2025 CVEs (page 232)
Page 232 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8435 | High | 7.3 | 2025-08-01 | A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2025-7845 | Medium | 6.4 | 2025-08-01 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widge… |
CVE-2025-7725 | High | 7.2 | 2025-08-01 | The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugi… |
CVE-2025-7443 | High | 8.1 | 2025-08-01 | The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to ar… |
CVE-2025-4523 | Medium | 6.5 | 2025-08-01 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability… |
CVE-2025-8434 | High | 7.3 | 2025-08-01 | A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been classified as critical. Affected is an unknown function of the file /admin.p… |
CVE-2025-8433 | Medium | 5.4 | 2025-08-01 | A vulnerability was found in code-projects Document Management System 1.0 and classified as critical. This issue affects the function unlink of the file /dell… |
CVE-2025-5947 | Critical | 9.8 | 2025-08-01 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. Thi… |
CVE-2025-53399 | | 2025-08-01 | In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or in… | |
CVE-2025-5954 | Critical | 9.8 | 2025-08-01 | The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This… |
CVE-2025-8431 | High | 7.3 | 2025-08-01 | A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/add… |
CVE-2025-48073 | Medium | 6.2 | 2025-07-31 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3… |
CVE-2025-48072 | Critical | 9.1 | 2025-07-31 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2… |
CVE-2025-48071 | High | 7.8 | 2025-07-31 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3… |
CVE-2025-45768 | High | 7.0 | 2025-07-31 | pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses t… |
CVE-2025-23289 | Medium | 5.5 | 2025-07-31 | NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive information to be written to… |
CVE-2025-8286 | | 2025-07-31 | The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate… | |
CVE-2025-50572 | High | 8.8 | 2025-07-31 | Archer 6.11.00204.10014 allows attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be executed after the user… |
CVE-2025-45770 | High | 7.0 | 2025-07-31 | jwt v5.4.3 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application… |
CVE-2025-45769 | Medium | 6.5 | 2025-07-31 | php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an applic… |
CVE-2025-37112 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exp… |
CVE-2025-37111 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orchestrator. Successful… |
CVE-2025-37110 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrato… |
CVE-2025-37109 | Low | 3.5 | 2025-07-31 | Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product |
CVE-2025-37108 | Low | 3.5 | 2025-07-31 | Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product |
CVE-2025-26064 | High | 7.3 | 2025-07-31 | A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injectin… |
CVE-2025-26063 | Critical | 9.8 | 2025-07-31 | An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSI… |
CVE-2025-26062 | Critical | 9.8 | 2025-07-31 | An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentia… |
CVE-2025-8426 | Critical | 9.4 | 2025-07-31 | Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service Vulnerability. This vulnerability allows remote a… |
CVE-2025-54834 | Medium | 5.3 | 2025-07-31 | OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check fo… |
CVE-2025-54833 | Medium | 5.3 | 2025-07-31 | OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers… |
CVE-2025-54832 | Medium | 4.3 | 2025-07-31 | OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of states and territories. |
CVE-2025-51503 | High | 7.6 | 2025-07-31 | A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbit… |
CVE-2025-51385 | Low | 3.5 | 2025-07-31 | D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the yyxz_dlink_asp function via the id parameter. |
CVE-2025-51384 | Low | 3.5 | 2025-07-31 | D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter. |
CVE-2025-51383 | Low | 3.5 | 2025-07-31 | D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter. |
CVE-2025-50866 | Medium | 6.1 | 2025-07-31 | CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of the postquerypublic endpoint. Improper s… |
CVE-2025-8409 | High | 7.3 | 2025-07-31 | A vulnerability has been found in code-projects Vehicle Management 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-52203 | High | 7.6 | 2025-07-31 | A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fa… |
CVE-2025-50867 | Medium | 6.5 | 2025-07-31 | A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter is directly embedde… |
CVE-2025-50850 | High | 8.6 | 2025-07-31 | An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limitin… |
CVE-2025-50848 | Medium | 6.1 | 2025-07-31 | A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestricted upload of HTML fil… |
CVE-2025-50847 | Medium | 6.5 | 2025-07-31 | Cross Site Request Forgery (CSRF) vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparison list via a crafted HTTP request. |
CVE-2025-46809 | Medium | 5.7 | 2025-07-31 | A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/… |
CVE-2025-29556 | High | 7.3 | 2025-07-31 | ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restrictions preventing users with the Admin role f… |
CVE-2025-8408 | High | 7.3 | 2025-07-31 | A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. Affected is an unknown function of the file /filter1.php… |
CVE-2025-52289 | High | 8.0 | 2025-07-31 | A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbi… |
CVE-2025-51569 | Medium | 6.1 | 2025-07-31 | A cross-site scripting (XSS) vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U14_06 router's web interface. The /goform/goform_get_cmd_process endpoi… |
CVE-2025-50849 | High | 8.0 | 2025-07-31 | CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference (IDOR). The user profile functionality allows enabling or disabling stickers through a paramet… |
CVE-2025-50475 | Critical | 9.8 | 2025-07-31 | An OS command injection vulnerability exists in Russound MBX-PRE-D67F firmware version 3.1.6, allowing unauthenticated attackers to execute arbitrary commands… |
CVE-2025-50270 | Medium | 6.1 | 2025-07-31 | A stored Cross Site Scripting (xss) vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remote attacker to execute arbitrary code vi… |
CVE-2025-34146 | | 2025-07-31 | A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via… | |
CVE-2025-29557 | Medium | 5.4 | 2025-07-31 | ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can is… |
CVE-2025-8407 | High | 7.3 | 2025-07-31 | A vulnerability, which was classified as critical, has been found in code-projects Vehicle Management 1.0. This issue affects some unknown processing of the fi… |
CVE-2025-7738 | Medium | 4.4 | 2025-07-31 | A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear tex… |
CVE-2025-54589 | Medium | 6.3 | 2025-07-31 | Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an inpu… |
CVE-2025-8213 | High | 7.2 | 2025-07-31 | The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscan_aj… |
CVE-2025-8401 | Medium | 4.3 | 2025-07-31 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.1 vi… |
CVE-2025-8382 | Medium | 6.3 | 2025-07-31 | A vulnerability, which was classified as critical, was found in Campcodes Online Hotel Reservation System 1.0. Affected is an unknown function of the file /adm… |
CVE-2025-8381 | Medium | 6.3 | 2025-07-31 | A vulnerability, which was classified as critical, has been found in Campcodes Online Hotel Reservation System 1.0. This issue affects some unknown processing… |
CVE-2025-8151 | Medium | 4.3 | 2025-07-31 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'save_bloc… |
CVE-2025-8068 | Medium | 4.3 | 2025-07-31 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an improper capability chec… |
CVE-2025-8380 | Low | 3.5 | 2025-07-31 | A vulnerability classified as problematic was found in Campcodes Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admi… |
CVE-2025-8379 | Medium | 4.7 | 2025-07-31 | A vulnerability classified as critical has been found in Campcodes Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/edit_ro… |
CVE-2025-8378 | High | 7.3 | 2025-07-31 | A vulnerability was found in Campcodes Online Hotel Reservation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2025-8376 | High | 7.3 | 2025-07-31 | A vulnerability classified as critical has been found in code-projects Vehicle Management 1.0. Affected is an unknown function of the file /updatebal.php. The… |
CVE-2025-41688 | High | 7.2 | 2025-07-31 | A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox. |
CVE-2025-40980 | | 2025-07-31 | A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of use… | |
CVE-2025-2813 | High | 7.5 | 2025-07-31 | An unauthenticated remote attacker can cause a Denial of Service by sending a large number of requests to the http service on port 80. |
CVE-2025-8375 | High | 7.3 | 2025-07-31 | A vulnerability was found in code-projects Vehicle Management 1.0. It has been rated as critical. This issue affects some unknown processing of the file /addve… |
CVE-2025-8374 | High | 7.3 | 2025-07-31 | A vulnerability was found in code-projects Vehicle Management 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /addco… |
CVE-2025-8192 | | 2025-07-31 | There exists a TOCTOU race condition in TvSettings AppRestrictionsFragment.java that lead to start of attacker supplied activity in Settings’ context, i.e. sys… | |
CVE-2025-24854 | Medium | 6.1 | 2025-07-31 | A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript… |
CVE-2025-24853 | High | 7.5 | 2025-07-31 | A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's br… |
CVE-2025-8373 | High | 7.3 | 2025-07-31 | A vulnerability was found in code-projects Vehicle Management 1.0. It has been classified as critical. This affects an unknown part of the file /print.php. The… |
CVE-2025-8372 | High | 7.3 | 2025-07-31 | A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-7205 | Medium | 5.4 | 2025-07-31 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all ve… |
CVE-2025-54757 | Medium | 6.5 | 2025-07-31 | Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an… |
CVE-2025-54752 | Medium | 6.5 | 2025-07-31 | Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it… |
CVE-2025-46359 | High | 7.2 | 2025-07-31 | A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a… |
CVE-2025-41396 | Medium | 5.4 | 2025-07-31 | A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user. |
CVE-2025-41391 | Medium | 5.4 | 2025-07-31 | Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be exec… |
CVE-2025-36563 | Medium | 6.1 | 2025-07-31 | Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script ma… |
CVE-2025-8371 | High | 7.3 | 2025-07-31 | A vulnerability has been found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-8370 | Medium | 4.3 | 2025-07-31 | A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9. Affected is an unknown function of the file /intranet/educar_escola… |
CVE-2025-8369 | Medium | 4.3 | 2025-07-31 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9. This issue affects some unknown processing of the file /intran… |
CVE-2025-8368 | Medium | 4.3 | 2025-07-31 | A vulnerability classified as problematic was found in Portabilis i-Educar 2.9. This vulnerability affects unknown code of the file /intranet/pesquisa_pessoa_l… |
CVE-2025-53558 | High | 8.8 | 2025-07-31 | ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log i… |
CVE-2025-8367 | Medium | 4.3 | 2025-07-31 | A vulnerability classified as problematic has been found in Portabilis i-Educar 2.9. This affects an unknown part of the file /intranet/funcionario_vinculo_lst… |
CVE-2025-8366 | Medium | 4.3 | 2025-07-31 | A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intra… |
CVE-2025-7847 | High | 8.8 | 2025-07-31 | The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versi… |
CVE-2025-5720 | Medium | 6.4 | 2025-07-31 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all versions up to, and in… |
CVE-2025-8365 | Low | 3.5 | 2025-07-31 | A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2025-8348 | High | 7.3 | 2025-07-31 | A vulnerability has been found in Kehua Charging Pile Cloud Platform 1.0 and classified as critical. This vulnerability affects unknown code of the file /home… |
CVE-2025-8347 | Medium | 6.3 | 2025-07-31 | A vulnerability, which was classified as critical, was found in Kehua Charging Pile Cloud Platform 1.0. This affects an unknown part of the file /sys/task/find… |
CVE-2025-8346 | Medium | 4.3 | 2025-07-31 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the f… |
CVE-2025-8345 | Medium | 6.3 | 2025-07-31 | A vulnerability classified as critical was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. Affected by this vulnerability is the… |
CVE-2025-8344 | Medium | 6.3 | 2025-07-31 | A vulnerability classified as critical has been found in openviglet shio up to 0.3.8. Affected is the function shStaticFileUpload of the file shio-app/src/main… |
CVE-2025-8343 | Medium | 4.3 | 2025-07-31 | A vulnerability was found in openviglet shio up to 0.3.8. It has been rated as critical. This issue affects the function shStaticFilePreUpload of the file shio… |
CVE-2025-8340 | Medium | 4.3 | 2025-07-31 | A vulnerability was found in code-projects Intern Membership Management System 1.0. It has been declared as problematic. This vulnerability affects unknown cod… |