2025 CVEs (page 23)
Page 23 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12107 | High | 8.4 | 2026-02-19 | Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax wi… |
CVE-2025-41023 | | 2026-02-19 | An authentication bypass vulnerability has been found in Thesamur's AutoGPT. This vulnerability allows an attacker to bypass authentication mechanisms. Once in… | |
CVE-2025-40697 | | 2026-02-19 | Reflected Cross-Site Scripting (XSS) vulnerability in '/index.php' in Lewe WebMeasure, which allows remote attackers to execute arbitrary code through the 'pag… | |
CVE-2025-4960 | High | 7.8 | 2026-02-19 | The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege escalation vulnerability due to multiple fl… |
CVE-2025-4521 | High | 8.8 | 2026-02-19 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check… |
CVE-2025-15586 | | 2026-02-19 | OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can result in authentica… | |
CVE-2025-15041 | High | 7.2 | 2026-02-19 | The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation… |
CVE-2025-14983 | Medium | 6.4 | 2026-02-19 | The Advanced Custom Fields: Font Awesome Field plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 5.0.1 due to in… |
CVE-2025-14864 | Medium | 4.3 | 2026-02-19 | The Virusdie - One-click website security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.7. Thi… |
CVE-2025-14851 | Medium | 6.4 | 2026-02-19 | The YaMaps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `yamap` shortcode parameters in all versions up to, and incl… |
CVE-2025-14452 | High | 7.2 | 2026-02-19 | The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and includi… |
CVE-2025-14445 | Medium | 6.4 | 2026-02-19 | The Image Hotspot by DevVN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hotspot_content' custom field meta in all versions up to… |
CVE-2025-14427 | Medium | 4.3 | 2026-02-19 | The Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to unauthorized modification of data due to… |
CVE-2025-14357 | Medium | 5.3 | 2026-02-19 | The Mega Store Woocommerce theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setup_widgets() func… |
CVE-2025-14342 | Medium | 4.3 | 2026-02-19 | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sq_ajax_uninsta… |
CVE-2025-14294 | Medium | 5.3 | 2026-02-19 | The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList() f… |
CVE-2025-14270 | Low | 2.7 | 2026-02-19 | The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.9. This is due to the plugin not pr… |
CVE-2025-14167 | Medium | 4.3 | 2026-02-19 | The Remove Post Type Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to incorrec… |
CVE-2025-14076 | Medium | 6.1 | 2026-02-19 | The iXML – Google XML sitemap generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'iXML_email' parameter in all versions up… |
CVE-2025-13930 | Medium | 5.3 | 2026-02-19 | The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 7.8… |
CVE-2025-13864 | Medium | 5.3 | 2026-02-19 | The Breeze - WordPress Cache Plugin plugin for WordPress is vulnerable to unauthorized cache clearing in all versions up to, and including, 2.2.21. This is due… |
CVE-2025-13851 | Critical | 9.8 | 2026-02-19 | The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and i… |
CVE-2025-13842 | Medium | 5.3 | 2026-02-19 | The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due… |
CVE-2025-13738 | Medium | 6.4 | 2026-02-19 | The Easy Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ez-toc` shortcode in all versions up to, and inc… |
CVE-2025-13732 | Medium | 6.4 | 2026-02-19 | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored… |
CVE-2025-13617 | Medium | 6.4 | 2026-02-19 | The Apollo13 Framework Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘a13_alt_link’ parameter in all versions up to, and… |
CVE-2025-13612 | Medium | 6.4 | 2026-02-19 | The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `aigpl-gallery-album` shortcode in… |
CVE-2025-13603 | High | 8.8 | 2026-02-19 | The WP AUDIO GALLERY plugin for WordPress is vulnerable to Unauthorized Arbitrary File Read in all versions up to, and including, 2.0. This is due to insuffici… |
CVE-2025-13587 | Medium | 6.5 | 2026-02-19 | The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. T… |
CVE-2025-13563 | Critical | 9.8 | 2026-02-19 | The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza_lms_pro_reg… |
CVE-2025-13438 | Medium | 4.3 | 2026-02-19 | The Page Title, Description & Open Graph Updater plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.02. T… |
CVE-2025-13413 | Medium | 4.3 | 2026-02-19 | The Country Blocker for AdSense plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to miss… |
CVE-2025-13113 | Medium | 5.3 | 2026-02-19 | The Web Accessibility by accessiBe plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11. This is due… |
CVE-2025-13091 | Medium | 4.3 | 2026-02-19 | The Shopire theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the shopire_admin_install_plugin() func… |
CVE-2025-13079 | Medium | 5.3 | 2026-02-19 | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up t… |
CVE-2025-13048 | Medium | 6.4 | 2026-02-19 | The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's Nickname in all versions up to… |
CVE-2025-12975 | High | 7.2 | 2026-02-19 | The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability ch… |
CVE-2025-12884 | Medium | 4.3 | 2026-02-19 | The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.0.14. This is due to the… |
CVE-2025-12882 | Critical | 9.8 | 2026-02-19 | The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing user… |
CVE-2025-12845 | High | 8.8 | 2026-02-19 | The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads… |
CVE-2025-12821 | High | 8.8 | 2026-02-19 | The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.6.1. This is due to missing or incorrect nonce vali… |
CVE-2025-12707 | High | 7.5 | 2026-02-19 | The Library Management System plugin for WordPress is vulnerable to SQL Injection via the 'bid' parameter in all versions up to, and including, 3.2.1 due to in… |
CVE-2025-12500 | Medium | 5.3 | 2026-02-19 | The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to… |
CVE-2025-12451 | Medium | 4.4 | 2026-02-19 | The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 4.0 due to in… |
CVE-2025-12448 | Medium | 6.4 | 2026-02-19 | The Smartsupp – live chat, AI shopping assistant and chatbots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'code' parameter in all… |
CVE-2025-12375 | Medium | 6.4 | 2026-02-19 | The Printful Integration for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.11 via the… |
CVE-2025-12172 | Medium | 4.3 | 2026-02-19 | The Mailchimp List Subscribe Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.0. This is due to… |
CVE-2025-12117 | Medium | 6.4 | 2026-02-19 | The Renden theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.8.1 due to insufficient… |
CVE-2025-12116 | Medium | 6.4 | 2026-02-19 | The Drift theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.5.0 due to insufficient i… |
CVE-2025-12081 | Medium | 4.3 | 2026-02-19 | The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "acf_photo_gallery… |
CVE-2025-12027 | Medium | 4.3 | 2026-02-19 | The Mesmerize Companion plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the "openPageIn… |
CVE-2025-11754 | High | 7.5 | 2026-02-19 | The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'gdpr/v1/settings' REST API… |
CVE-2025-11725 | Medium | 6.5 | 2026-02-19 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the multiple functions in… |
CVE-2025-11706 | Medium | 6.1 | 2026-02-19 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the dbstatus parameter in all versions up to, and including, 3… |
CVE-2025-15585 | | 2026-02-19 | Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. Successful exploitation req… | |
CVE-2025-15581 | | 2026-02-18 | Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploit… | |
CVE-2025-12812 | | 2026-02-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Delinea Inc. Cloud Suite and Privileged Access Service. Remediation… | |
CVE-2025-12811 | | 2026-02-18 | Improper Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Delinea Inc. Cloud Suite and Privileged Access Service. If you're not usin… | |
CVE-2025-8860 | Low | 3.3 | 2026-02-18 | A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is… |
CVE-2025-1272 | High | 7.7 | 2026-02-18 | The Linux Kernel lockdown mode for kernel versions starting on 6.12 and above for Fedora Linux has the lockdown mode disabled without any warning. This may all… |
CVE-2025-14876 | Medium | 5.5 | 2026-02-18 | A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to un… |
CVE-2025-12343 | Low | 3.3 | 2026-02-18 | A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_model_tf() function, w… |
CVE-2025-10256 | Medium | 5.3 | 2026-02-18 | A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of a… |
CVE-2025-0577 | Medium | 4.8 | 2026-02-18 | An insufficient entropy vulnerability was found in glibc. The getrandom and arc4random family of functions may return predictable randomness if these functions… |
CVE-2025-70064 | High | 8.8 | 2026-02-18 | PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the Administrator… |
CVE-2025-70063 | Medium | 6.5 | 2026-02-18 | The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application f… |
CVE-2025-70062 | Medium | 6.5 | 2026-02-18 | PHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Doctor' module. The application fails to enfo… |
CVE-2025-69287 | Medium | 5.4 | 2026-02-18 | The BSV Blockchain SDK is a unified TypeScript SDK for developing scalable apps on the BSV Blockchain. Prior to version 2.0.0, a cryptographic vulnerability in… |
CVE-2025-70152 | Critical | 9.8 | 2026-02-18 | code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /ad… |
CVE-2025-70151 | High | 8.8 | 2026-02-18 | code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints update… |
CVE-2025-70150 | Critical | 9.8 | 2026-02-18 | CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delet… |
CVE-2025-70148 | High | 7.5 | 2026-02-18 | Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access… |
CVE-2025-14009 | High | 8.8 | 2026-02-18 | A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipf… |
CVE-2025-70149 | Critical | 9.8 | 2026-02-18 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter. |
CVE-2025-70147 | High | 7.5 | 2026-02-18 | Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitiv… |
CVE-2025-70146 | Critical | 9.1 | 2026-02-18 | Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perf… |
CVE-2025-70141 | Critical | 9.4 | 2026-02-18 | SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication… |
CVE-2025-71237 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: Fix potential block overflow that cause system hang When a user executes the FITR… |
CVE-2025-71236 | High | 7.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate sp before freeing associated memory System crash with the followi… |
CVE-2025-71235 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Delay module unload while fabric scan in progress System crash seen during… |
CVE-2025-71234 | High | 8.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add The driver does not set hw->st… |
CVE-2025-71233 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Avoid creating sub-groups asynchronously The asynchronous creation of sub-… |
CVE-2025-71232 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Free sp in error path to fix system crash System crash seen during load/un… |
CVE-2025-71231 | High | 7.1 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode The local variab… |
CVE-2025-71230 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: hfs: ensure sb->s_fs_info is always cleaned up When hfs was converted to the new mount ap… |
CVE-2025-71229 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() rtw_core_enable_beacon() rea… |
CVE-2025-70998 | Critical | 9.8 | 2026-02-18 | UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote… |
CVE-2025-65791 | Critical | 9.8 | 2026-02-18 | ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. N… |
CVE-2025-65519 | Medium | 6.5 | 2026-02-18 | mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing. The application fails to validate ne… |
CVE-2025-15579 | | 2026-02-18 | Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code executio… | |
CVE-2025-71227 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't WARN for connections on invalid channels It's not clear (to me) how… |
CVE-2025-71225 | Medium | 5.3 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: md: suspend array while updating raid_disks via sysfs In raid1_reshape(), freeze_array()… |
CVE-2025-61982 | High | 7.8 | 2026-02-18 | An arbitrary code execution vulnerability exists in the Code Stream directive functionality of OpenCFD OpenFOAM 2506. A specially crafted OpenFOAM simulation f… |
CVE-2025-8308 | Medium | 6.3 | 2026-02-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Key Software Solutions Inc. INFOREX- General Infor… |
CVE-2025-60038 | High | 7.8 | 2026-02-18 | A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated… |
CVE-2025-60037 | High | 7.8 | 2026-02-18 | A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated… |
CVE-2025-60036 | High | 7.8 | 2026-02-18 | A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw… |
CVE-2025-60035 | High | 7.8 | 2026-02-18 | A vulnerability has been identified in the OPC.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw… |
CVE-2025-59920 | | 2026-02-18 | When hours are entered in time@work, version 7.0.5, it performs a query to display the projects assigned to the user. If the query URL is copied and opened in… | |
CVE-2025-33253 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciously crafted file. A s… |