2025 CVEs (page 20)
Page 20 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11950 | Medium | 6.3 | 2026-02-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KNOWHY Advanced Technology Trading Ltd. Co. EduAsi… |
CVE-2025-11252 | Critical | 9.8 | 2026-02-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm… |
CVE-2025-11251 | Critical | 9.8 | 2026-02-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platf… |
CVE-2025-14142 | Medium | 6.4 | 2026-02-27 | The Electric Enquiries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button' parameter of the electric-enquiry shortcode in all ve… |
CVE-2025-12150 | Low | 3.1 | 2026-02-27 | A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register… |
CVE-2025-9909 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of mi… |
CVE-2025-9908 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain… |
CVE-2025-9907 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive clien… |
CVE-2025-9572 | Medium | 5.0 | 2026-02-27 | n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which corr… |
CVE-2025-13327 | Medium | 6.3 | 2026-02-27 | A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zi… |
CVE-2025-15567 | Low | 3.3 | 2026-02-27 | Insufficient protection mechanisms in the Health Module may lead to partial information disclosure. |
CVE-2025-15509 | Medium | 4.3 | 2026-02-27 | The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage. |
CVE-2025-14149 | Medium | 6.4 | 2026-02-27 | The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link… |
CVE-2025-14040 | Medium | 6.4 | 2026-02-27 | The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Call to Action' custom fields in all… |
CVE-2025-12981 | Critical | 9.8 | 2026-02-27 | The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This is due to a broken validation check in t… |
CVE-2025-40932 | High | 8.2 | 2026-02-27 | Apache::SessionX versions through 2.01 for Perl create insecure session id. Apache::SessionX generates session ids insecurely. The default session id generato… |
CVE-2025-50857 | Critical | 9.8 | 2026-02-26 | ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a craft… |
CVE-2025-71057 | High | 8.2 | 2026-02-26 | Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing th… |
CVE-2025-56605 | Medium | 5.4 | 2026-02-26 | A reflected Cross-Site Scripting (XSS) vulnerability exists in the register.php backend script of PuneethReddyHC Event Management System 1.0. The mobile POST p… |
CVE-2025-14343 | High | 7.6 | 2026-02-26 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology Ltd. E-Commerce Product allow… |
CVE-2025-64999 | Medium | 5.4 | 2026-02-26 | Improper neutralization of input in Checkmk versions 2.4.0 before 2.4.0p22, and 2.3.0 before 2.3.0p43 allows an attacker that can manipulate a host's check out… |
CVE-2025-14511 | High | 7.5 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allow… |
CVE-2025-3525 | Medium | 6.5 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have, under… |
CVE-2025-14103 | Medium | 4.3 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allow… |
CVE-2025-69771 | Critical | 9.6 | 2026-02-25 | Cross-Site Scripting (XSS) vulnerability in the subtitle loading function of the asbplayer Chrome Extension version 1.14.0 allows attackers to execute arbitrar… |
CVE-2025-50180 | High | 7.5 | 2026-02-25 | esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to… |
CVE-2025-1242 | Critical | 9.1 | 2026-02-25 | The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineer… |
CVE-2025-67860 | Low | 3.8 | 2026-02-25 | A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller credentials as command-line arguments, p… |
CVE-2025-67601 | High | 8.3 | 2026-02-25 | A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login… |
CVE-2025-62878 | Critical | 9.9 | 2026-02-25 | A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensiti… |
CVE-2025-14742 | Medium | 4.3 | 2026-02-25 | The WP Recipe Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_search_recipes' and 'ajax_… |
CVE-2025-11563 | Medium | 4.6 | 2026-02-25 | URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly a… |
CVE-2025-0976 | Medium | 4.7 | 2026-02-25 | Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager.This issue affects Hitachi Ops Center API Con… |
CVE-2025-5781 | Medium | 5.2 | 2026-02-25 | Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager, Hitachi Device Manager allows Session Hijack… |
CVE-2025-69231 | High | 8.7 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a stored cross-site scripting… |
CVE-2025-68277 | Medium | 5.0 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link is sent via Secure… |
CVE-2025-67752 | High | 8.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper… |
CVE-2025-67491 | Medium | 5.4 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions 5.0.0.5 through 7.0.3.4 have a stored cross-s… |
CVE-2025-46320 | Medium | 6.1 | 2026-02-24 | A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerabi… |
CVE-2025-33181 | High | 7.3 | 2026-02-24 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit… |
CVE-2025-33180 | High | 8.0 | 2026-02-24 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit… |
CVE-2025-33179 | High | 8.0 | 2026-02-24 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could run an unauthorized command. A successf… |
CVE-2025-1789 | High | 7.8 | 2026-02-24 | Local privilege escalation in Genetec Update Service. An authenticated, low-privileged, Windows user could exploit this vulnerability to gain elevated privileg… |
CVE-2025-1787 | Medium | 4.2 | 2026-02-24 | Local admin could to leak information from the Genetec Update Service configuration web page. An authenticated, admin privileged, Windows user could exploit th… |
CVE-2025-62512 | Medium | 5.3 | 2026-02-24 | Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo… |
CVE-2025-14963 | High | 7.8 | 2026-02-24 | A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges… |
CVE-2025-13776 | High | 7.1 | 2026-02-24 | Multiple Finka programs use hard-coded Firebird database credentials (shared across all instances of this software). A malicious attacker in local network who… |
CVE-2025-69985 | Critical | 9.8 | 2026-02-24 | FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-hel… |
CVE-2025-63409 | High | 8.8 | 2026-02-24 | Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated users to modify administrator only settings and ext… |
CVE-2025-47904 | Medium | 4.1 | 2026-02-24 | Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider… |
CVE-2025-67445 | High | 7.5 | 2026-02-24 | TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI reads the CONTENT_LENGTH environment variab… |
CVE-2025-10010 | Medium | 6.8 | 2026-02-24 | The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows pa… |
CVE-2025-14577 | Critical | 9.8 | 2026-02-24 | Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sendin… |
CVE-2025-27555 | Medium | 6.5 | 2026-02-24 | Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they shou… |
CVE-2025-11165 | Critical | 9.9 | 2026-02-24 | A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class… |
CVE-2025-40541 | Critical | 9.1 | 2026-02-24 | An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as… |
CVE-2025-40540 | Critical | 9.1 | 2026-02-24 | A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged accoun… |
CVE-2025-40539 | Critical | 9.1 | 2026-02-24 | A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged accoun… |
CVE-2025-40538 | Critical | 9.1 | 2026-02-24 | A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbi… |
CVE-2025-15589 | Low | 3.8 | 2026-02-24 | A vulnerability was determined in MuYuCMS 2.7. Affected is the function delete_dir_file of the file application/admin/controller/Template.php of the component… |
CVE-2025-15386 | High | 8.8 | 2026-02-24 | The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules tha… |
CVE-2025-13943 | High | 8.8 | 2026-02-24 | A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could a… |
CVE-2025-13942 | Critical | 9.8 | 2026-02-24 | A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to exec… |
CVE-2025-11848 | Medium | 4.9 | 2026-02-24 | A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 and the Zyxel WX310… |
CVE-2025-11847 | Medium | 4.9 | 2026-02-24 | A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX31… |
CVE-2025-11846 | Medium | 4.9 | 2026-02-24 | A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel… |
CVE-2025-11845 | Medium | 4.9 | 2026-02-24 | A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the… |
CVE-2025-9120 | | 2026-02-24 | Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Carbonite Safe Server Backup allows Code Injection. The vulnerability co… | |
CVE-2025-69253 | Medium | 5.3 | 2026-02-24 | free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of the User Data Repository are affected by… |
CVE-2025-69252 | High | 7.5 | 2026-02-24 | free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. Versions up to and includi… |
CVE-2025-69251 | Medium | 5.3 | 2026-02-24 | free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and incl… |
CVE-2025-69250 | High | 7.5 | 2026-02-24 | free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and incl… |
CVE-2025-69248 | High | 7.5 | 2026-02-23 | free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of free5GC's AMF service have a Buffer Overf… |
CVE-2025-69247 | High | 7.5 | 2026-02-23 | free5GC go-upf is the User Plane Function (UPF) implementation for 5G networks that is part of the free5GC project. Versions prior to 1.2.8 have a Heap-based B… |
CVE-2025-69232 | High | 7.5 | 2026-02-23 | free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, corresponding to free5gc smf… |
CVE-2025-69208 | Medium | 5.3 | 2026-02-23 | free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Versions prior to 1.4.1 cont… |
CVE-2025-71056 | High | 8.1 | 2026-02-23 | Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an… |
CVE-2025-70328 | High | 8.8 | 2026-02-23 | TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. The h… |
CVE-2025-70327 | Critical | 9.8 | 2026-02-23 | TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The i… |
CVE-2025-68930 | High | 7.1 | 2026-02-23 | Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/… |
CVE-2025-70329 | High | 8.0 | 2026-02-23 | TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlan… |
CVE-2025-67733 | High | 8.5 | 2026-02-23 | Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary… |
CVE-2025-63946 | High | 7.4 | 2026-02-23 | A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with e… |
CVE-2025-63945 | High | 7.4 | 2026-02-23 | A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with eleva… |
CVE-2025-61147 | Medium | 6.2 | 2026-02-23 | strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decoder_context::compute_framedrop_table(). |
CVE-2025-61146 | Medium | 4.0 | 2026-02-23 | saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c. |
CVE-2025-61145 | Medium | 5.0 | 2026-02-23 | libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c. |
CVE-2025-61144 | High | 7.3 | 2026-02-23 | libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function. |
CVE-2025-61143 | Medium | 5.5 | 2026-02-23 | libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c. |
CVE-2025-70058 | High | 7.4 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by… |
CVE-2025-70045 | High | 7.4 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in jxcore jxm master. The application disables TLS/SSL certificate validation by… |
CVE-2025-70044 | Medium | 6.5 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in fofolee uTools-quickcommand 5.0.3. |
CVE-2025-70043 | Critical | 9.1 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation… |
CVE-2025-14905 | High | 7.2 | 2026-02-23 | A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file… |
CVE-2025-69700 | High | 7.5 | 2026-02-23 | Tenda FH1203 V2.0.1.6 contains a stack-based buffer overflow vulnerability in the modify_add_client_prio function, which is reachable via the formSetClientPrio… |
CVE-2025-59873 | Medium | 5.9 | 2026-02-23 | An information exposure vulnerability exists in Vulnerability in HCL Software ZIE for Web. The application transmits sensitive session tokens and authenticat… |
CVE-2025-40986 | | 2026-02-23 | Reflected Cross-Site Scripting (XSS) vulnerability in PideTuCita. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by s… | |
CVE-2025-40701 | | 2026-02-23 | Reflected Cross-Site Scripting vulnerability in SOTESHOP, version 8.3.4. THis vulnerability allows an attacker execute JavaScript code in the victim's browser… | |
CVE-2025-41002 | | 2026-02-23 | SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete the database by s… | |
CVE-2025-14339 | Medium | 6.5 | 2026-02-21 | The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized f… |