2025 CVEs (page 201)
Page 201 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9673 | Medium | 5.3 | 2025-08-29 | A vulnerability was detected in Kakao 헤이카카오 Hey Kakao App up to 2.17.4 on Android. Affected by this vulnerability is an unknown functionality of the file Andro… |
CVE-2025-9672 | Medium | 5.3 | 2025-08-29 | A security vulnerability has been detected in Rejseplanen App up to 8.2.2. Affected is an unknown function of the file AndroidManifest.xml of the component de… |
CVE-2025-9671 | Medium | 5.3 | 2025-08-29 | A weakness has been identified in UAB Paytend App up to 2.1.9 on Android. This impacts an unknown function of the file AndroidManifest.xml of the component com… |
CVE-2025-56577 | High | 8.4 | 2025-08-29 | An issue in Evope Core v.1.1.3.20 allows a local attacker to obtain sensitive information via the use of hard coded cryptographic keys. |
CVE-2025-9670 | Medium | 5.3 | 2025-08-29 | A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown function of the file src/commonmark-rules.js. Performing manipu… |
CVE-2025-9669 | High | 7.3 | 2025-08-29 | A vulnerability has been found in Jinher OA 1.0. This issue affects some unknown processing of the file GetTreeDate.aspx. The manipulation of the argument ID l… |
CVE-2025-9667 | Medium | 6.3 | 2025-08-29 | A vulnerability was detected in code-projects Simple Grading System 1.0. This affects an unknown part of the file /delete_account.php of the component Admin Pa… |
CVE-2025-43773 | Critical | 9.1 | 2025-08-29 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 20… |
CVE-2025-9666 | Medium | 6.3 | 2025-08-29 | A security vulnerability has been detected in code-projects Simple Grading System 1.0. Affected by this issue is some unknown functionality of the file /delete… |
CVE-2025-9665 | Medium | 6.3 | 2025-08-29 | A weakness has been identified in code-projects Simple Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_student… |
CVE-2025-9377 | High | 7.2 | 2025-08-29 | The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This… |
CVE-2025-58158 | High | 8.8 | 2025-08-29 | Harness Open Source is an end-to-end developer platform with Source Control Management, CI/CD Pipelines, Hosted Developer Environments, and Artifact Registries… |
CVE-2025-52861 | | 2025-08-29 | A path traversal vulnerability has been reported to affect VioStor. If a remote attacker gains an administrator account, they can then exploit the vulnerabilit… | |
CVE-2025-52856 | Critical | 9.8 | 2025-08-29 | An improper authentication vulnerability has been reported to affect VioStor. If a remote attacker, they can then exploit the vulnerability to compromise the s… |
CVE-2025-44033 | Critical | 9.8 | 2025-08-29 | SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declaration in src/main/ja… |
CVE-2025-44015 | High | 8.4 | 2025-08-29 | A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then exploit the vulnerab… |
CVE-2025-33038 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-33037 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-33036 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-33033 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-33032 | Medium | 4.9 | 2025-08-29 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they ca… |
CVE-2025-30278 | High | 8.8 | 2025-08-29 | An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit th… |
CVE-2025-30277 | High | 8.8 | 2025-08-29 | An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit th… |
CVE-2025-30275 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-30274 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerability to launch a… |
CVE-2025-30273 | High | 8.1 | 2025-08-29 | An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can th… |
CVE-2025-30272 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerability to launch a… |
CVE-2025-30271 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exp… |
CVE-2025-30270 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exp… |
CVE-2025-30268 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they ca… |
CVE-2025-30267 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they ca… |
CVE-2025-30265 | Medium | 6.5 | 2025-08-29 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then ex… |
CVE-2025-30264 | High | 8.8 | 2025-08-29 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then… |
CVE-2025-30263 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-30262 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-30261 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-30260 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-29900 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-29899 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-29898 | Medium | 6.5 | 2025-08-29 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-29894 | High | 8.8 | 2025-08-29 | An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-29893 | High | 8.8 | 2025-08-29 | An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-29890 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-29889 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29888 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29887 | High | 7.2 | 2025-08-29 | A command injection vulnerability has been reported to affect QuRouter 2.5.1. If a remote attacker gains an administrator account, they can then exploit the vu… |
CVE-2025-29886 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29882 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they ca… |
CVE-2025-9664 | Medium | 6.3 | 2025-08-29 | A security flaw has been discovered in code-projects Simple Grading System 1.0. Affected is an unknown function of the file /add_student_grade.php of the compo… |
CVE-2025-9663 | Medium | 6.3 | 2025-08-29 | A vulnerability was identified in code-projects Simple Grading System 1.0. This impacts an unknown function of the file /edit_account.php of the component Admi… |
CVE-2025-9662 | High | 7.3 | 2025-08-29 | A vulnerability was determined in code-projects Simple Grading System 1.0. This affects an unknown function of the file /login.php of the component Admin Panel… |
CVE-2025-9660 | High | 7.3 | 2025-08-29 | A vulnerability was found in SourceCodester Bakeshop Online Ordering System 1.0. The impacted element is an unknown function of the file /passwordrecover.php… |
CVE-2025-55763 | High | 7.5 | 2025-08-29 | Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request… |
CVE-2025-55580 | Medium | 5.4 | 2025-08-29 | SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can inject JavaScript th… |
CVE-2025-55579 | Medium | 5.4 | 2025-08-29 | SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality. The vulnerability is fixed in version 2.3… |
CVE-2025-29879 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29878 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29875 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29874 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-22483 | Medium | 4.8 | 2025-08-29 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator acco… |
CVE-2025-9659 | Low | 3.5 | 2025-08-29 | A vulnerability has been found in O2OA up to 10.0-410. The affected element is an unknown function of the file /x_portal_assemble_designer/jaxrs/widget of the… |
CVE-2025-9658 | Low | 3.5 | 2025-08-29 | A flaw has been found in O2OA up to 10.0-410. Impacted is an unknown function of the file /x_portal_assemble_designer/jaxrs/dict/ of the component Personal Pro… |
CVE-2025-9657 | Low | 3.5 | 2025-08-29 | A vulnerability was detected in O2OA up to 10.0-410. This issue affects some unknown processing of the file /x_program_center/jaxrs/script of the component Per… |
CVE-2025-9656 | Medium | 4.3 | 2025-08-29 | A security vulnerability has been detected in PHPGurukul Directory Management System 2.0. This vulnerability affects unknown code of the file /admin/add-direct… |
CVE-2025-5808 | | 2025-08-29 | Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Authentication Bypass.This issue affects Self Service Password Reset fro… | |
CVE-2025-55750 | Medium | 6.5 | 2025-08-29 | Gitpod is a developer platform for cloud development environments. In versions before main-gha.33628 for both Gitpod Classic and Gitpod Classic Enterprise, OAu… |
CVE-2025-55202 | Medium | 5.3 | 2025-08-29 | Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protec… |
CVE-2025-55177 | Medium | 5.4 | 2025-08-29 | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsAp… |
CVE-2025-54877 | Medium | 5.3 | 2025-08-29 | Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition versions before 16.10.99… |
CVE-2025-47909 | High | 7.3 | 2025-08-29 | Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-202… |
CVE-2025-9655 | Low | 3.5 | 2025-08-29 | A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_organization_assemble_control/jaxrs/person/ of the component… |
CVE-2025-9654 | Medium | 6.3 | 2025-08-29 | A security flaw has been discovered in AiondaDotCom mcp-ssh up to 1.0.3. Affected by this issue is some unknown functionality of the file server-simple.mjs. Pe… |
CVE-2025-9653 | Low | 3.5 | 2025-08-29 | A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_proje… |
CVE-2025-9652 | Low | 3.5 | 2025-08-29 | A vulnerability was determined in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /intranet/educar_transferencia_tipo_cad.php of th… |
CVE-2025-55304 | Medium | 5.5 | 2025-08-29 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Ex… |
CVE-2025-54080 | Medium | 5.5 | 2025-08-29 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in… |
CVE-2025-9651 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in shafhasan chatbox up to 156a39cde62f78532c3265a70eda12c70907e56f. This impacts an unknown function of the file /chat.php. The mani… |
CVE-2025-9650 | Medium | 5.4 | 2025-08-29 | A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This affects the function removeFileByPath of the file src/m… |
CVE-2025-9649 | Low | 3.3 | 2025-08-29 | A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calc_sleep_time of the file send_packets.c. Such manipulation l… |
CVE-2025-9647 | Medium | 4.3 | 2025-08-29 | A weakness has been identified in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/role/list. This manipulation of the ar… |
CVE-2025-9646 | Low | 3.5 | 2025-08-29 | A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_organization_assemble_personal/jaxrs/definit… |
CVE-2025-9645 | High | 7.3 | 2025-08-29 | A vulnerability was identified in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /t_dashboard/r_all_info.php. The manip… |
CVE-2025-9644 | High | 7.3 | 2025-08-29 | A vulnerability was determined in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /setting/bill_… |
CVE-2025-9643 | High | 7.3 | 2025-08-29 | A vulnerability was found in itsourcecode Apartment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /setting/util… |
CVE-2025-40709 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40708 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40707 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40706 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40705 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40704 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40703 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40702 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-9217 | Medium | 6.5 | 2025-08-29 | The Slider Revolution plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.7.36 via the 'used_svg' and 'used_images' pa… |
CVE-2025-9071 | | 2025-08-29 | Erroneously using an all-zero seed for RSA-OEAP padding instead of the generated random bytes, in Oberon microsystems AG’s Oberon PSA Crypto library in all ver… | |
CVE-2025-7383 | | 2025-08-29 | Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 1.5.1 allows an attacker to r… | |
CVE-2025-7071 | | 2025-08-29 | Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.1.0 and prior to 3.9.2 allows an attacker to recover pla… | |
CVE-2025-4644 | | 2025-08-29 | A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new a… | |
CVE-2025-4643 | | 2025-08-29 | Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to fr… | |
CVE-2025-8150 | Medium | 6.4 | 2025-08-29 | The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter and Countdown widgets in all versi… |
CVE-2025-54777 | Medium | 4.3 | 2025-08-29 | Uncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it may cause a denial-of… |