2025 CVEs (page 210)
Page 210 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-51991 | High | 8.8 | 2025-08-20 | XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info fie… |
CVE-2025-51990 | Medium | 4.8 | 2025-08-20 | XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specifically under the… |
CVE-2025-50864 | Medium | 6.5 | 2025-08-20 | An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library inco… |
CVE-2025-43748 | Medium | 6.8 | 2025-08-20 | Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 thr… |
CVE-2025-36114 | Medium | 6.5 | 2025-08-20 | IBM QRadar SOAR Plugin App 1.0.0 through 5.6.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted… |
CVE-2025-1142 | Medium | 5.4 | 2025-08-20 | IBM Edge Application Manager 4.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests fr… |
CVE-2025-1139 | Medium | 6.1 | 2025-08-20 | IBM Edge Application Manager 4.5 could allow a local user to read or modify resources that they should not have authorization to access due to incorrect permis… |
CVE-2025-9074 | | 2025-08-20 | A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, a… | |
CVE-2025-8449 | | 2025-08-20 | CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted reque… | |
CVE-2025-8448 | | 2025-08-20 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when… | |
CVE-2025-55503 | High | 7.3 | 2025-08-20 | Tenda AC6 V15.03.06.23_multi has a stack overflow vulnerability via the deviceName parameter in the saveParentControlInfo function. |
CVE-2025-55499 | Medium | 6.5 | 2025-08-20 | Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the ntpServer parameter in the fromSetSysTime function. |
CVE-2025-55483 | High | 7.5 | 2025-08-20 | Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the function formSetMacFilterCfg via the parameters macFilterType and deviceList. |
CVE-2025-54927 | Medium | 4.9 | 2025-08-20 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive f… |
CVE-2025-54926 | High | 7.2 | 2025-08-20 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an auth… |
CVE-2025-54925 | High | 7.5 | 2025-08-20 | CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the applica… |
CVE-2025-54924 | High | 7.5 | 2025-08-20 | CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially craf… |
CVE-2025-54923 | | 2025-08-20 | CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated us… | |
CVE-2025-50503 | High | 8.8 | 2025-08-20 | A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipul… |
CVE-2025-32010 | High | 8.1 | 2025-08-20 | A stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP response can lead t… |
CVE-2025-31355 | High | 7.2 | 2025-08-20 | A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted malicious file c… |
CVE-2025-30256 | High | 8.6 | 2025-08-20 | A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted series of HTTP requests… |
CVE-2025-27129 | Critical | 9.8 | 2025-08-20 | An authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP request can le… |
CVE-2025-24496 | High | 7.5 | 2025-08-20 | An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafted network packets c… |
CVE-2025-24322 | High | 8.1 | 2025-08-20 | An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted ne… |
CVE-2025-8453 | Medium | 6.7 | 2025-08-20 | CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privileged engineer user… |
CVE-2025-54175 | Medium | 6.1 | 2025-08-20 | QuickCMS.EXT is vulnerable to Reflected XSS in sFileName parameter in thumbnail viewer functionality. An attacker can craft a malicious URL that results in ar… |
CVE-2025-54174 | Medium | 4.3 | 2025-08-20 | QuickCMS is vulnerable to Cross-Site Request Forgery in article creation functionality. Malicious attacker can craft special website, which when visited by the… |
CVE-2025-54172 | Medium | 4.8 | 2025-08-20 | QuickCMS is vulnerable to Stored XSS in sTitle parameter in page editor functionality. Malicious attacker with admin privileges can inject arbitrary HTML and J… |
CVE-2025-4877 | Medium | 4.5 | 2025-08-20 | There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function… |
CVE-2025-4437 | Medium | 5.7 | 2025-08-20 | There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts… |
CVE-2025-43750 | Medium | 6.5 | 2025-08-20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-43749 | Medium | 5.3 | 2025-08-20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-8102 | Medium | 5.4 | 2025-08-20 | The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing… |
CVE-2025-7777 | Medium | 6.5 | 2025-08-20 | The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker to perform malicious redirects to atta… |
CVE-2025-43742 | Medium | 6.1 | 2025-08-20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 thro… |
CVE-2025-43741 | Medium | 5.4 | 2025-08-20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 thro… |
CVE-2025-57734 | Medium | 4.3 | 2025-08-20 | In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files |
CVE-2025-57733 | Medium | 5.5 | 2025-08-20 | In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content |
CVE-2025-57732 | High | 7.5 | 2025-08-20 | In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership |
CVE-2025-57731 | High | 8.7 | 2025-08-20 | In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content |
CVE-2025-57730 | Medium | 5.2 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature |
CVE-2025-57729 | Medium | 6.5 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start |
CVE-2025-57728 | Medium | 6.5 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files |
CVE-2025-57727 | Medium | 4.7 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference |
CVE-2025-9229 | Medium | 5.3 | 2025-08-20 | Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error informati… |
CVE-2025-9228 | Medium | 4.3 | 2025-08-20 | MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes w… |
CVE-2025-5261 | High | 7.5 | 2025-08-20 | Authorization Bypass Through User-Controlled Key vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Exploitation of Trusted Identifiers. Thi… |
CVE-2025-5260 | High | 8.6 | 2025-08-20 | Server-Side Request Forgery (SSRF) vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Server Side Request Forgery. This issue affects Pik On… |
CVE-2025-9225 | Medium | 5.5 | 2025-08-20 | Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots and MiR Fleet allows execution of arbitrary JavaSc… |
CVE-2025-55715 | High | 7.5 | 2025-08-20 | Insertion of Sensitive Information Into Sent Data vulnerability in Themeisle Otter - Gutenberg Block otter-blocks allows Retrieve Embedded Sensitive Data.This… |
CVE-2025-54750 | High | 7.5 | 2025-08-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Aman Funnel Builder by FunnelKit funne… |
CVE-2025-54735 | High | 8.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Privilege Escalation.This issue affects CubeWP: from n/a through <… |
CVE-2025-54726 | Critical | 9.3 | 2025-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget… |
CVE-2025-54713 | Critical | 9.8 | 2025-08-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows… |
CVE-2025-54677 | Critical | 9.1 | 2025-08-20 | Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita a… |
CVE-2025-54670 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik oik allows Reflected XSS.This issue affec… |
CVE-2025-54056 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playl… |
CVE-2025-54055 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Druco druco allows Reflected XSS.This issue affe… |
CVE-2025-54053 | Medium | 6.6 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in Adrian Tobey Groundhogg groundhogg allows Object Injection.This issue affects Groundhogg: from n/a through <… |
CVE-2025-54052 | High | 7.5 | 2025-08-20 | Cross-Site Request Forgery (CSRF) vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows PHP Local File Inclusion.This i… |
CVE-2025-54049 | Critical | 9.9 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP… |
CVE-2025-54048 | Critical | 9.3 | 2025-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL… |
CVE-2025-54046 | Medium | 6.5 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows St… |
CVE-2025-54044 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player all… |
CVE-2025-54040 | Medium | 6.5 | 2025-08-20 | Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-54034 | High | 7.5 | 2025-08-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Tribulant Software Newsletters newslet… |
CVE-2025-54032 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manage… |
CVE-2025-54031 | High | 8.1 | 2025-08-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Schiocco Support Board supportboard al… |
CVE-2025-54028 | High | 7.5 | 2025-08-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Saleswonder Team: Tobias CF7 WOW Style… |
CVE-2025-54027 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS… |
CVE-2025-54025 | Medium | 6.5 | 2025-08-20 | Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-54021 | High | 7.5 | 2025-08-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path T… |
CVE-2025-54019 | Medium | 6.5 | 2025-08-20 | Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a th… |
CVE-2025-54017 | High | 7.5 | 2025-08-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cozmoslabs Paid Member Subscriptions p… |
CVE-2025-54014 | Critical | 9.8 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Object Injection.This issue affects MediCe… |
CVE-2025-54012 | High | 7.2 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Object Injection.This issue affects Welcart e-Commerce: fr… |
CVE-2025-54008 | Medium | 6.5 | 2025-08-20 | Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Retrieve Embedded Sensitive Data.This is… |
CVE-2025-54007 | High | 8.8 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid an… |
CVE-2025-53998 | Medium | 6.5 | 2025-08-20 | Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2025-53993 | Medium | 6.5 | 2025-08-20 | Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetPopup jet-popup allows Retrieve Embedded Sensitive Data.This issue affects Jet… |
CVE-2025-53992 | Medium | 6.5 | 2025-08-20 | Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTricks jet-tricks allows Retrieve Embedded Sensitive Data.This issue affects J… |
CVE-2025-53988 | Medium | 6.5 | 2025-08-20 | Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This i… |
CVE-2025-53987 | Medium | 6.5 | 2025-08-20 | Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetMenu jet-menu allows Retrieve Embedded Sensitive Data.This issue affects JetMe… |
CVE-2025-53985 | Medium | 6.5 | 2025-08-20 | Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTabs jet-tabs allows Retrieve Embedded Sensitive Data.This issue affects JetTa… |
CVE-2025-53983 | Medium | 6.5 | 2025-08-20 | Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetElements For Elementor jet-elements allows Retrieve Embedded Sensitive Data.Th… |
CVE-2025-53580 | Critical | 9.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue… |
CVE-2025-53577 | Critical | 10.0 | 2025-08-20 | Improper Control of Generation of Code ('Code Injection') vulnerability in thehp Global DNS global-dns allows Remote Code Inclusion.This issue affects Global D… |
CVE-2025-53567 | High | 8.1 | 2025-08-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Ghost Kit ghostkit allows PHP Local… |
CVE-2025-53565 | High | 8.1 | 2025-08-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Widget for Google Reviews… |
CVE-2025-53564 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder A… |
CVE-2025-53563 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Youtube Vimeo Video Player and Slider video_… |
CVE-2025-53562 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery… |
CVE-2025-53561 | Medium | 6.5 | 2025-08-20 | Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path Traversal.This issue affects Prevent fil… |
CVE-2025-53560 | High | 8.8 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0. |
CVE-2025-53559 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery… |
CVE-2025-53319 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raptive Raptive Ads adthrive-ads allows Reflected XSS.Thi… |
CVE-2025-53299 | Critical | 9.8 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmm_content_composer allows Object Injection.This issue affe… |
CVE-2025-53226 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Comments Capcha Box comments-capcha-box… |
CVE-2025-53213 | Critical | 9.9 | 2025-08-20 | Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ReachShip WooCommerce Multi-Carrier & Conditional Shipping elex-reachship-multi-c… |