2025 CVEs (page 22)
Page 22 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68545 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local Fil… |
CVE-2025-68543 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local Fil… |
CVE-2025-68542 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in vgdevsolutions Checkout Gateway for IRIS checkout-gateway-iris allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-68541 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in BoldThemes Ippsum ippsum allows Object Injection.This issue affects Ippsum: from n/a through <= 1.2.0. |
CVE-2025-68539 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local Fil… |
CVE-2025-68536 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local Fil… |
CVE-2025-68534 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-68531 | High | 8.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Object Injecti… |
CVE-2025-68526 | High | 8.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in A WP Life Modal Popup Box modal-popup-box allows Object Injection.This issue affects Modal Popup Box: from n… |
CVE-2025-68514 | Medium | 6.5 | 2026-02-20 | Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly… |
CVE-2025-68501 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mollie Mollie Payments for WooCommerce mollie-payments-fo… |
CVE-2025-68495 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This… |
CVE-2025-68069 | High | 7.1 | 2026-02-20 | Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-68051 | High | 7.5 | 2026-02-20 | Authorization Bypass Through User-Controlled Key vulnerability in Shiprocket Shiprocket shiprocket allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-68050 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Leadpages Leadpages leadpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-68048 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-68043 | High | 7.3 | 2026-02-20 | Missing Authorization vulnerability in LottieFiles LottieFiles lottiefiles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-68042 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Travelpayouts Travelpayouts travelpayouts allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-68037 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atlas Gondal Export Media URLs export-media-urls allows R… |
CVE-2025-68032 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Passionate Brains Advanced WC Analytics advance-wc-analytics allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-68031 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faraz sms افزونه پیامک حرفه ای فراز اس ام اس farazsms all… |
CVE-2025-68028 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-68026 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-68025 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Addonify Addonify Floating Cart For WooCommerce addonify-floating-cart allows Exploiting Incorrectly Configured Access C… |
CVE-2025-68024 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Addonify Addonify – WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-68023 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Addonify Addonify – Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured… |
CVE-2025-68022 | High | 7.3 | 2026-02-20 | Missing Authorization vulnerability in soporteblue Plugin BlueX for WooCommerce bluex-for-woocommerce allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-68021 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-68005 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in themewant Easy Hotel Booking easy-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-68002 | Medium | 6.5 | 2026-02-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 100plugins Open User Map open-user-map allows Path Traversal.Th… |
CVE-2025-68000 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-67998 | High | 8.8 | 2026-02-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in kamleshyadav Miraculous Elementor miraculous-el allows Authentication Abuse.This issu… |
CVE-2025-67997 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in BoldThemes Travelicious travelicious allows Object Injection.This issue affects Travelicious: from n/a throu… |
CVE-2025-67996 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in BoldThemes Nestin nestin allows Object Injection.This issue affects Nestin: from n/a through < 1.2.6. |
CVE-2025-67995 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through < 2.1. |
CVE-2025-67994 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in YayCommerce YayCurrency yaycurrency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-67993 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-67992 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean PatioTime patiotime allows P… |
CVE-2025-67991 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Re… |
CVE-2025-67990 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 GMap Targeting gmap-targeting allows Reflected… |
CVE-2025-67988 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP… |
CVE-2025-67987 | High | 8.5 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-ne… |
CVE-2025-67984 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in calliko NPS computy nps-computy allows DOM-Based XSS.This… |
CVE-2025-67982 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Urna urna allows PHP Local Fil… |
CVE-2025-67981 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local Fil… |
CVE-2025-67980 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local Fil… |
CVE-2025-67979 | Critical | 9.9 | 2026-02-20 | Improper Control of Generation of Code ('Code Injection') vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Code Injec… |
CVE-2025-67978 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FixBD Educare educare allows Reflected XSS.This issue aff… |
CVE-2025-67977 | High | 8.2 | 2026-02-20 | Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-67975 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in aDirectory aDirectory adirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-67974 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in WP Legal Pages WPLegalPages wplegalpages allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-67973 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-67972 | Medium | 4.3 | 2026-02-20 | Missing Authorization vulnerability in Zoho Mail Zoho ZeptoMail allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zo… |
CVE-2025-67971 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja FluentCart fluent-cart allows Reflected XSS… |
CVE-2025-67970 | Medium | 5.9 | 2026-02-20 | Missing Authorization vulnerability in vertim Schedula schedula-smart-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-67969 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Co… |
CVE-2025-67624 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Arya Dhiratara Optimize More! – Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-67547 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in uixthemes Konte konte allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Konte… |
CVE-2025-67438 | Medium | 6.1 | 2026-02-20 | A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's… |
CVE-2025-60183 | Medium | 5.9 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silence Silencesoft RSS Reader external-rss-reader allows… |
CVE-2025-60087 | High | 8.1 | 2026-02-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nenad Obradovic Extensive VC Addons fo… |
CVE-2025-53237 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Wizard Cloak wp-wizard-cloak allows Reflected X… |
CVE-2025-53233 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RylanH Storyform storyform allows Reflected XSS.This issu… |
CVE-2025-53231 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevstudio Easy Taxonomy Images easy-taxonomy-images all… |
CVE-2025-53228 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jezza101 bbpress Simple Advert Units bbpress-simple-adver… |
CVE-2025-53217 | High | 7.6 | 2026-02-20 | Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-52744 | High | 7.7 | 2026-02-20 | Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Inpersttion For Theme err-our-team allows Code Injection.This issue affe… |
CVE-2025-52603 | Low | 3.5 | 2026-02-20 | HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information wh… |
CVE-2025-14547 | | 2026-02-20 | An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs during ZKP parsing. Triggering the und… | |
CVE-2025-14055 | | 2026-02-20 | An integer underflow vulnerability in Silicon Labs Secure NCP host implementation allows a buffer overread via a specially crafted packet. | |
CVE-2025-10970 | Critical | 9.8 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kolay Software Inc. Talentics allows Blind SQL Injection… |
CVE-2025-59819 | Medium | 6.5 | 2026-02-20 | This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path. |
CVE-2025-30416 | Critical | 10.0 | 2026-02-20 | Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before… |
CVE-2025-30412 | Critical | 10.0 | 2026-02-20 | Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befor… |
CVE-2025-30411 | Critical | 10.0 | 2026-02-20 | Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befor… |
CVE-2025-30410 | Critical | 9.8 | 2026-02-20 | Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS… |
CVE-2025-9208 | Medium | 5.4 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Stored… |
CVE-2025-8055 | Medium | 5.3 | 2026-02-19 | Server-Side Request Forgery (SSRF) vulnerability in OpenText™ XM Fax allows Server Side Request Forgery. The vulnerability could allow an attacker to perf… |
CVE-2025-8054 | High | 7.5 | 2026-02-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText™ XM Fax allows Path Traversal. The vulnerability cou… |
CVE-2025-13672 | Medium | 5.4 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Reflec… |
CVE-2025-13671 | Medium | 6.5 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in OpenText™ Web Site Management Server allows Cross Site Request Forgery. The vulnerability could make a user… |
CVE-2025-67305 | Critical | 9.8 | 2026-02-19 | In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical across all deploymen… |
CVE-2025-67304 | Critical | 9.8 | 2026-02-19 | In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In the default configura… |
CVE-2025-69725 | Medium | 4.7 | 2026-02-19 | An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using… |
CVE-2025-69674 | Medium | 6.4 | 2026-02-19 | Buffer Overflow vulnerability in CDATA FD614GS3-R850 V3.2.7_P161006 (Build.0333.250211) allows an attacker to execute arbitrary code via the node_mac, node_opt… |
CVE-2025-71244 | Medium | 6.1 | 2026-02-19 | SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a vi… |
CVE-2025-71243 | Critical | 9.8 | 2026-02-19 | The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacke… |
CVE-2025-71242 | Medium | 6.5 | 2026-02-19 | SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check authorization when di… |
CVE-2025-71241 | Medium | 6.1 | 2026-02-19 | SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' AP… |
CVE-2025-71240 | Medium | 5.4 | 2026-02-19 | SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags. The application does not properly verify JavaScript within code tag… |
CVE-2025-55853 | Critical | 9.1 | 2026-02-19 | SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery (SSRF). The PDF converter function does not check if internal or external resource… |
CVE-2025-9953 | Critical | 9.8 | 2026-02-19 | Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditation Software allows… |
CVE-2025-8350 | Critical | 9.8 | 2026-02-19 | Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authe… |
CVE-2025-9062 | High | 7.3 | 2026-02-19 | Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection. This is… |
CVE-2025-15563 | Medium | 5.3 | 2026-02-19 | Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization chec… |
CVE-2025-15562 | Medium | 6.1 | 2026-02-19 | The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attac… |
CVE-2025-15561 | High | 7.8 | 2026-02-19 | An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious exe… |
CVE-2025-15560 | High | 8.8 | 2026-02-19 | An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Fireb… |
CVE-2025-15559 | Critical | 9.8 | 2026-02-19 | An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the… |
CVE-2025-13590 | Critical | 9.1 | 2026-02-19 | A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Succes… |