2025 CVEs (page 185)
Page 185 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-40695 | Medium | 5.4 | 2025-09-11 | Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validati… |
CVE-2025-40694 | Medium | 5.4 | 2025-09-11 | Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validati… |
CVE-2025-40693 | Medium | 5.4 | 2025-09-11 | Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of pr… |
CVE-2025-40692 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via '… |
CVE-2025-40691 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via '… |
CVE-2025-40690 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'te… |
CVE-2025-40689 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via '… |
CVE-2025-40687 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via '… |
CVE-2025-10250 | Medium | 5.0 | 2025-09-11 | A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Exe… |
CVE-2025-58321 | Critical | 10.0 | 2025-09-11 | Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability. |
CVE-2025-58320 | High | 7.3 | 2025-09-11 | Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability. |
CVE-2025-48041 | | 2025-09-11 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerabili… | |
CVE-2025-48040 | | 2025-09-11 | Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated wi… | |
CVE-2025-48039 | | 2025-09-11 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. Th… | |
CVE-2025-48038 | | 2025-09-11 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. Th… | |
CVE-2025-9918 | | 2025-09-11 | A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server (versions 6.3.54.0, 6.3.53.2, and all prior versions) allows an… | |
CVE-2025-9874 | High | 7.5 | 2025-09-11 | The Ultimate Classified Listings plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6 via the 'uclwp_dashboard'… |
CVE-2025-9861 | Medium | 6.4 | 2025-09-11 | The ThemeLoom Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'los_showposts' shortcode in all versions up to, and i… |
CVE-2025-9860 | Medium | 6.4 | 2025-09-11 | The Mixtape plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mixtape' shortcode in all versions up to, and including, 1.1 du… |
CVE-2025-9855 | Medium | 6.4 | 2025-09-11 | The Enhanced BibliPlug plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bibliplug_authors' shortcode in all versions up to… |
CVE-2025-9850 | Medium | 6.4 | 2025-09-11 | The Evenium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'evenium_single_event' shortcode in all versions up to, and incl… |
CVE-2025-9693 | High | 8.0 | 2025-09-11 | The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path val… |
CVE-2025-9635 | Medium | 4.3 | 2025-09-11 | The Analytics Reduce Bounce Rate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to mis… |
CVE-2025-9634 | Medium | 4.3 | 2025-09-11 | The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing o… |
CVE-2025-9633 | Medium | 4.3 | 2025-09-11 | The LH Signing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.83. This is due to missing or incorrect… |
CVE-2025-9632 | Medium | 4.3 | 2025-09-11 | The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorr… |
CVE-2025-9631 | Medium | 4.3 | 2025-09-11 | The AutoCatSet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.4. This is due to missing or incorrec… |
CVE-2025-9628 | Medium | 4.3 | 2025-09-11 | The The integration of the AMO.CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to… |
CVE-2025-9627 | Medium | 4.3 | 2025-09-11 | The Run Log plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.10. This is due to missing or incorrect… |
CVE-2025-9623 | Medium | 4.3 | 2025-09-11 | The Admin in English with Switch plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to mis… |
CVE-2025-9620 | Medium | 6.1 | 2025-09-11 | The Seo Monster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.3. This is due to missing or incorre… |
CVE-2025-9617 | Medium | 5.3 | 2025-09-11 | The Publish approval plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or inco… |
CVE-2025-9451 | Medium | 6.5 | 2025-09-11 | The Smartcat Translator for WPML plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and includin… |
CVE-2025-9128 | Medium | 6.4 | 2025-09-11 | The eID Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.9.3 due to insuff… |
CVE-2025-9123 | Medium | 6.4 | 2025-09-11 | The CBX Map for Google Map & OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup heading and location address paramet… |
CVE-2025-9073 | High | 7.5 | 2025-09-11 | The All in one Minifier plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including, 3.2 due to insuff… |
CVE-2025-8721 | Medium | 6.4 | 2025-09-11 | The Workable Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's workable_jobs shortcode in all versions up to, and includin… |
CVE-2025-8692 | Medium | 4.9 | 2025-09-11 | The Coupon API plugin for WordPress is vulnerable to SQL Injection via the ‘log_duration’ parameter in all versions up to, and including, 6.2.12 due to insuffi… |
CVE-2025-8691 | Medium | 6.4 | 2025-09-11 | The WP Scriptcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.0.0 due to… |
CVE-2025-8689 | Medium | 6.4 | 2025-09-11 | The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets i… |
CVE-2025-8686 | Medium | 6.4 | 2025-09-11 | The WP Easy FAQs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's WP_EASY_FAQ shortcode in all versions up to, and including… |
CVE-2025-8570 | Critical | 9.8 | 2025-09-11 | The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determin… |
CVE-2025-8492 | Medium | 5.3 | 2025-09-11 | The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data du… |
CVE-2025-8481 | Medium | 4.3 | 2025-09-11 | The Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.1.7. This… |
CVE-2025-8445 | Medium | 6.4 | 2025-09-11 | The Countdown Timer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'countdown_label' Parameter in all versions up to… |
CVE-2025-8425 | High | 8.8 | 2025-09-11 | The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability c… |
CVE-2025-8423 | Medium | 5.4 | 2025-09-11 | The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mtswpt_remove_plugin() and… |
CVE-2025-8422 | High | 7.5 | 2025-09-11 | The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via… |
CVE-2025-8417 | High | 8.1 | 2025-09-11 | The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to re… |
CVE-2025-8398 | Medium | 6.4 | 2025-09-11 | The azurecurve BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including… |
CVE-2025-8392 | Medium | 6.4 | 2025-09-11 | The Mitfahrgelegenheit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.1.5 d… |
CVE-2025-8318 | Medium | 6.4 | 2025-09-11 | The Jobify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘keyword’ parameter in all versions up to, and including, 1.4.4 due to ins… |
CVE-2025-8316 | Medium | 6.4 | 2025-09-11 | The Certifica WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘evento’ parameter in all versions up to, and including, 3.1 due to… |
CVE-2025-8215 | Medium | 6.4 | 2025-09-11 | The Responsive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including… |
CVE-2025-5801 | Medium | 6.4 | 2025-09-11 | The Digital Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘column’ parameter in all versions up to, and including… |
CVE-2025-0763 | Medium | 4.3 | 2025-09-11 | The Ultimate Classified Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_custom_f… |
CVE-2025-8479 | Medium | 4.3 | 2025-09-11 | The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect no… |
CVE-2025-9059 | | 2025-09-11 | The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking. | |
CVE-2025-9034 | Medium | 6.1 | 2025-09-11 | The Wp Edit Password Protected WordPress plugin before 1.3.5 does not validate a parameter before redirecting the user to its value, leading to an Open Redire… |
CVE-2025-10247 | Medium | 6.3 | 2025-09-11 | A security vulnerability has been detected in JEPaaS 7.2.8. This vulnerability affects the function doFilterInternal of the component Filter Handler. Such mani… |
CVE-2025-9910 | Medium | 4.7 | 2025-09-11 | Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious… |
CVE-2025-9776 | Medium | 6.5 | 2025-09-11 | The CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Import contents in al… |
CVE-2025-10246 | Low | 3.5 | 2025-09-11 | A weakness has been identified in lokibhardwaj PHP-Code-For-Unlimited-File-Upload up to 124fe96324915490c81eaf7db3234b0b4e4bab3c. This affects an unknown part… |
CVE-2025-10245 | Medium | 4.3 | 2025-09-11 | A security flaw has been discovered in Display Painéis TGA up to 7.1.41. Affected by this issue is some unknown functionality of the file /gallery/rename of th… |
CVE-2025-10236 | Medium | 4.3 | 2025-09-11 | A vulnerability has been found in binary-husky gpt_academic up to 3.91. Impacted is the function merge_tex_files_ of the file crazy_functions/latex_fns/latex_t… |
CVE-2025-6088 | Low | 3.1 | 2025-09-11 | In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conver… |
CVE-2025-10235 | Low | 2.4 | 2025-09-11 | A flaw has been found in Scada-LTS up to 2.7.8.1. This issue affects some unknown processing of the file /reports.shtm of the component Reports Module. This ma… |
CVE-2025-10234 | Low | 2.4 | 2025-09-11 | A vulnerability was detected in Scada-LTS up to 2.7.8.1. This vulnerability affects unknown code of the file /data_point_edit.shtm of the component Data Point… |
CVE-2025-10233 | Medium | 6.3 | 2025-09-10 | A security vulnerability has been detected in kalcaddle kodbox 1.61. This affects the function fileGet/fileSave of the file app/controller/explorer/editor.clas… |
CVE-2025-10232 | Medium | 5.4 | 2025-09-10 | A weakness has been identified in 299ko up to 2.0.0. Affected by this issue is the function getSentDir/delete of the file plugin/filemanager/controllers/FileMa… |
CVE-2025-10229 | Medium | 4.3 | 2025-09-10 | A vulnerability has been found in Freshwork up to 1.2.3. This impacts an unknown function of the file /api/v2/logout. Such manipulation of the argument post_lo… |
CVE-2025-10218 | Medium | 6.3 | 2025-09-10 | A flaw has been found in lostvip-com ruoyi-go 2.1. This affects the function SelectListPage of the file modules/system/dao/SysRoleDao.go of the component Backg… |
CVE-2025-59052 | | 2025-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container… | |
CVE-2025-10216 | Low | 2.6 | 2025-09-10 | A vulnerability was detected in GrandNode up to 2.3.0. The impacted element is an unknown function of the file /checkout/ConfirmOrder/ of the component Voucher… |
CVE-2025-54376 | High | 7.5 | 2025-09-10 | Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same… |
CVE-2025-43783 | Medium | 6.1 | 2025-09-10 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through… |
CVE-2025-10211 | Medium | 6.3 | 2025-09-10 | A security vulnerability has been detected in yanyutao0402 ChanCMS 3.3.0. The affected element is the function CollectController of the file /cms/collect/getAr… |
CVE-2025-9714 | Medium | 6.2 | 2025-09-10 | Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressi… |
CVE-2025-59049 | High | 7.5 | 2025-09-10 | Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented… |
CVE-2025-54123 | Critical | 9.8 | 2025-09-10 | Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulne… |
CVE-2025-43784 | Medium | 6.5 | 2025-09-10 | Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and… |
CVE-2025-10210 | Medium | 6.3 | 2025-09-10 | A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.js. Executing manip… |
CVE-2025-10209 | Medium | 5.4 | 2025-09-10 | A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component Authorization Token Handler. Per… |
CVE-2025-10201 | High | 8.8 | 2025-09-10 | Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation vi… |
CVE-2025-10200 | High | 8.8 | 2025-09-10 | Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a craf… |
CVE-2025-8696 | High | 7.5 | 2025-09-10 | If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server. Thi… |
CVE-2025-57392 | High | 7.8 | 2025-09-10 | BenimPOS Masaustu 3.0.x is affected by insecure file permissions. The application installation directory grants Everyone and BUILTIN\Users groups FILE_ALL_ACCE… |
CVE-2025-55976 | High | 8.4 | 2025-09-10 | Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly ob… |
CVE-2025-50892 | High | 7.8 | 2025-09-10 | The eudskacs.sys driver version 20250328 shipped with EaseUs Todo Backup 1.2.0.1 fails to properly validate privileges for I/O requests (IRP_MJ_READ/IRP_MJ_WRI… |
CVE-2025-57642 | High | 7.2 | 2025-09-10 | A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the server, leading to re… |
CVE-2025-57520 | Medium | 6.1 | 2025-09-10 | A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3. Input fields such as body, tags, title, and description are not properly sanitized b… |
CVE-2025-43785 | Medium | 6.1 | 2025-09-10 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 20… |
CVE-2025-8681 | Medium | 5.5 | 2025-09-10 | Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. Requires a high privileged user with a devel… |
CVE-2025-59045 | | 2025-09-10 | Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exists in Stalwart's Cal… | |
CVE-2025-59041 | Critical | 9.8 | 2025-09-10 | Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to version 1.0.105, a malici… |
CVE-2025-59035 | Medium | 4.6 | 2025-09-10 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-… |
CVE-2025-59034 | Medium | 4.3 | 2025-09-10 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrie… |
CVE-2025-58764 | Critical | 9.8 | 2025-09-10 | Claude Code is an agentic coding tool. Due to an error in command parsing, versions prior to 1.0.105 were vulnerable to a bypass of the Claude Code confirmatio… |
CVE-2025-57573 | Medium | 5.6 | 2025-09-10 | Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the wifiTimeClose parameter in goform/setWifi. |
CVE-2025-57572 | Medium | 5.6 | 2025-09-10 | Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the onlineList parameter in goform/setParentControl. |