2025 CVEs (page 217)
Page 217 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-20238 | Medium | 6.0 | 2025-08-14 | A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an auth… |
CVE-2025-20237 | Medium | 6.0 | 2025-08-14 | A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an auth… |
CVE-2025-20235 | Medium | 6.1 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker… |
CVE-2025-20225 | Medium | 5.8 | 2025-08-14 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive Security Appliance (ASA… |
CVE-2025-20224 | Medium | 5.8 | 2025-08-14 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall T… |
CVE-2025-20222 | High | 8.6 | 2025-08-14 | A vulnerability in the RADIUS proxy feature for the IPsec VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Fire… |
CVE-2025-20220 | Medium | 6.0 | 2025-08-14 | A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an aut… |
CVE-2025-20219 | Medium | 5.3 | 2025-08-14 | A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and C… |
CVE-2025-20218 | Medium | 4.9 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker t… |
CVE-2025-20217 | High | 8.6 | 2025-08-14 | A vulnerability in the packet inspection functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an un… |
CVE-2025-20148 | High | 8.5 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker t… |
CVE-2025-20136 | High | 8.6 | 2025-08-14 | A vulnerability in the function that performs IPv4 and IPv6 Network Address Translation (NAT) DNS inspection for Cisco Secure Firewall Adaptive Security Applia… |
CVE-2025-20135 | Medium | 4.3 | 2025-08-14 | A vulnerability in the DHCP client functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (… |
CVE-2025-20134 | High | 8.6 | 2025-08-14 | A vulnerability in the certificate processing of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD… |
CVE-2025-20133 | High | 8.6 | 2025-08-14 | A vulnerability in the management and VPN web servers of the Remote Access SSL VPN feature of Cisco Secure Firewall ASA Software and Secure FTD Software could… |
CVE-2025-20127 | High | 7.7 | 2025-08-14 | A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firew… |
CVE-2025-8967 | High | 7.3 | 2025-08-14 | A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/operations/pack… |
CVE-2025-8966 | High | 7.3 | 2025-08-14 | A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operation… |
CVE-2025-8965 | Medium | 6.3 | 2025-08-14 | A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/… |
CVE-2025-54867 | High | 7.0 | 2025-08-14 | Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to… |
CVE-2025-54409 | Medium | 6.2 | 2025-08-14 | AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can c… |
CVE-2025-54389 | Medium | 6.2 | 2025-08-14 | AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker ca… |
CVE-2025-53631 | Medium | 5.4 | 2025-08-14 | flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createpost leads… |
CVE-2025-50518 | Critical | 9.8 | 2025-08-14 | A use-after-free vulnerability exists in the coap_delete_pdu_lkd function within coap_pdu.c of the libcoap library. This issue occurs due to improper handling… |
CVE-2025-36047 | Medium | 5.3 | 2025-08-14 | IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remot… |
CVE-2025-33142 | Medium | 5.3 | 2025-08-14 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections. |
CVE-2025-9042 | | 2025-08-14 | A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a f… | |
CVE-2025-9041 | | 2025-08-14 | A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a f… | |
CVE-2025-8964 | Medium | 5.3 | 2025-08-14 | A vulnerability was identified in code-projects Hostel Management System 1.0. This affects an unknown part of the file hostel_manage.exe of the component Login… |
CVE-2025-8962 | Medium | 5.3 | 2025-08-14 | A vulnerability was found in code-projects Hostel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file hostel_manage.e… |
CVE-2025-8876 | High | 8.8 | 2025-08-14 | Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1. |
CVE-2025-8875 | High | 7.8 | 2025-08-14 | Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1. |
CVE-2025-7972 | Critical | 9.1 | 2025-08-14 | A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP toke… |
CVE-2025-7971 | | 2025-08-14 | A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Des… | |
CVE-2025-43983 | Critical | 9.1 | 2025-08-14 | KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform_set_cmd_process and goform/gofor… |
CVE-2025-40758 | High | 8.7 | 2025-08-14 | A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4… |
CVE-2025-38745 | Medium | 4.8 | 2025-08-14 | Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Rest… |
CVE-2025-38738 | Medium | 6.7 | 2025-08-14 | SupportAssist for Home PCs Installer exe version(s) 4.8.2.29006 and prior, contain(s) an Incorrect Privilege Assignment vulnerability in the Installer. A low p… |
CVE-2025-36613 | Low | 2.8 | 2025-08-14 | SupportAssist for Home PCs versions 4.6.3 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment v… |
CVE-2025-36612 | Medium | 6.7 | 2025-08-14 | SupportAssist for Business PCs, version(s) 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local ac… |
CVE-2025-27847 | Medium | 4.3 | 2025-08-14 | In ESPEC North America Web Controller 3 before 3.3.8, /api/v4/auth/ users session privileges are not revoked on logout. |
CVE-2025-27846 | Medium | 4.3 | 2025-08-14 | In ESPEC North America Web Controller 3 before 3.3.8, an attacker with physical access can gain elevated privileges because GRUB and the BIOS are unprotected. |
CVE-2025-27845 | Critical | 9.8 | 2025-08-14 | In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret. This allows for e… |
CVE-2025-26484 | Medium | 5.5 | 2025-08-14 | Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privileged attacker with re… |
CVE-2025-9036 | | 2025-08-14 | A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and… | |
CVE-2025-7973 | | 2025-08-14 | A security issue exists in FactoryTalk ViewPoint version 14.0 or below due to improper handling of MSI repair operations. During a repair, attackers can hijack… | |
CVE-2025-7774 | | 2025-08-14 | A security issue exists within the 5032 16pt Digital Configurable module’s web server. Intercepted session credentials can be used within a 3-minute timeout wi… | |
CVE-2025-7773 | | 2025-08-14 | A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an interval that correlate… | |
CVE-2025-7353 | | 2025-08-14 | A security issue exists due to the web-based debugger agent enabled on Rockwell Automation ControlLogix® Ethernet Modules. If a specific IP address is used to… | |
CVE-2025-55675 | Medium | 6.5 | 2025-08-14 | Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to disco… |
CVE-2025-55674 | Medium | 6.5 | 2025-08-14 | A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special i… |
CVE-2025-55673 | Medium | 4.3 | 2025-08-14 | When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contain… |
CVE-2025-55672 | Medium | 5.4 | 2025-08-14 | A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can in… |
CVE-2025-43984 | Critical | 9.8 | 2025-08-14 | An issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0_20191211). They are vulnerable to unaut… |
CVE-2025-36581 | Low | 3.8 | 2025-08-14 | Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability. A low privileged… |
CVE-2025-8963 | Medium | 6.3 | 2025-08-14 | A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/te… |
CVE-2025-8961 | Low | 3.3 | 2025-08-14 | A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can le… |
CVE-2025-8715 | High | 8.8 | 2025-08-14 | Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the clie… |
CVE-2025-8714 | High | 8.8 | 2025-08-14 | Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the… |
CVE-2025-8713 | Low | 3.1 | 2025-08-14 | PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampl… |
CVE-2025-8960 | High | 7.3 | 2025-08-14 | A vulnerability has been found in Campcodes Online Flight Booking Management System 1.0. Affected by this issue is some unknown functionality of the file /admi… |
CVE-2025-8958 | High | 8.8 | 2025-08-14 | A vulnerability was identified in Tenda TX3 16.03.13.11_multi_TDE01. Affected by this vulnerability is an unknown functionality of the file /goform/fast_settin… |
CVE-2025-8957 | High | 7.3 | 2025-08-14 | A vulnerability was determined in Campcodes Online Flight Booking Management System 1.0. Affected is an unknown function of the file /flights.php. The manipula… |
CVE-2025-54707 | Critical | 9.3 | 2025-08-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter a… |
CVE-2025-54706 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Posts Display magical-posts-display all… |
CVE-2025-54705 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-54704 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons al… |
CVE-2025-54703 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Cross Site Request Forgery.This issue affec… |
CVE-2025-54702 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in motov.net Ebook Store ebook-store allows Cross Site Request Forgery.This issue affects Ebook Store: from n/a… |
CVE-2025-54701 | High | 8.1 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP L… |
CVE-2025-54700 | High | 8.1 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Makeaholic makeaholic allows… |
CVE-2025-54699 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masteriyo Masteriyo - LMS learning-management-system allo… |
CVE-2025-54698 | Medium | 5.4 | 2025-08-14 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RadiusTheme Classified Listing classified-listing allows Code In… |
CVE-2025-54697 | High | 7.2 | 2025-08-14 | Incorrect Privilege Assignment vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Privilege Escalation.Thi… |
CVE-2025-54696 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels allows Stored XSS.This issu… |
CVE-2025-54695 | Medium | 5.4 | 2025-08-14 | Missing Authorization vulnerability in DevItems HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-54694 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n… |
CVE-2025-54693 | Critical | 9.0 | 2025-08-14 | Unrestricted Upload of File with Dangerous Type vulnerability in epiphyt Form Block form-block allows Upload a Web Shell to a Web Server.This issue affects For… |
CVE-2025-54692 | High | 7.5 | 2025-08-14 | Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained… |
CVE-2025-54691 | Medium | 5.3 | 2025-08-14 | Authorization Bypass Through User-Controlled Key vulnerability in Stylemix Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Confi… |
CVE-2025-54690 | High | 8.1 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek Xinterio xinterio allows PHP… |
CVE-2025-54689 | High | 8.1 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Urna urna allows PHP Local Fil… |
CVE-2025-54688 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This is… |
CVE-2025-54687 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This iss… |
CVE-2025-54686 | Critical | 9.8 | 2025-08-14 | Deserialization of Untrusted Data vulnerability in scriptsbundle Exertio exertio allows Object Injection.This issue affects Exertio: from n/a through <= 1.3.2. |
CVE-2025-54685 | Medium | 6.5 | 2025-08-14 | Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force SureDash suredash allows Retrieve Embedded Sensitive Data.This issue affect… |
CVE-2025-54684 | Medium | 5.9 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks Integration for Contact Form 7 and Constant Con… |
CVE-2025-54683 | Medium | 5.9 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration wp-moda… |
CVE-2025-54682 | Medium | 5.4 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Cross Site Requ… |
CVE-2025-54681 | Medium | 4.7 | 2025-08-14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allo… |
CVE-2025-54680 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Blogger Buzz blogger-buzz allows Stored X… |
CVE-2025-54679 | High | 7.5 | 2025-08-14 | Missing Authorization vulnerability in vertim Neon Channel Product Customizer Free neon-channel-product-customizer-free allows Exploiting Incorrectly Configure… |
CVE-2025-54678 | Critical | 9.3 | 2025-08-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows… |
CVE-2025-54676 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress… |
CVE-2025-54675 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH WooCommerce Popup yith-woocommerce-popup allows Cross Site Request Forgery.This issue affects… |
CVE-2025-54674 | Medium | 5.4 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Cross Site Reques… |
CVE-2025-54673 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Chartify chart-builder allows Cross Site Request Forgery.This issue affects Chartify: from n/a throu… |
CVE-2025-54672 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in Jordy Meow Photo Engine wplr-sync allows Cross Site Request Forgery.This issue affects Photo Engine: from n/… |
CVE-2025-54671 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide oik oik allows Cross Site Request Forgery.This issue affects oik: from n/a through <= 4.15.2. |
CVE-2025-54669 | Critical | 9.3 | 2025-08-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RomanCode MapSVG mapsvg allows SQL Injection.This issue a… |