2025 CVEs (page 206)
Page 206 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-52218 | High | 7.5 | 2025-08-26 | SelectZero Data Observability Platform before 2025.5.2 is vulnerable to Content Spoofing / Text Injection. Improper sanitization of unspecified parameters allo… |
CVE-2025-52217 | Medium | 5.4 | 2025-08-26 | SelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly handle user-supplied input, allowing inject… |
CVE-2025-52037 | Medium | 6.1 | 2025-08-26 | A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the… |
CVE-2025-52036 | Medium | 6.1 | 2025-08-26 | A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation o… |
CVE-2025-52035 | Medium | 6.1 | 2025-08-26 | A vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the service descriptions leads to a stored XS… |
CVE-2025-25737 | Medium | 6.8 | 2025-08-26 | Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack secure password requireme… |
CVE-2025-25736 | Medium | 6.8 | 2025-08-26 | Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android Debug Bridge (ADB) pre-installed (/mnt/… |
CVE-2025-25735 | Medium | 4.6 | 2025-08-26 | Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Regis… |
CVE-2025-25734 | Medium | 6.8 | 2025-08-26 | Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI… |
CVE-2025-25733 | Low | 3.5 | 2025-08-26 | Incorrect access control in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28… |
CVE-2025-25732 | Medium | 6.8 | 2025-08-26 | Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211… |
CVE-2025-9483 | High | 8.8 | 2025-08-26 | A flaw has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the fun… |
CVE-2025-9482 | High | 8.8 | 2025-08-26 | A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This impacts… |
CVE-2025-9481 | High | 8.8 | 2025-08-26 | A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001… |
CVE-2025-8424 | | 2025-08-26 | Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Clu… | |
CVE-2025-55526 | Critical | 9.1 | 2025-08-26 | n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py |
CVE-2025-50753 | High | 8.4 | 2025-08-26 | Mitrastar GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell.The command "deviceinfo show file" is supposed to be use… |
CVE-2025-29992 | High | 7.5 | 2025-08-26 | Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or t… |
CVE-2025-9190 | | 2025-08-26 | The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code tha… | |
CVE-2025-8700 | | 2025-08-26 | Invoice Ninja's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged… | |
CVE-2025-8597 | | 2025-08-26 | MacVim's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged access… | |
CVE-2025-7776 | Critical | 9.8 | 2025-08-26 | Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is con… |
CVE-2025-7775 | Critical | 9.8 | 2025-08-26 | Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as… |
CVE-2025-53813 | | 2025-08-26 | The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that… | |
CVE-2025-53811 | | 2025-08-26 | The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code t… | |
CVE-2025-38676 | High | 7.8 | 2025-08-26 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Avoid stack buffer overflow from kernel cmdline While the kernel command line… |
CVE-2025-44002 | Medium | 6.1 | 2025-08-26 | Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create… |
CVE-2025-1501 | Medium | 4.3 | 2025-08-26 | An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restrictio… |
CVE-2025-48108 | Medium | 6.5 | 2025-08-26 | Missing Authorization vulnerability in Mojoomla School Management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sc… |
CVE-2025-29901 | Medium | 6.5 | 2025-08-26 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-6247 | Medium | 4.7 | 2025-08-26 | The WordPress Automatic Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.118.0. This is due to m… |
CVE-2025-57704 | Medium | 5.5 | 2025-08-26 | Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerability. |
CVE-2025-53419 | High | 7.8 | 2025-08-26 | Delta Electronics COMMGR has Code Injection vulnerability. |
CVE-2025-53418 | High | 8.6 | 2025-08-26 | Delta Electronics COMMGR has Stack-based Buffer Overflow vulnerability. |
CVE-2025-9476 | High | 7.3 | 2025-08-26 | A vulnerability has been found in SourceCodester Human Resource Information System 1.0. Affected by this issue is some unknown functionality of the file /Super… |
CVE-2025-9475 | High | 7.3 | 2025-08-26 | A flaw has been found in SourceCodester Human Resource Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /Admin_Da… |
CVE-2025-41702 | Critical | 9.8 | 2025-08-26 | The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 toke… |
CVE-2025-9474 | Medium | 4.5 | 2025-08-26 | A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the componen… |
CVE-2025-9473 | High | 7.3 | 2025-08-26 | A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. This impacts an unknown function of the file /feedback.php. The… |
CVE-2025-9472 | High | 7.3 | 2025-08-26 | A vulnerability was found in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /owner_utility/add_owner_util… |
CVE-2025-5931 | High | 8.8 | 2025-08-26 | The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5. This is due to the p… |
CVE-2025-9471 | High | 7.3 | 2025-08-26 | A vulnerability has been found in itsourcecode Apartment Management System 1.0. This vulnerability affects unknown code of the file /maintenance/add_maintenanc… |
CVE-2025-9470 | High | 7.3 | 2025-08-26 | A flaw has been found in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /management/add_m_committee.php. Executing mani… |
CVE-2025-9469 | High | 7.3 | 2025-08-26 | A vulnerability was detected in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /fund/add_fund.p… |
CVE-2025-9468 | High | 7.3 | 2025-08-26 | A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2025-9172 | High | 7.5 | 2025-08-26 | The Vibes plugin for WordPress is vulnerable to time-based SQL Injection via the ‘resource’ parameter in all versions up to, and including, 2.2.0 due to insuff… |
CVE-2025-9461 | Medium | 4.3 | 2025-08-26 | A weakness has been identified in diyhi bbs up to 6.8. The impacted element is an unknown function of the file src/main/java/cms/web/action/filePackage/FilePac… |
CVE-2025-9444 | High | 7.3 | 2025-08-26 | A vulnerability has been found in 1000projects Online Project Report Submission and Evaluation System 1.0. This issue affects some unknown processing of the fi… |
CVE-2025-9443 | High | 8.8 | 2025-08-26 | A flaw has been found in Tenda CH22 1.0.0.1. This vulnerability affects the function formeditUserName of the file /goform/editUserName. Executing manipulation… |
CVE-2025-9440 | Medium | 4.3 | 2025-08-26 | A security vulnerability has been detected in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this issue is some unknown f… |
CVE-2025-9439 | Medium | 4.3 | 2025-08-26 | A weakness has been identified in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2025-9438 | Medium | 4.3 | 2025-08-26 | A security flaw has been discovered in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-9434 | Medium | 4.3 | 2025-08-26 | A vulnerability was determined in 1000projects Online Project Report Submission and Evaluation System 1.0. This affects an unknown function of the file /admin/… |
CVE-2025-9433 | Medium | 4.3 | 2025-08-26 | A vulnerability was found in mtons mblog up to 3.5.0. The impacted element is an unknown function of the file /admin/user/list of the component Admin Panel. Pe… |
CVE-2025-8447 | Low | 3.1 | 2025-08-26 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code c… |
CVE-2025-9432 | Medium | 4.3 | 2025-08-26 | A vulnerability has been found in mtons mblog up to 3.5.0. The affected element is an unknown function of the file /admin/post/list of the component Admin Pane… |
CVE-2025-9431 | Medium | 4.3 | 2025-08-26 | A flaw has been found in mtons mblog up to 3.5.0. Impacted is an unknown function of the file /search. This manipulation of the argument kw causes cross site s… |
CVE-2025-9430 | Low | 2.4 | 2025-08-26 | A vulnerability was detected in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/options/update. The manipulation of the… |
CVE-2025-9429 | Low | 3.5 | 2025-08-26 | A security vulnerability has been detected in mtons mblog up to 3.5.0. This vulnerability affects unknown code of the file /post/submit of the component Post H… |
CVE-2025-9426 | High | 7.3 | 2025-08-25 | A weakness has been identified in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /package.php. Executing m… |
CVE-2025-9425 | High | 7.3 | 2025-08-25 | A security flaw has been discovered in itsourcecode Online Tour and Travel Management System 1.0. Affected by this issue is some unknown functionality of the f… |
CVE-2025-9424 | Medium | 4.7 | 2025-08-25 | A vulnerability was identified in Ruijie WS7204-A 2017.06.15. Affected by this vulnerability is an unknown functionality of the file /itbox_pi/branch_import.ph… |
CVE-2025-9423 | High | 7.3 | 2025-08-25 | A vulnerability was determined in Campcodes Online Water Billing System 1.0. Affected is an unknown function of the file /editecex.php. This manipulation of th… |
CVE-2025-9422 | Low | 2.4 | 2025-08-25 | A vulnerability was found in oitcode samarium up to 0.9.6. This impacts an unknown function of the file /dashboard/team of the component Team Image Handler. Th… |
CVE-2025-9421 | High | 7.3 | 2025-08-25 | A vulnerability has been found in itsourcecode Apartment Management System 1.0. This affects an unknown function of the file /complain/addcomplain.php. The man… |
CVE-2025-9420 | High | 7.3 | 2025-08-25 | A flaw has been found in itsourcecode Apartment Management System 1.0. The impacted element is an unknown function of the file /floor/addfloor.php. Executing m… |
CVE-2025-8627 | High | 8.8 | 2025-08-25 | The TP-Link KP303 Smartplug can be issued unauthenticated protocol commands that may cause unintended power-off condition and potential information leak. This… |
CVE-2025-57814 | | 2025-08-25 | request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Versions 1.x.x and earlier contain a vulnerab… | |
CVE-2025-57809 | High | 7.5 | 2025-08-25 | XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.21, XGrammar has an infinite recursion iss… |
CVE-2025-57805 | | 2025-08-25 | The Scratch Channel is a news website. In versions 1 and 1.1, a POST request to the endpoint used to publish articles, can be used to post an article in any ca… | |
CVE-2025-9419 | High | 7.3 | 2025-08-25 | A vulnerability was detected in itsourcecode Apartment Management System 1.0. The affected element is an unknown function of the file /unit/addunit.php. Perfor… |
CVE-2025-9418 | High | 7.3 | 2025-08-25 | A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /owner/addowner.php. Su… |
CVE-2025-6188 | High | 7.5 | 2025-08-25 | On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing… |
CVE-2025-57804 | | 2025-08-25 | h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform re… | |
CVE-2025-9417 | Medium | 6.3 | 2025-08-25 | A weakness has been identified in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /employee/addemployee.ph… |
CVE-2025-9416 | Low | 2.4 | 2025-08-25 | A security flaw has been discovered in oitcode samarium up to 0.9.6. This vulnerability affects unknown code of the file /cms/webpage/ of the component Pages I… |
CVE-2025-52130 | Medium | 5.4 | 2025-08-25 | File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to uploa… |
CVE-2025-3456 | Low | 3.8 | 2025-08-25 | On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowl… |
CVE-2025-9415 | Medium | 6.3 | 2025-08-25 | A vulnerability was identified in GreenCMS up to 2.3.0603. This affects an unknown part of the file /index.php?m=admin&c=media&a=fileconnect. The manipulation… |
CVE-2025-9414 | Medium | 4.7 | 2025-08-25 | A vulnerability was found in kalcaddle kodbox 1.61. Affected by this vulnerability is an unknown functionality of the file /?explorer/upload/serverDownload of… |
CVE-2025-9413 | Medium | 6.3 | 2025-08-25 | A flaw has been found in lostvip-com ruoyi-go up to 2.1. This impacts the function SelectListByPage of the file modules/system/system_router.go. This manipulat… |
CVE-2025-9412 | Medium | 6.3 | 2025-08-25 | A vulnerability was detected in lostvip-com ruoyi-go up to 2.1. This affects the function SelectListByPage of the file modules/system/dao/DictDataDao.go. The m… |
CVE-2025-57811 | High | 7.2 | 2025-08-25 | Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vuln… |
CVE-2025-57802 | | 2025-08-25 | Airlink's Daemon interfaces with Docker and the Panel to provide secure access for controlling instances via the Panel. In version 1.0.0, an attacker with acce… | |
CVE-2025-50383 | High | 8.1 | 2025-08-25 | alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter. |
CVE-2025-9411 | Medium | 6.3 | 2025-08-25 | A security vulnerability has been detected in lostvip-com ruoyi-go up to 2.1. The impacted element is the function SelectPageList of the file modules/system/se… |
CVE-2025-9410 | Medium | 6.3 | 2025-08-25 | A weakness has been identified in lostvip-com ruoyi-go up to 2.1. The affected element is the function SelectListByPage of the file modules/system/dao/GenTable… |
CVE-2025-6737 | High | 7.2 | 2025-08-25 | Securden’s Unified PAM Remote Vendor Gateway access portal shares infrastructure and access tokens across multiple tenants. A malicious actor can obtain authen… |
CVE-2025-57773 | Critical | 9.8 | 2025-08-25 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injecti… |
CVE-2025-57772 | Critical | 9.8 | 2025-08-25 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC… |
CVE-2025-57760 | High | 8.8 | 2025-08-25 | Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an auth… |
CVE-2025-53120 | Critical | 9.4 | 2025-08-25 | A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server’s configuration an… |
CVE-2025-50722 | Critical | 9.8 | 2025-08-25 | Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via the Common.php component |
CVE-2025-29421 | High | 7.5 | 2025-08-25 | PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function. |
CVE-2025-29420 | High | 7.5 | 2025-08-25 | PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function. |
CVE-2025-9409 | Medium | 4.3 | 2025-08-25 | A security flaw has been discovered in lostvip-com ruoyi-go up to 2.1. Impacted is the function DownloadTmp/DownloadUpload of the file modules/system/controlle… |
CVE-2025-55575 | Critical | 9.8 | 2025-08-25 | SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=service_detail. |
CVE-2025-55574 | Medium | 6.1 | 2025-08-25 | Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code |
CVE-2025-55409 | High | 8.8 | 2025-08-25 | FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. This allows attackers to execute arbitrary code. |
CVE-2025-55301 | Medium | 6.7 | 2025-08-25 | The Scratch Channel is a news website. In version 1, it is possible to go to application in devtools and click local storage to edit the account's username loc… |