2025 CVEs (page 233)
Page 233 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6004 | Medium | 5.3 | 2025-08-01 | Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1… |
CVE-2025-6000 | Critical | 9.1 | 2025-08-01 | A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin direc… |
CVE-2025-5999 | High | 7.2 | 2025-08-01 | A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vau… |
CVE-2025-54595 | High | 7.3 | 2025-08-01 | Pearcleaner is a free, source-available and fair-code licensed mac app cleaner. The PearcleanerHelper is a privileged helper tool bundled with the Pearcleaner… |
CVE-2025-54593 | High | 7.2 | 2025-08-01 | FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS… |
CVE-2025-54590 | | 2025-08-01 | webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8.0 and below, the lookup function accep… | |
CVE-2025-54574 | Critical | 9.3 | 2025-08-01 | Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when p… |
CVE-2025-54564 | High | 7.8 | 2025-08-01 | uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user. |
CVE-2025-53012 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested impor… |
CVE-2025-53011 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing… |
CVE-2025-53010 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing… |
CVE-2025-53009 | High | 7.5 | 2025-08-01 | MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, w… |
CVE-2025-50870 | Critical | 9.8 | 2025-08-01 | Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email addre… |
CVE-2025-50869 | Medium | 6.1 | 2025-08-01 | A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query an… |
CVE-2025-50868 | Medium | 6.5 | 2025-08-01 | A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST parameter is not properly sanitized before… |
CVE-2025-49832 | Medium | 6.5 | 2025-08-01 | Asterisk is an open source private branch exchange and telephony toolkit. In versions up to and including 18.26.2, between 20.00.0 and 20.15.0, 20.7-cert6, 21… |
CVE-2025-33118 | Medium | 6.4 | 2025-08-01 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 12 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary… |
CVE-2025-2824 | High | 7.4 | 2025-08-01 | IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redi… |
CVE-2025-51504 | High | 7.6 | 2025-08-01 | Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field. |
CVE-2025-51502 | Medium | 6.1 | 2025-08-01 | Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the… |
CVE-2025-51501 | Medium | 6.1 | 2025-08-01 | Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaS… |
CVE-2025-48074 | Medium | 5.5 | 2025-08-01 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3… |
CVE-2025-45778 | Medium | 6.1 | 2025-08-01 | A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via inje… |
CVE-2025-45150 | Critical | 9.8 | 2025-08-01 | Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request. |
CVE-2025-52390 | Critical | 9.1 | 2025-08-01 | Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the `prepareSearchQuery()` method in `Fulltex… |
CVE-2025-52361 | High | 7.8 | 2025-08-01 | Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authenticated low-privileg… |
CVE-2025-52327 | High | 7.8 | 2025-08-01 | SQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php file |
CVE-2025-50472 | Critical | 9.8 | 2025-08-01 | The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_model_meta()` f… |
CVE-2025-50460 | Critical | 9.8 | 2025-08-01 | A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from t… |
CVE-2025-44139 | High | 7.2 | 2025-08-01 | Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip |
CVE-2025-45767 | High | 7.0 | 2025-08-01 | jose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim of "do not meet recommended security standard… |
CVE-2025-46018 | Medium | 5.4 | 2025-08-01 | CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specifi… |
CVE-2025-41376 | Medium | 5.3 | 2025-08-01 | CRLF Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP… |
CVE-2025-41375 | Critical | 9.8 | 2025-08-01 | SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' par… |
CVE-2025-41374 | High | 8.8 | 2025-08-01 | A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated… |
CVE-2025-41373 | High | 8.8 | 2025-08-01 | A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated… |
CVE-2025-41372 | High | 8.8 | 2025-08-01 | A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated… |
CVE-2025-41371 | High | 8.8 | 2025-08-01 | A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated… |
CVE-2025-41370 | High | 8.8 | 2025-08-01 | A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated… |
CVE-2025-6228 | Medium | 6.4 | 2025-08-01 | The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Te… |
CVE-2025-4684 | Medium | 6.4 | 2025-08-01 | The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Import… |
CVE-2025-8443 | High | 7.3 | 2025-08-01 | A vulnerability was found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2025-6398 | | 2025-08-01 | A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. The vulnerability can be triggered by a specially crafted input… | |
CVE-2025-8442 | High | 7.3 | 2025-08-01 | A vulnerability has been found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-8441 | High | 7.3 | 2025-08-01 | A vulnerability, which was classified as critical, was found in code-projects Online Medicine Guide 1.0. Affected is an unknown function of the file /pharsignu… |
CVE-2025-8439 | High | 7.3 | 2025-08-01 | A vulnerability, which was classified as critical, has been found in code-projects Wazifa System 1.0. This issue affects some unknown processing of the file /c… |
CVE-2025-8438 | High | 7.3 | 2025-08-01 | A vulnerability classified as critical was found in code-projects Wazifa System 1.0. This vulnerability affects unknown code of the file /controllers/postpubli… |
CVE-2025-8437 | High | 7.3 | 2025-08-01 | A vulnerability classified as critical has been found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. Th… |
CVE-2025-7646 | Medium | 6.4 | 2025-08-01 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2025-8454 | Critical | 9.8 | 2025-08-01 | It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the l… |
CVE-2025-8436 | High | 7.3 | 2025-08-01 | A vulnerability was found in projectworlds Online Admission System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-5921 | Medium | 5.8 | 2025-08-01 | The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2025-54939 | Medium | 5.3 | 2025-08-01 | LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. |
CVE-2025-31716 | Medium | 5.1 | 2025-08-01 | In bootloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution p… |
CVE-2025-8435 | High | 7.3 | 2025-08-01 | A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2025-7845 | Medium | 6.4 | 2025-08-01 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widge… |
CVE-2025-7725 | High | 7.2 | 2025-08-01 | The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugi… |
CVE-2025-7443 | High | 8.1 | 2025-08-01 | The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to ar… |
CVE-2025-4523 | Medium | 6.5 | 2025-08-01 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability… |
CVE-2025-8434 | High | 7.3 | 2025-08-01 | A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been classified as critical. Affected is an unknown function of the file /admin.p… |
CVE-2025-8433 | Medium | 5.4 | 2025-08-01 | A vulnerability was found in code-projects Document Management System 1.0 and classified as critical. This issue affects the function unlink of the file /dell… |
CVE-2025-5947 | Critical | 9.8 | 2025-08-01 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. Thi… |
CVE-2025-53399 | | 2025-08-01 | In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or in… | |
CVE-2025-5954 | Critical | 9.8 | 2025-08-01 | The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This… |
CVE-2025-8431 | High | 7.3 | 2025-08-01 | A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/add… |
CVE-2025-48073 | Medium | 6.2 | 2025-07-31 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3… |
CVE-2025-48072 | Critical | 9.1 | 2025-07-31 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2… |
CVE-2025-48071 | High | 7.8 | 2025-07-31 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3… |
CVE-2025-45768 | High | 7.0 | 2025-07-31 | pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses t… |
CVE-2025-23289 | Medium | 5.5 | 2025-07-31 | NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive information to be written to… |
CVE-2025-8286 | | 2025-07-31 | The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate… | |
CVE-2025-50572 | High | 8.8 | 2025-07-31 | Archer 6.11.00204.10014 allows attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be executed after the user… |
CVE-2025-45770 | High | 7.0 | 2025-07-31 | jwt v5.4.3 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application… |
CVE-2025-45769 | Medium | 6.5 | 2025-07-31 | php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an applic… |
CVE-2025-37112 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exp… |
CVE-2025-37111 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orchestrator. Successful… |
CVE-2025-37110 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrato… |
CVE-2025-37109 | Low | 3.5 | 2025-07-31 | Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product |
CVE-2025-37108 | Low | 3.5 | 2025-07-31 | Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product |
CVE-2025-26064 | High | 7.3 | 2025-07-31 | A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injectin… |
CVE-2025-26063 | Critical | 9.8 | 2025-07-31 | An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSI… |
CVE-2025-26062 | Critical | 9.8 | 2025-07-31 | An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentia… |
CVE-2025-8426 | Critical | 9.4 | 2025-07-31 | Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service Vulnerability. This vulnerability allows remote a… |
CVE-2025-54834 | Medium | 5.3 | 2025-07-31 | OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check fo… |
CVE-2025-54833 | Medium | 5.3 | 2025-07-31 | OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers… |
CVE-2025-54832 | Medium | 4.3 | 2025-07-31 | OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of states and territories. |
CVE-2025-51503 | High | 7.6 | 2025-07-31 | A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbit… |
CVE-2025-51385 | Low | 3.5 | 2025-07-31 | D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the yyxz_dlink_asp function via the id parameter. |
CVE-2025-51384 | Low | 3.5 | 2025-07-31 | D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter. |
CVE-2025-51383 | Low | 3.5 | 2025-07-31 | D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter. |
CVE-2025-50866 | Medium | 6.1 | 2025-07-31 | CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of the postquerypublic endpoint. Improper s… |
CVE-2025-8409 | High | 7.3 | 2025-07-31 | A vulnerability has been found in code-projects Vehicle Management 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-52203 | High | 7.6 | 2025-07-31 | A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fa… |
CVE-2025-50867 | Medium | 6.5 | 2025-07-31 | A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter is directly embedde… |
CVE-2025-50850 | High | 8.6 | 2025-07-31 | An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limitin… |
CVE-2025-50848 | Medium | 6.1 | 2025-07-31 | A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestricted upload of HTML fil… |
CVE-2025-50847 | Medium | 6.5 | 2025-07-31 | Cross Site Request Forgery (CSRF) vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparison list via a crafted HTTP request. |
CVE-2025-46809 | Medium | 5.7 | 2025-07-31 | A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/… |
CVE-2025-29556 | High | 7.3 | 2025-07-31 | ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restrictions preventing users with the Admin role f… |
CVE-2025-8408 | High | 7.3 | 2025-07-31 | A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. Affected is an unknown function of the file /filter1.php… |