2025 CVEs (page 197)
Page 197 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55852 | High | 7.5 | 2025-09-03 | Tenda AC8 v16.03.34.06 is vulnerable to Buffer Overflow in the formWifiBasicSet function via the parameter security or security_5g. |
CVE-2025-0280 | High | 7.5 | 2025-09-03 | A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access. |
CVE-2025-9824 | Medium | 5.9 | 2025-09-03 | ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after whi… |
CVE-2025-9823 | | 2025-09-03 | SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs beca… | |
CVE-2025-58644 | High | 7.2 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes - TQL Edition ltl-freight-quotes-tql-edition allows Object Injection.Th… |
CVE-2025-58643 | High | 7.2 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Daylight Edition ltl-freight-quotes-daylight-edition allows Object In… |
CVE-2025-58642 | High | 7.2 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Day & Ross Edition ltl-freight-quotes-day-ross-edition allows Object… |
CVE-2025-58641 | Medium | 5.4 | 2025-09-03 | Server-Side Request Forgery (SSRF) vulnerability in kamleshyadav Exit Intent Popup exitintentpopup allows Server Side Request Forgery.This issue affects Exit I… |
CVE-2025-58640 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Document Engine document-engine allows Store… |
CVE-2025-58639 | Medium | 5.4 | 2025-09-03 | Missing Authorization vulnerability in Ali Khallad Contact Form By Mega Forms mega-forms allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-58637 | High | 7.5 | 2025-09-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in immonex immonex Kickstart immonex-kick… |
CVE-2025-58635 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-58634 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in peachpay PeachPay Payments peachpay-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-58633 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Stor… |
CVE-2025-58632 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dadevarzan Dadevarzan WordPress Common dadevarzan-common… |
CVE-2025-58631 | Medium | 5.9 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 IssueM issuem allows DOM-Based XSS.This issue aff… |
CVE-2025-58630 | Medium | 5.9 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer Simple Matomo Tracking Code simple-matomo-tracking-… |
CVE-2025-58626 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-c… |
CVE-2025-58625 | Medium | 5.9 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored X… |
CVE-2025-58624 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falselight Exchange Rates exchange-rates allows Stored XS… |
CVE-2025-58623 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bohemia Plugins Event Feed for Eventbrite event-feed-for-… |
CVE-2025-58622 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in yydevelopment Mobile Contact Line mobile-contact-line allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-58621 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amuse Labs PuzzleMe for WordPress puzzleme allows Stored… |
CVE-2025-58620 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Stored… |
CVE-2025-58618 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar allows DOM-Ba… |
CVE-2025-58617 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in FAKTOR VIER F4 Media Taxonomies f4-media-taxonomies allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-58616 | Medium | 6.5 | 2025-09-03 | Missing Authorization vulnerability in Frisbii Frisbii Pay reepay-checkout-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58615 | Medium | 4.4 | 2025-09-03 | Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Server Side Request Forgery.This issue affects WP Banneri… |
CVE-2025-58614 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows… |
CVE-2025-58613 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-58612 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS… |
CVE-2025-58611 | Medium | 4.3 | 2025-09-03 | Cross-Site Request Forgery (CSRF) vulnerability in Tickera Tickera tickera-event-ticketing-system allows Cross Site Request Forgery.This issue affects Tickera… |
CVE-2025-58610 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery all… |
CVE-2025-58609 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode a… |
CVE-2025-58608 | High | 7.5 | 2025-09-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows… |
CVE-2025-58607 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA… |
CVE-2025-58606 | Medium | 5.0 | 2025-09-03 | Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-58605 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored… |
CVE-2025-58604 | High | 7.6 | 2025-09-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This i… |
CVE-2025-58603 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfe… |
CVE-2025-58602 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalizati… |
CVE-2025-58601 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-58600 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-58599 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Con… |
CVE-2025-58598 | Medium | 6.6 | 2025-09-03 | Insertion of Sensitive Information Into Debugging Code vulnerability in Klarna Klarna Order Management for WooCommerce klarna-order-management-for-woocommerce… |
CVE-2025-58597 | Medium | 4.3 | 2025-09-03 | Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-58596 | Medium | 5.9 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin mailoptin allows Stored XSS.This… |
CVE-2025-58594 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Briz… |
CVE-2025-58593 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allo… |
CVE-2025-58460 | Medium | 4.2 | 2025-09-03 | A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an at… |
CVE-2025-58459 | Medium | 4.3 | 2025-09-03 | Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/… |
CVE-2025-58458 | Medium | 4.3 | 2025-09-03 | In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path… |
CVE-2025-57151 | High | 8.8 | 2025-09-03 | phpgurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/userprofile.php via the fullname parameter. |
CVE-2025-57150 | High | 7.2 | 2025-09-03 | phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/subcategory.php via the categoryName parameter. |
CVE-2025-57149 | Medium | 6.5 | 2025-09-03 | phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid parameter. |
CVE-2025-57148 | Critical | 9.1 | 2025-09-03 | phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension validation. |
CVE-2025-57147 | High | 7.5 | 2025-09-03 | A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. The vulnerability is due to lack of input validation of multiple paramet… |
CVE-2025-57146 | High | 8.1 | 2025-09-03 | phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter. |
CVE-2025-57052 | Critical | 9.8 | 2025-09-03 | cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass a… |
CVE-2025-56608 | Medium | 4.2 | 2025-09-03 | The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest… |
CVE-2025-9822 | Medium | 5.5 | 2025-09-03 | SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn a… |
CVE-2025-47421 | | 2025-09-03 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This is… | |
CVE-2025-2416 | High | 8.6 | 2025-09-03 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft LimonDesk allows Authentication Bypass. This issue affects LimonDesk: from… |
CVE-2025-26210 | High | 8.8 | 2025-09-03 | DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parti… |
CVE-2025-0878 | Medium | 4.7 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft LimonDesk allows Cross-Site Scripting (XS… |
CVE-2025-9901 | Medium | 5.9 | 2025-09-03 | A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that re… |
CVE-2025-53694 | High | 7.5 | 2025-09-03 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This i… |
CVE-2025-53693 | Critical | 9.8 | 2025-09-03 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experie… |
CVE-2025-53691 | High | 8.8 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This… |
CVE-2025-3701 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner wp-malware-removal allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-38678 | High | 7.8 | 2025-09-03 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject duplicate device on updates A chain/flowtable update with du… |
CVE-2025-41000 | | 2025-09-03 | Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users… | |
CVE-2025-9821 | Low | 2.7 | 2025-09-03 | SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also d… |
CVE-2025-9219 | Medium | 4.3 | 2025-09-03 | The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin fo… |
CVE-2025-2415 | High | 8.6 | 2025-09-03 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass. This issue affects MyRezzta: from s… |
CVE-2025-1740 | Critical | 9.8 | 2025-09-03 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, Brut… |
CVE-2025-9817 | High | 7.8 | 2025-09-03 | SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service |
CVE-2025-9378 | Medium | 6.4 | 2025-09-03 | The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie… |
CVE-2025-8663 | Medium | 6.5 | 2025-09-03 | Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects… |
CVE-2025-58210 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-58272 | Low | 3.7 | 2025-09-03 | Cross-site request forgery vulnerability exists in Web Caster V130 versions 1.08 and earlier. If a logged-in user views a malicious page created by an attacker… |
CVE-2025-21041 | Medium | 6.2 | 2025-09-03 | Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attackers to access sensitive information. |
CVE-2025-21040 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by ExternalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary information. |
CVE-2025-21039 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by SystemExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary informat… |
CVE-2025-21038 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by SamsungExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary informa… |
CVE-2025-21037 | Medium | 4.1 | 2025-09-03 | Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. User interaction is… |
CVE-2025-21036 | Medium | 5.0 | 2025-09-03 | Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exported note files. User interaction is requir… |
CVE-2025-21035 | Medium | 4.6 | 2025-09-03 | Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers to access data acro… |
CVE-2025-21034 | Medium | 4.0 | 2025-09-03 | Out-of-bounds write in libsavsvc.so prior to SMR Sep-2025 Release 1 allows local attackers to potentially execute arbitrary code. |
CVE-2025-21033 | Medium | 4.0 | 2025-09-03 | Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-21032 | Medium | 5.9 | 2025-09-03 | Improper access control in One UI Home prior to SMR Sep-2025 Release 1 allows physical attackers to bypass Kiosk mode under limited conditions. |
CVE-2025-21031 | Medium | 6.8 | 2025-09-03 | Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs. |
CVE-2025-21030 | Medium | 4.3 | 2025-09-03 | Improper handling of insufficient permission in AppPrelaunchManagerService prior to SMR Sep-2025 Release 1 in Chinese Android 15 allows local attackers to exec… |
CVE-2025-21029 | Medium | 4.0 | 2025-09-03 | Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies to messages from the… |
CVE-2025-21028 | Medium | 5.5 | 2025-09-03 | Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items. |
CVE-2025-21027 | Medium | 5.1 | 2025-09-03 | Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to temporarily disable the SIM. |
CVE-2025-21026 | Medium | 4.0 | 2025-09-03 | Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to interrupt the call. |
CVE-2025-21025 | Medium | 5.1 | 2025-09-03 | Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded from background execution management. |
CVE-2025-9785 | | 2025-09-03 | PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management. When the component is de… | |
CVE-2025-58351 | Medium | 6.8 | 2025-09-03 | Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file… |