2025 CVEs (page 217)
Page 217 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9051 | High | 7.3 | 2025-08-15 | A vulnerability was determined in projectworlds Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /updatecategory… |
CVE-2025-9050 | High | 7.3 | 2025-08-15 | A vulnerability was found in projectworlds Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /addcategory.ph… |
CVE-2025-54475 | | 2025-08-15 | A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands. | |
CVE-2025-54474 | | 2025-08-15 | A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands. | |
CVE-2025-54473 | | 2025-08-15 | An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the… | |
CVE-2025-1929 | High | 7.2 | 2025-08-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Risk Yazılım Teknolojileri Ltd. Şti. Reel Sektör Hazine v… |
CVE-2025-9047 | High | 7.3 | 2025-08-15 | A vulnerability has been found in projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /visitor_out.php. The manipulation o… |
CVE-2025-9046 | High | 8.8 | 2025-08-15 | A vulnerability was identified in Tenda AC20 16.03.08.12. This issue affects the function sub_46A2AC of the file /goform/setMacFilterCfg. The manipulation of t… |
CVE-2025-9028 | High | 7.3 | 2025-08-15 | A flaw has been found in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /adphar.php. Executing manipulation of th… |
CVE-2025-26709 | Medium | 5.7 | 2025-08-15 | There is an unauthorized access vulnerability in ZTE F50. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain s… |
CVE-2025-9027 | High | 7.3 | 2025-08-15 | A vulnerability has been found in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /addelivery.php. The manipulatio… |
CVE-2025-9026 | High | 7.3 | 2025-08-15 | A vulnerability was identified in D-Link DIR-860L 2.04.B04. This affects the function ssdpcgi_main of the file htdocs/cgibin of the component Simple Service Di… |
CVE-2025-9025 | Medium | 6.3 | 2025-08-15 | A vulnerability was determined in code-projects Simple Cafe Ordering System 1.0. Affected by this issue is some unknown functionality of the file /portal.php… |
CVE-2025-9024 | High | 7.3 | 2025-08-15 | A vulnerability was found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the file /book-appo… |
CVE-2025-9023 | High | 8.8 | 2025-08-15 | A vulnerability has been found in Tenda AC7 and AC18 15.03.05.19/15.03.06.44. Affected is the function formSetSchedLed of the file /goform/SetLEDCfg. The manip… |
CVE-2025-8905 | Medium | 6.3 | 2025-08-15 | The Inpersttion For Theme plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the theme_section_shortcode… |
CVE-2025-8720 | Medium | 6.4 | 2025-08-15 | The Plugin README Parser plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘target’ parameter in all versions up to, and including, 1.3… |
CVE-2025-8091 | Medium | 4.3 | 2025-08-15 | The EventON Lite plugin for WordPress is vulnerable to Information Exposure in all versions less than, or equal to, 2.4.6 via the add_single_eventon and add_ev… |
CVE-2025-8080 | Medium | 4.4 | 2025-08-15 | The Alobaidi Captcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.3 due… |
CVE-2025-7778 | Critical | 9.8 | 2025-08-15 | The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delet… |
CVE-2025-7688 | Medium | 6.1 | 2025-08-15 | The Add User Meta plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incor… |
CVE-2025-7662 | Medium | 6.5 | 2025-08-15 | The Gestion de tarifs plugin for WordPress is vulnerable to SQL Injection via the 'tarif' and 'intitule' shortcodes in all versions up to, and including, 1.4 d… |
CVE-2025-7650 | High | 7.5 | 2025-08-15 | The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.0.53 via the 'bizcalv' shortcode. This… |
CVE-2025-7641 | High | 7.5 | 2025-08-15 | The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/n… |
CVE-2025-7507 | Medium | 6.4 | 2025-08-15 | The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not r… |
CVE-2025-5844 | Medium | 6.4 | 2025-08-15 | The Radius Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subHeadingTagName’ parameter in all versions up to, and including… |
CVE-2025-9022 | High | 7.3 | 2025-08-15 | A vulnerability was identified in SourceCodester Online Bank Management System up to 1.0. This issue affects some unknown processing of the file /bank/statemen… |
CVE-2025-9021 | High | 7.3 | 2025-08-15 | A vulnerability was determined in SourceCodester Online Bank Management System up to 1.0. This vulnerability affects unknown code of the file /bank/transfer.ph… |
CVE-2025-9020 | Medium | 4.5 | 2025-08-15 | A vulnerability was found in PX4 PX4-Autopilot up to 1.15.4. This issue affects the function MavlinkReceiver::handle_message_serial_control of the file src/mod… |
CVE-2025-8604 | Medium | 6.4 | 2025-08-15 | The WP Table Builder – WordPress Table Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wptb shortcode in all versions… |
CVE-2025-9019 | Low | 3.1 | 2025-08-15 | A vulnerability has been found in tcpreplay 4.5.1. This vulnerability affects the function mask_cidr6 of the file cidr.c of the component tcpprep. The manipula… |
CVE-2025-9017 | Medium | 4.3 | 2025-08-15 | A vulnerability has been found in PHPGurukul Zoo Management System 2.1. This vulnerability affects unknown code of the file /admin/add-foreigner-ticket.php. Th… |
CVE-2025-9016 | High | 7.0 | 2025-08-15 | A vulnerability was identified in Mechrevo Control Center GX V2 5.56.51.48. This affects an unknown part of the file C:\Program Files\OEM\机械革命控制中心\AiStoneServi… |
CVE-2025-8451 | Medium | 6.4 | 2025-08-15 | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the… |
CVE-2025-8013 | Low | 3.8 | 2025-08-15 | The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the 'RunEx… |
CVE-2025-6679 | Critical | 9.8 | 2025-08-15 | The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.2… |
CVE-2025-9013 | High | 7.3 | 2025-08-15 | A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.0. This vulnerability affects unknown code of the file /shopping/password-recover… |
CVE-2025-9012 | High | 7.3 | 2025-08-15 | A vulnerability was identified in PHPGurukul Online Shopping Portal Project 2.0. This affects an unknown part of the file shopping/bill-ship-addresses.php. The… |
CVE-2025-9011 | High | 7.3 | 2025-08-15 | A vulnerability was determined in PHPGurukul Online Shopping Portal Project 2.0. Affected by this issue is some unknown functionality of the file /shopping/sig… |
CVE-2025-9010 | High | 7.3 | 2025-08-15 | A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-9009 | High | 7.3 | 2025-08-15 | A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/email_setup.php… |
CVE-2025-31961 | Low | 3.7 | 2025-08-15 | HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. |
CVE-2025-9008 | High | 7.3 | 2025-08-15 | A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/sms_… |
CVE-2025-9007 | High | 8.8 | 2025-08-15 | A vulnerability has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formeditFileName of the file /goform/editFileName. The manipulatio… |
CVE-2025-9006 | High | 8.8 | 2025-08-15 | A vulnerability was identified in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function formdelFileName of the file /goform/delFileName. The manip… |
CVE-2025-9005 | Low | 3.7 | 2025-08-15 | A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to information exposur… |
CVE-2025-9004 | Low | 3.7 | 2025-08-15 | A vulnerability was found in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /settings/password. The manipulation leads to impr… |
CVE-2025-9003 | Low | 3.5 | 2025-08-15 | A vulnerability has been found in D-Link DIR-818LW 1.04. This vulnerability affects unknown code of the file /bsc_lan.php of the component DHCP Reserved Addres… |
CVE-2025-9002 | High | 7.3 | 2025-08-15 | A vulnerability was identified in Surbowl dormitory-management-php 1.0. This affects an unknown part of the file login.php. The manipulation of the argument Ac… |
CVE-2025-9001 | Medium | 5.3 | 2025-08-15 | A vulnerability was determined in LemonOS up to nightly-2024-07-12 on LemonOS. Affected by this issue is the function HTTPGet of the file /Applications/Steal/m… |
CVE-2025-8867 | Medium | 6.4 | 2025-08-15 | The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget parameters in version 3… |
CVE-2025-8680 | Medium | 4.3 | 2025-08-15 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the… |
CVE-2025-8676 | Medium | 4.3 | 2025-08-15 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in versions less than, or equal to, 2.0.0 via… |
CVE-2025-8342 | High | 8.1 | 2025-08-15 | The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value check… |
CVE-2025-6025 | High | 7.5 | 2025-08-15 | The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This… |
CVE-2025-9000 | High | 7.0 | 2025-08-15 | A vulnerability was found in Mechrevo Control Center GX V2 5.56.51.48. Affected by this vulnerability is an unknown functionality of the component reg File Han… |
CVE-2025-8993 | High | 7.3 | 2025-08-15 | A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/expense_report.php. The… |
CVE-2025-8992 | Medium | 4.3 | 2025-08-15 | A vulnerability has been found in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request f… |
CVE-2025-8991 | Medium | 4.3 | 2025-08-15 | A vulnerability was identified in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file /admin/config/express… |
CVE-2025-8990 | High | 7.3 | 2025-08-15 | A vulnerability was determined in code-projects Online Medicine Guide 1.0. Affected is an unknown function of the file /browsemdcn.php. The manipulation of the… |
CVE-2025-8989 | High | 7.3 | 2025-08-15 | A vulnerability was found in SourceCodester COVID 19 Testing Management System 1.0. This issue affects some unknown processing of the file /edit-phlebotomist.p… |
CVE-2025-8988 | High | 7.3 | 2025-08-14 | A vulnerability has been found in SourceCodester COVID 19 Testing Management System 1.0. This vulnerability affects unknown code of the file /bwdates-report-re… |
CVE-2025-8987 | High | 7.3 | 2025-08-14 | A vulnerability was identified in SourceCodester COVID 19 Testing Management System 1.0. This affects an unknown part of the file /test-details.php. The manipu… |
CVE-2025-31987 | Medium | 4.8 | 2025-08-14 | HCL Connections Docs may mishandle validation of certain uploaded documents leading to denial of service due to resource exhaustion. |
CVE-2025-8986 | High | 7.3 | 2025-08-14 | A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /sear… |
CVE-2025-8985 | High | 7.3 | 2025-08-14 | A vulnerability was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /pro… |
CVE-2025-8984 | High | 7.3 | 2025-08-14 | A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/operations/expe… |
CVE-2025-8983 | High | 7.3 | 2025-08-14 | A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/oper… |
CVE-2025-8982 | High | 7.3 | 2025-08-14 | A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operati… |
CVE-2025-8981 | High | 7.3 | 2025-08-14 | A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/operations/payment.php… |
CVE-2025-8980 | Medium | 6.6 | 2025-08-14 | A vulnerability has been found in Tenda G1 16.01.7.8(3660). Affected by this issue is the function check_upload_file of the component Firmware Update Handler… |
CVE-2025-8979 | Medium | 6.6 | 2025-08-14 | A vulnerability was identified in Tenda AC15 15.13.07.13. Affected by this vulnerability is the function check_fw_type/split_fireware/check_fw of the component… |
CVE-2025-51965 | Medium | 6.1 | 2025-08-14 | OURPHP thru 8.6.1 is vulnerable to Cross-Site Scripting (XSS) via the "Name" field of the "Complete Profile" functionality under the "My User Center" page, whi… |
CVE-2025-50862 | Medium | 5.9 | 2025-08-14 | The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 has allowBackup=true set in its manifest, allowing data exfiltration via ADB backup on rooted or… |
CVE-2025-50861 | Medium | 6.5 | 2025-08-14 | The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication… |
CVE-2025-8978 | Medium | 6.6 | 2025-08-14 | A vulnerability was determined in D-Link DIR-619L 6.02CN02. Affected is the function FirmwareUpgrade of the component boa. The manipulation leads to insufficie… |
CVE-2025-8976 | Low | 3.5 | 2025-08-14 | A vulnerability has been found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/index.php?module=content/post&type=p… |
CVE-2025-8975 | Low | 3.5 | 2025-08-14 | A vulnerability was identified in givanz Vvveb up to 1.0.5. This affects an unknown part of the file admin/template/content/edit.tpl. The manipulation of the a… |
CVE-2025-55716 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in VeronaLabs WP Statistics wp-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-55714 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows… |
CVE-2025-55713 | Medium | 5.9 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativethemeshq Blocksy blocksy allows Stored XSS.This i… |
CVE-2025-55712 | Medium | 6.5 | 2025-08-14 | Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Exploiting In… |
CVE-2025-55711 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder wp-table-builder allows… |
CVE-2025-55710 | Medium | 4.3 | 2025-08-14 | Insertion of Sensitive Information Into Sent Data vulnerability in Steve Burge TaxoPress simple-tags allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2025-55709 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcom… |
CVE-2025-55708 | High | 8.5 | 2025-08-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-ne… |
CVE-2025-54749 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery jet-woo-product-gallery allo… |
CVE-2025-54747 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbakery Templatera templatera allows DOM-Based XSS.This… |
CVE-2025-54746 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj Shortcode Redirect shortcode-redirect allows Sto… |
CVE-2025-54740 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Nelson Print My Blog print-my-blog allows Stored… |
CVE-2025-54739 | Medium | 5.3 | 2025-08-14 | Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-54736 | Medium | 5.3 | 2025-08-14 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NordicMade Savoy savoy allows Retrieve Embedded Sensitive Data.This… |
CVE-2025-54732 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Cross Site Request Forgery.This issue affects… |
CVE-2025-54730 | Medium | 5.3 | 2025-08-14 | Missing Authorization vulnerability in PARETO Digital Embedder for Google Reviews embedder-for-google-reviews allows Accessing Functionality Not Properly Const… |
CVE-2025-54729 | Medium | 5.9 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webba Appointment Booking Webba Booking webba-booking-lit… |
CVE-2025-54728 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Cross Site Req… |
CVE-2025-54727 | Medium | 5.9 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm… |
CVE-2025-54717 | Medium | 5.4 | 2025-08-14 | Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-54715 | Medium | 4.9 | 2025-08-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventor… |
CVE-2025-54712 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security… |