2025 CVEs (page 202)
Page 202 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9441 | Medium | 6.5 | 2025-08-29 | The iATS Online Forms plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order' parameter in all versions up to, and including, 1.2 due to… |
CVE-2025-9374 | Medium | 4.3 | 2025-08-29 | The Ultimate Tag Warrior Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to mi… |
CVE-2025-8619 | Medium | 6.4 | 2025-08-29 | The OSM Map Widget for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map Block URL in all versions up to, and in… |
CVE-2025-8290 | Medium | 6.4 | 2025-08-29 | The List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.0.6 due t… |
CVE-2025-8147 | Medium | 4.3 | 2025-08-29 | The LWSCache plugin for WordPress is vulnerable to unauthorized modification of data due to improper authorization on the lwscache_activatePlugin() function in… |
CVE-2025-53508 | High | 7.2 | 2025-08-29 | Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed and sensitive in… |
CVE-2025-53507 | Medium | 6.5 | 2025-08-29 | Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information vulnerability. If exploited, configuration information, such as… |
CVE-2025-9639 | High | 7.5 | 2025-08-29 | The QbiCRMGateway developed by Ai3 has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to… |
CVE-2025-9619 | Medium | 5.3 | 2025-08-29 | A security flaw has been discovered in E4 Sistemas Mercatus ERP 2.00.019. The affected element is an unknown function of the file /basico/webservice/imprimir-d… |
CVE-2025-9610 | High | 7.3 | 2025-08-29 | A vulnerability was determined in code-projects Online Event Judging System 1.0. This issue affects some unknown processing of the file /create_account.php. Th… |
CVE-2025-9609 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results… |
CVE-2025-8861 | Critical | 9.8 | 2025-08-29 | TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents. |
CVE-2025-8858 | High | 7.5 | 2025-08-29 | Clinic Image System developed by Changing has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read… |
CVE-2025-8857 | Critical | 9.8 | 2025-08-29 | Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system using administrator… |
CVE-2025-9608 | Medium | 6.3 | 2025-08-29 | A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/view of the component Formula d… |
CVE-2025-9607 | Medium | 6.3 | 2025-08-29 | A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/TabelaArredondamento/view of… |
CVE-2025-9606 | Medium | 6.3 | 2025-08-29 | A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_prefere… |
CVE-2025-9605 | Critical | 9.8 | 2025-08-29 | A security vulnerability has been detected in Tenda AC21 and AC23 16.03.08.16. Affected is the function GetParentControlInfo of the file /goform/GetParentContr… |
CVE-2025-58323 | High | 7.7 | 2025-08-29 | NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by executing arbitrary files due to imp… |
CVE-2025-39247 | High | 8.6 | 2025-08-29 | There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission. |
CVE-2025-39246 | Medium | 5.3 | 2025-08-29 | There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated user to potentially enable escalation of… |
CVE-2025-39245 | Medium | 4.7 | 2025-08-29 | There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV da… |
CVE-2025-9604 | Low | 3.7 | 2025-08-29 | A vulnerability was identified in coze-studio up to 0.2.4. The impacted element is an unknown function of the file backend/domain/plugin/encrypt/aes.go. The ma… |
CVE-2025-9603 | Medium | 6.3 | 2025-08-29 | A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4. The affected element is an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg. E… |
CVE-2025-9602 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in impro… |
CVE-2025-9601 | High | 7.3 | 2025-08-29 | A vulnerability was detected in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /setting/employee_salary_setup.php. The… |
CVE-2025-9600 | High | 7.3 | 2025-08-29 | A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /s… |
CVE-2025-9599 | High | 7.3 | 2025-08-29 | A weakness has been identified in itsourcecode Apartment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /setting… |
CVE-2025-54142 | Medium | 4.0 | 2025-08-29 | Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within t… |
CVE-2025-43284 | Medium | 5.5 | 2025-08-29 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app… |
CVE-2025-43268 | High | 7.8 | 2025-08-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A malicious app may be able to gain root privileges. |
CVE-2025-43255 | Low | 3.3 | 2025-08-29 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app… |
CVE-2025-43187 | High | 7.8 | 2025-08-29 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. Running an hdiu… |
CVE-2025-40927 | High | 7.3 | 2025-08-29 | CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple tha… |
CVE-2025-9598 | High | 7.3 | 2025-08-29 | A security flaw has been discovered in itsourcecode Apartment Management System 1.0. Affected is an unknown function of the file /setting/year_setup.php. Perfo… |
CVE-2025-9597 | High | 7.3 | 2025-08-29 | A vulnerability was identified in itsourcecode Apartment Management System 1.0. This impacts an unknown function of the file /o_dashboard/rented_all_info.php… |
CVE-2025-9596 | High | 7.3 | 2025-08-29 | A vulnerability was determined in itsourcecode Sports Management System 1.0. This affects an unknown function of the file /login.php. This manipulation of the… |
CVE-2025-9595 | Medium | 4.3 | 2025-08-29 | A vulnerability was found in code-projects Student Information Management System 1.0. The impacted element is an unknown function of the file /login.php. The m… |
CVE-2025-48979 | Low | 3.4 | 2025-08-29 | An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access. |
CVE-2025-9594 | High | 7.3 | 2025-08-28 | A vulnerability has been found in itsourcecode Apartment Management System 1.0. The affected element is an unknown function of the file /report/complain_info.p… |
CVE-2025-9593 | High | 7.3 | 2025-08-28 | A flaw has been found in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /report/unit_status_info.php. Executing mani… |
CVE-2025-58062 | | 2025-08-28 | LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp developer. Prior to version 0.1.12, when users on a Windows platform connect to an attacker controlle… | |
CVE-2025-9592 | High | 7.3 | 2025-08-28 | A vulnerability was detected in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /report/bill_info.php. Per… |
CVE-2025-9591 | Low | 2.4 | 2025-08-28 | A security vulnerability has been detected in ZrLog up to 3.1.5. This vulnerability affects unknown code of the file /api/admin/template/config of the componen… |
CVE-2025-9590 | Low | 3.5 | 2025-08-28 | A vulnerability was identified in Weaver E-Mobile Mobile Management Platform up to 20250813. Affected by this vulnerability is an unknown functionality. The ma… |
CVE-2025-9589 | Low | 2.5 | 2025-08-28 | A vulnerability was determined in Cudy WR1200EA 2.3.7-20250113-121810. Affected is an unknown function of the file /etc/shadow. Executing manipulation can lead… |
CVE-2025-58061 | Medium | 5.5 | 2025-08-28 | OpenEBS Local PV RawFile allows dynamic deployment of Stateful Persistent Node-Local Volumes & Filesystems for Kubernetes. Prior to version 0.10.0, persistent… |
CVE-2025-58058 | Medium | 5.3 | 2025-08-28 | xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte s… |
CVE-2025-9586 | Medium | 6.3 | 2025-08-28 | A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipu… |
CVE-2025-9585 | Medium | 6.3 | 2025-08-28 | A vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipulation of th… |
CVE-2025-9584 | Medium | 6.3 | 2025-08-28 | A vulnerability was found in Comfast CF-N1 2.6.0. Affected by this issue is the function update_interface_png of the file /usr/bin/webmgnt. The manipulation of… |
CVE-2025-9583 | Medium | 6.3 | 2025-08-28 | A vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function ping_config of the file /usr/bin/webmgnt. The manipulatio… |
CVE-2025-9582 | Medium | 6.3 | 2025-08-28 | A flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntp_timezone of the file /usr/bin/webmgnt. Executing manipulation of the argument timest… |
CVE-2025-6203 | High | 7.5 | 2025-08-28 | A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU c… |
CVE-2025-9581 | Medium | 6.3 | 2025-08-28 | A vulnerability was detected in Comfast CF-N1 2.6.0. This impacts the function multi_pppoe of the file /usr/bin/webmgnt. Performing manipulation of the argumen… |
CVE-2025-9580 | Medium | 6.3 | 2025-08-28 | A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/set_blacklist of the component HTTP Ha… |
CVE-2025-9579 | Medium | 6.3 | 2025-08-28 | A weakness has been identified in LB-LINK BL-X26 1.2.8. The impacted element is an unknown function of the file /goform/set_hidessid_cfg of the component HTTP… |
CVE-2025-9577 | Low | 2.5 | 2025-08-28 | A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0. The affected element is an unknown function of the file /etc/shadow.sample of the component… |
CVE-2025-57220 | Medium | 5.3 | 2025-08-28 | An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileges to root via a crafted UDP packet. |
CVE-2025-57219 | Medium | 5.3 | 2025-08-28 | Incorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 allows attackers to escalate privileges or access sen… |
CVE-2025-57215 | High | 7.5 | 2025-08-28 | Tenda AC10 v4.0 firmware v16.03.10.20 was discovered to contain a stack overflow via the function get_parentControl_list_Info. |
CVE-2025-9576 | Low | 2.5 | 2025-08-28 | A vulnerability was identified in seeedstudio ReSpeaker LinkIt7688. Impacted is an unknown function of the file /etc/shadow of the component Administrative Int… |
CVE-2025-9575 | Medium | 6.3 | 2025-08-28 | A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue… |
CVE-2025-9195 | Medium | 4.4 | 2025-08-28 | Improper input validation in firmware of some Solidigm DC Products may allow an attacker with local access to cause a Denial of Service |
CVE-2025-58059 | Critical | 9.1 | 2025-08-28 | Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can… |
CVE-2025-58049 | Medium | 5.8 | 2025-08-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1… |
CVE-2025-58048 | Critical | 9.9 | 2025-08-28 | Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a maliciou… |
CVE-2025-58047 | High | 7.5 | 2025-08-28 | Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17… |
CVE-2025-57218 | Medium | 5.3 | 2025-08-28 | Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parameter in the function sub_46284C. |
CVE-2025-57217 | Medium | 5.3 | 2025-08-28 | Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the Password parameter in the function R7WebsSecurityHandler. |
CVE-2025-31971 | Medium | 5.1 | 2025-08-28 | AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability. The issue may allow attackers to launch a server-side request forgery (SSRF) attack… |
CVE-2025-58335 | Medium | 5.5 | 2025-08-28 | In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 2… |
CVE-2025-58334 | High | 8.1 | 2025-08-28 | In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves |
CVE-2025-57819 | Critical | 9.8 | 2025-08-28 | FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied dat… |
CVE-2025-57759 | Medium | 4.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit field… |
CVE-2025-57758 | Medium | 4.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is… |
CVE-2025-57757 | Medium | 5.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items… |
CVE-2025-57756 | Medium | 5.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragmen… |
CVE-2025-31979 | Medium | 5.4 | 2025-08-28 | A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions… |
CVE-2025-31977 | Medium | 5.3 | 2025-08-28 | HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness… |
CVE-2025-31972 | Medium | 6.5 | 2025-08-28 | HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker… |
CVE-2025-57767 | High | 7.5 | 2025-08-28 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an… |
CVE-2025-51643 | Low | 2.4 | 2025-08-28 | Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection. An attacker… |
CVE-2025-29364 | Medium | 6.5 | 2025-08-28 | spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system calls. The application verifies the legitim… |
CVE-2025-25010 | Medium | 6.5 | 2025-08-28 | Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana… |
CVE-2025-8067 | High | 8.5 | 2025-08-28 | A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device h… |
CVE-2025-56236 | Medium | 6.1 | 2025-08-28 | FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing m… |
CVE-2025-55583 | Critical | 9.8 | 2025-08-28 | D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endp… |
CVE-2025-54995 | Medium | 6.5 | 2025-08-28 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can l… |
CVE-2025-52054 | Medium | 5.3 | 2025-08-28 | An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated… |
CVE-2025-9578 | High | 7.8 | 2025-08-28 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40… |
CVE-2025-51972 | Medium | 6.5 | 2025-08-28 | A SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input… |
CVE-2025-51971 | Medium | 5.4 | 2025-08-28 | A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0. Unsanitized user input in th… |
CVE-2025-51969 | Medium | 6.5 | 2025-08-28 | A SQL Injection vulnerability exists in the product.php page of PuneethReddyHC Online Shopping System Advanced 1.0. This flaw is present in the product_id GET… |
CVE-2025-51968 | Medium | 6.5 | 2025-08-28 | A SQL Injection vulnerability exists in the action.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The application fails to properly sanitize u… |
CVE-2025-51967 | Medium | 6.1 | 2025-08-28 | A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. The application fails… |
CVE-2025-58127 | Medium | 4.8 | 2025-08-28 | Improper Certificate Validation in Checkmk Exchange plugin Dell Powerscale allows attackers in MitM position to intercept traffic. |
CVE-2025-58126 | Medium | 4.8 | 2025-08-28 | Improper Certificate Validation in Checkmk Exchange plugin VMware vSAN allows attackers in MitM position to intercept traffic. |
CVE-2025-58125 | Medium | 4.8 | 2025-08-28 | Improper Certificate Validation in Checkmk Exchange plugin Freebox v6 agent allows attackers in MitM position to intercept traffic. |
CVE-2025-58124 | Medium | 4.8 | 2025-08-28 | Improper Certificate Validation in Checkmk Exchange plugin check-mk-api allows attackers in MitM position to intercept traffic. |