2025 CVEs (page 220)
Page 220 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47610 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wetail WooCommerce Fortnox Integration woocommerce-fortno… |
CVE-2025-47536 | High | 7.2 | 2025-08-14 | Deserialization of Untrusted Data vulnerability in keywordrush Content Egg content-egg allows Object Injection.This issue affects Content Egg: from n/a through… |
CVE-2025-3703 | High | 7.5 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wipeoutmedia CSS & JavaScript Toolbox… |
CVE-2025-39510 | High | 8.5 | 2025-08-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic… |
CVE-2025-39483 | Medium | 6.5 | 2025-08-14 | Improper Control of Generation of Code ('Code Injection') vulnerability in imithemes Eventer eventer allows Code Injection.This issue affects Eventer: from n/a… |
CVE-2025-32288 | High | 7.5 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-e… |
CVE-2025-31425 | High | 7.5 | 2025-08-14 | Missing Authorization vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-31007 | High | 7.1 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alvind Billplz Addon for Contact Form 7 billplz-for-conta… |
CVE-2025-30998 | High | 8.5 | 2025-08-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rico Macchi WP Links Page wp-links-page allows SQL Inject… |
CVE-2025-30993 | Medium | 6.5 | 2025-08-14 | Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configu… |
CVE-2025-30639 | High | 7.5 | 2025-08-14 | Missing Authorization vulnerability in ThemeAtelier IDonatePro idonate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-30635 | High | 8.1 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeAtelier IDonatePro idonate-pro al… |
CVE-2025-30626 | High | 7.1 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Multimedia Playlist Slider Addon for WPBaker… |
CVE-2025-29014 | High | 7.1 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomIt FoodMenu allows Reflected XSS. This issue affects… |
CVE-2025-28999 | High | 7.1 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomIt WooCommerce Shop Page Builder allows Reflected XSS… |
CVE-2025-28987 | Medium | 6.4 | 2025-08-14 | Server-Side Request Forgery (SSRF) vulnerability in PressForward PressForward pressforward allows Server Side Request Forgery.This issue affects PressForward… |
CVE-2025-28979 | High | 8.1 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local Fi… |
CVE-2025-28975 | High | 7.1 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Alike - WordPress Custom Post Comparison alike a… |
CVE-2025-28962 | Medium | 6.5 | 2025-08-14 | Missing Authorization vulnerability in stefanoai Advanced Google Universal Analytics advanced-google-universal-analytics allows Exploiting Incorrectly Configur… |
CVE-2025-25174 | Critical | 10.0 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beete… |
CVE-2025-25172 | High | 8.1 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 VidMov vidmov allows PHP Lo… |
CVE-2025-24775 | Critical | 9.9 | 2025-08-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects… |
CVE-2025-24766 | High | 7.5 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wproyal News Magazine X news-magazine-… |
CVE-2025-8956 | Medium | 6.3 | 2025-08-14 | A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the component ssdpcgi. The man… |
CVE-2025-8955 | High | 7.3 | 2025-08-14 | A vulnerability has been found in PHPGurukul Hospital Management System 4.0. This vulnerability affects unknown code of the file /admin/edit-doctor.php. The ma… |
CVE-2025-8943 | Critical | 9.8 | 2025-08-14 | The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent auth… |
CVE-2025-8047 | Critical | 9.8 | 2025-08-14 | The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been… |
CVE-2025-7761 | | 2025-08-14 | Lepszy BIP is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in index.php form in one of the parameters allows arbitrary JavaScr… | |
CVE-2025-55346 | Critical | 9.8 | 2025-08-14 | User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in t… |
CVE-2025-8954 | High | 7.3 | 2025-08-14 | A vulnerability was identified in PHPGurukul Hospital Management System 4.0. This affects an unknown part of the file /admin/doctor-specilization.php. The mani… |
CVE-2025-8953 | High | 7.3 | 2025-08-14 | A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /chec… |
CVE-2025-8952 | High | 7.3 | 2025-08-14 | A vulnerability was found in Campcodes Online Flight Booking Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /adm… |
CVE-2025-5998 | Medium | 6.5 | 2025-08-14 | The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, however users with sub… |
CVE-2025-54472 | High | 7.5 | 2025-08-14 | Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network… |
CVE-2025-48862 | High | 7.1 | 2025-08-14 | Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set… |
CVE-2025-48861 | Medium | 5.3 | 2025-08-14 | A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application… |
CVE-2025-48860 | High | 8.0 | 2025-08-14 | A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup a… |
CVE-2025-8951 | High | 7.3 | 2025-08-14 | A vulnerability has been found in PHPGurukul Teachers Record Management System 2.1. Affected is an unknown function of the file /admin/search.php. The manipula… |
CVE-2025-8950 | High | 7.3 | 2025-08-14 | A vulnerability was identified in Campcodes Online Recruitment Management System 1.0. This issue affects some unknown processing of the file /Recruitment/index… |
CVE-2025-27388 | | 2025-08-14 | Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens. | |
CVE-2025-8949 | High | 7.2 | 2025-08-14 | A vulnerability was identified in D-Link DIR-825 2.10. Affected by this vulnerability is the function get_ping_app_stat of the file ping_response.cgi of the co… |
CVE-2025-8948 | High | 7.3 | 2025-08-14 | A vulnerability was determined in projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /front.php. The manipulation of the… |
CVE-2025-8947 | High | 7.3 | 2025-08-14 | A vulnerability was found in projectworlds Visitor Management System 1.0. This issue affects some unknown processing of the file /query_data.php. The manipulat… |
CVE-2025-8946 | High | 7.3 | 2025-08-14 | A vulnerability has been found in projectworlds Online Notes Sharing Platform 1.0. This vulnerability affects unknown code of the file /login.php. The manipula… |
CVE-2025-8940 | High | 8.8 | 2025-08-14 | A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Affected by this vulnerability is the function strcpy of the file /goform/saveParentControlInfo… |
CVE-2025-8939 | High | 8.8 | 2025-08-14 | A vulnerability was determined in Tenda AC20 up to 16.03.08.12. Affected is an unknown function of the file /goform/WifiGuestSet. The manipulation of the argum… |
CVE-2025-8046 | Medium | 6.1 | 2025-08-14 | The Injection Guard WordPress plugin before 1.2.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could… |
CVE-2025-7808 | Medium | 6.1 | 2025-08-14 | The WP Shopify WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2025-6790 | Medium | 4.3 | 2025-08-14 | The Quiz and Survey Master (QSM) WordPress plugin before 10.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to m… |
CVE-2025-3414 | Medium | 5.4 | 2025-08-14 | The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a pa… |
CVE-2025-8938 | Medium | 6.3 | 2025-08-14 | A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet… |
CVE-2025-8937 | Medium | 6.3 | 2025-08-14 | A vulnerability has been found in TOTOLINK N350R 1.2.3-B20130826. This vulnerability affects unknown code of the file /boafrm/formSysCmd. The manipulation lead… |
CVE-2025-8936 | High | 7.3 | 2025-08-14 | A vulnerability was determined in 1000 Projects Sales Management System 1.0. Affected by this issue is some unknown functionality of the file /superstore/dist/… |
CVE-2025-5942 | | 2025-08-14 | Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, an unprivileged user can trigg… | |
CVE-2025-5941 | | 2025-08-14 | Netskope is notified about a potential gap in its agent (NS Client) in which a malicious actor could trigger a memory leak by sending a crafted DNS packet to a… | |
CVE-2025-0309 | | 2025-08-14 | An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient valida… | |
CVE-2025-8935 | High | 7.3 | 2025-08-14 | A vulnerability was found in 1000 Projects Sales Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /superstore/cust… |
CVE-2025-8934 | Medium | 4.3 | 2025-08-14 | A vulnerability has been found in 1000 Projects Sales Management System 1.0. Affected is an unknown function of the file /sales.php. The manipulation of the ar… |
CVE-2025-8933 | Medium | 4.3 | 2025-08-14 | A vulnerability was identified in 1000 Projects Sales Management System 1.0. This issue affects some unknown processing of the file /superstore/admin/sales.php… |
CVE-2025-8932 | High | 7.3 | 2025-08-14 | A vulnerability was determined in 1000 Projects Sales Management System 1.0. This vulnerability affects unknown code of the file /superstore/admin/sales.php. T… |
CVE-2025-8931 | Medium | 6.3 | 2025-08-14 | A vulnerability was determined in code-projects Medical Store Management System 1.0. Affected is an unknown function of the file ChangePassword.java. The manip… |
CVE-2025-8930 | Medium | 6.3 | 2025-08-14 | A vulnerability was found in code-projects Medical Store Management System 1.0. This issue affects some unknown processing of the file UpdateCompany.java of th… |
CVE-2025-55199 | Medium | 6.5 | 2025-08-14 | Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to… |
CVE-2025-55198 | Medium | 6.5 | 2025-08-14 | Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type erro… |
CVE-2025-55197 | High | 7.5 | 2025-08-13 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requi… |
CVE-2025-55196 | | 2025-08-13 | External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability wa… | |
CVE-2025-55194 | Medium | 5.7 | 2025-08-13 | Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture w… |
CVE-2025-55193 | | 2025-08-13 | Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be… | |
CVE-2025-8929 | Medium | 6.3 | 2025-08-13 | A vulnerability has been found in code-projects Medical Store Management System 1.0. This vulnerability affects unknown code of the file MainPanel.java. The ma… |
CVE-2025-8928 | Medium | 6.3 | 2025-08-13 | A vulnerability was identified in code-projects Medical Store Management System 1.0. This affects an unknown part of the file UpdateMedicines.java of the compo… |
CVE-2025-34154 | | 2025-08-13 | UnForm Server Manager versions prior to 10.1.12 expose an unauthenticated file read vulnerability via its log file analysis interface. The flaw resides in the… | |
CVE-2025-8927 | Low | 3.7 | 2025-08-13 | A vulnerability was determined in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality of the file /email/send_code of the component V… |
CVE-2025-8926 | High | 7.3 | 2025-08-13 | A vulnerability was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /log… |
CVE-2025-43988 | High | 7.5 | 2025-08-13 | KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data… |
CVE-2025-43986 | Critical | 9.8 | 2025-08-13 | An issue was discovered on KuWFi GC111 GC111-GL-LM321_V3.0_20191211 devices. The TELNET service is enabled by default and exposed over the WAN interface withou… |
CVE-2025-43982 | Critical | 9.8 | 2025-08-13 | Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default. There is a hidden hard-coded root account that cannot be… |
CVE-2025-8925 | High | 7.3 | 2025-08-13 | A vulnerability has been found in itsourcecode Sports Management System 1.0. Affected is an unknown function of the file /Admin/match.php. The manipulation of… |
CVE-2025-8924 | High | 7.3 | 2025-08-13 | A vulnerability was identified in Campcodes Online Water Billing System 1.0. This issue affects some unknown processing of the file /viewbill.php. The manipula… |
CVE-2025-8923 | High | 7.3 | 2025-08-13 | A vulnerability was determined in code-projects Job Diary 1.0. This vulnerability affects unknown code of the file /edit-details.php. The manipulation of the a… |
CVE-2025-8922 | High | 7.3 | 2025-08-13 | A vulnerability was found in code-projects Job Diary 1.0. This affects an unknown part of the file /admin-inbox.php. The manipulation of the argument ID leads… |
CVE-2025-45313 | Medium | 6.1 | 2025-08-13 | A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a us… |
CVE-2025-43989 | Medium | 6.5 | 2025-08-13 | The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the… |
CVE-2025-8921 | High | 7.3 | 2025-08-13 | A vulnerability has been found in code-projects Job Diary 1.0. Affected by this issue is some unknown functionality of the file /user-apply.php. The manipulati… |
CVE-2025-8920 | Low | 2.4 | 2025-08-13 | A vulnerability was identified in Portabilis i-Diario 1.6. Affected by this vulnerability is an unknown functionality of the file /dicionario-de-termos-bncc of… |
CVE-2025-8919 | Low | 2.4 | 2025-08-13 | A vulnerability was determined in Portabilis i-Diario up to 1.6. Affected is an unknown function of the file /objetivos-de-aprendizagem-e-habilidades of the co… |
CVE-2025-8904 | High | 8.5 | 2025-08-13 | Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory… |
CVE-2025-8770 | Medium | 6.5 | 2025-08-13 | An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allo… |
CVE-2025-8754 | High | 7.5 | 2025-08-13 | Missing Authentication for Critical Function vulnerability in ABB ABB AbilityTM zenon.This issue affects ABB AbilityTM zenon: from 7.50 through 14. |
CVE-2025-7739 | High | 8.7 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated us… |
CVE-2025-7734 | High | 8.7 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.2 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 that, under certain cond… |
CVE-2025-6186 | High | 8.7 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users… |
CVE-2025-5819 | Medium | 5.0 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed… |
CVE-2025-50946 | Medium | 6.5 | 2025-08-13 | OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go. |
CVE-2025-50617 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046ed68 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50616 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046f984 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50615 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00470c50 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-45317 | Medium | 6.5 | 2025-08-13 | A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a crafted archive. |
CVE-2025-45316 | Medium | 6.1 | 2025-08-13 | A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2025-45315 | Medium | 5.4 | 2025-08-13 | A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the… |
CVE-2025-45314 | Medium | 6.1 | 2025-08-13 | A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a… |