2025 CVEs (page 229)
Page 229 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-51628 | High | 7.5 | 2025-08-05 | Insecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and below allows unauthenticated attackers to… |
CVE-2025-51627 | Medium | 6.5 | 2025-08-05 | Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-level access to escalate privileges to Ad… |
CVE-2025-51060 | Medium | 6.5 | 2025-08-05 | An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0x9C402440 and 0x9C402444 as IoControlCo… |
CVE-2025-50688 | Medium | 6.5 | 2025-08-05 | A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality. An attacker can ex… |
CVE-2025-50454 | Medium | 6.5 | 2025-08-05 | An Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an unauthorized attacker to log into the application as an administrato… |
CVE-2025-8585 | Medium | 5.3 | 2025-08-05 | A vulnerability, which was classified as critical, has been found in libav up to 12.3. Affected by this issue is the function main of the file /avtools/avconv… |
CVE-2025-8584 | Low | 3.3 | 2025-08-05 | A vulnerability classified as problematic was found in libav up to 12.3. Affected by this vulnerability is the function av_buffer_unref of the file libavutil/b… |
CVE-2025-7674 | | 2025-08-05 | Improper Input Validation vulnerability in Roche Diagnostics navify Monitoring allows an attacker to manipulate input data, which may lead to a denial of servi… | |
CVE-2025-54254 | High | 8.6 | 2025-08-05 | Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could… |
CVE-2025-54253 | Critical | 10.0 | 2025-08-05 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacke… |
CVE-2025-43980 | Medium | 6.5 | 2025-08-05 | An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN. They enable the SSH service by default with the credentials of root/admin. The GUI does… |
CVE-2025-43978 | High | 7.4 | 2025-08-05 | Jointelli 5G CPE 21H01 firmware JY_21H01_A3_v1.36 devices allow (blind) OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=set_WPS_… |
CVE-2025-46658 | Critical | 9.8 | 2025-08-05 | An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages. |
CVE-2025-43979 | High | 7.4 | 2025-08-05 | An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system commands with root pr… |
CVE-2025-54874 | Critical | 9.8 | 2025-08-05 | OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data… |
CVE-2025-50707 | Critical | 9.8 | 2025-08-05 | An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component |
CVE-2025-50706 | Critical | 9.8 | 2025-08-05 | An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function |
CVE-2025-47152 | Medium | 6.5 | 2025-08-05 | An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co. Ltd PDF-XChange Editor 10.6.0.396. By using a specially crafted EMF fil… |
CVE-2025-46958 | Medium | 5.4 | 2025-08-05 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-44964 | Low | 3.9 | 2025-08-05 | A lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the-middle attack and obtain sensitive information. |
CVE-2025-2611 | | 2025-08-05 | The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that… | |
CVE-2025-29745 | High | 7.5 | 2025-08-05 | A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NTLMv2 hash informati… |
CVE-2025-27931 | Medium | 6.5 | 2025-08-05 | An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Editor version 10.5.2.395. By using a specially crafted EMF file, an attack… |
CVE-2025-7033 | High | 7.8 | 2025-08-05 | A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory spa… |
CVE-2025-7032 | High | 7.8 | 2025-08-05 | A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory spa… |
CVE-2025-7025 | High | 7.8 | 2025-08-05 | A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory spa… |
CVE-2025-54987 | Critical | 9.4 | 2025-08-05 | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute co… |
CVE-2025-54948 | Critical | 9.4 | 2025-08-05 | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute co… |
CVE-2025-8555 | Low | 3.5 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. Affected is an unknown function of the file /search. The manipulati… |
CVE-2025-8554 | Low | 2.4 | 2025-08-05 | A vulnerability, which was classified as problematic, has been found in atjiu pybbs up to 6.0.0. This issue affects some unknown processing of the file /admin/… |
CVE-2025-8553 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0. This vulnerability affects unknown code of the file /admin/sensitive_word/list… |
CVE-2025-8552 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic has been found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /admin/tag/list. The manipulation… |
CVE-2025-8551 | Low | 3.5 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin… |
CVE-2025-8295 | Medium | 6.4 | 2025-08-05 | The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including… |
CVE-2025-8294 | Medium | 6.4 | 2025-08-05 | The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due t… |
CVE-2025-6207 | High | 7.5 | 2025-08-05 | The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' functi… |
CVE-2025-5061 | High | 7.5 | 2025-08-05 | The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' func… |
CVE-2025-41698 | High | 7.8 | 2025-08-05 | A low privileged local attacker can interact with the affected service although user-interaction should not be allowed. |
CVE-2025-2810 | Medium | 5.5 | 2025-08-05 | A low privileged local attacker can abuse the affected service by using a hardcoded cryptographic key. |
CVE-2025-8550 | Low | 2.4 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-8549 | Low | 3.7 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pyb… |
CVE-2025-8548 | Low | 3.7 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/… |
CVE-2025-8315 | Medium | 6.4 | 2025-08-05 | The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4… |
CVE-2025-8313 | Medium | 6.4 | 2025-08-05 | The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1… |
CVE-2025-7050 | High | 7.2 | 2025-08-05 | The Use-your-Drive | Google Drive plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in file meta… |
CVE-2025-8547 | Medium | 5.3 | 2025-08-05 | A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical. This vulnerability affects unknown code of the component Email Verificati… |
CVE-2025-54982 | Critical | 9.6 | 2025-08-05 | An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse. |
CVE-2025-8546 | Medium | 5.3 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verific… |
CVE-2025-8545 | Low | 2.4 | 2025-08-05 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the f… |
CVE-2025-8544 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic was found in Portabilis i-Educar 2.10. Affected by this vulnerability is an unknown functionality of the file /module… |
CVE-2025-54868 | High | 7.5 | 2025-08-05 | LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly… |
CVE-2025-8543 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educar_raca_cad.php… |
CVE-2025-8542 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empre… |
CVE-2025-8541 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /intranet/publi… |
CVE-2025-8540 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municip… |
CVE-2025-53417 | | 2025-08-05 | DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability | |
CVE-2025-8539 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this issue is some unknown functionality of the file /intranet… |
CVE-2025-8538 | Low | 2.4 | 2025-08-05 | A vulnerability has been found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-8537 | Low | 3.7 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of th… |
CVE-2025-8535 | Low | 3.5 | 2025-08-05 | A vulnerability, which was classified as problematic, has been found in cronoh NanoVault up to 1.2.1. This issue affects the function executeJavaScript of the… |
CVE-2025-54871 | Medium | 5.5 | 2025-08-05 | Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged use… |
CVE-2025-54870 | | 2025-08-05 | VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules might cause reversion to plaintext due… | |
CVE-2025-54865 | High | 7.3 | 2025-08-05 | Tilesheets MediaWiki Extension adds a table lookup parser function for an item and returns the requested image. A missing backtick in a query executed by the T… |
CVE-2025-54804 | Medium | 6.5 | 2025-08-05 | Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free spac… |
CVE-2025-54803 | High | 7.5 | 2025-08-05 | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allo… |
CVE-2025-54802 | Critical | 9.8 | 2025-08-05 | pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in… |
CVE-2025-54795 | Critical | 9.8 | 2025-08-05 | Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to… |
CVE-2025-54794 | Critical | 9.1 | 2025-08-05 | Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it p… |
CVE-2025-54780 | High | 7.7 | 2025-08-05 | The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /a… |
CVE-2025-54387 | Critical | 9.8 | 2025-08-05 | IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check wh… |
CVE-2025-54135 | High | 8.5 | 2025-08-05 | Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a… |
CVE-2025-54130 | High | 7.5 | 2025-08-05 | Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file… |
CVE-2025-54119 | Critical | 10.0 | 2025-08-05 | ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. In versions 5.22.9 and below, improper escaping… |
CVE-2025-53544 | High | 7.5 | 2025-08-05 | Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0… |
CVE-2025-52892 | Medium | 4.5 | 2025-08-05 | EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a use… |
CVE-2025-8534 | Low | 2.5 | 2025-08-05 | A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the co… |
CVE-2025-8530 | Medium | 5.3 | 2025-08-04 | A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the f… |
CVE-2025-8529 | Medium | 6.3 | 2025-08-04 | A vulnerability classified as critical was found in cloudfavorites favorites-web up to 1.3.0. Affected by this vulnerability is the function getCollectLogoUrl… |
CVE-2025-46094 | Low | 3.8 | 2025-08-04 | LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actionscript. |
CVE-2025-46093 | Critical | 9.9 | 2025-08-04 | LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging… |
CVE-2025-27212 | Critical | 9.8 | 2025-08-04 | An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management networ… |
CVE-2025-27211 | High | 7.5 | 2025-08-04 | An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch… |
CVE-2025-8528 | Low | 3.7 | 2025-08-04 | A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList… |
CVE-2025-8527 | Medium | 6.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been rated as critical. This issue affects some unknown processing of the file xboot-fast/src/mai… |
CVE-2025-7844 | | 2025-08-04 | Exporting a TPM based RSA key larger than 2048 bits from the TPM could overrun a stack buffer if the default `MAX_RSA_KEY_BITS=2048` is used. If your TPM 2.0 m… | |
CVE-2025-54554 | Medium | 5.3 | 2025-08-04 | tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries… |
CVE-2025-4604 | Medium | 6.1 | 2025-08-04 | The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through… |
CVE-2025-4599 | Medium | 6.1 | 2025-08-04 | The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 202… |
CVE-2025-8526 | Medium | 6.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/… |
CVE-2025-8525 | Medium | 5.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/S… |
CVE-2025-51726 | High | 8.4 | 2025-08-04 | CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attacks. This allows a… |
CVE-2025-51387 | Critical | 9.8 | 2025-08-04 | The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses. Specifically, the following insecure settings wer… |
CVE-2025-50754 | Critical | 9.6 | 2025-08-04 | Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality. A malicious script submitted by an attacker i… |
CVE-2025-50341 | Critical | 9.8 | 2025-08-04 | A Boolean-based SQL injection vulnerability was discovered in Axelor 5.2.4 via the _domain parameter. An attacker can manipulate the SQL query logic and determ… |
CVE-2025-8524 | Medium | 5.3 | 2025-08-04 | A vulnerability was found in Boquan DotWallet App 2.15.2 on Android and classified as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2025-8523 | Medium | 5.3 | 2025-08-04 | A vulnerability has been found in RiderLike Fruit Crush-Brain App 1.0 on Android and classified as problematic. Affected by this vulnerability is an unknown fu… |
CVE-2025-55014 | Medium | 4.7 | 2025-08-04 | The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dict.youdao.com and… |
CVE-2025-50340 | Medium | 4.3 | 2025-08-04 | An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send emails on behalf of… |
CVE-2025-8522 | Medium | 5.0 | 2025-08-04 | A vulnerability, which was classified as critical, was found in givanz Vvvebjs up to 2.0.4. Affected is an unknown function of the file /save.php of the compon… |
CVE-2025-8521 | Low | 2.4 | 2025-08-04 | A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5. This issue affects some unknown processing of the file /vadmi… |