2025 CVEs (page 201)
Page 201 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9586 | Medium | 6.3 | 2025-08-28 | A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipu… |
CVE-2025-9585 | Medium | 6.3 | 2025-08-28 | A vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipulation of th… |
CVE-2025-9584 | Medium | 6.3 | 2025-08-28 | A vulnerability was found in Comfast CF-N1 2.6.0. Affected by this issue is the function update_interface_png of the file /usr/bin/webmgnt. The manipulation of… |
CVE-2025-9583 | Medium | 6.3 | 2025-08-28 | A vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function ping_config of the file /usr/bin/webmgnt. The manipulatio… |
CVE-2025-9582 | Medium | 6.3 | 2025-08-28 | A flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntp_timezone of the file /usr/bin/webmgnt. Executing manipulation of the argument timest… |
CVE-2025-6203 | High | 7.5 | 2025-08-28 | A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU c… |
CVE-2025-9581 | Medium | 6.3 | 2025-08-28 | A vulnerability was detected in Comfast CF-N1 2.6.0. This impacts the function multi_pppoe of the file /usr/bin/webmgnt. Performing manipulation of the argumen… |
CVE-2025-9580 | Medium | 6.3 | 2025-08-28 | A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/set_blacklist of the component HTTP Ha… |
CVE-2025-9579 | Medium | 6.3 | 2025-08-28 | A weakness has been identified in LB-LINK BL-X26 1.2.8. The impacted element is an unknown function of the file /goform/set_hidessid_cfg of the component HTTP… |
CVE-2025-9577 | Low | 2.5 | 2025-08-28 | A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0. The affected element is an unknown function of the file /etc/shadow.sample of the component… |
CVE-2025-57220 | Medium | 5.3 | 2025-08-28 | An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileges to root via a crafted UDP packet. |
CVE-2025-57219 | Medium | 5.3 | 2025-08-28 | Incorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 allows attackers to escalate privileges or access sen… |
CVE-2025-57215 | High | 7.5 | 2025-08-28 | Tenda AC10 v4.0 firmware v16.03.10.20 was discovered to contain a stack overflow via the function get_parentControl_list_Info. |
CVE-2025-9576 | Low | 2.5 | 2025-08-28 | A vulnerability was identified in seeedstudio ReSpeaker LinkIt7688. Impacted is an unknown function of the file /etc/shadow of the component Administrative Int… |
CVE-2025-9575 | Medium | 6.3 | 2025-08-28 | A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue… |
CVE-2025-9195 | Medium | 4.4 | 2025-08-28 | Improper input validation in firmware of some Solidigm DC Products may allow an attacker with local access to cause a Denial of Service |
CVE-2025-58059 | Critical | 9.1 | 2025-08-28 | Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can… |
CVE-2025-58049 | Medium | 5.8 | 2025-08-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1… |
CVE-2025-58048 | Critical | 9.9 | 2025-08-28 | Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a maliciou… |
CVE-2025-58047 | High | 7.5 | 2025-08-28 | Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17… |
CVE-2025-57218 | Medium | 5.3 | 2025-08-28 | Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parameter in the function sub_46284C. |
CVE-2025-57217 | Medium | 5.3 | 2025-08-28 | Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the Password parameter in the function R7WebsSecurityHandler. |
CVE-2025-31971 | Medium | 5.1 | 2025-08-28 | AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability. The issue may allow attackers to launch a server-side request forgery (SSRF) attack… |
CVE-2025-58335 | Medium | 5.5 | 2025-08-28 | In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 2… |
CVE-2025-58334 | High | 8.1 | 2025-08-28 | In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves |
CVE-2025-57819 | Critical | 9.8 | 2025-08-28 | FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied dat… |
CVE-2025-57759 | Medium | 4.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit field… |
CVE-2025-57758 | Medium | 4.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is… |
CVE-2025-57757 | Medium | 5.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items… |
CVE-2025-57756 | Medium | 5.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragmen… |
CVE-2025-31979 | Medium | 5.4 | 2025-08-28 | A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions… |
CVE-2025-31977 | Medium | 5.3 | 2025-08-28 | HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness… |
CVE-2025-31972 | Medium | 6.5 | 2025-08-28 | HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker… |
CVE-2025-57767 | High | 7.5 | 2025-08-28 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an… |
CVE-2025-51643 | Low | 2.4 | 2025-08-28 | Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection. An attacker… |
CVE-2025-29364 | Medium | 6.5 | 2025-08-28 | spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system calls. The application verifies the legitim… |
CVE-2025-25010 | Medium | 6.5 | 2025-08-28 | Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana… |
CVE-2025-8067 | High | 8.5 | 2025-08-28 | A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device h… |
CVE-2025-56236 | Medium | 6.1 | 2025-08-28 | FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing m… |
CVE-2025-55583 | Critical | 9.8 | 2025-08-28 | D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endp… |
CVE-2025-54995 | Medium | 6.5 | 2025-08-28 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can l… |
CVE-2025-52054 | Medium | 5.3 | 2025-08-28 | An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated… |
CVE-2025-9578 | High | 7.8 | 2025-08-28 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40… |
CVE-2025-51972 | Medium | 6.5 | 2025-08-28 | A SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input… |
CVE-2025-51971 | Medium | 5.4 | 2025-08-28 | A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0. Unsanitized user input in th… |
CVE-2025-51969 | Medium | 6.5 | 2025-08-28 | A SQL Injection vulnerability exists in the product.php page of PuneethReddyHC Online Shopping System Advanced 1.0. This flaw is present in the product_id GET… |
CVE-2025-51968 | Medium | 6.5 | 2025-08-28 | A SQL Injection vulnerability exists in the action.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The application fails to properly sanitize u… |
CVE-2025-51967 | Medium | 6.1 | 2025-08-28 | A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. The application fails… |
CVE-2025-58127 | Medium | 4.8 | 2025-08-28 | Improper Certificate Validation in Checkmk Exchange plugin Dell Powerscale allows attackers in MitM position to intercept traffic. |
CVE-2025-58126 | Medium | 4.8 | 2025-08-28 | Improper Certificate Validation in Checkmk Exchange plugin VMware vSAN allows attackers in MitM position to intercept traffic. |
CVE-2025-58125 | Medium | 4.8 | 2025-08-28 | Improper Certificate Validation in Checkmk Exchange plugin Freebox v6 agent allows attackers in MitM position to intercept traffic. |
CVE-2025-58124 | Medium | 4.8 | 2025-08-28 | Improper Certificate Validation in Checkmk Exchange plugin check-mk-api allows attackers in MitM position to intercept traffic. |
CVE-2025-58123 | Medium | 4.8 | 2025-08-28 | Improper Certificate Validation in Checkmk Exchange plugin BGP Monitoring allows attackers in MitM position to intercept traffic. |
CVE-2025-54742 | High | 8.8 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a thro… |
CVE-2025-54738 | Critical | 9.8 | 2025-08-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster noo-jobmonster allows Authentication Abuse.This issue affects Job… |
CVE-2025-54734 | Medium | 5.8 | 2025-08-28 | Missing Authorization vulnerability in bPlugins B Slider b-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B… |
CVE-2025-54733 | Medium | 6.5 | 2025-08-28 | Missing Authorization vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-54731 | High | 8.1 | 2025-08-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue… |
CVE-2025-54725 | Critical | 9.8 | 2025-08-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through… |
CVE-2025-54724 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Golo golo allows Reflected XSS.This issue affects G… |
CVE-2025-54720 | Critical | 9.3 | 2025-08-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SteelThemes Nest Addons nest-addons allows SQL Injection… |
CVE-2025-54716 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ireca ireca allows PHP Local… |
CVE-2025-54714 | High | 7.1 | 2025-08-28 | Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-54710 | High | 7.1 | 2025-08-28 | Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ti… |
CVE-2025-54029 | High | 7.7 | 2025-08-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in extendons WooCommerce csv import export extendons-eo-wooimport-… |
CVE-2025-53588 | High | 7.7 | 2025-08-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator u… |
CVE-2025-53584 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Object Injection… |
CVE-2025-53583 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design Employee Spotlight employee-spotlight allows Object Injection.This issue affects Employee Spo… |
CVE-2025-53579 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu captcha-eu allows Reflected XSS.Thi… |
CVE-2025-53578 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kipso kipso allows PHP Local Fi… |
CVE-2025-53576 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ovatheme Events ova-events al… |
CVE-2025-53572 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact wp-easy-contact allows Object Injection.This issue affects WP Easy Contact: f… |
CVE-2025-53337 | Medium | 5.4 | 2025-08-28 | Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-53334 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local… |
CVE-2025-53328 | High | 7.5 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Opinion Stage Poll, Survey & Quiz Make… |
CVE-2025-53326 | High | 7.5 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodeYatri Gutenify gutenify allows PHP… |
CVE-2025-53289 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas all… |
CVE-2025-53250 | Medium | 6.4 | 2025-08-28 | Server-Side Request Forgery (SSRF) vulnerability in Chartbeat Chartbeat chartbeat allows Server Side Request Forgery.This issue affects Chartbeat: from n/a thr… |
CVE-2025-53248 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine eximious-magazine al… |
CVE-2025-53247 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpinterface BlogMarks blogmarks allows… |
CVE-2025-53244 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine Elite magazine-elite… |
CVE-2025-53243 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design Employee Directory – Staff Listing & Team Directory Plugin for WordPress employee-directory a… |
CVE-2025-53230 | High | 7.6 | 2025-08-28 | Missing Authorization vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-53227 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine Saga magazine-saga a… |
CVE-2025-53225 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eboekhouden e-Boekhouden.nl e-boekhoudennl-connector allo… |
CVE-2025-53224 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Koen Schuit NextGEN Gallery Search nextgen-gallery-search… |
CVE-2025-53223 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undoIT Theme Switcher Reloaded theme-switcher-reloaded al… |
CVE-2025-53220 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XmasB XmasB Quotes xmasb-quotes allows Reflected XSS.This… |
CVE-2025-53216 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeuniver Glamer glamer allows PHP L… |
CVE-2025-53215 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Reflec… |
CVE-2025-52761 | Critical | 9.8 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in manfcarlo WP Funnel Manager wp-funnel-manager allows Object Injection.This issue affects WP Funnel Manager… |
CVE-2025-49407 | High | 8.8 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affect… |
CVE-2025-49405 | Medium | 4.3 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez allows PHP Local Fil… |
CVE-2025-49404 | High | 8.5 | 2025-08-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in purethemes Listeo Core listeo-core allows SQL Injection.T… |
CVE-2025-49402 | High | 8.5 | 2025-08-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scriptsbundle Exertio Framework exertio-framework allows… |
CVE-2025-49388 | Critical | 9.8 | 2025-08-28 | Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Privilege Escalation.This issue affects Miraculous Co… |
CVE-2025-49387 | Critical | 10.0 | 2025-08-28 | Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elemen… |
CVE-2025-49383 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CocoBasic Neresa neresa-wp allows PHP… |
CVE-2025-48365 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imaprogrammer Custom Comment customcomment allows Stored… |
CVE-2025-48364 | Medium | 4.9 | 2025-08-28 | Server-Side Request Forgery (SSRF) vulnerability in vEnCa-X rajce rajce allows Server Side Request Forgery.This issue affects rajce: from n/a through <= 0.4.2. |