2025 CVEs (page 22)
Page 22 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14742 | Medium | 4.3 | 2026-02-25 | The WP Recipe Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_search_recipes' and 'ajax_… |
CVE-2025-11563 | Medium | 4.6 | 2026-02-25 | URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly a… |
CVE-2025-0976 | Medium | 4.7 | 2026-02-25 | Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager.This issue affects Hitachi Ops Center API Con… |
CVE-2025-5781 | Medium | 5.2 | 2026-02-25 | Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager, Hitachi Device Manager allows Session Hijack… |
CVE-2025-69231 | High | 8.7 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a stored cross-site scripting… |
CVE-2025-68277 | Medium | 5.0 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link is sent via Secure… |
CVE-2025-67752 | High | 8.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper… |
CVE-2025-67491 | Medium | 5.4 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions 5.0.0.5 through 7.0.3.4 have a stored cross-s… |
CVE-2025-46320 | Medium | 6.1 | 2026-02-24 | A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerabi… |
CVE-2025-33181 | High | 7.3 | 2026-02-24 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit… |
CVE-2025-33180 | High | 8.0 | 2026-02-24 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit… |
CVE-2025-33179 | High | 8.0 | 2026-02-24 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could run an unauthorized command. A successf… |
CVE-2025-1789 | High | 7.8 | 2026-02-24 | Local privilege escalation in Genetec Update Service. An authenticated, low-privileged, Windows user could exploit this vulnerability to gain elevated privileg… |
CVE-2025-1787 | Medium | 4.2 | 2026-02-24 | Local admin could to leak information from the Genetec Update Service configuration web page. An authenticated, admin privileged, Windows user could exploit th… |
CVE-2025-62512 | Medium | 5.3 | 2026-02-24 | Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo… |
CVE-2025-14963 | High | 7.8 | 2026-02-24 | A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges… |
CVE-2025-13776 | High | 7.1 | 2026-02-24 | Multiple Finka programs use hard-coded Firebird database credentials (shared across all instances of this software). A malicious attacker in local network who… |
CVE-2025-69985 | Critical | 9.8 | 2026-02-24 | FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-hel… |
CVE-2025-63409 | High | 8.8 | 2026-02-24 | Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated users to modify administrator only settings and ext… |
CVE-2025-47904 | Medium | 4.1 | 2026-02-24 | Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider… |
CVE-2025-67445 | High | 7.5 | 2026-02-24 | TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI reads the CONTENT_LENGTH environment variab… |
CVE-2025-10010 | Medium | 6.8 | 2026-02-24 | The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows pa… |
CVE-2025-14577 | Critical | 9.8 | 2026-02-24 | Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sendin… |
CVE-2025-27555 | Medium | 6.5 | 2026-02-24 | Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they shou… |
CVE-2025-11165 | Critical | 9.9 | 2026-02-24 | A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class… |
CVE-2025-40541 | Critical | 9.1 | 2026-02-24 | An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as… |
CVE-2025-40540 | Critical | 9.1 | 2026-02-24 | A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged accoun… |
CVE-2025-40539 | Critical | 9.1 | 2026-02-24 | A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged accoun… |
CVE-2025-40538 | Critical | 9.1 | 2026-02-24 | A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbi… |
CVE-2025-15589 | Low | 3.8 | 2026-02-24 | A vulnerability was determined in MuYuCMS 2.7. Affected is the function delete_dir_file of the file application/admin/controller/Template.php of the component… |
CVE-2025-15386 | High | 8.8 | 2026-02-24 | The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules tha… |
CVE-2025-13943 | High | 8.8 | 2026-02-24 | A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could a… |
CVE-2025-13942 | Critical | 9.8 | 2026-02-24 | A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to exec… |
CVE-2025-11848 | Medium | 4.9 | 2026-02-24 | A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 and the Zyxel WX310… |
CVE-2025-11847 | Medium | 4.9 | 2026-02-24 | A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX31… |
CVE-2025-11846 | Medium | 4.9 | 2026-02-24 | A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel… |
CVE-2025-11845 | Medium | 4.9 | 2026-02-24 | A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the… |
CVE-2025-9120 | | 2026-02-24 | Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Carbonite Safe Server Backup allows Code Injection. The vulnerability co… | |
CVE-2025-69253 | Medium | 5.3 | 2026-02-24 | free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of the User Data Repository are affected by… |
CVE-2025-69252 | High | 7.5 | 2026-02-24 | free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. Versions up to and includi… |
CVE-2025-69251 | Medium | 5.3 | 2026-02-24 | free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and incl… |
CVE-2025-69250 | High | 7.5 | 2026-02-24 | free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and incl… |
CVE-2025-69248 | High | 7.5 | 2026-02-23 | free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of free5GC's AMF service have a Buffer Overf… |
CVE-2025-69247 | High | 7.5 | 2026-02-23 | free5GC go-upf is the User Plane Function (UPF) implementation for 5G networks that is part of the free5GC project. Versions prior to 1.2.8 have a Heap-based B… |
CVE-2025-69232 | High | 7.5 | 2026-02-23 | free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, corresponding to free5gc smf… |
CVE-2025-69208 | Medium | 5.3 | 2026-02-23 | free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Versions prior to 1.4.1 cont… |
CVE-2025-71056 | High | 8.1 | 2026-02-23 | Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an… |
CVE-2025-70328 | High | 8.8 | 2026-02-23 | TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. The h… |
CVE-2025-70327 | Critical | 9.8 | 2026-02-23 | TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The i… |
CVE-2025-68930 | High | 7.1 | 2026-02-23 | Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/… |
CVE-2025-70329 | High | 8.0 | 2026-02-23 | TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlan… |
CVE-2025-67733 | High | 8.5 | 2026-02-23 | Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary… |
CVE-2025-63946 | High | 7.4 | 2026-02-23 | A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with e… |
CVE-2025-63945 | High | 7.4 | 2026-02-23 | A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with eleva… |
CVE-2025-61147 | Medium | 6.2 | 2026-02-23 | strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decoder_context::compute_framedrop_table(). |
CVE-2025-61146 | Medium | 4.0 | 2026-02-23 | saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c. |
CVE-2025-61145 | Medium | 5.0 | 2026-02-23 | libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c. |
CVE-2025-61144 | High | 7.3 | 2026-02-23 | libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function. |
CVE-2025-61143 | Medium | 5.5 | 2026-02-23 | libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c. |
CVE-2025-70058 | High | 7.4 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by… |
CVE-2025-70045 | High | 7.4 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in jxcore jxm master. The application disables TLS/SSL certificate validation by… |
CVE-2025-70044 | Medium | 6.5 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in fofolee uTools-quickcommand 5.0.3. |
CVE-2025-70043 | Critical | 9.1 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation… |
CVE-2025-14905 | High | 7.2 | 2026-02-23 | A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` file… |
CVE-2025-69700 | High | 7.5 | 2026-02-23 | Tenda FH1203 V2.0.1.6 contains a stack-based buffer overflow vulnerability in the modify_add_client_prio function, which is reachable via the formSetClientPrio… |
CVE-2025-59873 | Medium | 5.9 | 2026-02-23 | An information exposure vulnerability exists in Vulnerability in HCL Software ZIE for Web. The application transmits sensitive session tokens and authenticat… |
CVE-2025-40986 | | 2026-02-23 | Reflected Cross-Site Scripting (XSS) vulnerability in PideTuCita. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by s… | |
CVE-2025-40701 | | 2026-02-23 | Reflected Cross-Site Scripting vulnerability in SOTESHOP, version 8.3.4. THis vulnerability allows an attacker execute JavaScript code in the victim's browser… | |
CVE-2025-41002 | | 2026-02-23 | SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete the database by s… | |
CVE-2025-14339 | Medium | 6.5 | 2026-02-21 | The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized f… |
CVE-2025-65995 | Medium | 6.5 | 2026-02-21 | When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitiv… |
CVE-2025-62326 | Medium | 6.1 | 2026-02-20 | HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to expl… |
CVE-2025-70833 | Critical | 9.4 | 2026-02-20 | An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and f… |
CVE-2025-15583 | Low | 3.5 | 2026-02-20 | A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. Executing a manipula… |
CVE-2025-15582 | Medium | 5.4 | 2026-02-20 | A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Mod… |
CVE-2025-70831 | Critical | 9.8 | 2026-02-20 | A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to properly sanitize user-su… |
CVE-2025-69410 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Belletrist belletrist allo… |
CVE-2025-69409 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes PJ | Life & Business Coach… |
CVE-2025-69408 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes HealthFirst healthfirst… |
CVE-2025-69407 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur struktur allows… |
CVE-2025-69406 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX FreightCo freightco allows PH… |
CVE-2025-69405 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum | Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue… |
CVE-2025-69404 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a throu… |
CVE-2025-69403 | Critical | 9.9 | 2026-02-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Bravis-Themes Bravis Addons bravis-addons allows Using Malicious Files.This issue affects Brav… |
CVE-2025-69402 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX R&F rf allows PHP Local File… |
CVE-2025-69401 | High | 7.5 | 2026-02-20 | Authentication Bypass by Spoofing vulnerability in mdalabar WooODT Lite byconsole-woo-order-delivery-time allows Identity Spoofing.This issue affects WooODT Li… |
CVE-2025-69400 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Yokoo yokoo allows PHP Local… |
CVE-2025-69399 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Cobble cobble allows PHP Loca… |
CVE-2025-69398 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Plank plank allows PHP Local… |
CVE-2025-69397 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Tint tint allows PHP Local Fi… |
CVE-2025-69396 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Splendour splendour allows PH… |
CVE-2025-69395 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Gable gable allows PHP Local… |
CVE-2025-69394 | High | 7.5 | 2026-02-20 | Authorization Bypass Through User-Controlled Key vulnerability in cnvrse Cnvrse cnvrse allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-69393 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in Jthemes Exzo exzo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Exzo: from… |
CVE-2025-69392 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itex iMoney imoney allows Reflected XSS.This issue affect… |
CVE-2025-69391 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes Diamond diamond allows Reflected XSS.This issue… |
CVE-2025-69390 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Business Template Blocks for WPBakery (Visual Co… |
CVE-2025-69389 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hugh Mungus Visitor Maps Extended Referer Field visitor-m… |
CVE-2025-69388 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in cliengo Cliengo – Chatbot cliengo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-69387 | High | 7.5 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in whatwouldjessedo Simple Retail Menus s… |