2025 CVEs (page 182)
Page 182 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49089 | Medium | 6.3 | 2025-09-15 | wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd. |
CVE-2025-43792 | Medium | 5.3 | 2025-09-15 | Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA throug… |
CVE-2025-10471 | Medium | 6.3 | 2025-09-15 | A vulnerability was detected in ZKEACMS 4.3. Impacted is the function Proxy of the file src/ZKEACMS/Controllers/MediaController.cs. Performing manipulation of… |
CVE-2025-10203 | High | 7.8 | 2025-09-15 | Relative path traversal vulnerability due to improper input validation in Digilent WaveForms that may result in arbitrary code execution. Successful exploitat… |
CVE-2025-59397 | Medium | 5.0 | 2025-09-15 | Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[value] SQL injection. |
CVE-2025-58046 | Critical | 9.8 | 2025-09-15 | Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote co… |
CVE-2025-58045 | Critical | 9.8 | 2025-09-15 | Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserializa… |
CVE-2025-57248 | High | 7.3 | 2025-09-15 | A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is opened, the applica… |
CVE-2025-56252 | Medium | 6.1 | 2025-09-15 | Cross Site Scripting (xss) vulnerability in ServitiumCRM 2.10 allowing attackers to execute arbitrary code via a crafted URL to the mobile parameter. |
CVE-2025-52048 | Medium | 6.5 | 2025-09-15 | In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which… |
CVE-2025-43793 | High | 7.5 | 2025-09-15 | Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 G… |
CVE-2025-36082 | Medium | 4.0 | 2025-09-15 | IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system. |
CVE-2025-10491 | High | 7.8 | 2025-09-15 | The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB'… |
CVE-2025-8396 | | 2025-09-15 | Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory… | |
CVE-2025-6202 | | 2025-09-15 | Vulnerability in SK Hynix DDR5 on x86 allows a local attacker to trigger Rowhammer bit flips impacting the Hardware Integrity and the system's security. This i… | |
CVE-2025-52053 | Critical | 9.8 | 2025-09-15 | TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This vul… |
CVE-2025-10459 | High | 7.3 | 2025-09-15 | A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/all-appointment.php. Th… |
CVE-2025-59377 | Low | 3.7 | 2025-09-15 | feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. NOTE: this is u… |
CVE-2025-59376 | Low | 3.7 | 2025-09-15 | feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delete, e.g., it allows… |
CVE-2025-56710 | High | 7.3 | 2025-09-15 | A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Using-PHP-V2.0. This fl… |
CVE-2025-50944 | High | 8.8 | 2025-09-15 | An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X509TrustManager used… |
CVE-2025-50110 | High | 8.8 | 2025-09-15 | An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sen… |
CVE-2025-46408 | Critical | 9.8 | 2025-09-15 | An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient in AVTECH Eag… |
CVE-2025-10448 | High | 7.3 | 2025-09-15 | A flaw has been found in Campcodes Online Job Finder System 1.0. This affects an unknown function of the file /index.php?q=result&searchfor=bycompany. This man… |
CVE-2025-10447 | High | 7.3 | 2025-09-15 | A vulnerability was detected in Campcodes Online Job Finder System 1.0. The impacted element is an unknown function of the file /eris/applicationform.php. The… |
CVE-2025-3025 | High | 7.3 | 2025-09-15 | Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM privileges via exploit… |
CVE-2025-39804 | High | 7.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts Restore the SIMD… |
CVE-2025-39803 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Remove WARN_ON_ONCE() call from ufshcd_uic_cmd_compl() The UIC completio… |
CVE-2025-39802 | High | 7.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts Restore the SIMD us… |
CVE-2025-39801 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a ra… |
CVE-2025-39800 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an u… |
CVE-2025-10446 | High | 7.3 | 2025-09-15 | A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages… |
CVE-2025-10445 | High | 7.3 | 2025-09-15 | A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/us_transac.php?action=a… |
CVE-2025-59361 | Critical | 9.8 | 2025-09-15 | The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated i… |
CVE-2025-59360 | Critical | 9.8 | 2025-09-15 | The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated i… |
CVE-2025-59359 | Critical | 9.8 | 2025-09-15 | The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cl… |
CVE-2025-59358 | High | 7.5 | 2025-09-15 | The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to… |
CVE-2025-43794 | Medium | 4.8 | 2025-09-15 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1… |
CVE-2025-10444 | High | 7.3 | 2025-09-15 | A security flaw has been discovered in Campcodes Online Job Finder System 1.0. This issue affects some unknown processing of the file /advancesearch.php. Perfo… |
CVE-2025-10443 | High | 8.8 | 2025-09-15 | A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18. This vulnerability affects the function formexeCommand of the file /goform/exeCom… |
CVE-2025-9826 | Medium | 5.4 | 2025-09-15 | Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. |
CVE-2025-9084 | Low | 3.1 | 2025-09-15 | Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth logi… |
CVE-2025-9072 | High | 7.6 | 2025-09-15 | Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a maliciou… |
CVE-2025-10442 | Medium | 6.3 | 2025-09-15 | A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of… |
CVE-2025-10441 | Medium | 6.3 | 2025-09-15 | A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file versio… |
CVE-2025-9078 | Medium | 4.3 | 2025-09-15 | Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link m… |
CVE-2025-9076 | Medium | 6.5 | 2025-09-15 | Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromi… |
CVE-2025-10440 | Medium | 6.3 | 2025-09-15 | A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerab… |
CVE-2025-10436 | High | 7.3 | 2025-09-15 | A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/sup_searchf… |
CVE-2025-10435 | High | 7.3 | 2025-09-15 | A security flaw has been discovered in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_e… |
CVE-2025-10434 | Low | 2.4 | 2025-09-15 | A vulnerability was identified in IbuyuCMS up to 2.6.3. Impacted is an unknown function of the file /admin/article.php?a=mod of the component Add Article Page… |
CVE-2025-41713 | Medium | 6.5 | 2025-09-15 | During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating… |
CVE-2025-10433 | Medium | 6.3 | 2025-09-15 | A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0. This issue affects some unknown processing of the file /admin/api/workspace/default/tool/… |
CVE-2025-10432 | Critical | 9.8 | 2025-09-15 | A vulnerability was found in Tenda AC1206 15.03.06.23. This vulnerability affects the function check_param_changed of the file /goform/AdvSetMacMtuWa of the co… |
CVE-2025-10431 | Medium | 6.3 | 2025-09-15 | A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file /admin/ajax_represent.php. Such… |
CVE-2025-10430 | Medium | 6.3 | 2025-09-15 | A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/barcode.p… |
CVE-2025-59378 | Medium | 5.7 | 2025-09-15 | In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the pr… |
CVE-2025-10453 | Medium | 5.3 | 2025-09-15 | O'View MapServer developed by PilotGaea Technologies has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to exploit this… |
CVE-2025-10429 | Medium | 6.3 | 2025-09-15 | A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Affected by this vulnerability is an unknown functionality of the file /ad… |
CVE-2025-10428 | Medium | 6.3 | 2025-09-15 | A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/seo_setti… |
CVE-2025-10427 | Medium | 6.3 | 2025-09-15 | A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/operation/user.php… |
CVE-2025-10426 | High | 7.3 | 2025-09-15 | A security flaw has been discovered in itsourcecode Online Laundry Management System 1.0. This affects an unknown function of the file /login.php. Performing m… |
CVE-2025-10425 | High | 7.3 | 2025-09-15 | A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The impacted element is an unknown function… |
CVE-2025-10424 | High | 7.3 | 2025-09-15 | A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function… |
CVE-2025-10423 | Low | 3.7 | 2025-09-15 | A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable capt… |
CVE-2025-59375 | High | 7.5 | 2025-09-15 | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. |
CVE-2025-10452 | Critical | 9.8 | 2025-09-15 | Statistical Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delet… |
CVE-2025-10422 | Medium | 4.3 | 2025-09-15 | A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySucces… |
CVE-2025-10421 | Medium | 6.3 | 2025-09-15 | A flaw has been found in SourceCodester Student Grading System 1.0. This vulnerability affects unknown code of the file /update_account.php. Executing manipula… |
CVE-2025-10420 | Medium | 6.3 | 2025-09-15 | A vulnerability was detected in SourceCodester Student Grading System 1.0. This affects an unknown part of the file /form137.php. Performing manipulation of th… |
CVE-2025-10419 | Medium | 6.3 | 2025-09-15 | A security vulnerability has been detected in SourceCodester Student Grading System 1.0. Affected by this issue is some unknown functionality of the file /del_… |
CVE-2025-10418 | Medium | 6.3 | 2025-09-15 | A weakness has been identified in SourceCodester Student Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_stude… |
CVE-2025-10417 | High | 7.3 | 2025-09-15 | A security flaw has been discovered in Campcodes Grocery Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=delete_pr… |
CVE-2025-10416 | High | 7.3 | 2025-09-15 | A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=delete_suppli… |
CVE-2025-59364 | Medium | 5.3 | 2025-09-14 | The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/sanitize.js for a J… |
CVE-2025-10415 | High | 7.3 | 2025-09-14 | A vulnerability was determined in Campcodes Grocery Sales and Inventory System 1.0. This affects an unknown function of the file /ajax.php?action=save_supplier… |
CVE-2025-10414 | High | 7.3 | 2025-09-14 | A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_cu… |
CVE-2025-10413 | High | 7.3 | 2025-09-14 | A vulnerability has been found in Campcodes Grocery Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=de… |
CVE-2025-10411 | Medium | 4.3 | 2025-09-14 | A vulnerability was detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /… |
CVE-2025-10410 | Medium | 6.3 | 2025-09-14 | A security vulnerability has been detected in SourceCodester Link Status Checker 1.0. This vulnerability affects unknown code of the file index.php. The manipu… |
CVE-2025-10409 | Medium | 6.3 | 2025-09-14 | A weakness has been identified in SourceCodester Student Grading System 1.0. This affects an unknown part of the file /rms.php?page=users. Executing manipulati… |
CVE-2025-10408 | Medium | 6.3 | 2025-09-14 | A security flaw has been discovered in SourceCodester Student Grading System 1.0. Affected by this issue is some unknown functionality of the file /edit_user.p… |
CVE-2025-10407 | Medium | 6.3 | 2025-09-14 | A vulnerability was identified in SourceCodester Student Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_user… |
CVE-2025-10405 | High | 7.3 | 2025-09-14 | A vulnerability was determined in itsourcecode Baptism Information Management System 1.0. Affected is an unknown function of the file /listbaptism.php. This ma… |
CVE-2025-10404 | High | 7.3 | 2025-09-14 | A vulnerability was found in itsourcecode Baptism Information Management System 1.0. This impacts an unknown function of the file /rptbaptismal.php. The manipu… |
CVE-2025-10403 | High | 7.3 | 2025-09-14 | A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/view-enquiry.php. The ma… |
CVE-2025-6051 | Medium | 5.3 | 2025-09-14 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_number… |
CVE-2025-10402 | High | 7.3 | 2025-09-14 | A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /admin/readenq.php. Executing… |
CVE-2025-10401 | Medium | 6.3 | 2025-09-14 | A vulnerability was detected in D-Link DIR-823x up to 250416. The affected element is an unknown function of the file /goform/diag_ping. Performing manipulatio… |
CVE-2025-10400 | Medium | 6.3 | 2025-09-14 | A security vulnerability has been detected in SourceCodester Food Ordering Management System 1.0. Impacted is an unknown function of the file /routers/ticket-m… |
CVE-2025-36035 | Medium | 6.7 | 2025-09-14 | IBM PowerVM Hypervisor FW950.00 through FW950.E0, FW1050.00 through FW1050.50, and FW1060.00 through FW1060.40 could allow a local privileged user to cause a d… |
CVE-2025-10399 | Medium | 6.3 | 2025-09-14 | A weakness has been identified in Korzh EasyQuery up to 7.4.0. This issue affects some unknown processing of the file /api/easyquery/models/nwind/fetch of the… |
CVE-2025-10204 | | 2025-09-14 | A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the adm… | |
CVE-2025-0164 | Low | 2.3 | 2025-09-14 | IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on configuration files du… |
CVE-2025-10398 | Medium | 6.3 | 2025-09-14 | A security flaw has been discovered in fcba_zzm ics-park Smart Park Management System 2.0. This vulnerability affects unknown code of the file FileUploadUtils… |
CVE-2025-10397 | Medium | 4.7 | 2025-09-14 | A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument… |
CVE-2025-10396 | High | 7.3 | 2025-09-14 | A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/… |
CVE-2025-10395 | Medium | 4.7 | 2025-09-14 | A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler… |
CVE-2025-10394 | Medium | 4.7 | 2025-09-14 | A vulnerability has been found in fcba_zzm ics-park Smart Park Management System 2.0. Affected is an unknown function of the file ruoyi-quartz/src/main/java/co… |
CVE-2025-10393 | Medium | 6.3 | 2025-09-14 | A flaw has been found in miurla morphic up to 0.4.5. This impacts the function fetchHtml of the file /api/advanced-search of the component HTTP Status Code 3xx… |