2025 CVEs (page 208)
Page 208 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-36042 | Medium | 5.4 | 2025-08-22 | IBM QRadar SIEM 7.5 through 7.5.0 Dashboard is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScrip… |
CVE-2025-33120 | High | 7.8 | 2025-08-22 | IBM QRadar SIEM 7.5 through 7.5.0 UP13 could allow an authenticated user to escalate their privileges via a misconfigured cronjob due to execution with unneces… |
CVE-2025-51825 | Medium | 6.5 | 2025-08-22 | JeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseSql endpoint, which… |
CVE-2025-50691 | Medium | 5.3 | 2025-08-22 | MCSManager 10.5.3 daemon process runs as a root account by default, and its sensitive data (including tokens and terminal content) is stored in the data direct… |
CVE-2025-38618 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to… |
CVE-2025-38617 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring()… |
CVE-2025-38616 | High | 7.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: tls: handle data disappearing from under the TLS ULP TLS expects that it owns the receive… |
CVE-2025-9331 | Medium | 4.3 | 2025-08-22 | The Spacious theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'welcome_notice_import_handler' fu… |
CVE-2025-9259 | Medium | 6.5 | 2025-08-22 | WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to… |
CVE-2025-9258 | Medium | 6.5 | 2025-08-22 | WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to… |
CVE-2025-9257 | Medium | 6.5 | 2025-08-22 | WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to… |
CVE-2025-9256 | Medium | 6.5 | 2025-08-22 | WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to… |
CVE-2025-9255 | High | 7.5 | 2025-08-22 | WebITR developed by Uniong has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database conte… |
CVE-2025-9254 | Critical | 9.8 | 2025-08-22 | WebITR developed by Uniong has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to log into the system as arbitrary users by e… |
CVE-2025-57896 | Medium | 5.3 | 2025-08-22 | Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-57895 | Medium | 4.3 | 2025-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2… |
CVE-2025-57894 | Medium | 4.3 | 2025-08-22 | Missing Authorization vulnerability in ollybach WPPizza wppizza allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPPi… |
CVE-2025-57893 | Medium | 4.3 | 2025-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Cross Site Request Forgery.This issue affects WP Fas… |
CVE-2025-57892 | Medium | 4.3 | 2025-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in Jeff Starr Simple Statistics for Feeds simple-feed-stats allows Cross Site Request Forgery.This issue affect… |
CVE-2025-57891 | Medium | 5.9 | 2025-08-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations recurring-donation… |
CVE-2025-57890 | Medium | 5.9 | 2025-08-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy Sessions sessions allows Stored XSS.This is… |
CVE-2025-57888 | Medium | 5.3 | 2025-08-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NooTheme Jobmonster noo-jobmonster allows Retrieve Embedded Sensiti… |
CVE-2025-57887 | Medium | 6.5 | 2025-08-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Stored XSS.This… |
CVE-2025-57886 | Medium | 5.4 | 2025-08-22 | Authorization Bypass Through User-Controlled Key vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Explo… |
CVE-2025-57885 | Medium | 4.3 | 2025-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Cross Site Request Forgery.This issue affects Fluent Su… |
CVE-2025-57884 | Medium | 4.3 | 2025-08-22 | Missing Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-9340 | | 2025-08-22 | Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All (API modules). This vulnerability is associated wit… | |
CVE-2025-9341 | | 2025-08-22 | Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bou… | |
CVE-2025-8678 | Medium | 5.9 | 2025-08-22 | The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wp_remote_request' function. This… |
CVE-2025-57699 | Medium | 6.7 | 2025-08-22 | Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. A user with the write permi… |
CVE-2025-8281 | High | 7.1 | 2025-08-22 | The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2025-41452 | | 2025-08-22 | Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow f… | |
CVE-2025-41451 | | 2025-08-22 | Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4… | |
CVE-2025-43752 | Medium | 6.5 | 2025-08-22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-43753 | Medium | 5.4 | 2025-08-21 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 t… |
CVE-2025-51606 | High | 8.8 | 2025-08-21 | hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled bin… |
CVE-2025-43747 | Medium | 6.5 | 2025-08-21 | A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.d… |
CVE-2025-55231 | High | 7.5 | 2025-08-21 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an unauthorized attacker to execute code… |
CVE-2025-55230 | High | 7.8 | 2025-08-21 | Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-55229 | Medium | 5.3 | 2025-08-21 | Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-55107 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticat… |
CVE-2025-55106 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated a… |
CVE-2025-55105 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated a… |
CVE-2025-55104 | Medium | 4.8 | 2025-08-21 | A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create o… |
CVE-2025-55103 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated a… |
CVE-2025-54460 | High | 7.1 | 2025-08-21 | The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to create or access publication targets of type Text File or HDFS) t… |
CVE-2025-53795 | Critical | 9.1 | 2025-08-21 | Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-53763 | Critical | 9.8 | 2025-08-21 | Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-51989 | High | 7.0 | 2025-08-21 | HTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster module v235 allows an attacker to inject HTML tags into the "k… |
CVE-2025-41415 | Medium | 6.5 | 2025-08-21 | The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to access publication targets) to retrieve sensitive information tha… |
CVE-2025-3128 | Critical | 9.8 | 2025-08-21 | A remote unauthenticated attacker who has bypassed authentication could execute arbitrary OS commands to disclose, tamper with, destroy or delete information… |
CVE-2025-27721 | High | 7.5 | 2025-08-21 | Unauthorized users can access INFINITT PACS System Manager without proper authorization, which could lead to unauthorized access to system resources. |
CVE-2025-27714 | Medium | 6.3 | 2025-08-21 | An attacker could exploit this vulnerability by uploading arbitrary files via the a specific endpoint, leading to unauthorized remote code execution or syste… |
CVE-2025-24489 | Medium | 6.3 | 2025-08-21 | An attacker could exploit this vulnerability by uploading arbitrary files via a specific service, which could lead to system compromise. |
CVE-2025-57751 | | 2025-08-21 | pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk paramet… | |
CVE-2025-38743 | High | 7.8 | 2025-08-21 | Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value vulnerability. A low privileged attacker with… |
CVE-2025-38742 | Medium | 5.3 | 2025-08-21 | Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged a… |
CVE-2025-7051 | High | 8.3 | 2025-08-21 | On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerabil… |
CVE-2025-57768 | | 2025-08-21 | Phproject is a high performance full-featured project management system. From 1.8.0 to before 1.8.3, a Stored Cross-Site Scripting (XSS) vulnerability exists i… | |
CVE-2025-55524 | High | 7.3 | 2025-08-21 | Insecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors. |
CVE-2025-55523 | Low | 3.5 | 2025-08-21 | An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory traversal. |
CVE-2025-52352 | Critical | 9.8 | 2025-08-21 | Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option… |
CVE-2025-52351 | High | 8.8 | 2025-08-21 | Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes the same password as… |
CVE-2025-43754 | Medium | 5.3 | 2025-08-21 | Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q… |
CVE-2025-9311 | High | 7.3 | 2025-08-21 | A vulnerability was identified in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /fair/addfair… |
CVE-2025-9310 | Medium | 5.3 | 2025-08-21 | A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-9309 | Low | 2.5 | 2025-08-21 | A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Handler. Performing m… |
CVE-2025-8402 | Medium | 4.9 | 2025-08-21 | Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a sys… |
CVE-2025-7969 | Medium | 6.1 | 2025-08-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). Thi… |
CVE-2025-6465 | Medium | 4.3 | 2025-08-21 | Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload pe… |
CVE-2025-57765 | Medium | 6.5 | 2025-08-21 | WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the pre_cadastro_ado… |
CVE-2025-57764 | Medium | 6.5 | 2025-08-21 | WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cargos.php endpo… |
CVE-2025-57763 | Medium | 6.1 | 2025-08-21 | WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the insere_despacho.php en… |
CVE-2025-57762 | Medium | 6.1 | 2025-08-21 | WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Stored Cross-Site Scripting (XSS) vulnerability in the dependente_docdependente… |
CVE-2025-57761 | High | 8.8 | 2025-08-21 | WeGIA is a Web manager for charitable institutions. Prior to 3.4.10, there is a SQL Injection vulnerability in the /html/funcionario/dependente_remover.php end… |
CVE-2025-57755 | | 2025-08-21 | claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due to improper Cross-Origin Resource Sharin… | |
CVE-2025-57754 | Critical | 9.8 | 2025-08-21 | eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI wit… |
CVE-2025-55522 | Medium | 6.5 | 2025-08-21 | Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scripts or HTML via in… |
CVE-2025-55521 | Medium | 6.5 | 2025-08-21 | An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service (DoS) via a crafted POST requ… |
CVE-2025-43756 | Medium | 5.4 | 2025-08-21 | <!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, a… |
CVE-2025-43755 | Medium | 5.4 | 2025-08-21 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0… |
CVE-2025-9308 | Low | 3.3 | 2025-08-21 | A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation l… |
CVE-2025-9307 | High | 7.3 | 2025-08-21 | A flaw has been found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /admin/session.php. This manipulation of the a… |
CVE-2025-9306 | Low | 3.5 | 2025-08-21 | A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/notice… |
CVE-2025-9162 | Medium | 4.9 | 2025-08-21 | A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documen… |
CVE-2025-57753 | | 2025-08-21 | vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerabil… | |
CVE-2025-55744 | Medium | 4.3 | 2025-08-21 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, some of the endpoints of the application is… |
CVE-2025-55743 | High | 8.8 | 2025-08-21 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the image upload at the user creation featur… |
CVE-2025-55742 | High | 8.0 | 2025-08-21 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scriptin… |
CVE-2025-55420 | High | 8.8 | 2025-08-21 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6. When a crafted script is sent via a GET request, it is reflected… |
CVE-2025-52395 | Critical | 9.8 | 2025-08-21 | An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to valida… |
CVE-2025-9305 | High | 7.3 | 2025-08-21 | A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. The affected element is an unknown function of the file /bank/m… |
CVE-2025-9304 | High | 7.3 | 2025-08-21 | A weakness has been identified in SourceCodester Online Bank Management System 1.0. Impacted is an unknown function of the file /bank/show.php. Executing manip… |
CVE-2025-9303 | High | 8.8 | 2025-08-21 | A security flaw has been discovered in TOTOLINK A720R 4.1.5cu.630_B20250509. This issue affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi… |
CVE-2025-55383 | High | 8.6 | 2025-08-21 | Moss before v0.15 has a file upload vulnerability. The "upload" function configuration allows attackers to upload files of any extension to any location on the… |
CVE-2025-55371 | Medium | 5.3 | 2025-08-21 | Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the h… |
CVE-2025-55297 | High | 8.8 | 2025-08-21 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. The BluFi example bundled in ESP-IDF was vulnerable to memory overflows in two areas… |
CVE-2025-53251 | Critical | 9.9 | 2025-08-21 | Unrestricted Upload of File with Dangerous Type vulnerability in An-Themes Pin WP pin-wp allows Upload a Web Shell to a Web Server.This issue affects Pin WP: f… |
CVE-2025-52194 | High | 7.5 | 2025-08-21 | A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio files. The vulnerabil… |
CVE-2025-50860 | Medium | 5.4 | 2025-08-21 | SQL Injection in the listdomains function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to access or manipulate database conten… |