2025 CVEs (page 234)
Page 234 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-52289 | High | 8.0 | 2025-07-31 | A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbi… |
CVE-2025-51569 | Medium | 6.1 | 2025-07-31 | A cross-site scripting (XSS) vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U14_06 router's web interface. The /goform/goform_get_cmd_process endpoi… |
CVE-2025-50849 | High | 8.0 | 2025-07-31 | CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference (IDOR). The user profile functionality allows enabling or disabling stickers through a paramet… |
CVE-2025-50475 | Critical | 9.8 | 2025-07-31 | An OS command injection vulnerability exists in Russound MBX-PRE-D67F firmware version 3.1.6, allowing unauthenticated attackers to execute arbitrary commands… |
CVE-2025-50270 | Medium | 6.1 | 2025-07-31 | A stored Cross Site Scripting (xss) vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remote attacker to execute arbitrary code vi… |
CVE-2025-34146 | | 2025-07-31 | A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via… | |
CVE-2025-29557 | Medium | 5.4 | 2025-07-31 | ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can is… |
CVE-2025-8407 | High | 7.3 | 2025-07-31 | A vulnerability, which was classified as critical, has been found in code-projects Vehicle Management 1.0. This issue affects some unknown processing of the fi… |
CVE-2025-7738 | Medium | 4.4 | 2025-07-31 | A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear tex… |
CVE-2025-54589 | Medium | 6.3 | 2025-07-31 | Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an inpu… |
CVE-2025-8213 | High | 7.2 | 2025-07-31 | The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscan_aj… |
CVE-2025-8401 | Medium | 4.3 | 2025-07-31 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.1 vi… |
CVE-2025-8382 | Medium | 6.3 | 2025-07-31 | A vulnerability, which was classified as critical, was found in Campcodes Online Hotel Reservation System 1.0. Affected is an unknown function of the file /adm… |
CVE-2025-8381 | Medium | 6.3 | 2025-07-31 | A vulnerability, which was classified as critical, has been found in Campcodes Online Hotel Reservation System 1.0. This issue affects some unknown processing… |
CVE-2025-8151 | Medium | 4.3 | 2025-07-31 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'save_bloc… |
CVE-2025-8068 | Medium | 4.3 | 2025-07-31 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an improper capability chec… |
CVE-2025-8380 | Low | 3.5 | 2025-07-31 | A vulnerability classified as problematic was found in Campcodes Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admi… |
CVE-2025-8379 | Medium | 4.7 | 2025-07-31 | A vulnerability classified as critical has been found in Campcodes Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/edit_ro… |
CVE-2025-8378 | High | 7.3 | 2025-07-31 | A vulnerability was found in Campcodes Online Hotel Reservation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2025-8376 | High | 7.3 | 2025-07-31 | A vulnerability classified as critical has been found in code-projects Vehicle Management 1.0. Affected is an unknown function of the file /updatebal.php. The… |
CVE-2025-41688 | High | 7.2 | 2025-07-31 | A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox. |
CVE-2025-40980 | | 2025-07-31 | A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of use… | |
CVE-2025-2813 | High | 7.5 | 2025-07-31 | An unauthenticated remote attacker can cause a Denial of Service by sending a large number of requests to the http service on port 80. |
CVE-2025-8375 | High | 7.3 | 2025-07-31 | A vulnerability was found in code-projects Vehicle Management 1.0. It has been rated as critical. This issue affects some unknown processing of the file /addve… |
CVE-2025-8374 | High | 7.3 | 2025-07-31 | A vulnerability was found in code-projects Vehicle Management 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /addco… |
CVE-2025-8192 | | 2025-07-31 | There exists a TOCTOU race condition in TvSettings AppRestrictionsFragment.java that lead to start of attacker supplied activity in Settings’ context, i.e. sys… | |
CVE-2025-24854 | Medium | 6.1 | 2025-07-31 | A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript… |
CVE-2025-24853 | High | 7.5 | 2025-07-31 | A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's br… |
CVE-2025-8373 | High | 7.3 | 2025-07-31 | A vulnerability was found in code-projects Vehicle Management 1.0. It has been classified as critical. This affects an unknown part of the file /print.php. The… |
CVE-2025-8372 | High | 7.3 | 2025-07-31 | A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-7205 | Medium | 5.4 | 2025-07-31 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all ve… |
CVE-2025-54757 | Medium | 6.5 | 2025-07-31 | Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an… |
CVE-2025-54752 | Medium | 6.5 | 2025-07-31 | Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it… |
CVE-2025-46359 | High | 7.2 | 2025-07-31 | A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a… |
CVE-2025-41396 | Medium | 5.4 | 2025-07-31 | A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user. |
CVE-2025-41391 | Medium | 5.4 | 2025-07-31 | Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be exec… |
CVE-2025-36563 | Medium | 6.1 | 2025-07-31 | Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script ma… |
CVE-2025-8371 | High | 7.3 | 2025-07-31 | A vulnerability has been found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-8370 | Medium | 4.3 | 2025-07-31 | A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9. Affected is an unknown function of the file /intranet/educar_escola… |
CVE-2025-8369 | Medium | 4.3 | 2025-07-31 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9. This issue affects some unknown processing of the file /intran… |
CVE-2025-8368 | Medium | 4.3 | 2025-07-31 | A vulnerability classified as problematic was found in Portabilis i-Educar 2.9. This vulnerability affects unknown code of the file /intranet/pesquisa_pessoa_l… |
CVE-2025-53558 | High | 8.8 | 2025-07-31 | ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log i… |
CVE-2025-8367 | Medium | 4.3 | 2025-07-31 | A vulnerability classified as problematic has been found in Portabilis i-Educar 2.9. This affects an unknown part of the file /intranet/funcionario_vinculo_lst… |
CVE-2025-8366 | Medium | 4.3 | 2025-07-31 | A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intra… |
CVE-2025-7847 | High | 8.8 | 2025-07-31 | The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versi… |
CVE-2025-5720 | Medium | 6.4 | 2025-07-31 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all versions up to, and in… |
CVE-2025-8365 | Low | 3.5 | 2025-07-31 | A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2025-8348 | High | 7.3 | 2025-07-31 | A vulnerability has been found in Kehua Charging Pile Cloud Platform 1.0 and classified as critical. This vulnerability affects unknown code of the file /home… |
CVE-2025-8347 | Medium | 6.3 | 2025-07-31 | A vulnerability, which was classified as critical, was found in Kehua Charging Pile Cloud Platform 1.0. This affects an unknown part of the file /sys/task/find… |
CVE-2025-8346 | Medium | 4.3 | 2025-07-31 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the f… |
CVE-2025-8345 | Medium | 6.3 | 2025-07-31 | A vulnerability classified as critical was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. Affected by this vulnerability is the… |
CVE-2025-8344 | Medium | 6.3 | 2025-07-31 | A vulnerability classified as critical has been found in openviglet shio up to 0.3.8. Affected is the function shStaticFileUpload of the file shio-app/src/main… |
CVE-2025-8343 | Medium | 4.3 | 2025-07-31 | A vulnerability was found in openviglet shio up to 0.3.8. It has been rated as critical. This issue affects the function shStaticFilePreUpload of the file shio… |
CVE-2025-8340 | Medium | 4.3 | 2025-07-31 | A vulnerability was found in code-projects Intern Membership Management System 1.0. It has been declared as problematic. This vulnerability affects unknown cod… |
CVE-2025-8339 | High | 7.3 | 2025-07-31 | A vulnerability was found in code-projects Intern Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the fil… |
CVE-2025-8338 | High | 7.3 | 2025-07-31 | A vulnerability was found in projectworlds Online Admission System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-54085 | Low | 3.8 | 2025-07-31 | CVE-2025-54085 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the conso… |
CVE-2025-49084 | Critical | 9.1 | 2025-07-31 | CVE-2025-49084 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access can overwrit… |
CVE-2025-49083 | High | 7.2 | 2025-07-31 | CVE-2025-49083 is a vulnerability in the management console of Absolute Secure Access after version 12.00 and prior to version 13.56. Attackers with administra… |
CVE-2025-49082 | Low | 2.7 | 2025-07-31 | CVE-2025-49082 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the conso… |
CVE-2025-36040 | Medium | 6.5 | 2025-07-31 | IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side securit… |
CVE-2025-36039 | Medium | 6.5 | 2025-07-31 | IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side securit… |
CVE-2025-8337 | Low | 2.4 | 2025-07-30 | A vulnerability, which was classified as problematic, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing… |
CVE-2025-8336 | High | 7.3 | 2025-07-30 | A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. This vulnerability affects unknown code of the file /ad… |
CVE-2025-8335 | Medium | 4.3 | 2025-07-30 | A vulnerability classified as problematic has been found in code-projects Simple Car Rental System 1.0. This affects an unknown part. The manipulation leads to… |
CVE-2025-8334 | High | 7.3 | 2025-07-30 | A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. Affected by this issue is some unknown function… |
CVE-2025-54586 | High | 7.1 | 2025-07-30 | GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into th… |
CVE-2025-8333 | High | 7.3 | 2025-07-30 | A vulnerability was found in code-projects Online Farm System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-8332 | High | 7.3 | 2025-07-30 | A vulnerability was found in code-projects Online Farm System 1.0. It has been classified as critical. Affected is an unknown function of the file /register.ph… |
CVE-2025-54585 | Medium | 6.5 | 2025-07-30 | GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit the way GitProxy handl… |
CVE-2025-8331 | High | 7.3 | 2025-07-30 | A vulnerability was found in code-projects Online Farm System 1.0 and classified as critical. This issue affects some unknown processing of the file /forgot_pa… |
CVE-2025-8330 | High | 7.3 | 2025-07-30 | A vulnerability has been found in code-projects Vehicle Management 1.0 and classified as critical. This vulnerability affects unknown code of the file /edit1.p… |
CVE-2025-54584 | Medium | 5.7 | 2025-07-30 | GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a m… |
CVE-2025-54583 | Medium | 6.5 | 2025-07-30 | GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote… |
CVE-2025-54581 | High | 7.5 | 2025-07-30 | vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header… |
CVE-2025-54576 | Critical | 9.1 | 2025-07-30 | OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load… |
CVE-2025-54575 | Medium | 5.3 | 2025-07-30 | ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension b… |
CVE-2025-53022 | High | 8.6 | 2025-07-30 | TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade. While pr… |
CVE-2025-52187 | High | 8.2 | 2025-07-30 | GetProjectsIdea Create School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in my_profile_update_form1.php. |
CVE-2025-51954 | Medium | 6.1 | 2025-07-30 | playground.electronhub.ai v1.1.9 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2025-8329 | High | 7.3 | 2025-07-30 | A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. This affects an unknown part of the file /filter3.php. Th… |
CVE-2025-51951 | Medium | 6.1 | 2025-07-30 | andisearch v0.5.249 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2025-50777 | High | 7.8 | 2025-07-30 | The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerability that allows l… |
CVE-2025-50464 | Medium | 6.5 | 2025-07-30 | A buffer overflow vulnerability exists in the upload.cgi module of the iptime NAS firmware v1.5.04. The vulnerability arises due to the unsafe use of the strcp… |
CVE-2025-36609 | Low | 2.5 | 2025-07-30 | Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains a Use of Hard-coded Password vulnerability. A low privileged attacker with local access co… |
CVE-2025-36608 | Medium | 6.5 | 2025-07-30 | Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged a… |
CVE-2025-30103 | Medium | 5.5 | 2025-07-30 | Dell SmartFabric OS10 Software, versions prior to 10.6.0.5 contains a Files or Directories Accessible to External Parties vulnerability. A low privileged attac… |
CVE-2025-8328 | High | 7.3 | 2025-07-30 | A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. Affected by this issue is some unknown functionali… |
CVE-2025-8327 | High | 7.3 | 2025-07-30 | A vulnerability classified as critical was found in code-projects Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2025-30480 | Medium | 6.5 | 2025-07-30 | Dell PowerProtect Data Manager, versions prior to 19.19, contain(s) an Improper Input Validation vulnerability in PowerProtect Data Manager. A low privileged a… |
CVE-2025-30105 | High | 8.8 | 2025-07-30 | Dell XtremIO, version(s) 6.4.0-22, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access co… |
CVE-2025-26332 | High | 8.8 | 2025-07-30 | TechAdvisor versions 2.6 through 3.37-30 for Dell XtremIO X2, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged at… |
CVE-2025-45620 | High | 8.1 | 2025-07-30 | An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted request |
CVE-2025-45619 | Medium | 6.5 | 2025-07-30 | An issue in Aver PTC310UV2 firmware v.0.1.0000.59 allows a remote attacker to execute arbitrary code via the SendAction function |
CVE-2025-36611 | High | 7.3 | 2025-07-30 | Dell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an Improper Link Resolution Before File Access ('Link Following') Vulne… |
CVE-2025-25692 | Medium | 6.5 | 2025-07-30 | A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2025-25691 | Medium | 6.5 | 2025-07-30 | A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2025-8353 | Medium | 5.9 | 2025-07-30 | UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated… |
CVE-2025-8312 | High | 7.1 | 2025-07-30 | Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a dea… |
CVE-2025-54656 | Medium | 6.5 | 2025-07-30 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. Wh… |