2025 CVEs (page 196)
Page 196 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58594 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Briz… |
CVE-2025-58593 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allo… |
CVE-2025-58460 | Medium | 4.2 | 2025-09-03 | A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an at… |
CVE-2025-58459 | Medium | 4.3 | 2025-09-03 | Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/… |
CVE-2025-58458 | Medium | 4.3 | 2025-09-03 | In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path… |
CVE-2025-57151 | High | 8.8 | 2025-09-03 | phpgurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/userprofile.php via the fullname parameter. |
CVE-2025-57150 | High | 7.2 | 2025-09-03 | phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/subcategory.php via the categoryName parameter. |
CVE-2025-57149 | Medium | 6.5 | 2025-09-03 | phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid parameter. |
CVE-2025-57148 | Critical | 9.1 | 2025-09-03 | phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension validation. |
CVE-2025-57147 | High | 7.5 | 2025-09-03 | A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. The vulnerability is due to lack of input validation of multiple paramet… |
CVE-2025-57146 | High | 8.1 | 2025-09-03 | phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter. |
CVE-2025-57052 | Critical | 9.8 | 2025-09-03 | cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass a… |
CVE-2025-56608 | Medium | 4.2 | 2025-09-03 | The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest… |
CVE-2025-9822 | Medium | 5.5 | 2025-09-03 | SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn a… |
CVE-2025-47421 | | 2025-09-03 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This is… | |
CVE-2025-2416 | High | 8.6 | 2025-09-03 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft LimonDesk allows Authentication Bypass. This issue affects LimonDesk: from… |
CVE-2025-26210 | High | 8.8 | 2025-09-03 | DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parti… |
CVE-2025-0878 | Medium | 4.7 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft LimonDesk allows Cross-Site Scripting (XS… |
CVE-2025-9901 | Medium | 5.9 | 2025-09-03 | A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that re… |
CVE-2025-53694 | High | 7.5 | 2025-09-03 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This i… |
CVE-2025-53693 | Critical | 9.8 | 2025-09-03 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experie… |
CVE-2025-53691 | High | 8.8 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This… |
CVE-2025-3701 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner wp-malware-removal allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-38678 | High | 7.8 | 2025-09-03 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject duplicate device on updates A chain/flowtable update with du… |
CVE-2025-41000 | | 2025-09-03 | Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users… | |
CVE-2025-9821 | Low | 2.7 | 2025-09-03 | SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also d… |
CVE-2025-9219 | Medium | 4.3 | 2025-09-03 | The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin fo… |
CVE-2025-2415 | High | 8.6 | 2025-09-03 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass. This issue affects MyRezzta: from s… |
CVE-2025-1740 | Critical | 9.8 | 2025-09-03 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, Brut… |
CVE-2025-9817 | High | 7.8 | 2025-09-03 | SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service |
CVE-2025-9378 | Medium | 6.4 | 2025-09-03 | The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie… |
CVE-2025-8663 | Medium | 6.5 | 2025-09-03 | Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects… |
CVE-2025-58210 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-58272 | Low | 3.7 | 2025-09-03 | Cross-site request forgery vulnerability exists in Web Caster V130 versions 1.08 and earlier. If a logged-in user views a malicious page created by an attacker… |
CVE-2025-21041 | Medium | 6.2 | 2025-09-03 | Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attackers to access sensitive information. |
CVE-2025-21040 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by ExternalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary information. |
CVE-2025-21039 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by SystemExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary informat… |
CVE-2025-21038 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by SamsungExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary informa… |
CVE-2025-21037 | Medium | 4.1 | 2025-09-03 | Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. User interaction is… |
CVE-2025-21036 | Medium | 5.0 | 2025-09-03 | Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exported note files. User interaction is requir… |
CVE-2025-21035 | Medium | 4.6 | 2025-09-03 | Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers to access data acro… |
CVE-2025-21034 | Medium | 4.0 | 2025-09-03 | Out-of-bounds write in libsavsvc.so prior to SMR Sep-2025 Release 1 allows local attackers to potentially execute arbitrary code. |
CVE-2025-21033 | Medium | 4.0 | 2025-09-03 | Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-21032 | Medium | 5.9 | 2025-09-03 | Improper access control in One UI Home prior to SMR Sep-2025 Release 1 allows physical attackers to bypass Kiosk mode under limited conditions. |
CVE-2025-21031 | Medium | 6.8 | 2025-09-03 | Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs. |
CVE-2025-21030 | Medium | 4.3 | 2025-09-03 | Improper handling of insufficient permission in AppPrelaunchManagerService prior to SMR Sep-2025 Release 1 in Chinese Android 15 allows local attackers to exec… |
CVE-2025-21029 | Medium | 4.0 | 2025-09-03 | Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies to messages from the… |
CVE-2025-21028 | Medium | 5.5 | 2025-09-03 | Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items. |
CVE-2025-21027 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to temporarily disable the SIM. |
CVE-2025-21026 | Medium | 4.0 | 2025-09-03 | Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to interrupt the call. |
CVE-2025-21025 | Medium | 5.1 | 2025-09-03 | Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded from background execution management. |
CVE-2025-9785 | | 2025-09-03 | PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management. When the component is de… | |
CVE-2025-58351 | Medium | 6.8 | 2025-09-03 | Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file… |
CVE-2025-58176 | High | 8.8 | 2025-09-03 | Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. In versions 0.9.0 through 0.9.3, there is a one-click… |
CVE-2025-9848 | High | 7.3 | 2025-09-03 | A security vulnerability has been detected in ScriptAndTools Real Estate Management System 1.0. The affected element is an unknown function of the file /admin/… |
CVE-2025-9847 | Medium | 6.3 | 2025-09-03 | A weakness has been identified in ScriptAndTools Real Estate Management System 1.0. Impacted is an unknown function of the file register.php. This manipulation… |
CVE-2025-7039 | Low | 3.7 | 2025-09-03 | A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perfo… |
CVE-2025-58163 | High | 8.8 | 2025-09-03 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.185 and earlier contain a deserialization of untrusted data vul… |
CVE-2025-9845 | Low | 3.5 | 2025-09-03 | A vulnerability has been found in code-projects Fruit Shop Management System 1.0. Affected by this vulnerability is an unknown functionality of the file produc… |
CVE-2025-9843 | Medium | 5.3 | 2025-09-03 | A flaw has been found in Das Parking Management System 停车场管理系统 6.2.0. Affected is an unknown function of the file /Operator/FindAll. This manipulation causes i… |
CVE-2025-57806 | | 2025-09-03 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including A… | |
CVE-2025-9842 | Medium | 5.3 | 2025-09-03 | A vulnerability was detected in Das Parking Management System 停车场管理系统 6.2.0. This impacts an unknown function of the file /Operator/Search. The manipulation re… |
CVE-2025-9841 | Medium | 6.3 | 2025-09-03 | A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file AddNewProduct.php… |
CVE-2025-9260 | Medium | 6.5 | 2025-09-03 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versio… |
CVE-2025-54588 | High | 7.5 | 2025-09-03 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 cont… |
CVE-2025-9840 | Medium | 6.3 | 2025-09-02 | A weakness has been identified in itsourcecode Sports Management System 1.0. The impacted element is an unknown function of the file /Admin/gametype.php. Execu… |
CVE-2025-9839 | High | 7.3 | 2025-09-02 | A security flaw has been discovered in itsourcecode Student Information Management System 1.0. The affected element is an unknown function of the file /admin/m… |
CVE-2025-9838 | High | 7.3 | 2025-09-02 | A vulnerability was identified in itsourcecode Student Information Management System 1.0. Impacted is an unknown function of the file /admin/modules/subject/in… |
CVE-2025-26416 | Critical | 9.8 | 2025-09-02 | In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of… |
CVE-2025-22442 | High | 7.0 | 2025-09-02 | In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to… |
CVE-2025-22439 | High | 7.3 | 2025-09-02 | In onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing permission check. This… |
CVE-2025-22438 | High | 7.8 | 2025-09-02 | In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additi… |
CVE-2025-22437 | High | 7.8 | 2025-09-02 | In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code. This coul… |
CVE-2025-22435 | Critical | 9.8 | 2025-09-02 | In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of privilege with no a… |
CVE-2025-22434 | High | 7.8 | 2025-09-02 | In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalati… |
CVE-2025-22433 | High | 7.8 | 2025-09-02 | In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commonly used in Work Profile scenarios due t… |
CVE-2025-22431 | Medium | 5.5 | 2025-09-02 | In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in… |
CVE-2025-22430 | Medium | 5.5 | 2025-09-02 | In isInSignificantPlace of multiple files, there is a possible way to access sensitive information due to a missing permission check. This could lead to local… |
CVE-2025-22429 | Critical | 9.8 | 2025-09-02 | In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege wit… |
CVE-2025-22428 | High | 7.8 | 2025-09-02 | In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user from the primary user… |
CVE-2025-22427 | High | 7.3 | 2025-09-02 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to grant notification access above the lock screen due to a logic error in… |
CVE-2025-22423 | High | 7.5 | 2025-09-02 | In ParseTag of dng_ifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. This could lead to remote denial of service with… |
CVE-2025-22422 | High | 7.8 | 2025-09-02 | In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another du… |
CVE-2025-22421 | Medium | 5.5 | 2025-09-02 | In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error i… |
CVE-2025-22419 | High | 7.3 | 2025-09-02 | In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This coul… |
CVE-2025-22418 | High | 7.8 | 2025-09-02 | In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no additional executio… |
CVE-2025-22417 | High | 7.3 | 2025-09-02 | In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. This could lead to l… |
CVE-2025-22416 | High | 7.8 | 2025-09-02 | In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of priv… |
CVE-2025-9837 | High | 7.3 | 2025-09-02 | A vulnerability was determined in itsourcecode Student Information Management System 1.0. This issue affects some unknown processing of the file /admin/modules… |
CVE-2025-9836 | Medium | 4.3 | 2025-09-02 | A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of… |
CVE-2025-9835 | Medium | 4.3 | 2025-09-02 | A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of th… |
CVE-2025-9834 | Low | 3.5 | 2025-09-02 | A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /registration.php. Executing manipulation o… |
CVE-2025-9833 | High | 7.3 | 2025-09-02 | A vulnerability was detected in SourceCodester Online Farm Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login… |
CVE-2025-9832 | High | 7.3 | 2025-09-02 | A security vulnerability has been detected in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the file /routers/register… |
CVE-2025-9831 | High | 7.3 | 2025-09-02 | A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. This impacts an unknown function of the file /admin/edit-services.php. This… |
CVE-2025-9330 | High | 7.8 | 2025-09-02 | Foxit PDF Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalat… |
CVE-2025-9329 | High | 7.8 | 2025-09-02 | Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-9328 | High | 7.8 | 2025-09-02 | Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-9327 | Medium | 5.5 | 2025-09-02 | Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2025-9326 | High | 7.8 | 2025-09-02 | Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |