2025 CVEs (page 231)
Page 231 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8469 | High | 7.3 | 2025-08-02 | A vulnerability classified as critical has been found in SourceCodester Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/de… |
CVE-2025-8468 | High | 7.3 | 2025-08-02 | A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-7710 | Critical | 9.8 | 2025-08-02 | The Brave Conversion Engine (PRO) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.7.7. This is due to the p… |
CVE-2025-7500 | Medium | 6.4 | 2025-08-02 | The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 d… |
CVE-2025-8467 | High | 7.3 | 2025-08-02 | A vulnerability was found in code-projects Wazifa System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-8488 | Medium | 4.3 | 2025-08-02 | The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2025-6722 | Medium | 5.3 | 2025-08-02 | The BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… |
CVE-2025-8466 | High | 7.3 | 2025-08-02 | A vulnerability was found in code-projects Online Farm System 1.0. It has been classified as critical. Affected is an unknown function of the file /forgot_pass… |
CVE-2025-8400 | Medium | 6.1 | 2025-08-02 | The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sa… |
CVE-2025-8399 | Medium | 6.4 | 2025-08-02 | The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to, and including, 1.0… |
CVE-2025-8391 | Medium | 6.4 | 2025-08-02 | The Magic Edge – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6… |
CVE-2025-6832 | Medium | 6.1 | 2025-08-02 | The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'non… |
CVE-2025-8317 | Medium | 6.4 | 2025-08-02 | The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due… |
CVE-2025-8212 | Medium | 6.4 | 2025-08-02 | The Medical Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter widget in all versions up to, and… |
CVE-2025-8152 | Medium | 5.3 | 2025-08-02 | The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil… |
CVE-2025-6754 | High | 8.8 | 2025-08-02 | The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks in both the seo_metrics_handle_connect_button_cl… |
CVE-2025-6626 | Medium | 4.4 | 2025-08-02 | The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting… |
CVE-2025-4588 | Medium | 6.4 | 2025-08-02 | The 360 Photo Spheres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sphere' shortcode in all versions up to, and includin… |
CVE-2025-8146 | Medium | 6.4 | 2025-08-02 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and i… |
CVE-2025-7694 | Medium | 6.8 | 2025-08-02 | The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() fu… |
CVE-2025-6078 | Medium | 5.4 | 2025-08-02 | Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job bu… |
CVE-2025-6077 | Critical | 9.8 | 2025-08-02 | Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account… |
CVE-2025-6076 | High | 8.8 | 2025-08-02 | Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated atta… |
CVE-2025-54796 | High | 7.5 | 2025-08-02 | Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is… |
CVE-2025-54790 | Medium | 6.5 | 2025-08-02 | Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of ba… |
CVE-2025-54789 | Medium | 6.1 | 2025-08-02 | Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that pre… |
CVE-2025-54782 | High | 8.8 | 2025-08-02 | Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability w… |
CVE-2025-54781 | Low | 2.8 | 2025-08-02 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau in version 1.0.0, the himmelblaud_tas… |
CVE-2025-54386 | Critical | 9.8 | 2025-08-02 | Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discov… |
CVE-2025-54136 | High | 7.2 | 2025-08-02 | Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an… |
CVE-2025-54133 | Critical | 9.6 | 2025-08-02 | Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP (Model… |
CVE-2025-54792 | Medium | 6.8 | 2025-08-01 | LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In version… |
CVE-2025-54424 | High | 8.1 | 2025-08-01 | 1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTP… |
CVE-2025-54132 | Medium | 4.4 | 2025-08-01 | Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid (which is used to render diagrams) allows embedding images which then get… |
CVE-2025-54131 | Medium | 6.4 | 2025-08-01 | Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick (`) or $(c… |
CVE-2025-8480 | High | 8.0 | 2025-08-01 | Alpine iLX-507 Command Injection Remote Code Execution. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installation… |
CVE-2025-8477 | High | 7.4 | 2025-08-01 | Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute a… |
CVE-2025-8476 | High | 8.0 | 2025-08-01 | Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected… |
CVE-2025-8475 | High | 7.4 | 2025-08-01 | Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary… |
CVE-2025-8474 | Medium | 6.8 | 2025-08-01 | Alpine iLX-507 CarPlay Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary co… |
CVE-2025-8473 | Medium | 6.6 | 2025-08-01 | Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affect… |
CVE-2025-8472 | High | 7.4 | 2025-08-01 | Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute a… |
CVE-2025-6037 | Medium | 6.8 | 2025-08-01 | Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+… |
CVE-2025-6015 | Medium | 5.7 | 2025-08-01 | Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vau… |
CVE-2025-6014 | Medium | 6.5 | 2025-08-01 | Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Com… |
CVE-2025-6011 | Low | 3.7 | 2025-08-01 | A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users… |
CVE-2025-6004 | Medium | 5.3 | 2025-08-01 | Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1… |
CVE-2025-6000 | Critical | 9.1 | 2025-08-01 | A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin direc… |
CVE-2025-5999 | High | 7.2 | 2025-08-01 | A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vau… |
CVE-2025-54595 | High | 7.3 | 2025-08-01 | Pearcleaner is a free, source-available and fair-code licensed mac app cleaner. The PearcleanerHelper is a privileged helper tool bundled with the Pearcleaner… |
CVE-2025-54593 | High | 7.2 | 2025-08-01 | FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS… |
CVE-2025-54590 | | 2025-08-01 | webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8.0 and below, the lookup function accep… | |
CVE-2025-54574 | Critical | 9.3 | 2025-08-01 | Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when p… |
CVE-2025-54564 | High | 7.8 | 2025-08-01 | uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user. |
CVE-2025-53012 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested impor… |
CVE-2025-53011 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing… |
CVE-2025-53010 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing… |
CVE-2025-53009 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, w… |
CVE-2025-50870 | Critical | 9.8 | 2025-08-01 | Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email addre… |
CVE-2025-50869 | Medium | 6.1 | 2025-08-01 | A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query an… |
CVE-2025-50868 | Medium | 6.5 | 2025-08-01 | A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST parameter is not properly sanitized before… |
CVE-2025-49832 | Medium | 6.5 | 2025-08-01 | Asterisk is an open source private branch exchange and telephony toolkit. In versions up to and including 18.26.2, between 20.00.0 and 20.15.0, 20.7-cert6, 21… |
CVE-2025-33118 | Medium | 6.4 | 2025-08-01 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 12 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary… |
CVE-2025-2824 | High | 7.4 | 2025-08-01 | IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redi… |
CVE-2025-51504 | High | 7.6 | 2025-08-01 | Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field. |
CVE-2025-51502 | Medium | 6.1 | 2025-08-01 | Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the… |
CVE-2025-51501 | Medium | 6.1 | 2025-08-01 | Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaS… |
CVE-2025-48074 | Medium | 5.5 | 2025-08-01 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3… |
CVE-2025-45778 | Medium | 6.1 | 2025-08-01 | A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via inje… |
CVE-2025-45150 | Critical | 9.8 | 2025-08-01 | Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request. |
CVE-2025-52390 | Critical | 9.1 | 2025-08-01 | Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the `prepareSearchQuery()` method in `Fulltex… |
CVE-2025-52361 | High | 7.8 | 2025-08-01 | Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authenticated low-privileg… |
CVE-2025-52327 | High | 7.8 | 2025-08-01 | SQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php file |
CVE-2025-50472 | Critical | 9.8 | 2025-08-01 | The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_model_meta()` f… |
CVE-2025-50460 | Critical | 9.8 | 2025-08-01 | A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from t… |
CVE-2025-44139 | High | 7.2 | 2025-08-01 | Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip |
CVE-2025-45767 | High | 7.0 | 2025-08-01 | jose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim of "do not meet recommended security standard… |
CVE-2025-46018 | Medium | 5.4 | 2025-08-01 | CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specifi… |
CVE-2025-41376 | Medium | 5.3 | 2025-08-01 | CRLF Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP… |
CVE-2025-41375 | Critical | 9.8 | 2025-08-01 | SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' par… |
CVE-2025-41374 | High | 8.8 | 2025-08-01 | A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated… |
CVE-2025-41373 | High | 8.8 | 2025-08-01 | A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated… |
CVE-2025-41372 | High | 8.8 | 2025-08-01 | A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated… |
CVE-2025-41371 | High | 8.8 | 2025-08-01 | A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated… |
CVE-2025-41370 | High | 8.8 | 2025-08-01 | A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated… |
CVE-2025-6228 | Medium | 6.4 | 2025-08-01 | The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Te… |
CVE-2025-4684 | Medium | 6.4 | 2025-08-01 | The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Import… |
CVE-2025-8443 | High | 7.3 | 2025-08-01 | A vulnerability was found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2025-6398 | | 2025-08-01 | A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. The vulnerability can be triggered by a specially crafted input… | |
CVE-2025-8442 | High | 7.3 | 2025-08-01 | A vulnerability has been found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-8441 | High | 7.3 | 2025-08-01 | A vulnerability, which was classified as critical, was found in code-projects Online Medicine Guide 1.0. Affected is an unknown function of the file /pharsignu… |
CVE-2025-8439 | High | 7.3 | 2025-08-01 | A vulnerability, which was classified as critical, has been found in code-projects Wazifa System 1.0. This issue affects some unknown processing of the file /c… |
CVE-2025-8438 | High | 7.3 | 2025-08-01 | A vulnerability classified as critical was found in code-projects Wazifa System 1.0. This vulnerability affects unknown code of the file /controllers/postpubli… |
CVE-2025-8437 | High | 7.3 | 2025-08-01 | A vulnerability classified as critical has been found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. Th… |
CVE-2025-7646 | Medium | 6.4 | 2025-08-01 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2025-8454 | Critical | 9.8 | 2025-08-01 | It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the l… |
CVE-2025-8436 | High | 7.3 | 2025-08-01 | A vulnerability was found in projectworlds Online Admission System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-5921 | Medium | 5.8 | 2025-08-01 | The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2025-54939 | Medium | 5.3 | 2025-08-01 | LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. |
CVE-2025-31716 | Medium | 5.1 | 2025-08-01 | In bootloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution p… |