2025 CVEs (page 200)
Page 200 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9664 | Medium | 6.3 | 2025-08-29 | A security flaw has been discovered in code-projects Simple Grading System 1.0. Affected is an unknown function of the file /add_student_grade.php of the compo… |
CVE-2025-9663 | Medium | 6.3 | 2025-08-29 | A vulnerability was identified in code-projects Simple Grading System 1.0. This impacts an unknown function of the file /edit_account.php of the component Admi… |
CVE-2025-9662 | High | 7.3 | 2025-08-29 | A vulnerability was determined in code-projects Simple Grading System 1.0. This affects an unknown function of the file /login.php of the component Admin Panel… |
CVE-2025-9660 | High | 7.3 | 2025-08-29 | A vulnerability was found in SourceCodester Bakeshop Online Ordering System 1.0. The impacted element is an unknown function of the file /passwordrecover.php… |
CVE-2025-55763 | High | 7.5 | 2025-08-29 | Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request… |
CVE-2025-55580 | Medium | 5.4 | 2025-08-29 | SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can inject JavaScript th… |
CVE-2025-55579 | Medium | 5.4 | 2025-08-29 | SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality. The vulnerability is fixed in version 2.3… |
CVE-2025-29879 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29878 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29875 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29874 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-22483 | Medium | 4.8 | 2025-08-29 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator acco… |
CVE-2025-9659 | Low | 3.5 | 2025-08-29 | A vulnerability has been found in O2OA up to 10.0-410. The affected element is an unknown function of the file /x_portal_assemble_designer/jaxrs/widget of the… |
CVE-2025-9658 | Low | 3.5 | 2025-08-29 | A flaw has been found in O2OA up to 10.0-410. Impacted is an unknown function of the file /x_portal_assemble_designer/jaxrs/dict/ of the component Personal Pro… |
CVE-2025-9657 | Low | 3.5 | 2025-08-29 | A vulnerability was detected in O2OA up to 10.0-410. This issue affects some unknown processing of the file /x_program_center/jaxrs/script of the component Per… |
CVE-2025-9656 | Medium | 4.3 | 2025-08-29 | A security vulnerability has been detected in PHPGurukul Directory Management System 2.0. This vulnerability affects unknown code of the file /admin/add-direct… |
CVE-2025-5808 | | 2025-08-29 | Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Authentication Bypass.This issue affects Self Service Password Reset fro… | |
CVE-2025-55750 | Medium | 6.5 | 2025-08-29 | Gitpod is a developer platform for cloud development environments. In versions before main-gha.33628 for both Gitpod Classic and Gitpod Classic Enterprise, OAu… |
CVE-2025-55202 | Medium | 5.3 | 2025-08-29 | Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protec… |
CVE-2025-55177 | Medium | 5.4 | 2025-08-29 | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsAp… |
CVE-2025-54877 | Medium | 5.3 | 2025-08-29 | Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition versions before 16.10.99… |
CVE-2025-47909 | High | 7.3 | 2025-08-29 | Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-202… |
CVE-2025-9655 | Low | 3.5 | 2025-08-29 | A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_organization_assemble_control/jaxrs/person/ of the component… |
CVE-2025-9654 | Medium | 6.3 | 2025-08-29 | A security flaw has been discovered in AiondaDotCom mcp-ssh up to 1.0.3. Affected by this issue is some unknown functionality of the file server-simple.mjs. Pe… |
CVE-2025-9653 | Low | 3.5 | 2025-08-29 | A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_proje… |
CVE-2025-9652 | Low | 3.5 | 2025-08-29 | A vulnerability was determined in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /intranet/educar_transferencia_tipo_cad.php of th… |
CVE-2025-55304 | Medium | 5.5 | 2025-08-29 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Ex… |
CVE-2025-54080 | Medium | 5.5 | 2025-08-29 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in… |
CVE-2025-9651 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in shafhasan chatbox up to 156a39cde62f78532c3265a70eda12c70907e56f. This impacts an unknown function of the file /chat.php. The mani… |
CVE-2025-9650 | Medium | 5.4 | 2025-08-29 | A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This affects the function removeFileByPath of the file src/m… |
CVE-2025-9649 | Low | 3.3 | 2025-08-29 | A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calc_sleep_time of the file send_packets.c. Such manipulation l… |
CVE-2025-9647 | Medium | 4.3 | 2025-08-29 | A weakness has been identified in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/role/list. This manipulation of the ar… |
CVE-2025-9646 | Low | 3.5 | 2025-08-29 | A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_organization_assemble_personal/jaxrs/definit… |
CVE-2025-9645 | High | 7.3 | 2025-08-29 | A vulnerability was identified in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /t_dashboard/r_all_info.php. The manip… |
CVE-2025-9644 | High | 7.3 | 2025-08-29 | A vulnerability was determined in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /setting/bill_… |
CVE-2025-9643 | High | 7.3 | 2025-08-29 | A vulnerability was found in itsourcecode Apartment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /setting/util… |
CVE-2025-40709 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40708 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40707 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40706 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40705 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40704 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40703 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40702 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-9217 | Medium | 6.5 | 2025-08-29 | The Slider Revolution plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.7.36 via the 'used_svg' and 'used_images' pa… |
CVE-2025-9071 | | 2025-08-29 | Erroneously using an all-zero seed for RSA-OEAP padding instead of the generated random bytes, in Oberon microsystems AG’s Oberon PSA Crypto library in all ver… | |
CVE-2025-7383 | | 2025-08-29 | Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 1.5.1 allows an attacker to r… | |
CVE-2025-7071 | | 2025-08-29 | Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.1.0 and prior to 3.9.2 allows an attacker to recover pla… | |
CVE-2025-4644 | | 2025-08-29 | A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new a… | |
CVE-2025-4643 | | 2025-08-29 | Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to fr… | |
CVE-2025-8150 | Medium | 6.4 | 2025-08-29 | The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter and Countdown widgets in all versi… |
CVE-2025-54777 | Medium | 4.3 | 2025-08-29 | Uncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it may cause a denial-of… |
CVE-2025-9441 | Medium | 6.5 | 2025-08-29 | The iATS Online Forms plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order' parameter in all versions up to, and including, 1.2 due to… |
CVE-2025-9374 | Medium | 4.3 | 2025-08-29 | The Ultimate Tag Warrior Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to mi… |
CVE-2025-8619 | Medium | 6.4 | 2025-08-29 | The OSM Map Widget for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map Block URL in all versions up to, and in… |
CVE-2025-8290 | Medium | 6.4 | 2025-08-29 | The List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.0.6 due t… |
CVE-2025-8147 | Medium | 4.3 | 2025-08-29 | The LWSCache plugin for WordPress is vulnerable to unauthorized modification of data due to improper authorization on the lwscache_activatePlugin() function in… |
CVE-2025-53508 | High | 7.2 | 2025-08-29 | Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed and sensitive in… |
CVE-2025-53507 | Medium | 6.5 | 2025-08-29 | Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information vulnerability. If exploited, configuration information, such as… |
CVE-2025-9639 | High | 7.5 | 2025-08-29 | The QbiCRMGateway developed by Ai3 has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to… |
CVE-2025-9619 | Medium | 5.3 | 2025-08-29 | A security flaw has been discovered in E4 Sistemas Mercatus ERP 2.00.019. The affected element is an unknown function of the file /basico/webservice/imprimir-d… |
CVE-2025-9610 | High | 7.3 | 2025-08-29 | A vulnerability was determined in code-projects Online Event Judging System 1.0. This issue affects some unknown processing of the file /create_account.php. Th… |
CVE-2025-9609 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results… |
CVE-2025-8861 | Critical | 9.8 | 2025-08-29 | TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents. |
CVE-2025-8858 | High | 7.5 | 2025-08-29 | Clinic Image System developed by Changing has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read… |
CVE-2025-8857 | Critical | 9.8 | 2025-08-29 | Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system using administrator… |
CVE-2025-9608 | Medium | 6.3 | 2025-08-29 | A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/view of the component Formula d… |
CVE-2025-9607 | Medium | 6.3 | 2025-08-29 | A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/TabelaArredondamento/view of… |
CVE-2025-9606 | Medium | 6.3 | 2025-08-29 | A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_prefere… |
CVE-2025-9605 | Critical | 9.8 | 2025-08-29 | A security vulnerability has been detected in Tenda AC21 and AC23 16.03.08.16. Affected is the function GetParentControlInfo of the file /goform/GetParentContr… |
CVE-2025-58323 | High | 7.7 | 2025-08-29 | NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by executing arbitrary files due to imp… |
CVE-2025-39247 | High | 8.6 | 2025-08-29 | There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission. |
CVE-2025-39246 | Medium | 5.3 | 2025-08-29 | There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated user to potentially enable escalation of… |
CVE-2025-39245 | Medium | 4.7 | 2025-08-29 | There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV da… |
CVE-2025-9604 | Low | 3.7 | 2025-08-29 | A vulnerability was identified in coze-studio up to 0.2.4. The impacted element is an unknown function of the file backend/domain/plugin/encrypt/aes.go. The ma… |
CVE-2025-9603 | Medium | 6.3 | 2025-08-29 | A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4. The affected element is an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg. E… |
CVE-2025-9602 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in impro… |
CVE-2025-9601 | High | 7.3 | 2025-08-29 | A vulnerability was detected in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /setting/employee_salary_setup.php. The… |
CVE-2025-9600 | High | 7.3 | 2025-08-29 | A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /s… |
CVE-2025-9599 | High | 7.3 | 2025-08-29 | A weakness has been identified in itsourcecode Apartment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /setting… |
CVE-2025-54142 | Medium | 4.0 | 2025-08-29 | Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within t… |
CVE-2025-43284 | Medium | 5.5 | 2025-08-29 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app… |
CVE-2025-43268 | High | 7.8 | 2025-08-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A malicious app may be able to gain root privileges. |
CVE-2025-43255 | Low | 3.3 | 2025-08-29 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app… |
CVE-2025-43187 | High | 7.8 | 2025-08-29 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. Running an hdiu… |
CVE-2025-40927 | High | 7.3 | 2025-08-29 | CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple tha… |
CVE-2025-9598 | High | 7.3 | 2025-08-29 | A security flaw has been discovered in itsourcecode Apartment Management System 1.0. Affected is an unknown function of the file /setting/year_setup.php. Perfo… |
CVE-2025-9597 | High | 7.3 | 2025-08-29 | A vulnerability was identified in itsourcecode Apartment Management System 1.0. This impacts an unknown function of the file /o_dashboard/rented_all_info.php… |
CVE-2025-9596 | High | 7.3 | 2025-08-29 | A vulnerability was determined in itsourcecode Sports Management System 1.0. This affects an unknown function of the file /login.php. This manipulation of the… |
CVE-2025-9595 | Medium | 4.3 | 2025-08-29 | A vulnerability was found in code-projects Student Information Management System 1.0. The impacted element is an unknown function of the file /login.php. The m… |
CVE-2025-48979 | Low | 3.4 | 2025-08-29 | An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access. |
CVE-2025-9594 | High | 7.3 | 2025-08-28 | A vulnerability has been found in itsourcecode Apartment Management System 1.0. The affected element is an unknown function of the file /report/complain_info.p… |
CVE-2025-9593 | High | 7.3 | 2025-08-28 | A flaw has been found in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /report/unit_status_info.php. Executing mani… |
CVE-2025-58062 | | 2025-08-28 | LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp developer. Prior to version 0.1.12, when users on a Windows platform connect to an attacker controlle… | |
CVE-2025-9592 | High | 7.3 | 2025-08-28 | A vulnerability was detected in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /report/bill_info.php. Per… |
CVE-2025-9591 | Low | 2.4 | 2025-08-28 | A security vulnerability has been detected in ZrLog up to 3.1.5. This vulnerability affects unknown code of the file /api/admin/template/config of the componen… |
CVE-2025-9590 | Low | 3.5 | 2025-08-28 | A vulnerability was identified in Weaver E-Mobile Mobile Management Platform up to 20250813. Affected by this vulnerability is an unknown functionality. The ma… |
CVE-2025-9589 | Low | 2.5 | 2025-08-28 | A vulnerability was determined in Cudy WR1200EA 2.3.7-20250113-121810. Affected is an unknown function of the file /etc/shadow. Executing manipulation can lead… |
CVE-2025-58061 | Medium | 5.5 | 2025-08-28 | OpenEBS Local PV RawFile allows dynamic deployment of Stateful Persistent Node-Local Volumes & Filesystems for Kubernetes. Prior to version 0.10.0, persistent… |
CVE-2025-58058 | Medium | 5.3 | 2025-08-28 | xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte s… |