2025 CVEs (page 189)
Page 189 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-56266 | Critical | 9.8 | 2025-09-08 | A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL. |
CVE-2025-56265 | High | 8.8 | 2025-09-08 | An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uplo… |
CVE-2025-10100 | High | 7.3 | 2025-09-08 | A vulnerability was detected in SourceCodester Simple Forum Discussion System 1.0. This impacts an unknown function of the file /admin_class.php?action=login… |
CVE-2025-10099 | Low | 2.4 | 2025-09-08 | A weakness has been identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_usuar… |
CVE-2025-51586 | Low | 3.7 | 2025-09-08 | An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the r… |
CVE-2025-10098 | Medium | 6.3 | 2025-09-08 | A security flaw has been discovered in PHPGurukul User Management System 1.0. Affected is an unknown function of the file /admin/edit-user-profile.php. The man… |
CVE-2025-10097 | Medium | 6.3 | 2025-09-08 | A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The man… |
CVE-2025-10096 | Medium | 6.3 | 2025-09-08 | A vulnerability was determined in SimStudioAI sim up to 1.0.0. This affects an unknown function of the file apps/sim/app/api/files/parse/route.ts. Executing ma… |
CVE-2025-7709 | | 2025-09-08 | An integer overflow exists in the FTS5 https://sqlite.org/fts5.html extension. It occurs when the size of an array of tombstone pointers is calculated and tr… | |
CVE-2025-59033 | High | 7.4 | 2025-09-08 | The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TB… |
CVE-2025-57141 | Critical | 9.8 | 2025-09-08 | rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc. |
CVE-2025-56630 | High | 7.3 | 2025-09-08 | FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column_model parameter in the app/admin/controller/Column.php file. |
CVE-2025-55998 | High | 8.1 | 2025-09-08 | A cross-site scripting (XSS) vulnerability in Smart Search & Filter Shopify and BigCommerce apps allows a remote attacker to execute arbitrary JavaScript in th… |
CVE-2025-52161 | Critical | 9.8 | 2025-09-08 | Scholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2025-40930 | High | 7.5 | 2025-09-08 | JSON::SIMD before version 1.07 and earlier for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service att… |
CVE-2025-40929 | Medium | 5.6 | 2025-09-08 | Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks o… |
CVE-2025-40928 | High | 7.5 | 2025-09-08 | JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other… |
CVE-2025-36855 | High | 8.8 | 2025-09-08 | A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://c… |
CVE-2025-36854 | High | 8.1 | 2025-09-08 | A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the r… |
CVE-2025-36853 | High | 7.5 | 2025-09-08 | A vulnerability (CVE-2025-21172) exists in msdia140.dll due to integer overflow and heap-based overflow. Per CWE-122: Heap-based Buffer Overflow, a heap over… |
CVE-2025-22956 | Critical | 9.8 | 2025-09-08 | OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. This can lead to privilege escalation if any ProductP… |
CVE-2025-3212 | Medium | 5.3 | 2025-09-08 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2025-40642 | | 2025-09-08 | Reflected Cross-Site Scripting (XSS) vulnerability in WebWork, which allows remote attackers to execute arbitrary code through the 'q' and 'engine' request par… | |
CVE-2025-40641 | | 2025-09-08 | Cross-site Scripting (XSS) vulnerability stored in Multi-Purpose Inventory Management System, consisting of a stored XSS due to lack of proper validation of us… | |
CVE-2025-10093 | Medium | 5.3 | 2025-09-08 | A vulnerability was identified in D-Link DIR-852 up to 1.00CN B09. Affected by this vulnerability is the function phpcgi_main of the file /getcfg.php of the co… |
CVE-2025-10092 | High | 7.3 | 2025-09-08 | A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add o… |
CVE-2025-5993 | | 2025-09-08 | ITCube CRM in versions from 2023.2 through 2025.2 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit vulnerable parameter file… | |
CVE-2025-10091 | High | 7.3 | 2025-09-08 | A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Ty… |
CVE-2025-10090 | High | 7.3 | 2025-09-08 | A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing ma… |
CVE-2025-58782 | Medium | 6.5 | 2025-09-08 | Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1… |
CVE-2025-41708 | High | 7.4 | 2025-09-08 | Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit thi… |
CVE-2025-41682 | High | 8.8 | 2025-09-08 | An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password. |
CVE-2025-41664 | High | 7.5 | 2025-09-08 | A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling d… |
CVE-2025-10088 | Low | 3.5 | 2025-09-08 | A vulnerability was detected in SourceCodester Time Tracker 1.0. The affected element is an unknown function of the file /index.html. Performing manipulation o… |
CVE-2025-10087 | Medium | 4.7 | 2025-09-08 | A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/profit_re… |
CVE-2025-8085 | High | 8.6 | 2025-09-08 | The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors t… |
CVE-2025-10086 | Medium | 6.3 | 2025-09-08 | A weakness has been identified in fuyang_lipengjun platform 1.0.0. This issue affects the function queryAll of the file /adposition/queryAll of the component A… |
CVE-2025-10085 | Medium | 6.3 | 2025-09-08 | A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file manage_website… |
CVE-2025-58422 | Low | 3.1 | 2025-09-08 | RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If an attacker can perform a man-in-the-middle attack, they may… |
CVE-2025-10084 | Medium | 4.3 | 2025-09-08 | A vulnerability was identified in elunez eladmin up to 2.7. This affects the function queryErrorLogDetail of the file /api/logs/error/1 of the component SysLog… |
CVE-2025-10083 | Medium | 6.3 | 2025-09-08 | A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/… |
CVE-2025-10082 | High | 7.3 | 2025-09-08 | A vulnerability has been found in SourceCodester Online Polling System 1.0. Affected is an unknown function of the file /admin/manage-admins.php. Such manipula… |
CVE-2025-10081 | Medium | 4.7 | 2025-09-08 | A flaw has been found in SourceCodester Pet Management System 1.0. This impacts an unknown function of the file /admin/profile.php. This manipulation of the ar… |
CVE-2025-10080 | Low | 3.1 | 2025-09-08 | A vulnerability has been found in running-elephant Datart up to 1.0.0-rc3. Affected by this issue is the function getTokensecret of the file datart/security/sr… |
CVE-2025-10079 | High | 7.3 | 2025-09-08 | A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this vulnerability is an unknown functionality of the file /get-quote.php. Executing manipulatio… |
CVE-2025-10078 | High | 7.3 | 2025-09-08 | A vulnerability was detected in SourceCodester Online Polling System 1.0. Affected is an unknown function of the file /admin/candidates.php. Performing manipul… |
CVE-2025-10077 | High | 7.3 | 2025-09-08 | A security vulnerability has been detected in SourceCodester Online Polling System 1.0. This impacts an unknown function of the file /registeracc.php. Such man… |
CVE-2025-10076 | High | 7.3 | 2025-09-08 | A weakness has been identified in SourceCodester Online Polling System 1.0. This affects an unknown function of the file /manage-profile.php. This manipulation… |
CVE-2025-10075 | Low | 3.5 | 2025-09-08 | A security flaw has been discovered in SourceCodester Online Polling System 1.0. The impacted element is an unknown function of the file /manage-profile.php. T… |
CVE-2025-10074 | Low | 3.5 | 2025-09-08 | A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of… |
CVE-2025-10073 | Medium | 4.3 | 2025-09-08 | A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lea… |
CVE-2025-10072 | Medium | 6.3 | 2025-09-07 | A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /matricula/[ID_STUDENT]/enturmar/. Performi… |
CVE-2025-10071 | Medium | 6.3 | 2025-09-07 | A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manip… |
CVE-2025-10070 | Medium | 6.3 | 2025-09-07 | A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper acces… |
CVE-2025-48042 | | 2025-09-07 | Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This vulnerability is associa… | |
CVE-2025-39734 | Medium | 5.5 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: Revert "fs/ntfs3: Replace inode_trylock with inode_lock" This reverts commit 69505fe98f19… |
CVE-2025-39733 | Medium | 5.5 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: team: replace team lock with rtnl lock syszbot reports various ordering issues for lower… |
CVE-2025-39732 | High | 7.8 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() ath11k_mac_disab… |
CVE-2025-39731 | Medium | 5.5 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: f2fs: vm_unmap_ram() may be called from an invalid context When testing F2FS with xfstest… |
CVE-2025-39730 | High | 7.8 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the… |
CVE-2025-39729 | Medium | 5.5 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix dereferencing uninitialized error pointer Fix below smatch warnings: dr… |
CVE-2025-39727 | High | 7.8 | 2025-09-07 | In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix potential buffer overflow in setup_clusters() In setup_swap_map(), we only… |
CVE-2025-10068 | High | 7.3 | 2025-09-07 | A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/admin_forum/add_views.php. Executing man… |
CVE-2025-10067 | Medium | 4.3 | 2025-09-07 | A vulnerability was detected in itsourcecode POS Point of Sale System 1.0. The impacted element is an unknown function of the file /inventory/main/vendors/data… |
CVE-2025-36100 | Medium | 5.1 | 2025-09-07 | IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and… |
CVE-2025-10066 | Medium | 4.3 | 2025-09-07 | A security vulnerability has been detected in itsourcecode POS Point of Sale System 1.0. The affected element is an unknown function of the file /inventory/mai… |
CVE-2025-10065 | Medium | 4.3 | 2025-09-07 | A weakness has been identified in itsourcecode POS Point of Sale System 1.0. Impacted is an unknown function of the file /inventory/main/vendors/datatables/uni… |
CVE-2025-10064 | Medium | 4.3 | 2025-09-07 | A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This issue affects some unknown processing of the file /inventory/main/vendor… |
CVE-2025-10063 | Medium | 4.3 | 2025-09-06 | A vulnerability was identified in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/datata… |
CVE-2025-10062 | High | 7.3 | 2025-09-06 | A vulnerability was determined in itsourcecode Student Information Management System 1.0. This affects an unknown part of the file /admin/login.php. Executing… |
CVE-2025-58445 | High | 7.5 | 2025-09-06 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed ver… |
CVE-2025-58443 | Critical | 9.1 | 2025-09-06 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerabili… |
CVE-2025-58446 | High | 7.5 | 2025-09-06 | xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large gramma… |
CVE-2025-58438 | | 2025-09-06 | internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory traversal (path traversal) vulnerabilit… | |
CVE-2025-0034 | Medium | 4.7 | 2025-09-06 | Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cause read or write pa… |
CVE-2025-0032 | High | 7.2 | 2025-09-06 | Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcode, potentially res… |
CVE-2025-0011 | Low | 3.3 | 2025-09-06 | Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address information potenti… |
CVE-2025-0010 | Medium | 6.1 | 2025-09-06 | An out of bounds write in the Linux graphics driver could allow an attacker to overflow the buffer potentially resulting in loss of confidentiality, integrity… |
CVE-2025-0009 | Medium | 5.5 | 2025-09-06 | A NULL pointer dereference in AMD Crash Defender could allow an attacker to write a NULL output to a log file potentially resulting in a system crash and loss… |
CVE-2025-10034 | High | 8.8 | 2025-09-06 | A vulnerability was found in D-Link DIR-825 1.08.01. This impacts the function get_ping6_app_stat of the file ping6_response.cg of the component httpd. Perform… |
CVE-2025-10033 | High | 7.3 | 2025-09-06 | A vulnerability has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin. Such manipulation of the argum… |
CVE-2025-10032 | Medium | 4.3 | 2025-09-06 | A vulnerability was detected in Campcodes Grocery Sales and Inventory System 1.0. The affected element is an unknown function of the file /index.php. The manip… |
CVE-2025-10031 | High | 7.3 | 2025-09-06 | A security vulnerability has been detected in Campcodes Grocery Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=de… |
CVE-2025-10030 | High | 7.3 | 2025-09-06 | A weakness has been identified in Campcodes Grocery Sales and Inventory System 1.0. This issue affects some unknown processing of the file /ajax.php?action=sav… |
CVE-2025-10029 | Low | 3.5 | 2025-09-06 | A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/d… |
CVE-2025-9961 | | 2025-09-06 | An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be conducted via a Man… | |
CVE-2025-10046 | Medium | 4.9 | 2025-09-06 | The ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress is vulnerable to SQL Injection via the 'file_to_delete' parameter in all versio… |
CVE-2025-10028 | Low | 3.5 | 2025-09-06 | A vulnerability was identified in itsourcecode POS Point of Sale System 1.0. This affects an unknown part of the file /inventory/main/vendors/datatables/unit_t… |
CVE-2025-6757 | Medium | 6.4 | 2025-09-06 | The Recent Posts Widget Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rpwe' shortcode in all versions up to, and… |
CVE-2025-9493 | Medium | 6.4 | 2025-09-06 | The Admin Menu Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ parameter in all versions up to, and including, 1… |
CVE-2025-9442 | Medium | 6.4 | 2025-09-06 | The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vodsChannel’ parameter in all versions up to, and… |
CVE-2025-9126 | Medium | 6.4 | 2025-09-06 | The Smart Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.0.1 du… |
CVE-2025-8722 | Medium | 6.4 | 2025-09-06 | The Content Views plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid and List widgets in all versions up to, and including… |
CVE-2025-8564 | Medium | 6.4 | 2025-09-06 | The SKT Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.7 d… |
CVE-2025-8149 | Medium | 6.4 | 2025-09-06 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and… |
CVE-2025-7045 | Medium | 6.5 | 2025-09-06 | The Cloud SAML SSO plugin for WordPress is vulnerable to Identity Provider Deletion due to a missing capability check on the delete_config action of the csso_h… |
CVE-2025-7040 | High | 8.2 | 2025-09-06 | The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'set_organization_settings'… |
CVE-2025-9853 | Medium | 6.4 | 2025-09-06 | The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and in… |
CVE-2025-9515 | High | 7.2 | 2025-09-06 | The Multi Step Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the import functionality in all versio… |
CVE-2025-9085 | Medium | 4.9 | 2025-09-06 | The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in version 4.3.0. This is due to insufficient esca… |