2025 CVEs (page 230)
Page 230 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8631 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8630 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8629 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8628 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-7502 | Medium | 6.4 | 2025-08-06 | The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all versions up to, and inc… |
CVE-2025-7036 | High | 7.5 | 2025-08-06 | The CleverReach® WP plugin for WordPress is vulnerable to time-based SQL Injection via the ‘title’ parameter in all versions up to, and including, 1.5.20 due t… |
CVE-2025-6986 | Medium | 6.5 | 2025-08-06 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up… |
CVE-2025-6690 | Medium | 6.4 | 2025-08-06 | The WP Tournament Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘field’ parameter in all versions up to, and including… |
CVE-2025-6259 | Medium | 6.4 | 2025-08-06 | The esri-map-view plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's esri-map-view shortcode in all versions up to, and includi… |
CVE-2025-6256 | Medium | 6.4 | 2025-08-06 | The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including… |
CVE-2025-54623 | Medium | 6.3 | 2025-08-06 | Out-of-bounds read vulnerability in the devicemanager module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-54622 | High | 8.3 | 2025-08-06 | Binding authentication bypass vulnerability in the devicemanager module. Impact: Successful exploitation of this vulnerability may affect service confidentiali… |
CVE-2025-54621 | Medium | 5.3 | 2025-08-06 | Iterator failure issue in the WantAgent module. Impact: Successful exploitation of this vulnerability may cause memory release failures. |
CVE-2025-54620 | Medium | 5.5 | 2025-08-06 | Deserialization vulnerability of untrusted data in the ability module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-54619 | Medium | 5.3 | 2025-08-06 | Iterator failure issue in the multi-mode input module. Impact: Successful exploitation of this vulnerability may cause iterator failures and affect availabilit… |
CVE-2025-54618 | Medium | 5.7 | 2025-08-06 | Permission control vulnerability in the distributed clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-54617 | Medium | 6.8 | 2025-08-06 | Stack-based buffer overflow vulnerability in the dms_fwk module. Impact: Successful exploitation of this vulnerability can cause RCE. |
CVE-2025-54616 | Medium | 4.0 | 2025-08-06 | Out-of-bounds array access vulnerability in the ArkUI framework. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-54615 | Medium | 6.2 | 2025-08-06 | Vulnerability of insufficient information protection in the media library module. Impact: Successful exploitation of this vulnerability may affect service conf… |
CVE-2025-54614 | Medium | 6.2 | 2025-08-06 | Input verification vulnerability in the home screen module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-54613 | Medium | 5.9 | 2025-08-06 | Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability. |
CVE-2025-54612 | Medium | 5.9 | 2025-08-06 | Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability. |
CVE-2025-54611 | High | 7.3 | 2025-08-06 | EXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-54610 | Medium | 5.4 | 2025-08-06 | Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-54609 | Medium | 5.4 | 2025-08-06 | Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-54608 | Medium | 6.2 | 2025-08-06 | Vulnerability that allows setting screen rotation direction without permission verification in the screen management module. Impact: Successful exploitation of… |
CVE-2025-54607 | High | 7.7 | 2025-08-06 | Authentication management vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-54606 | High | 7.3 | 2025-08-06 | Status verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2025-54655 | High | 8.1 | 2025-08-06 | Race condition vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect the confidentiality and integrity of t… |
CVE-2025-54653 | High | 8.4 | 2025-08-06 | Path traversal vulnerability in the virtualization file module. Successful exploitation of this vulnerability may affect the confidentiality of the virtualizat… |
CVE-2025-54652 | High | 8.4 | 2025-08-06 | Path traversal vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect the confidentiality of the virtualizat… |
CVE-2025-54884 | | 2025-08-06 | Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the generateSecureId and getSecure… | |
CVE-2025-54883 | | 2025-08-06 | Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the getSecureRandomInt function in… | |
CVE-2025-54879 | Medium | 5.3 | 2025-08-06 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5… |
CVE-2025-54876 | | 2025-08-06 | The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the… | |
CVE-2025-54873 | | 2025-08-06 | RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. RISC packages risc0-zkvm versions 2.0… | |
CVE-2025-54872 | | 2025-08-06 | onion-site-template is a complete, scalable tor hidden service self-hosting sample. Versions which include commit 3196bd89 contain a baked-in tor image if the… | |
CVE-2025-54869 | | 2025-08-06 | FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below… | |
CVE-2025-54801 | High | 7.5 | 2025-08-06 | Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large… |
CVE-2025-54594 | Critical | 9.1 | 2025-08-06 | react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actio… |
CVE-2025-54571 | Medium | 6.1 | 2025-08-06 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can ov… |
CVE-2025-54125 | Medium | 6.5 | 2025-08-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old… |
CVE-2025-54124 | Medium | 6.5 | 2025-08-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old… |
CVE-2025-32430 | Medium | 6.1 | 2025-08-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-… |
CVE-2025-8573 | Medium | 4.8 | 2025-08-05 | Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could… |
CVE-2025-8571 | Medium | 4.8 | 2025-08-05 | Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitiz… |
CVE-2025-53534 | | 2025-08-05 | RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obtains the backend login path of RatPanel… | |
CVE-2025-52237 | Medium | 6.5 | 2025-08-05 | An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal. |
CVE-2025-52078 | Medium | 6.5 | 2025-08-05 | File upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0, allowing remote attackers to gain escalated privileges via a crafted… |
CVE-2025-51541 | Medium | 6.1 | 2025-08-05 | A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The c_database_… |
CVE-2025-50592 | Medium | 5.4 | 2025-08-05 | Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player. |
CVE-2025-45512 | Medium | 6.5 | 2025-08-05 | A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attackers to install crafted firmware files… |
CVE-2025-8586 | Low | 3.3 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in libav up to 12.3. This affects the function ff_seek_frame_binary of the file /libavformat/ut… |
CVE-2025-51857 | Medium | 6.1 | 2025-08-05 | The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks. |
CVE-2025-51628 | High | 7.5 | 2025-08-05 | Insecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and below allows unauthenticated attackers to… |
CVE-2025-51627 | Medium | 6.5 | 2025-08-05 | Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-level access to escalate privileges to Ad… |
CVE-2025-51060 | Medium | 6.5 | 2025-08-05 | An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0x9C402440 and 0x9C402444 as IoControlCo… |
CVE-2025-50688 | Medium | 6.5 | 2025-08-05 | A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality. An attacker can ex… |
CVE-2025-50454 | Medium | 6.5 | 2025-08-05 | An Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an unauthorized attacker to log into the application as an administrato… |
CVE-2025-8585 | Medium | 5.3 | 2025-08-05 | A vulnerability, which was classified as critical, has been found in libav up to 12.3. Affected by this issue is the function main of the file /avtools/avconv… |
CVE-2025-8584 | Low | 3.3 | 2025-08-05 | A vulnerability classified as problematic was found in libav up to 12.3. Affected by this vulnerability is the function av_buffer_unref of the file libavutil/b… |
CVE-2025-7674 | | 2025-08-05 | Improper Input Validation vulnerability in Roche Diagnostics navify Monitoring allows an attacker to manipulate input data, which may lead to a denial of servi… | |
CVE-2025-54254 | High | 8.6 | 2025-08-05 | Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could… |
CVE-2025-54253 | Critical | 10.0 | 2025-08-05 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacke… |
CVE-2025-43980 | Medium | 6.5 | 2025-08-05 | An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN. They enable the SSH service by default with the credentials of root/admin. The GUI does… |
CVE-2025-43978 | High | 7.4 | 2025-08-05 | Jointelli 5G CPE 21H01 firmware JY_21H01_A3_v1.36 devices allow (blind) OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=set_WPS_… |
CVE-2025-46658 | Critical | 9.8 | 2025-08-05 | An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages. |
CVE-2025-43979 | High | 7.4 | 2025-08-05 | An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system commands with root pr… |
CVE-2025-54874 | Critical | 9.8 | 2025-08-05 | OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data… |
CVE-2025-50707 | Critical | 9.8 | 2025-08-05 | An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component |
CVE-2025-50706 | Critical | 9.8 | 2025-08-05 | An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function |
CVE-2025-47152 | Medium | 6.5 | 2025-08-05 | An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co. Ltd PDF-XChange Editor 10.6.0.396. By using a specially crafted EMF fil… |
CVE-2025-46958 | Medium | 5.4 | 2025-08-05 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-44964 | Low | 3.9 | 2025-08-05 | A lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the-middle attack and obtain sensitive information. |
CVE-2025-2611 | | 2025-08-05 | The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that… | |
CVE-2025-29745 | High | 7.5 | 2025-08-05 | A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NTLMv2 hash informati… |
CVE-2025-27931 | Medium | 6.5 | 2025-08-05 | An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Editor version 10.5.2.395. By using a specially crafted EMF file, an attack… |
CVE-2025-7033 | High | 7.8 | 2025-08-05 | A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory spa… |
CVE-2025-7032 | High | 7.8 | 2025-08-05 | A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory spa… |
CVE-2025-7025 | High | 7.8 | 2025-08-05 | A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory spa… |
CVE-2025-54987 | Critical | 9.4 | 2025-08-05 | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute co… |
CVE-2025-54948 | Critical | 9.4 | 2025-08-05 | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute co… |
CVE-2025-8555 | Low | 3.5 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. Affected is an unknown function of the file /search. The manipulati… |
CVE-2025-8554 | Low | 2.4 | 2025-08-05 | A vulnerability, which was classified as problematic, has been found in atjiu pybbs up to 6.0.0. This issue affects some unknown processing of the file /admin/… |
CVE-2025-8553 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0. This vulnerability affects unknown code of the file /admin/sensitive_word/list… |
CVE-2025-8552 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic has been found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /admin/tag/list. The manipulation… |
CVE-2025-8551 | Low | 3.5 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin… |
CVE-2025-8295 | Medium | 6.4 | 2025-08-05 | The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including… |
CVE-2025-8294 | Medium | 6.4 | 2025-08-05 | The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due t… |
CVE-2025-6207 | High | 7.5 | 2025-08-05 | The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' functi… |
CVE-2025-5061 | High | 7.5 | 2025-08-05 | The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' func… |
CVE-2025-41698 | High | 7.8 | 2025-08-05 | A low privileged local attacker can interact with the affected service although user-interaction should not be allowed. |
CVE-2025-2810 | Medium | 5.5 | 2025-08-05 | A low privileged local attacker can abuse the affected service by using a hardcoded cryptographic key. |
CVE-2025-8550 | Low | 2.4 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-8549 | Low | 3.7 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pyb… |
CVE-2025-8548 | Low | 3.7 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/… |
CVE-2025-8315 | Medium | 6.4 | 2025-08-05 | The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4… |
CVE-2025-8313 | Medium | 6.4 | 2025-08-05 | The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1… |
CVE-2025-7050 | High | 7.2 | 2025-08-05 | The Use-your-Drive | Google Drive plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in file meta… |
CVE-2025-8547 | Medium | 5.3 | 2025-08-05 | A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical. This vulnerability affects unknown code of the component Email Verificati… |