2025 CVEs (page 215)
Page 215 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8113 | Medium | 6.1 | 2025-08-16 | The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lea… |
CVE-2025-38501 | High | 7.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit repeated connections from clients with the same IP Repeated connections from… |
CVE-2025-8293 | Medium | 6.4 | 2025-08-16 | The Intl DateTime Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.0… |
CVE-2025-7686 | Medium | 6.1 | 2025-08-16 | The weichuncai(WP伪春菜) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or inc… |
CVE-2025-7684 | Medium | 6.1 | 2025-08-16 | The Last.fm Recent Album Artwork plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to m… |
CVE-2025-7683 | Medium | 6.1 | 2025-08-16 | The LatestCheckins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. This is due to missing or incorrec… |
CVE-2025-7668 | Medium | 6.1 | 2025-08-16 | The Linux Promotional Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing… |
CVE-2025-7664 | High | 7.5 | 2025-08-16 | The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback… |
CVE-2025-7651 | Medium | 6.4 | 2025-08-16 | The Earnware Connect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ew_hasrole' shortcode in all versions up to, and inclu… |
CVE-2025-7649 | Medium | 6.4 | 2025-08-16 | The Surbma | Recent Comments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'recent-comments' shortcode in all ve… |
CVE-2025-7441 | Critical | 9.8 | 2025-08-16 | The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the… |
CVE-2025-7440 | Medium | 6.4 | 2025-08-16 | The Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $item['button_link']['url'] parameter in all versions up to… |
CVE-2025-7439 | Medium | 6.4 | 2025-08-16 | Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $anber_item['button_link']['url']’ parameter in all versions up… |
CVE-2025-6221 | Medium | 6.4 | 2025-08-16 | The Embed Bokun plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 0.23 due to i… |
CVE-2025-6080 | High | 8.8 | 2025-08-16 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to, and including, 67… |
CVE-2025-6079 | High | 8.8 | 2025-08-16 | The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the homework.php… |
CVE-2025-3671 | High | 8.8 | 2025-08-16 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67.7.0 via the 'pa… |
CVE-2025-49895 | Medium | 6.5 | 2025-08-16 | Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy… |
CVE-2025-55284 | High | 7.5 | 2025-08-16 | Claude Code is an agentic coding tool. Prior to version 1.0.4, it's possible to bypass the Claude Code confirmation prompts to read a file and then send file c… |
CVE-2025-55286 | | 2025-08-16 | z2d is a pure Zig 2D graphics library. z2d v0.7.0 released with a new multi-sample anti-aliasing (MSAA) method, which uses a new buffering mechanism for storin… | |
CVE-2025-52621 | Medium | 5.3 | 2025-08-15 | HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its pre… |
CVE-2025-52620 | Medium | 4.3 | 2025-08-15 | HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequately validated the su… |
CVE-2025-52619 | Medium | 5.3 | 2025-08-15 | HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose sensitive version… |
CVE-2025-52618 | Medium | 4.3 | 2025-08-15 | HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. The vulnerability allows potential attackers to manipulate SQL queries. |
CVE-2025-43201 | Medium | 6.2 | 2025-08-15 | This issue was addressed with improved checks. This issue is fixed in Apple Music Classical 2.3 for Android. An app may be able to unexpectedly leak a user's c… |
CVE-2025-8959 | High | 7.5 | 2025-08-15 | HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated director… |
CVE-2025-36088 | Medium | 5.4 | 2025-08-15 | IBM TS4500 1.11.0.0-D00, 1.11.0.1-C00, 1.11.0.2-C00, and 1.10.00-F00 web GUI is vulnerable to cross-site scripting. This vulnerability allows an authenticated… |
CVE-2025-43490 | | 2025-08-15 | A potential security vulnerability has been identified in the HPAudioAnalytics service included in the HP Hotkey Support software, which might allow escalation… | |
CVE-2025-55285 | Low | 2.6 | 2025-08-15 | @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values… |
CVE-2025-9060 | Critical | 9.1 | 2025-08-15 | A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration… |
CVE-2025-8996 | Medium | 4.3 | 2025-08-15 | Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder Advanced Permissio… |
CVE-2025-8995 | Critical | 9.8 | 2025-08-15 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authentica… |
CVE-2025-8675 | High | 8.8 | 2025-08-15 | Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from… |
CVE-2025-8362 | Medium | 6.1 | 2025-08-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GoogleTag Manager allows Cross-Site Scripting (XSS… |
CVE-2025-8361 | High | 7.6 | 2025-08-15 | Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing. This issue affects Config Pages: from 0.0.0 before 2.18.0. |
CVE-2025-8092 | High | 7.6 | 2025-08-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scrip… |
CVE-2025-7961 | | 2025-08-15 | Improper Control of Generation of Code ('Code Injection') vulnerability in Wulkano KAP on MacOS allows TCC Bypass.This issue affects KAP: 3.6.0. | |
CVE-2025-8066 | | 2025-08-15 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bunkerity Bunker Web on Linux allows Phishing.This issue affects Bunker Web: 1.6.2. | |
CVE-2025-55207 | | 2025-08-15 | Astro is a web framework for content-driven websites. Following CVE-2025-54793 there's still an Open Redirect vulnerability in a subset of Astro deployment sce… | |
CVE-2025-49898 | High | 7.6 | 2025-08-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xolluteon Dropshix allows DOM-Based XSS.This issue affect… |
CVE-2025-49897 | High | 8.8 | 2025-08-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blin… |
CVE-2025-49432 | Medium | 5.3 | 2025-08-15 | Missing Authorization vulnerability in FWDesign Ultimate Video Player fwduvp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-5048 | High | 7.8 | 2025-08-15 | A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force a Memory Corruption vulnerability. A malicious actor can leverage this… |
CVE-2025-5047 | High | 7.8 | 2025-08-15 | A maliciously crafted DGN file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vu… |
CVE-2025-5046 | High | 7.8 | 2025-08-15 | A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage th… |
CVE-2025-55203 | Medium | 5.4 | 2025-08-15 | Plane is open-source project management software. Prior to version 0.28.0, a stored cross-site scripting (XSS) vulnerability exists in the description_html fie… |
CVE-2025-54989 | Medium | 5.3 | 2025-08-15 | Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulne… |
CVE-2025-54466 | Critical | 9.8 | 2025-08-15 | Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBi… |
CVE-2025-24975 | High | 7.1 | 2025-08-15 | Firebird is a relational database. Prior to snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609, Firebird is vulnerable if ExtConnPoolSize is not set equal… |
CVE-2025-9053 | High | 7.3 | 2025-08-15 | A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /updatesubcategory.php. The m… |
CVE-2025-9052 | High | 7.3 | 2025-08-15 | A vulnerability was identified in projectworlds Travel Management System 1.0. This affects an unknown part of the file /updatepackage.php. The manipulation of… |
CVE-2025-9051 | High | 7.3 | 2025-08-15 | A vulnerability was determined in projectworlds Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /updatecategory… |
CVE-2025-9050 | High | 7.3 | 2025-08-15 | A vulnerability was found in projectworlds Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /addcategory.ph… |
CVE-2025-54475 | | 2025-08-15 | A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands. | |
CVE-2025-54474 | | 2025-08-15 | A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands. | |
CVE-2025-54473 | | 2025-08-15 | An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the… | |
CVE-2025-1929 | High | 7.2 | 2025-08-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Risk Yazılım Teknolojileri Ltd. Şti. Reel Sektör Hazine v… |
CVE-2025-9047 | High | 7.3 | 2025-08-15 | A vulnerability has been found in projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /visitor_out.php. The manipulation o… |
CVE-2025-9046 | High | 8.8 | 2025-08-15 | A vulnerability was identified in Tenda AC20 16.03.08.12. This issue affects the function sub_46A2AC of the file /goform/setMacFilterCfg. The manipulation of t… |
CVE-2025-9028 | High | 7.3 | 2025-08-15 | A flaw has been found in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /adphar.php. Executing manipulation of th… |
CVE-2025-26709 | Medium | 5.7 | 2025-08-15 | There is an unauthorized access vulnerability in ZTE F50. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain s… |
CVE-2025-9027 | High | 7.3 | 2025-08-15 | A vulnerability has been found in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /addelivery.php. The manipulatio… |
CVE-2025-9026 | High | 7.3 | 2025-08-15 | A vulnerability was identified in D-Link DIR-860L 2.04.B04. This affects the function ssdpcgi_main of the file htdocs/cgibin of the component Simple Service Di… |
CVE-2025-9025 | Medium | 6.3 | 2025-08-15 | A vulnerability was determined in code-projects Simple Cafe Ordering System 1.0. Affected by this issue is some unknown functionality of the file /portal.php… |
CVE-2025-9024 | High | 7.3 | 2025-08-15 | A vulnerability was found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the file /book-appo… |
CVE-2025-9023 | High | 8.8 | 2025-08-15 | A vulnerability has been found in Tenda AC7 and AC18 15.03.05.19/15.03.06.44. Affected is the function formSetSchedLed of the file /goform/SetLEDCfg. The manip… |
CVE-2025-8905 | Medium | 6.3 | 2025-08-15 | The Inpersttion For Theme plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the theme_section_shortcode… |
CVE-2025-8720 | Medium | 6.4 | 2025-08-15 | The Plugin README Parser plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘target’ parameter in all versions up to, and including, 1.3… |
CVE-2025-8091 | Medium | 4.3 | 2025-08-15 | The EventON Lite plugin for WordPress is vulnerable to Information Exposure in all versions less than, or equal to, 2.4.6 via the add_single_eventon and add_ev… |
CVE-2025-8080 | Medium | 4.4 | 2025-08-15 | The Alobaidi Captcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.3 due… |
CVE-2025-7778 | Critical | 9.8 | 2025-08-15 | The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delet… |
CVE-2025-7688 | Medium | 6.1 | 2025-08-15 | The Add User Meta plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incor… |
CVE-2025-7662 | Medium | 6.5 | 2025-08-15 | The Gestion de tarifs plugin for WordPress is vulnerable to SQL Injection via the 'tarif' and 'intitule' shortcodes in all versions up to, and including, 1.4 d… |
CVE-2025-7650 | High | 7.5 | 2025-08-15 | The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.0.53 via the 'bizcalv' shortcode. This… |
CVE-2025-7641 | High | 7.5 | 2025-08-15 | The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/n… |
CVE-2025-7507 | Medium | 6.4 | 2025-08-15 | The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not r… |
CVE-2025-5844 | Medium | 6.4 | 2025-08-15 | The Radius Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subHeadingTagName’ parameter in all versions up to, and including… |
CVE-2025-9022 | High | 7.3 | 2025-08-15 | A vulnerability was identified in SourceCodester Online Bank Management System up to 1.0. This issue affects some unknown processing of the file /bank/statemen… |
CVE-2025-9021 | High | 7.3 | 2025-08-15 | A vulnerability was determined in SourceCodester Online Bank Management System up to 1.0. This vulnerability affects unknown code of the file /bank/transfer.ph… |
CVE-2025-9020 | Medium | 4.5 | 2025-08-15 | A vulnerability was found in PX4 PX4-Autopilot up to 1.15.4. This issue affects the function MavlinkReceiver::handle_message_serial_control of the file src/mod… |
CVE-2025-8604 | Medium | 6.4 | 2025-08-15 | The WP Table Builder – WordPress Table Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wptb shortcode in all versions… |
CVE-2025-9019 | Low | 3.1 | 2025-08-15 | A vulnerability has been found in tcpreplay 4.5.1. This vulnerability affects the function mask_cidr6 of the file cidr.c of the component tcpprep. The manipula… |
CVE-2025-9017 | Medium | 4.3 | 2025-08-15 | A vulnerability has been found in PHPGurukul Zoo Management System 2.1. This vulnerability affects unknown code of the file /admin/add-foreigner-ticket.php. Th… |
CVE-2025-9016 | High | 7.0 | 2025-08-15 | A vulnerability was identified in Mechrevo Control Center GX V2 5.56.51.48. This affects an unknown part of the file C:\Program Files\OEM\机械革命控制中心\AiStoneServi… |
CVE-2025-8451 | Medium | 6.4 | 2025-08-15 | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the… |
CVE-2025-8013 | Low | 3.8 | 2025-08-15 | The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the 'RunEx… |
CVE-2025-6679 | Critical | 9.8 | 2025-08-15 | The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.2… |
CVE-2025-9013 | High | 7.3 | 2025-08-15 | A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.0. This vulnerability affects unknown code of the file /shopping/password-recover… |
CVE-2025-9012 | High | 7.3 | 2025-08-15 | A vulnerability was identified in PHPGurukul Online Shopping Portal Project 2.0. This affects an unknown part of the file shopping/bill-ship-addresses.php. The… |
CVE-2025-9011 | High | 7.3 | 2025-08-15 | A vulnerability was determined in PHPGurukul Online Shopping Portal Project 2.0. Affected by this issue is some unknown functionality of the file /shopping/sig… |
CVE-2025-9010 | High | 7.3 | 2025-08-15 | A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-9009 | High | 7.3 | 2025-08-15 | A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/email_setup.php… |
CVE-2025-31961 | Low | 3.7 | 2025-08-15 | HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. |
CVE-2025-9008 | High | 7.3 | 2025-08-15 | A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/sms_… |
CVE-2025-9007 | High | 8.8 | 2025-08-15 | A vulnerability has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formeditFileName of the file /goform/editFileName. The manipulatio… |
CVE-2025-9006 | High | 8.8 | 2025-08-15 | A vulnerability was identified in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function formdelFileName of the file /goform/delFileName. The manip… |
CVE-2025-9005 | Low | 3.7 | 2025-08-15 | A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to information exposur… |
CVE-2025-9004 | Low | 3.7 | 2025-08-15 | A vulnerability was found in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /settings/password. The manipulation leads to impr… |
CVE-2025-9003 | Low | 3.5 | 2025-08-15 | A vulnerability has been found in D-Link DIR-818LW 1.04. This vulnerability affects unknown code of the file /bsc_lan.php of the component DHCP Reserved Addres… |
CVE-2025-9002 | High | 7.3 | 2025-08-15 | A vulnerability was identified in Surbowl dormitory-management-php 1.0. This affects an unknown part of the file login.php. The manipulation of the argument Ac… |