2025 CVEs (page 195)
Page 195 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-36896 | Critical | 9.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106. |
CVE-2025-36895 | High | 7.5 | 2025-09-04 | Information disclosure |
CVE-2025-36894 | High | 7.5 | 2025-09-04 | In TBD of TBD, there is a possible DoS due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed… |
CVE-2025-36893 | Medium | 5.5 | 2025-09-04 | In ReadTachyonCommands of gxp_main_actor.cc, there is a possible information leak due to uninitialized data. This could lead to local information disclosure wi… |
CVE-2025-36892 | High | 7.5 | 2025-09-04 | Denial of service |
CVE-2025-36891 | High | 8.8 | 2025-09-04 | Elevation of privilege |
CVE-2025-36890 | Critical | 9.8 | 2025-09-04 | Elevation of Privilege |
CVE-2025-36887 | High | 7.8 | 2025-09-04 | In wl_cfgscan_update_v3_schedscan_results() of wl_cfgscan.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to loca… |
CVE-2025-2417 | High | 8.6 | 2025-09-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft e-Mutabakat allows Authentication Bypass. This issue affects e-Mutabakat… |
CVE-2025-2411 | High | 8.6 | 2025-09-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft TaskPano allows Authentication Bypass. This issue affects TaskPano: from s… |
CVE-2025-9928 | High | 7.3 | 2025-09-03 | A security flaw has been discovered in projectworlds Travel Management System 1.0. The impacted element is an unknown function of the file /viewcategory.php. P… |
CVE-2025-9927 | High | 7.3 | 2025-09-03 | A vulnerability was identified in projectworlds Travel Management System 1.0. The affected element is an unknown function of the file /viewpackage.php. Such ma… |
CVE-2025-8268 | Medium | 6.5 | 2025-09-03 | The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the rest_list and delete_files fu… |
CVE-2025-58056 | High | 7.5 | 2025-09-03 | Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions… |
CVE-2025-57833 | High | 7.1 | 2025-09-03 | An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, u… |
CVE-2025-55748 | High | 7.5 | 2025-09-03 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configura… |
CVE-2025-55747 | Critical | 9.1 | 2025-09-03 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configur… |
CVE-2025-9926 | High | 7.3 | 2025-09-03 | A vulnerability was determined in projectworlds Travel Management System 1.0. Impacted is an unknown function of the file /viewsubcategory.php. This manipulati… |
CVE-2025-9925 | High | 7.3 | 2025-09-03 | A vulnerability was found in projectworlds Travel Management System 1.0. This issue affects some unknown processing of the file /detail.php. The manipulation o… |
CVE-2025-9365 | High | 7.8 | 2025-09-03 | Fuji Electric FRENIC-Loader 4 is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacke… |
CVE-2025-56139 | Medium | 5.3 | 2025-09-03 | LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original… |
CVE-2025-55162 | Medium | 6.3 | 2025-09-03 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1… |
CVE-2025-53690 | Critical | 9.0 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects… |
CVE-2025-9924 | High | 7.3 | 2025-09-03 | A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /enquiry.php. The manipulatio… |
CVE-2025-9923 | Medium | 4.3 | 2025-09-03 | A flaw has been found in Campcodes Sales and Inventory System 1.0. This affects an unknown part of the file /index.php. Executing manipulation of the argument… |
CVE-2025-36193 | High | 8.4 | 2025-09-03 | IBM Transformation Advisor 2.0.1 through 4.3.1 incorrectly assigns privileges to security critical files which could allow a local root escalation inside a con… |
CVE-2025-56803 | High | 8.4 | 2025-09-03 | Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands… |
CVE-2025-56752 | Critical | 9.4 | 2025-09-03 | A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanisms, providing them w… |
CVE-2025-52494 | High | 7.5 | 2025-09-03 | Adacore Ada Web Server (AWS) before 25.2 is vulnerable to a denial-of-service (DoS) condition due to improper handling of SSL handshakes during connection init… |
CVE-2025-45805 | High | 7.6 | 2025-09-03 | In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile name. This payload… |
CVE-2025-20336 | Medium | 5.3 | 2025-09-03 | A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an un… |
CVE-2025-20335 | Medium | 5.3 | 2025-09-03 | A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an un… |
CVE-2025-20330 | Medium | 6.1 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an un… |
CVE-2025-20328 | Medium | 5.4 | 2025-09-03 | A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privileges to conduct a cro… |
CVE-2025-20326 | Medium | 4.3 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edi… |
CVE-2025-20291 | Medium | 4.3 | 2025-09-03 | A vulnerability in Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to redirect a targeted Webex Meetings user to an untrusted websi… |
CVE-2025-20287 | Medium | 4.3 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to upl… |
CVE-2025-20280 | Medium | 4.8 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authen… |
CVE-2025-20270 | Medium | 4.3 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authen… |
CVE-2025-9959 | High | 7.6 | 2025-09-03 | Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smolagents. The attack… |
CVE-2025-9922 | Medium | 4.3 | 2025-09-03 | A security vulnerability has been detected in Campcodes Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-9921 | Low | 2.4 | 2025-09-03 | A weakness has been identified in code-projects POS Pharmacy System 1.0. Affected is an unknown function of the file /main/products.php. This manipulation of t… |
CVE-2025-9867 | Medium | 5.4 | 2025-09-03 | Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTM… |
CVE-2025-9866 | High | 8.8 | 2025-09-03 | Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HT… |
CVE-2025-9865 | Medium | 5.4 | 2025-09-03 | Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-56761 | Medium | 5.4 | 2025-09-03 | Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the cont… |
CVE-2025-56760 | Medium | 4.3 | 2025-09-03 | When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in t… |
CVE-2025-56689 | Medium | 4.6 | 2025-09-03 | One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass… |
CVE-2025-9920 | Medium | 4.7 | 2025-09-03 | A security flaw has been discovered in Campcodes Recruitment Management System 1.0. This impacts the function include of the file /admin/index.php. The manipul… |
CVE-2025-9919 | High | 7.3 | 2025-09-03 | A vulnerability was identified in 1000projects Beauty Parlour Management System 1.0. This affects an unknown function of the file /admin/bwdates-reports-detail… |
CVE-2025-56498 | Medium | 5.3 | 2025-09-03 | An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user in… |
CVE-2025-56435 | Medium | 5.3 | 2025-09-03 | SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBackup.php and the operation on t… |
CVE-2025-55944 | Medium | 6.1 | 2025-09-03 | Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. When a user views the shared image in a new browser tab, the embedded JavaScript… |
CVE-2025-55852 | High | 7.5 | 2025-09-03 | Tenda AC8 v16.03.34.06 is vulnerable to Buffer Overflow in the formWifiBasicSet function via the parameter security or security_5g. |
CVE-2025-0280 | High | 7.5 | 2025-09-03 | A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access. |
CVE-2025-9824 | Medium | 5.9 | 2025-09-03 | ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after whi… |
CVE-2025-9823 | | 2025-09-03 | SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs beca… | |
CVE-2025-58644 | High | 7.2 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes - TQL Edition ltl-freight-quotes-tql-edition allows Object Injection.Th… |
CVE-2025-58643 | High | 7.2 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Daylight Edition ltl-freight-quotes-daylight-edition allows Object In… |
CVE-2025-58642 | High | 7.2 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Day & Ross Edition ltl-freight-quotes-day-ross-edition allows Object… |
CVE-2025-58641 | Medium | 5.4 | 2025-09-03 | Server-Side Request Forgery (SSRF) vulnerability in kamleshyadav Exit Intent Popup exitintentpopup allows Server Side Request Forgery.This issue affects Exit I… |
CVE-2025-58640 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Document Engine document-engine allows Store… |
CVE-2025-58639 | Medium | 5.4 | 2025-09-03 | Missing Authorization vulnerability in Ali Khallad Contact Form By Mega Forms mega-forms allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-58637 | High | 7.5 | 2025-09-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in immonex immonex Kickstart immonex-kick… |
CVE-2025-58635 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-58634 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in peachpay PeachPay Payments peachpay-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-58633 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Stor… |
CVE-2025-58632 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dadevarzan Dadevarzan WordPress Common dadevarzan-common… |
CVE-2025-58631 | Medium | 5.9 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 IssueM issuem allows DOM-Based XSS.This issue aff… |
CVE-2025-58630 | Medium | 5.9 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer Simple Matomo Tracking Code simple-matomo-tracking-… |
CVE-2025-58626 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-c… |
CVE-2025-58625 | Medium | 5.9 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored X… |
CVE-2025-58624 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falselight Exchange Rates exchange-rates allows Stored XS… |
CVE-2025-58623 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bohemia Plugins Event Feed for Eventbrite event-feed-for-… |
CVE-2025-58622 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in yydevelopment Mobile Contact Line mobile-contact-line allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-58621 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amuse Labs PuzzleMe for WordPress puzzleme allows Stored… |
CVE-2025-58620 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Stored… |
CVE-2025-58618 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar allows DOM-Ba… |
CVE-2025-58617 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in FAKTOR VIER F4 Media Taxonomies f4-media-taxonomies allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-58616 | Medium | 6.5 | 2025-09-03 | Missing Authorization vulnerability in Frisbii Frisbii Pay reepay-checkout-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58615 | Medium | 4.4 | 2025-09-03 | Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Server Side Request Forgery.This issue affects WP Banneri… |
CVE-2025-58614 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows… |
CVE-2025-58613 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-58612 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS… |
CVE-2025-58611 | Medium | 4.3 | 2025-09-03 | Cross-Site Request Forgery (CSRF) vulnerability in Tickera Tickera tickera-event-ticketing-system allows Cross Site Request Forgery.This issue affects Tickera… |
CVE-2025-58610 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery all… |
CVE-2025-58609 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode a… |
CVE-2025-58608 | High | 7.5 | 2025-09-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows… |
CVE-2025-58607 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA… |
CVE-2025-58606 | Medium | 5.0 | 2025-09-03 | Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-58605 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored… |
CVE-2025-58604 | High | 7.6 | 2025-09-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This i… |
CVE-2025-58603 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfe… |
CVE-2025-58602 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalizati… |
CVE-2025-58601 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-58600 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-58599 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Con… |
CVE-2025-58598 | Medium | 6.6 | 2025-09-03 | Insertion of Sensitive Information Into Debugging Code vulnerability in Klarna Klarna Order Management for WooCommerce klarna-order-management-for-woocommerce… |
CVE-2025-58597 | Medium | 4.3 | 2025-09-03 | Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-58596 | Medium | 5.9 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin mailoptin allows Stored XSS.This… |