2025 CVEs (page 218)
Page 218 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54708 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows DOM-Based XSS.This issu… |
CVE-2025-54054 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list… |
CVE-2025-53587 | High | 8.8 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in ApusTheme Findgo findgo allows Cross Site Request Forgery.This issue affects Findgo: from n/a through <= 1.3… |
CVE-2025-53582 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordLift WordLift wordlift allows Stored XSS.This issue a… |
CVE-2025-53581 | Medium | 5.9 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artiosmedia RSS Feed Pro rss-feed-pro allows Stored XSS.T… |
CVE-2025-53575 | High | 7.1 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in primersoftware Primer MyData for Woocommerce primer-mydat… |
CVE-2025-53347 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in Laborator Kalium kalium allows Cross Site Request Forgery.This issue affects Kalium: from n/a through <= 3.1… |
CVE-2025-53343 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in GoodLayers Modernize modernize allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-53342 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Modernize modernize allows Stored XSS.This iss… |
CVE-2025-53341 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in Pixel Makers Creative INC. App, SaaS & Software Startup Tech Theme - Stratus allows Exploiting Incorrectly Configured Ac… |
CVE-2025-53330 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate WP Rentals wprentals allows Stored XSS.This issu… |
CVE-2025-53249 | Medium | 6.5 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App… |
CVE-2025-53241 | Medium | 5.5 | 2025-08-14 | Server-Side Request Forgery (SSRF) vulnerability in kodeshpa Simplified simplified allows Server Side Request Forgery.This issue affects Simplified: from n/a t… |
CVE-2025-53221 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in codeablepress CodeablePress codeablepress-simple-frontend-profile-picture-upload allows Exploiting Incorrectly Configure… |
CVE-2025-53219 | Medium | 5.4 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in pl4g4 WP-Database-Optimizer-Tools wp-database-optimizer-tools allows Cross Site Request Forgery.This issue a… |
CVE-2025-52797 | High | 8.2 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in josepsitjar StoryMap wp-storymap allows SQL Injection.This issue affects StoryMap: from n/a through <= 2.1. |
CVE-2025-52771 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bcupham Video Expander video-expander allows Stored XSS.T… |
CVE-2025-52769 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in flexostudio flexo-social-gallery flexo-social-gallery allows Cross Site Request Forgery.This issue affects f… |
CVE-2025-52767 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin netinsight-analytics-implementation-plugin allows Cross… |
CVE-2025-52765 | High | 7.1 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin netinsight-analytics-implementation-plugin allows Stored… |
CVE-2025-8974 | Low | 3.7 | 2025-08-14 | A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/ja… |
CVE-2025-8973 | High | 7.3 | 2025-08-14 | A vulnerability has been found in SourceCodester Cashier Queuing System 1.0. Affected is an unknown function of the file /Actions.php. The manipulation of the… |
CVE-2025-8972 | High | 7.3 | 2025-08-14 | A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/page… |
CVE-2025-52335 | Medium | 6.1 | 2025-08-14 | EyouCMS 1.7.3 is vulnerale to Cross Site Scripting (XSS) in index.php, which can be exploited to obtain sensitive information. |
CVE-2025-51986 | High | 7.5 | 2025-08-14 | An issue was discovered in the demo/LINUXTCP implementation of cwalter-at freemodbus v.2018-09-12 allowing attackers to reach an infinite loop via a crafted le… |
CVE-2025-21110 | Medium | 6.7 | 2025-08-14 | Dell Data Lakehouse, versions prior to 1.5.0.0, contains an Execution with Unnecessary Privileges vulnerability. A high privileged attacker with local access c… |
CVE-2025-9043 | | 2025-08-14 | The service executable path in Seagate Toolkit on Versions prior to 2.34.0.33 on Windows allows an attacker with Admin privileges to exploit a vulnerability as… | |
CVE-2025-9039 | Medium | 4.3 | 2025-08-14 | We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the i… |
CVE-2025-8971 | High | 7.3 | 2025-08-14 | A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operati… |
CVE-2025-8970 | High | 7.3 | 2025-08-14 | A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/operations/booking.php… |
CVE-2025-8969 | High | 7.3 | 2025-08-14 | A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-8968 | High | 7.3 | 2025-08-14 | A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-55195 | High | 7.3 | 2025-08-14 | @std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrust… |
CVE-2025-55192 | | 2025-08-14 | HomeAssistant-Tapo-Control offers Control for Tapo cameras as a Home Assistant component. Prior to commit 2a3b80f, there is a code injection vulnerability in t… | |
CVE-2025-50817 | Medium | 5.4 | 2025-08-14 | A vulnerability in the Python-Future 1.0.0 module allows for arbitrary code execution via the unintended import of a file named test.py. When the module is loa… |
CVE-2025-50515 | Medium | 6.5 | 2025-08-14 | An issue was discovered in phome Empirebak 2010 in ebak2008/upload/class/config.php allowing attackers to execute arbitrary code when the config file was loade… |
CVE-2025-20306 | Medium | 4.9 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker w… |
CVE-2025-20302 | Medium | 4.3 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, low-privileged, remote attacker to retrieve a… |
CVE-2025-20301 | Medium | 6.5 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, low-privileged, remote attacker to access trou… |
CVE-2025-20268 | Medium | 5.8 | 2025-08-14 | A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated… |
CVE-2025-20265 | Critical | 10.0 | 2025-08-14 | A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacke… |
CVE-2025-20263 | High | 8.6 | 2025-08-14 | A vulnerability in the web services interface of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD… |
CVE-2025-20254 | Medium | 5.8 | 2025-08-14 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall T… |
CVE-2025-20253 | High | 8.6 | 2025-08-14 | A vulnerability in the IKEv2 feature of Cisco IOS Software, IOS XE Software, Secure Firewall ASA Software, and Secure FTD Software could allow an unauthenticat… |
CVE-2025-20252 | Medium | 5.8 | 2025-08-14 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall T… |
CVE-2025-20251 | High | 8.5 | 2025-08-14 | A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defe… |
CVE-2025-20244 | High | 7.7 | 2025-08-14 | A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defe… |
CVE-2025-20243 | High | 8.6 | 2025-08-14 | A vulnerability in the management and VPN web servers of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote atta… |
CVE-2025-20239 | High | 8.6 | 2025-08-14 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive Security Appliance (ASA… |
CVE-2025-20238 | Medium | 6.0 | 2025-08-14 | A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an auth… |
CVE-2025-20237 | Medium | 6.0 | 2025-08-14 | A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an auth… |
CVE-2025-20235 | Medium | 6.1 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker… |
CVE-2025-20225 | Medium | 5.8 | 2025-08-14 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive Security Appliance (ASA… |
CVE-2025-20224 | Medium | 5.8 | 2025-08-14 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall T… |
CVE-2025-20222 | High | 8.6 | 2025-08-14 | A vulnerability in the RADIUS proxy feature for the IPsec VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Fire… |
CVE-2025-20220 | Medium | 6.0 | 2025-08-14 | A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an aut… |
CVE-2025-20219 | Medium | 5.3 | 2025-08-14 | A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and C… |
CVE-2025-20218 | Medium | 4.9 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker t… |
CVE-2025-20217 | High | 8.6 | 2025-08-14 | A vulnerability in the packet inspection functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an un… |
CVE-2025-20148 | High | 8.5 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker t… |
CVE-2025-20136 | High | 8.6 | 2025-08-14 | A vulnerability in the function that performs IPv4 and IPv6 Network Address Translation (NAT) DNS inspection for Cisco Secure Firewall Adaptive Security Applia… |
CVE-2025-20135 | Medium | 4.3 | 2025-08-14 | A vulnerability in the DHCP client functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (… |
CVE-2025-20134 | High | 8.6 | 2025-08-14 | A vulnerability in the certificate processing of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD… |
CVE-2025-20133 | High | 8.6 | 2025-08-14 | A vulnerability in the management and VPN web servers of the Remote Access SSL VPN feature of Cisco Secure Firewall ASA Software and Secure FTD Software could… |
CVE-2025-20127 | High | 7.7 | 2025-08-14 | A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firew… |
CVE-2025-8967 | High | 7.3 | 2025-08-14 | A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/operations/pack… |
CVE-2025-8966 | High | 7.3 | 2025-08-14 | A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operation… |
CVE-2025-8965 | Medium | 6.3 | 2025-08-14 | A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/… |
CVE-2025-54867 | High | 7.0 | 2025-08-14 | Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to… |
CVE-2025-54409 | Medium | 6.2 | 2025-08-14 | AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can c… |
CVE-2025-54389 | Medium | 6.2 | 2025-08-14 | AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker ca… |
CVE-2025-53631 | Medium | 5.4 | 2025-08-14 | flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createpost leads… |
CVE-2025-50518 | Critical | 9.8 | 2025-08-14 | A use-after-free vulnerability exists in the coap_delete_pdu_lkd function within coap_pdu.c of the libcoap library. This issue occurs due to improper handling… |
CVE-2025-36047 | Medium | 5.3 | 2025-08-14 | IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remot… |
CVE-2025-33142 | Medium | 5.3 | 2025-08-14 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections. |
CVE-2025-9042 | | 2025-08-14 | A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a f… | |
CVE-2025-9041 | | 2025-08-14 | A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a f… | |
CVE-2025-8964 | Medium | 5.3 | 2025-08-14 | A vulnerability was identified in code-projects Hostel Management System 1.0. This affects an unknown part of the file hostel_manage.exe of the component Login… |
CVE-2025-8962 | Medium | 5.3 | 2025-08-14 | A vulnerability was found in code-projects Hostel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file hostel_manage.e… |
CVE-2025-8876 | High | 8.8 | 2025-08-14 | Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1. |
CVE-2025-8875 | High | 7.8 | 2025-08-14 | Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1. |
CVE-2025-7972 | Critical | 9.1 | 2025-08-14 | A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP toke… |
CVE-2025-7971 | | 2025-08-14 | A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Des… | |
CVE-2025-43983 | Critical | 9.1 | 2025-08-14 | KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform_set_cmd_process and goform/gofor… |
CVE-2025-40758 | High | 8.7 | 2025-08-14 | A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4… |
CVE-2025-38745 | Medium | 4.8 | 2025-08-14 | Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Rest… |
CVE-2025-38738 | Medium | 6.7 | 2025-08-14 | SupportAssist for Home PCs Installer exe version(s) 4.8.2.29006 and prior, contain(s) an Incorrect Privilege Assignment vulnerability in the Installer. A low p… |
CVE-2025-36613 | Low | 2.8 | 2025-08-14 | SupportAssist for Home PCs versions 4.6.3 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment v… |
CVE-2025-36612 | Medium | 6.7 | 2025-08-14 | SupportAssist for Business PCs, version(s) 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local ac… |
CVE-2025-27847 | Medium | 4.3 | 2025-08-14 | In ESPEC North America Web Controller 3 before 3.3.8, /api/v4/auth/ users session privileges are not revoked on logout. |
CVE-2025-27846 | Medium | 4.3 | 2025-08-14 | In ESPEC North America Web Controller 3 before 3.3.8, an attacker with physical access can gain elevated privileges because GRUB and the BIOS are unprotected. |
CVE-2025-27845 | Critical | 9.8 | 2025-08-14 | In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret. This allows for e… |
CVE-2025-26484 | Medium | 5.5 | 2025-08-14 | Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privileged attacker with re… |
CVE-2025-9036 | | 2025-08-14 | A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and… | |
CVE-2025-7973 | | 2025-08-14 | A security issue exists in FactoryTalk ViewPoint version 14.0 or below due to improper handling of MSI repair operations. During a repair, attackers can hijack… | |
CVE-2025-7774 | | 2025-08-14 | A security issue exists within the 5032 16pt Digital Configurable module’s web server. Intercepted session credentials can be used within a 3-minute timeout wi… | |
CVE-2025-7773 | | 2025-08-14 | A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an interval that correlate… | |
CVE-2025-7353 | | 2025-08-14 | A security issue exists due to the web-based debugger agent enabled on Rockwell Automation ControlLogix® Ethernet Modules. If a specific IP address is used to… | |
CVE-2025-55675 | Medium | 6.5 | 2025-08-14 | Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to disco… |
CVE-2025-55674 | Medium | 6.5 | 2025-08-14 | A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special i… |