2025 CVEs (page 196)
Page 196 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-41037 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41036 | Medium | 5.4 | 2025-09-04 | A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, th… |
CVE-2025-41035 | Medium | 6.5 | 2025-09-04 | A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass th… |
CVE-2025-41034 | Critical | 9.8 | 2025-09-04 | An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database… |
CVE-2025-41033 | Critical | 9.8 | 2025-09-04 | An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database… |
CVE-2025-41032 | Critical | 9.8 | 2025-09-04 | An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database… |
CVE-2025-9942 | Medium | 6.3 | 2025-09-04 | A vulnerability has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /submitproperty.php. The manipulatio… |
CVE-2025-9941 | Medium | 6.3 | 2025-09-04 | A flaw has been found in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /register.php. Executing manipulation of the… |
CVE-2025-9940 | Low | 3.5 | 2025-09-04 | A vulnerability was detected in CodeAstro Real Estate Management System 1.0. This affects an unknown function of the file /feature.php. Performing manipulation… |
CVE-2025-9939 | Low | 3.5 | 2025-09-04 | A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of the file /propertyvie… |
CVE-2025-9938 | High | 8.8 | 2025-09-04 | A weakness has been identified in D-Link DI-8400 16.07.26A1. The affected element is the function yyxz_dlink_asp of the file /yyxz.asp. This manipulation of th… |
CVE-2025-9937 | Medium | 5.4 | 2025-09-04 | A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The manipulation result… |
CVE-2025-9936 | Medium | 4.3 | 2025-09-04 | A vulnerability was identified in fuyang_lipengjun platform 1.0.0. This issue affects the function AdController of the file /ad/queryAll. The manipulation lead… |
CVE-2025-9935 | High | 7.3 | 2025-09-04 | A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstec… |
CVE-2025-9934 | Medium | 6.3 | 2025-09-04 | A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515. This affects the function sub_410C34 of the file /cgi-bin/cstecgi.cgi. Performing manipula… |
CVE-2025-9933 | High | 7.3 | 2025-09-04 | A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/view… |
CVE-2025-9932 | High | 7.3 | 2025-09-04 | A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the file /admin/update-… |
CVE-2025-9931 | Medium | 4.3 | 2025-09-04 | A vulnerability was detected in Jinher OA 1.0. Affected is an unknown function of the file /jc6/platform/sys/login!changePassWord.action of the component POST… |
CVE-2025-9930 | High | 7.3 | 2025-09-04 | A security vulnerability has been detected in 1000projects Beauty Parlour Management System 1.0. This impacts an unknown function of the file /admin/contact-us… |
CVE-2025-9929 | Low | 2.4 | 2025-09-04 | A weakness has been identified in code-projects Responsive Blog Site 1.0. This affects an unknown function of the file blogs_view.php. Executing manipulation o… |
CVE-2025-9616 | Medium | 5.3 | 2025-09-04 | The PopAd plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect non… |
CVE-2025-9519 | High | 7.2 | 2025-09-04 | The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due… |
CVE-2025-9518 | High | 7.2 | 2025-09-04 | The atec Debug plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation on the 'debug_path' parameter in all vers… |
CVE-2025-9517 | High | 7.2 | 2025-09-04 | The atec Debug plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 1.2.22 via the 'custom_log' parameter. This is… |
CVE-2025-9516 | Medium | 4.9 | 2025-09-04 | The atec Debug plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.22 via the 'custom_log' parameter. This make… |
CVE-2025-9467 | | 2025-09-04 | When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affe… | |
CVE-2025-6984 | High | 7.5 | 2025-09-04 | The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing… |
CVE-2025-6085 | High | 7.2 | 2025-09-04 | The Make Connector plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'upload_media' function in all… |
CVE-2025-58358 | High | 7.5 | 2025-09-04 | Markdownify is a Model Context Protocol server for converting almost anything to Markdown. Versions below 0.0.2 contain a command injection vulnerability, caus… |
CVE-2025-58357 | Critical | 9.6 | 2025-09-04 | 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Version 0.13.2 contains a vulnerability in the chat page'… |
CVE-2025-58355 | High | 7.7 | 2025-09-04 | Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled… |
CVE-2025-58064 | | 2025-09-04 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 throug… | |
CVE-2025-58057 | High | 7.5 | 2025-09-04 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty… |
CVE-2025-43772 | | 2025-09-04 | Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict t… | |
CVE-2025-36909 | Medium | 5.3 | 2025-09-04 | Information disclosure |
CVE-2025-36908 | Medium | 6.7 | 2025-09-04 | In lwis_top_register_io of lwis_device_top.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of… |
CVE-2025-36907 | High | 7.3 | 2025-09-04 | In draw_surface_image() of abl/android/lib/draw/draw.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalat… |
CVE-2025-36906 | High | 7.8 | 2025-09-04 | In ConvertReductionOp of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escala… |
CVE-2025-36905 | High | 7.8 | 2025-09-04 | In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privi… |
CVE-2025-36904 | Critical | 9.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384. |
CVE-2025-36903 | High | 7.8 | 2025-09-04 | In lwis_io_buffer_write, there is a possible OOB read/write due to improper input validation. This could lead to local escalation of privilege with no addition… |
CVE-2025-36902 | Medium | 6.7 | 2025-09-04 | In syna_cdev_ioctl_store_pid() of syna_tcm2_sysfs.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation… |
CVE-2025-36901 | High | 8.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223. |
CVE-2025-36900 | Medium | 6.7 | 2025-09-04 | In lwis_test_register_io of lwis_device_test.c, there is a possible OOB Write due to an integer overflow. This could lead to local escalation of privilege with… |
CVE-2025-36899 | High | 8.4 | 2025-09-04 | There is a possible escalation of privilege due to test/debugging code left in a production build. This could lead to physical escalation of privilege with no… |
CVE-2025-36898 | High | 7.8 | 2025-09-04 | There is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution pri… |
CVE-2025-36897 | Critical | 9.8 | 2025-09-04 | In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no… |
CVE-2025-36896 | Critical | 9.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106. |
CVE-2025-36895 | High | 7.5 | 2025-09-04 | Information disclosure |
CVE-2025-36894 | High | 7.5 | 2025-09-04 | In TBD of TBD, there is a possible DoS due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed… |
CVE-2025-36893 | Medium | 5.5 | 2025-09-04 | In ReadTachyonCommands of gxp_main_actor.cc, there is a possible information leak due to uninitialized data. This could lead to local information disclosure wi… |
CVE-2025-36892 | High | 7.5 | 2025-09-04 | Denial of service |
CVE-2025-36891 | High | 8.8 | 2025-09-04 | Elevation of privilege |
CVE-2025-36890 | Critical | 9.8 | 2025-09-04 | Elevation of Privilege |
CVE-2025-36887 | High | 7.8 | 2025-09-04 | In wl_cfgscan_update_v3_schedscan_results() of wl_cfgscan.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to loca… |
CVE-2025-2417 | High | 8.6 | 2025-09-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft e-Mutabakat allows Authentication Bypass. This issue affects e-Mutabakat… |
CVE-2025-2411 | High | 8.6 | 2025-09-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft TaskPano allows Authentication Bypass. This issue affects TaskPano: from s… |
CVE-2025-9928 | High | 7.3 | 2025-09-03 | A security flaw has been discovered in projectworlds Travel Management System 1.0. The impacted element is an unknown function of the file /viewcategory.php. P… |
CVE-2025-9927 | High | 7.3 | 2025-09-03 | A vulnerability was identified in projectworlds Travel Management System 1.0. The affected element is an unknown function of the file /viewpackage.php. Such ma… |
CVE-2025-8268 | Medium | 6.5 | 2025-09-03 | The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the rest_list and delete_files fu… |
CVE-2025-58056 | High | 7.5 | 2025-09-03 | Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions… |
CVE-2025-57833 | High | 7.1 | 2025-09-03 | An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, u… |
CVE-2025-55748 | High | 7.5 | 2025-09-03 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configura… |
CVE-2025-55747 | Critical | 9.1 | 2025-09-03 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configur… |
CVE-2025-9926 | High | 7.3 | 2025-09-03 | A vulnerability was determined in projectworlds Travel Management System 1.0. Impacted is an unknown function of the file /viewsubcategory.php. This manipulati… |
CVE-2025-9925 | High | 7.3 | 2025-09-03 | A vulnerability was found in projectworlds Travel Management System 1.0. This issue affects some unknown processing of the file /detail.php. The manipulation o… |
CVE-2025-9365 | High | 7.8 | 2025-09-03 | Fuji Electric FRENIC-Loader 4 is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacke… |
CVE-2025-56139 | Medium | 5.3 | 2025-09-03 | LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original… |
CVE-2025-55162 | Medium | 6.3 | 2025-09-03 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1… |
CVE-2025-53690 | Critical | 9.0 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects… |
CVE-2025-9924 | High | 7.3 | 2025-09-03 | A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /enquiry.php. The manipulatio… |
CVE-2025-9923 | Medium | 4.3 | 2025-09-03 | A flaw has been found in Campcodes Sales and Inventory System 1.0. This affects an unknown part of the file /index.php. Executing manipulation of the argument… |
CVE-2025-36193 | High | 8.4 | 2025-09-03 | IBM Transformation Advisor 2.0.1 through 4.3.1 incorrectly assigns privileges to security critical files which could allow a local root escalation inside a con… |
CVE-2025-56803 | High | 8.4 | 2025-09-03 | Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands… |
CVE-2025-56752 | Critical | 9.4 | 2025-09-03 | A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanisms, providing them w… |
CVE-2025-52494 | High | 7.5 | 2025-09-03 | Adacore Ada Web Server (AWS) before 25.2 is vulnerable to a denial-of-service (DoS) condition due to improper handling of SSL handshakes during connection init… |
CVE-2025-45805 | High | 7.6 | 2025-09-03 | In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile name. This payload… |
CVE-2025-20336 | Medium | 5.3 | 2025-09-03 | A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an un… |
CVE-2025-20335 | Medium | 5.3 | 2025-09-03 | A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an un… |
CVE-2025-20330 | Medium | 6.1 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an un… |
CVE-2025-20328 | Medium | 5.4 | 2025-09-03 | A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privileges to conduct a cro… |
CVE-2025-20326 | Medium | 4.3 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edi… |
CVE-2025-20291 | Medium | 4.3 | 2025-09-03 | A vulnerability in Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to redirect a targeted Webex Meetings user to an untrusted websi… |
CVE-2025-20287 | Medium | 4.3 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to upl… |
CVE-2025-20280 | Medium | 4.8 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authen… |
CVE-2025-20270 | Medium | 4.3 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authen… |
CVE-2025-9959 | High | 7.6 | 2025-09-03 | Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smolagents. The attack… |
CVE-2025-9922 | Medium | 4.3 | 2025-09-03 | A security vulnerability has been detected in Campcodes Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-9921 | Low | 2.4 | 2025-09-03 | A weakness has been identified in code-projects POS Pharmacy System 1.0. Affected is an unknown function of the file /main/products.php. This manipulation of t… |
CVE-2025-9867 | Medium | 5.4 | 2025-09-03 | Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTM… |
CVE-2025-9866 | High | 8.8 | 2025-09-03 | Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HT… |
CVE-2025-9865 | Medium | 5.4 | 2025-09-03 | Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-56761 | Medium | 5.4 | 2025-09-03 | Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the cont… |
CVE-2025-56760 | Medium | 4.3 | 2025-09-03 | When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in t… |
CVE-2025-56689 | Medium | 4.6 | 2025-09-03 | One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass… |
CVE-2025-9920 | Medium | 4.7 | 2025-09-03 | A security flaw has been discovered in Campcodes Recruitment Management System 1.0. This impacts the function include of the file /admin/index.php. The manipul… |
CVE-2025-9919 | High | 7.3 | 2025-09-03 | A vulnerability was identified in 1000projects Beauty Parlour Management System 1.0. This affects an unknown function of the file /admin/bwdates-reports-detail… |
CVE-2025-56498 | Medium | 5.3 | 2025-09-03 | An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user in… |
CVE-2025-56435 | Medium | 5.3 | 2025-09-03 | SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBackup.php and the operation on t… |
CVE-2025-55944 | Medium | 6.1 | 2025-09-03 | Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. When a user views the shared image in a new browser tab, the embedded JavaScript… |