2025 CVEs (page 21)
Page 21 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48609 | Critical | 9.1 | 2026-03-02 | In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a pa… |
CVE-2025-48605 | High | 8.4 | 2026-03-02 | In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation… |
CVE-2025-48602 | High | 8.4 | 2026-03-02 | In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This… |
CVE-2025-48587 | Medium | 6.2 | 2026-03-02 | In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
CVE-2025-48585 | Medium | 6.2 | 2026-03-02 | In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
CVE-2025-48582 | High | 8.4 | 2026-03-02 | In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect. This could lead to loc… |
CVE-2025-48579 | High | 8.4 | 2026-03-02 | In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confused deputy. This could lead to local es… |
CVE-2025-48578 | High | 7.8 | 2026-03-02 | In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a missing permission check. This co… |
CVE-2025-48577 | High | 7.4 | 2026-03-02 | In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privi… |
CVE-2025-48574 | High | 8.4 | 2026-03-02 | In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check. This c… |
CVE-2025-48568 | High | 7.4 | 2026-03-02 | In multiple locations, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privilege with no additional execu… |
CVE-2025-48567 | High | 7.8 | 2026-03-02 | In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normaliza… |
CVE-2025-32313 | High | 8.4 | 2026-03-02 | In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege… |
CVE-2025-70252 | High | 7.5 | 2026-03-02 | An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. If the conditions are met to sprintf… |
CVE-2025-64427 | High | 7.1 | 2026-03-02 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or re… |
CVE-2025-59603 | High | 7.8 | 2026-03-02 | Memory Corruption when processing invalid user address with nonstandard buffer address. |
CVE-2025-59600 | High | 7.8 | 2026-03-02 | Memory Corruption when adding user-supplied data without checking available buffer space. |
CVE-2025-47386 | High | 7.8 | 2026-03-02 | Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs. |
CVE-2025-47385 | High | 7.8 | 2026-03-02 | Memory Corruption when accessing trusted execution environment without proper privilege check. |
CVE-2025-47384 | Medium | 6.5 | 2026-03-02 | Transient DOS when MAC configures config id greater than supported maximum value. |
CVE-2025-47383 | High | 7.2 | 2026-03-02 | Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE. |
CVE-2025-47381 | High | 7.8 | 2026-03-02 | Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs. |
CVE-2025-47379 | High | 7.8 | 2026-03-02 | Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources. |
CVE-2025-47378 | High | 7.1 | 2026-03-02 | Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain. |
CVE-2025-47377 | High | 7.8 | 2026-03-02 | Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls. |
CVE-2025-47376 | High | 7.8 | 2026-03-02 | Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls. |
CVE-2025-47375 | High | 7.8 | 2026-03-02 | Memory corruption while handling different IOCTL calls from the user-space simultaneously. |
CVE-2025-47373 | High | 7.8 | 2026-03-02 | Memory Corruption when accessing buffers with invalid length during TA invocation. |
CVE-2025-47371 | Medium | 6.5 | 2026-03-02 | Transient DOS when an LTE RLC packet with invalid TB is received by UE. |
CVE-2025-66880 | Medium | 6.1 | 2026-03-02 | Cross Site Scripting vulnerability in Wethink Technology Inc 720yun pano-sdk 0.5.877 allows a remote attacker to execute arbitrary code via the LoginComp (Modu… |
CVE-2025-52998 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attack… |
CVE-2025-52564 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacke… |
CVE-2025-52563 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to insufficient sanitizati… |
CVE-2025-52476 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to improper sanitization o… |
CVE-2025-52475 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability in the admin/user_list.php end… |
CVE-2025-52470 | Medium | 4.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists in the session_category_add.php scr… |
CVE-2025-52469 | High | 7.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allo… |
CVE-2025-52468 | High | 8.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw… |
CVE-2025-50199 | Critical | 9.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This is… |
CVE-2025-50198 | Medium | 4.9 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import… |
CVE-2025-50197 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via… |
CVE-2025-50196 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php vi… |
CVE-2025-50195 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/manage.controller.p… |
CVE-2025-50194 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/cron/lang/check_parse_lang.php. This… |
CVE-2025-50193 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the… |
CVE-2025-65465 | Medium | 6.1 | 2026-03-02 | A reflected Cross-Site Scripting (XSS) vulnerability in the RaiseError function of Skrol29 TbsZip version 2.17 and earlier allows remote attackers to execute a… |
CVE-2025-58107 | High | 7.5 | 2026-03-02 | In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in… |
CVE-2025-52482 | High | 8.3 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teac… |
CVE-2025-50192 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. Thi… |
CVE-2025-50191 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes… |
CVE-2025-50190 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /in… |
CVE-2025-50189 | High | 8.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST… |
CVE-2025-50188 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET v… |
CVE-2025-50187 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execut… |
CVE-2025-50186 | Medium | 4.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists due to insufficient sanitization of… |
CVE-2025-14532 | Critical | 9.8 | 2026-03-02 | DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result… |
CVE-2025-12462 | | 2026-03-02 | A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in multiple… | |
CVE-2025-58406 | Medium | 4.3 | 2026-03-02 | The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe… |
CVE-2025-58405 | Medium | 6.1 | 2026-03-02 | The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting pr… |
CVE-2025-58402 | High | 7.5 | 2026-03-02 | The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET… |
CVE-2025-30062 | | 2026-03-02 | In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection. | |
CVE-2025-30044 | | 2026-03-02 | In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl"… | |
CVE-2025-30042 | High | 7.8 | 2026-03-02 | The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certif… |
CVE-2025-30035 | | 2026-03-02 | The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username… | |
CVE-2025-10350 | | 2026-03-02 | SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to… | |
CVE-2025-15597 | Medium | 6.3 | 2026-03-02 | A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the compone… |
CVE-2025-13673 | High | 7.5 | 2026-02-28 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to… |
CVE-2025-69437 | High | 8.7 | 2026-02-27 | PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsF… |
CVE-2025-15498 | | 2026-02-27 | Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass auth… | |
CVE-2025-10990 | High | 7.5 | 2026-02-27 | A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x… |
CVE-2025-11950 | Medium | 6.3 | 2026-02-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KNOWHY Advanced Technology Trading Ltd. Co. EduAsi… |
CVE-2025-11252 | Critical | 9.8 | 2026-02-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm… |
CVE-2025-11251 | Critical | 9.8 | 2026-02-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platf… |
CVE-2025-14142 | Medium | 6.4 | 2026-02-27 | The Electric Enquiries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button' parameter of the electric-enquiry shortcode in all ve… |
CVE-2025-12150 | Low | 3.1 | 2026-02-27 | A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register… |
CVE-2025-9909 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of mi… |
CVE-2025-9908 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain… |
CVE-2025-9907 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive clien… |
CVE-2025-9572 | Medium | 5.0 | 2026-02-27 | n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which corr… |
CVE-2025-13327 | Medium | 6.3 | 2026-02-27 | A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zi… |
CVE-2025-15567 | Low | 3.3 | 2026-02-27 | Insufficient protection mechanisms in the Health Module may lead to partial information disclosure. |
CVE-2025-15509 | Medium | 4.3 | 2026-02-27 | The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage. |
CVE-2025-14149 | Medium | 6.4 | 2026-02-27 | The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link… |
CVE-2025-14040 | Medium | 6.4 | 2026-02-27 | The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Call to Action' custom fields in all… |
CVE-2025-12981 | Critical | 9.8 | 2026-02-27 | The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This is due to a broken validation check in t… |
CVE-2025-40932 | High | 8.2 | 2026-02-27 | Apache::SessionX versions through 2.01 for Perl create insecure session id. Apache::SessionX generates session ids insecurely. The default session id generato… |
CVE-2025-50857 | Critical | 9.8 | 2026-02-26 | ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a craft… |
CVE-2025-71057 | High | 8.2 | 2026-02-26 | Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing th… |
CVE-2025-56605 | Medium | 5.4 | 2026-02-26 | A reflected Cross-Site Scripting (XSS) vulnerability exists in the register.php backend script of PuneethReddyHC Event Management System 1.0. The mobile POST p… |
CVE-2025-14343 | High | 7.6 | 2026-02-26 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology Ltd. E-Commerce Product allow… |
CVE-2025-64999 | Medium | 5.4 | 2026-02-26 | Improper neutralization of input in Checkmk versions 2.4.0 before 2.4.0p22, and 2.3.0 before 2.3.0p43 allows an attacker that can manipulate a host's check out… |
CVE-2025-14511 | High | 7.5 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allow… |
CVE-2025-3525 | Medium | 6.5 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have, under… |
CVE-2025-14103 | Medium | 4.3 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allow… |
CVE-2025-69771 | Critical | 9.6 | 2026-02-25 | Cross-Site Scripting (XSS) vulnerability in the subtitle loading function of the asbplayer Chrome Extension version 1.14.0 allows attackers to execute arbitrar… |
CVE-2025-50180 | High | 7.5 | 2026-02-25 | esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to… |
CVE-2025-1242 | Critical | 9.1 | 2026-02-25 | The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineer… |
CVE-2025-67860 | Low | 3.8 | 2026-02-25 | A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller credentials as command-line arguments, p… |
CVE-2025-67601 | High | 8.3 | 2026-02-25 | A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login… |
CVE-2025-62878 | Critical | 9.9 | 2026-02-25 | A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensiti… |