusted data… |
CVE-2025-59155 | | 2025-09-15 | hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants. From 1.4.0 to before 1.5.0, hackmd-mcp contains… | |
CVE-2025-58748 | Critical | 9.8 | 2025-09-15 | Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12 the H2 data source implementation (H2.java) does not v… |
CVE-2025-58177 | Medium | 5.4 | 2025-09-15 | n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scripting (XSS) vulnerability in @n8n/n8n-nodes… |
CVE-2025-58172 | | 2025-09-15 | drawnix is an all in one open-source whiteboard tool. In drawnix versions through 0.2.1, a cross-site scripting (XSS) vulnerability exists in the debug logging… | |
CVE-2025-57176 | Medium | 6.5 | 2025-09-15 | On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unaut… |
CVE-2025-57174 | Critical | 9.8 | 2025-09-15 | An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. The rf… |
CVE-2025-57104 | Medium | 5.4 | 2025-09-15 | Teampel 5.1.6 is vulnerable to SQL Injection in /Common/login.aspx. |
CVE-2025-49089 | Medium | 6.3 | 2025-09-15 | wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd. |
CVE-2025-43792 | Medium | 5.3 | 2025-09-15 | Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA throug… |
CVE-2025-10471 | Medium | 6.3 | 2025-09-15 | A vulnerability was detected in ZKEACMS 4.3. Impacted is the function Proxy of the file src/ZKEACMS/Controllers/MediaController.cs. Performing manipulation of… |
CVE-2025-10203 | High | 7.8 | 2025-09-15 | Relative path traversal vulnerability due to improper input validation in Digilent WaveForms that may result in arbitrary code execution. Successful exploitat… |
CVE-2025-59397 | Medium | 5.0 | 2025-09-15 | Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[value] SQL injection. |
CVE-2025-58046 | Critical | 9.8 | 2025-09-15 | Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote co… |
CVE-2025-58045 | Critical | 9.8 | 2025-09-15 | Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserializa… |
CVE-2025-57248 | High | 7.3 | 2025-09-15 | A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is opened, the applica… |
CVE-2025-56252 | Medium | 6.1 | 2025-09-15 | Cross Site Scripting (xss) vulnerability in ServitiumCRM 2.10 allowing attackers to execute arbitrary code via a crafted URL to the mobile parameter. |
CVE-2025-52048 | Medium | 6.5 | 2025-09-15 | In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which… |
CVE-2025-43793 | High | 7.5 | 2025-09-15 | Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 G… |
CVE-2025-36082 | Medium | 4.0 | 2025-09-15 | IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system. |
CVE-2025-10491 | High | 7.8 | 2025-09-15 | The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB'… |
CVE-2025-8396 | | 2025-09-15 | Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory… | |
CVE-2025-6202 | | 2025-09-15 | Vulnerability in SK Hynix DDR5 on x86 allows a local attacker to trigger Rowhammer bit flips impacting the Hardware Integrity and the system's security. This i… | |
CVE-2025-52053 | Critical | 9.8 | 2025-09-15 | TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This vul… |
CVE-2025-10459 | High | 7.3 | 2025-09-15 | A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/all-appointment.php. Th… |
CVE-2025-59377 | Low | 3.7 | 2025-09-15 | feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. NOTE: this is u… |
CVE-2025-59376 | Low | 3.7 | 2025-09-15 | feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delete, e.g., it allows… |
CVE-2025-56710 | High | 7.3 | 2025-09-15 | A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Using-PHP-V2.0. This fl… |
CVE-2025-50944 | High | 8.8 | 2025-09-15 | An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X509TrustManager used… |
CVE-2025-50110 | High | 8.8 | 2025-09-15 | An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sen… |
CVE-2025-46408 | Critical | 9.8 | 2025-09-15 | An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient in AVTECH Eag… |
CVE-2025-10448 | High | 7.3 | 2025-09-15 | A flaw has been found in Campcodes Online Job Finder System 1.0. This affects an unknown function of the file /index.php?q=result&searchfor=bycompany. This man… |
CVE-2025-10447 | High | 7.3 | 2025-09-15 | A vulnerability was detected in Campcodes Online Job Finder System 1.0. The impacted element is an unknown function of the file /eris/applicationform.php. The… |
CVE-2025-3025 | High | 7.3 | 2025-09-15 | Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM privileges via exploit… |
CVE-2025-39804 | High | 7.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts Restore the SIMD… |
CVE-2025-39803 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Remove WARN_ON_ONCE() call from ufshcd_uic_cmd_compl() The UIC completio… |
CVE-2025-39802 | High | 7.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts Restore the SIMD us… |
CVE-2025-39801 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a ra… |
CVE-2025-39800 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an u… |
CVE-2025-10446 | High | 7.3 | 2025-09-15 | A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages… |
CVE-2025-10445 | High | 7.3 | 2025-09-15 | A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/us_transac.php?action=a… |
CVE-2025-59361 | Critical | 9.8 | 2025-09-15 | The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated i… |
CVE-2025-59360 | Critical | 9.8 | 2025-09-15 | The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated i… |
CVE-2025-59359 | Critical | 9.8 | 2025-09-15 | The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cl… |
CVE-2025-59358 | High | 7.5 | 2025-09-15 | The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to… |
CVE-2025-43794 | Medium | 4.8 | 2025-09-15 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1… |
CVE-2025-10444 | High | 7.3 | 2025-09-15 | A security flaw has been discovered in Campcodes Online Job Finder System 1.0. This issue affects some unknown processing of the file /advancesearch.php. Perfo… |
CVE-2025-10443 | High | 8.8 | 2025-09-15 | A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18. This vulnerability affects the function formexeCommand of the file /goform/exeCom… |
CVE-2025-9826 | Medium | 5.4 | 2025-09-15 | Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. |
CVE-2025-9084 | Low | 3.1 | 2025-09-15 | Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth logi… |
CVE-2025-9072 | High | 7.6 | 2025-09-15 | Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a maliciou… |
CVE-2025-10442 | Medium | 6.3 | 2025-09-15 | A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of… |
CVE-2025-10441 | Medium | 6.3 | 2025-09-15 | A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file versio… |
CVE-2025-9078 | Medium | 4.3 | 2025-09-15 | Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link m… |
CVE-2025-9076 | Medium | 6.5 | 2025-09-15 | Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromi… |
CVE-2025-10440 | Medium | 6.3 | 2025-09-15 | A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerab… |
CVE-2025-10436 | High | 7.3 | 2025-09-15 | A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/sup_searchf… |
CVE-2025-10435 | High | 7.3 | 2025-09-15 | A security flaw has been discovered in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_e… |
CVE-2025-10434 | Low | 2.4 | 2025-09-15 | A vulnerability was identified in IbuyuCMS up to 2.6.3. Impacted is an unknown function of the file /admin/article.php?a=mod of the component Add Article Page… |
CVE-2025-41713 | Medium | 6.5 | 2025-09-15 | During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating… |
CVE-2025-10433 | Medium | 6.3 | 2025-09-15 | A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0. This issue affects some unknown processing of the file /admin/api/workspace/default/tool/… |
CVE-2025-10432 | Critical | 9.8 | 2025-09-15 | A vulnerability was found in Tenda AC1206 15.03.06.23. This vulnerability affects the function check_param_changed of the file /goform/AdvSetMacMtuWa of the co… |
CVE-2025-10431 | Medium | 6.3 | 2025-09-15 | A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file /admin/ajax_represent.php. Such… |
CVE-2025-10430 | Medium | 6.3 | 2025-09-15 | A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/barcode.p… |