2025 CVEs (page 203)
Page 203 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58203 | Medium | 4.4 | 2025-08-27 | Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from… |
CVE-2025-58202 | Medium | 4.3 | 2025-08-27 | Cross-Site Request Forgery (CSRF) vulnerability in Plugins and Snippets Simple Page Access Restriction simple-page-access-restriction allows Cross Site Request… |
CVE-2025-58201 | Medium | 5.3 | 2025-08-27 | Missing Authorization vulnerability in AfterShip & Automizely AfterShip Tracking aftership-woocommerce-tracking allows Accessing Functionality Not Properly Con… |
CVE-2025-58198 | Medium | 6.5 | 2025-08-27 | Missing Authorization vulnerability in Xpro Xpro Theme Builder xpro-theme-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58197 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mra13 Simple Download Monitor simple-download-monitor all… |
CVE-2025-58196 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uicore UiCore Elements uicore-elements allows Stored XSS… |
CVE-2025-58195 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows S… |
CVE-2025-58194 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Sto… |
CVE-2025-58193 | Medium | 4.3 | 2025-08-27 | Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-58192 | Medium | 4.3 | 2025-08-27 | Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-55422 | High | 8.8 | 2025-08-27 | In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus. |
CVE-2025-51667 | High | 7.0 | 2025-08-27 | An issue was discovered in simple-admin-core v1.2.0 thru v1.6.7. The /sys-api/role/update interface in the simple-admin-core system has a limited SQL injection… |
CVE-2025-50979 | High | 8.6 | 2025-08-27 | NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sani… |
CVE-2025-5187 | Medium | 6.7 | 2025-08-27 | A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patchi… |
CVE-2025-57821 | Medium | 4.2 | 2025-08-27 | Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.0, it is possible to craft a malformed URL that passes the "same orig… |
CVE-2025-50977 | Medium | 6.1 | 2025-08-27 | A template injection vulnerability leading to reflected cross-site scripting (XSS) has been identified in version 1.7.1, requiring authenticated admin access f… |
CVE-2025-50428 | Critical | 9.8 | 2025-08-27 | In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script. The vulnerability is due to improper sa… |
CVE-2025-34161 | High | 8.8 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows aut… |
CVE-2025-34159 | High | 8.8 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows… |
CVE-2025-34157 | Critical | 9.0 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated use… |
CVE-2025-20348 | Medium | 5.0 | 2025-08-27 | A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privile… |
CVE-2025-20347 | Medium | 5.4 | 2025-08-27 | A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privile… |
CVE-2025-20344 | Medium | 6.5 | 2025-08-27 | A vulnerability in the backup restore functionality of Cisco Nexus Dashboard could allow an authenticated, remote attacker to conduct a path traversal attack o… |
CVE-2025-20342 | Medium | 5.4 | 2025-08-27 | A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an authenticated… |
CVE-2025-20317 | High | 7.1 | 2025-08-27 | A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an unauthenticated… |
CVE-2025-20296 | Medium | 5.4 | 2025-08-27 | A vulnerability in the web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker to conduct a stored cross-sit… |
CVE-2025-20295 | Medium | 6.0 | 2025-08-27 | A vulnerability in the CLI of Cisco UCS Manager Software could allow an authenticated, local attacker with administrative privileges to read or create a file o… |
CVE-2025-20294 | Medium | 6.5 | 2025-08-27 | Multiple vulnerabilities in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker with adminis… |
CVE-2025-20292 | Medium | 4.4 | 2025-08-27 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute a command injection attack on the underlying operati… |
CVE-2025-20290 | Medium | 5.5 | 2025-08-27 | A vulnerability in the logging feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches, Cisco Nexus 9000 Series Switches in standalone NX-OS mode… |
CVE-2025-20262 | Medium | 5.0 | 2025-08-27 | A vulnerability in the Protocol Independent Multicast Version 6 (PIM6) feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in stan… |
CVE-2025-20241 | High | 7.4 | 2025-08-27 | A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus… |
CVE-2025-54598 | Medium | 6.5 | 2025-08-27 | The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via the /notifications/… |
CVE-2025-50984 | Medium | 5.3 | 2025-08-27 | diskover-web v2.3.0 Community Edition is vulnerable to multiple boolean-based blind SQL injection flaws in its Elasticsearch configuration form. Unsanitized us… |
CVE-2025-50983 | High | 8.3 | 2025-08-27 | SQL Injection vulnerability exists in the sortKey parameter of the GET /api/v1/wanted/cutoff API endpoint in readarr 0.4.15.2787. The endpoint fails to properl… |
CVE-2025-50978 | Medium | 6.1 | 2025-08-27 | In Gitblit v1.7.1, a reflected cross-site scripting (XSS) vulnerability exists in the way repository path names are handled. By injecting a specially crafted p… |
CVE-2025-9533 | High | 7.3 | 2025-08-27 | A vulnerability has been found in TOTOLINK T10 4.1.8cu.5241_B20210927. Affected is an unknown function of the file /formLoginAuth.htm. The manipulation of the… |
CVE-2025-53105 | High | 7.5 | 2025-08-27 | GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, l… |
CVE-2025-52122 | Critical | 9.8 | 2025-08-27 | Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection… |
CVE-2025-50989 | Critical | 9.1 | 2025-08-27 | OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span P… |
CVE-2025-50986 | Medium | 5.6 | 2025-08-27 | diskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its administrative settings interface. Various… |
CVE-2025-50985 | Medium | 5.6 | 2025-08-27 | diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws in its web interface. Unsanitized GET parameters inc… |
CVE-2025-50972 | Critical | 9.8 | 2025-08-27 | SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id parameter to index.php. Thr… |
CVE-2025-9532 | Medium | 6.3 | 2025-08-27 | A flaw has been found in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /RegraAvaliacao/view. Executing manipulation of the argum… |
CVE-2025-9531 | Medium | 6.3 | 2025-08-27 | A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Modul… |
CVE-2025-9529 | High | 7.3 | 2025-08-27 | A weakness has been identified in Campcodes Payroll Management System 1.0. The affected element is the function include of the file /index.php. This manipulati… |
CVE-2025-9528 | Medium | 4.7 | 2025-08-27 | A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function systemCommand of the file /goform/systemCommand. Executing… |
CVE-2025-9527 | High | 8.8 | 2025-08-27 | A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function QoSSetup of the file /goform/QoSSetup. Performing manipulation of the argumen… |
CVE-2025-56694 | Medium | 5.8 | 2025-08-27 | Client-side password validation (CWE-602) in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums. |
CVE-2025-43882 | High | 7.8 | 2025-08-27 | Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership vulnerability. A local low-privileged attacker could potentially exploit this… |
CVE-2025-43730 | High | 8.4 | 2025-08-27 | Dell ThinOS 10, versions prior to 2508_10.0127, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A… |
CVE-2025-43729 | High | 7.8 | 2025-08-27 | Dell ThinOS 10, versions prior to 2508_10.0127, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A local low-privileged attacke… |
CVE-2025-43728 | Critical | 9.6 | 2025-08-27 | Dell ThinOS 10, versions prior to 2508_10.0127, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could pote… |
CVE-2025-9526 | High | 8.8 | 2025-08-27 | A vulnerability has been found in Linksys E1700 1.0.0.4.003. Affected by this issue is the function setSysAdm of the file /goform/setSysAdm. Such manipulation… |
CVE-2025-9525 | High | 8.8 | 2025-08-27 | A flaw has been found in Linksys E1700 1.0.0.4.003. Affected by this vulnerability is the function setWan of the file /goform/setWan. This manipulation of the… |
CVE-2025-9523 | Critical | 9.8 | 2025-08-27 | A vulnerability was detected in Tenda AC1206 15.03.06.23. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulat… |
CVE-2025-30064 | | 2025-08-27 | An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which si… | |
CVE-2025-30063 | | 2025-08-27 | The configuration file containing database logins and passwords is readable by any local user. | |
CVE-2025-30061 | | 2025-08-27 | In the "utils/Reporter/OpenReportWindow.pl" service, there is an SQL injection vulnerability through the "UserID" parameter. | |
CVE-2025-30060 | | 2025-08-27 | In the ReturnUserUnitsXML.pl service, the "getUserInfo" function is vulnerable to SQL injection through the "UserID" parameter. | |
CVE-2025-30059 | | 2025-08-27 | In the PrepareCDExportJSON.pl service, the "getPerfServiceIds" function is vulnerable to SQL injection. | |
CVE-2025-30058 | | 2025-08-27 | In the PatientService.pl service, the "getPatientIdentifier" function is vulnerable to SQL injection through the "pesel" parameter. | |
CVE-2025-30057 | | 2025-08-27 | In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function. | |
CVE-2025-30056 | | 2025-08-27 | The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system. | |
CVE-2025-30055 | | 2025-08-27 | The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrary code provided as… | |
CVE-2025-30048 | | 2025-08-27 | The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authentication. | |
CVE-2025-30041 | | 2025-08-27 | The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data… | |
CVE-2025-30040 | | 2025-08-27 | The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls… | |
CVE-2025-30039 | | 2025-08-27 | Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users… | |
CVE-2025-30038 | | 2025-08-27 | The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security… | |
CVE-2025-30037 | | 2025-08-27 | The system exposes several endpoints, typically including "/int/" in their path, that should be restricted to internal services, but are instead publicly acces… | |
CVE-2025-30036 | | 2025-08-27 | Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code… | |
CVE-2025-2313 | | 2025-08-27 | In the Print.pl service, the "uhcPrintServerPrint" function allows execution of arbitrary code via the "CopyCounter" parameter. | |
CVE-2025-9514 | Low | 3.7 | 2025-08-27 | A vulnerability has been found in macrozheng mall up to 1.0.3. This impacts an unknown function of the component Registration. Such manipulation leads to weak… |
CVE-2025-9513 | Low | 3.7 | 2025-08-27 | A flaw has been found in editso fuso up to 1.0.4-beta.7. This affects the function PenetrateRsaAndAesHandshake of the file src/net/penetrate/handshake/mod.rs… |
CVE-2025-9511 | High | 7.3 | 2025-08-27 | A vulnerability was identified in itsourcecode Apartment Management System 1.0. This vulnerability affects unknown code of the file /visitor/addvisitor.php. Su… |
CVE-2025-57846 | High | 7.8 | 2025-08-27 | Multiple i-フィルター products contain an issue with incorrect default permissions. If this vulnerability is exploited, a local authenticated attacker may replace a… |
CVE-2025-57797 | High | 7.8 | 2025-08-27 | Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vulnerability is exploited, an authentica… |
CVE-2025-9510 | High | 7.3 | 2025-08-27 | A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. The affected element is an unknown function of the file /branch/add… |
CVE-2025-9509 | High | 7.3 | 2025-08-27 | A security flaw has been discovered in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /report/fair_info_a… |
CVE-2025-9508 | High | 7.3 | 2025-08-27 | A vulnerability was detected in itsourcecode Apartment Management System 1.0. The impacted element is an unknown function of the file /report/rented_info.php… |
CVE-2025-48081 | Medium | 5.3 | 2025-08-27 | Path Traversal: '.../...//' vulnerability in Printeers Printeers Print & Ship allows Path Traversal.This issue affects Printeers Print & Ship: from n/a through… |
CVE-2025-9507 | High | 7.3 | 2025-08-27 | A weakness has been identified in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /report/visitor_info.php. Executing… |
CVE-2025-9506 | High | 7.3 | 2025-08-27 | A vulnerability has been found in Campcodes Online Loan Management System 1.0. This affects an unknown part of the file /ajax.php?action=delete_plan. Such mani… |
CVE-2025-9505 | High | 7.3 | 2025-08-27 | A flaw has been found in Campcodes Online Loan Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_lo… |
CVE-2025-9504 | High | 7.3 | 2025-08-27 | A vulnerability was detected in Campcodes Online Loan Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?a… |
CVE-2025-49040 | Medium | 4.3 | 2025-08-27 | Cross-Site Request Forgery (CSRF) vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery.This issue affects Backup Bolt: from n… |
CVE-2025-49039 | Medium | 5.9 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View link-view allows Stored XSS.This issue… |
CVE-2025-49035 | Medium | 5.9 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaimchaikin Admin Menu Groups admin-menu-groups allows S… |
CVE-2025-9503 | High | 7.3 | 2025-08-27 | A security vulnerability has been detected in Campcodes Online Loan Management System 1.0. Affected is an unknown function of the file /ajax.php?action=save_bo… |
CVE-2025-9502 | High | 7.3 | 2025-08-27 | A weakness has been identified in Campcodes Online Loan Management System 1.0. This impacts an unknown function of the file /ajax.php?action=save_payment. Exec… |
CVE-2025-7732 | Medium | 6.4 | 2025-08-27 | The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lazy‑loading handlers in all versions up to, and including… |
CVE-2025-8490 | Medium | 4.4 | 2025-08-27 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7… |
CVE-2025-9277 | Medium | 6.4 | 2025-08-26 | The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all versions up to, an… |
CVE-2025-57820 | | 2025-08-26 | Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.p… | |
CVE-2025-35115 | High | 8.1 | 2025-08-26 | Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could replace or modify the… |
CVE-2025-35114 | High | 7.5 | 2025-08-26 | Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one… |
CVE-2025-35113 | Medium | 5.9 | 2025-08-26 | Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code exec… |
CVE-2025-35112 | Medium | 4.1 | 2025-08-26 | Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the t… |
CVE-2025-26417 | Medium | 4.0 | 2025-08-26 | In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused… |