2025 CVEs (page 244)
Page 244 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4129 | High | 7.5 | 2025-07-21 | Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay… |
CVE-2025-7925 | Medium | 4.3 | 2025-07-21 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Online Banquet Booking System 1.0. Affected by this issue is some unknown fu… |
CVE-2025-4040 | High | 7.1 | 2025-07-21 | Authorization Bypass Through User-Controlled Key vulnerability in Turpak Automatic Station Monitoring System allows Privilege Escalation. This issue affects A… |
CVE-2025-41100 | | 2025-07-21 | Incorrect authentication vulnerability in ParkingDoor. Through this vulnerability it is possible to operate the device without the access being logged in the a… | |
CVE-2025-30192 | High | 7.5 | 2025-07-21 | An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. The updated version… |
CVE-2025-2301 | Medium | 4.4 | 2025-07-21 | Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Identifiers. This iss… |
CVE-2025-7924 | Low | 3.5 | 2025-07-21 | A vulnerability classified as problematic was found in PHPGurukul Online Banquet Booking System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2025-5681 | Medium | 6.5 | 2025-07-21 | Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek… |
CVE-2025-41459 | High | 7.8 | 2025-07-21 | Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local… |
CVE-2025-41458 | Medium | 5.5 | 2025-07-21 | Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s fi… |
CVE-2025-50151 | High | 8.8 | 2025-07-21 | File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. U… |
CVE-2025-49656 | High | 7.5 | 2025-07-21 | Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. U… |
CVE-2025-41681 | Medium | 4.8 | 2025-07-21 | A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content. |
CVE-2025-41679 | Medium | 5.3 | 2025-07-21 | An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initia… |
CVE-2025-41678 | Medium | 6.5 | 2025-07-21 | A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL state… |
CVE-2025-41677 | Medium | 4.9 | 2025-07-21 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast successio… |
CVE-2025-41676 | Medium | 4.9 | 2025-07-21 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession. |
CVE-2025-41675 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralizatio… |
CVE-2025-41674 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special el… |
CVE-2025-41673 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elem… |
CVE-2025-1469 | High | 7.5 | 2025-07-21 | Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek… |
CVE-2025-7369 | Medium | 6.1 | 2025-07-21 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. Th… |
CVE-2025-7354 | Medium | 6.4 | 2025-07-21 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up… |
CVE-2025-4685 | Medium | 6.4 | 2025-07-21 | The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML data attribu… |
CVE-2025-4570 | | 2025-07-21 | An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with c… | |
CVE-2025-4569 | | 2025-07-21 | An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with c… | |
CVE-2025-4049 | | 2025-07-21 | Use of hard-coded, the same among all vulnerable installations SQLite credentials vulnerability in SIGNUM-NET FARA allows to read and manipulate local-stored d… | |
CVE-2025-7921 | Critical | 9.8 | 2025-07-21 | Certain modem models developed by Askey has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's exe… |
CVE-2025-7920 | Medium | 6.1 | 2025-07-21 | WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute… |
CVE-2025-7919 | Medium | 6.5 | 2025-07-21 | WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL com… |
CVE-2025-7344 | High | 8.8 | 2025-07-21 | The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to adminis… |
CVE-2025-7343 | Critical | 9.8 | 2025-07-21 | The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and… |
CVE-2025-24938 | High | 8.4 | 2025-07-21 | The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access (adm… |
CVE-2025-24937 | Critical | 9.0 | 2025-07-21 | File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise… |
CVE-2025-24936 | Critical | 9.0 | 2025-07-21 | The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the net… |
CVE-2025-0664 | | 2025-07-21 | A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrary local library. Th… | |
CVE-2025-7918 | Critical | 9.8 | 2025-07-21 | WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL com… |
CVE-2025-7917 | High | 7.2 | 2025-07-21 | WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to u… |
CVE-2025-7916 | Critical | 9.8 | 2025-07-21 | WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code o… |
CVE-2025-54352 | Low | 3.7 | 2025-07-21 | WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not ch… |
CVE-2025-7915 | High | 7.3 | 2025-07-21 | A vulnerability was found in Chanjet CRM 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /mail/mailinactive.ph… |
CVE-2025-7914 | High | 8.8 | 2025-07-21 | A vulnerability has been found in Tenda AC6 15.03.06.50 and classified as critical. Affected by this vulnerability is the function setparentcontrolinfo of the… |
CVE-2025-7913 | High | 8.8 | 2025-07-21 | A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. Affected is the function updateWifiInfo of the component MQT… |
CVE-2025-7912 | High | 8.8 | 2025-07-20 | A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748_B20211015. This issue affects the function recvSlaveUpgstatus of t… |
CVE-2025-7911 | High | 8.8 | 2025-07-20 | A vulnerability classified as critical was found in D-Link DI-8100 1.0. This vulnerability affects the function sprintf of the file /upnp_ctrl.asp of the compo… |
CVE-2025-53771 | Medium | 6.5 | 2025-07-20 | Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-7910 | High | 8.8 | 2025-07-20 | A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function sprintf of the file /goform/formSetWanNonLogin of the c… |
CVE-2025-7909 | High | 8.8 | 2025-07-20 | A vulnerability was found in D-Link DIR-513 1.0. It has been rated as critical. Affected by this issue is the function sprintf of the file /goform/formLanSetup… |
CVE-2025-7908 | High | 8.8 | 2025-07-20 | A vulnerability was found in D-Link DI-8100 1.0. It has been declared as critical. Affected by this vulnerability is the function sprintf of the file /ddns.asp… |
CVE-2025-7907 | Medium | 4.3 | 2025-07-20 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been classified as problematic. Affected is an unknown function of the file ruoyi-admin/sr… |
CVE-2025-54319 | Medium | 6.3 | 2025-07-20 | An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can gain unauthorized access to sensitive information via system l… |
CVE-2025-7906 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src… |
CVE-2025-7905 | Medium | 6.3 | 2025-07-20 | A vulnerability has been found in itsourcecode Insurance Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-54317 | High | 8.4 | 2025-07-20 | An issue was discovered in Logpoint before 7.6.0. An attacker with operator privileges can exploit a path traversal vulnerability when creating a Layout Templa… |
CVE-2025-54316 | Medium | 4.9 | 2025-07-20 | An issue was discovered in Logpoint before 7.6.0. When creating reports, attackers can create custom Jinja templates that chained built-in filter functions to… |
CVE-2025-49087 | Medium | 4.0 | 2025-07-20 | In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS#7 padd… |
CVE-2025-47917 | High | 8.9 | 2025-07-20 | Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedt… |
CVE-2025-48965 | Medium | 4.0 | 2025-07-20 | Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater… |
CVE-2025-7904 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, was found in itsourcecode Insurance Management System 1.0. This affects an unknown part of the file /insertN… |
CVE-2025-7903 | Medium | 4.3 | 2025-07-20 | A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the compo… |
CVE-2025-7902 | Low | 3.5 | 2025-07-20 | A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/control… |
CVE-2025-7901 | Medium | 4.3 | 2025-07-20 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger… |
CVE-2025-7898 | Medium | 4.7 | 2025-07-20 | A vulnerability was found in Codecanyon iDentSoft 2.0. It has been classified as critical. This affects an unknown part of the file /clinica/profile/updateSett… |
CVE-2025-7897 | High | 7.3 | 2025-07-20 | A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this issue is the function verify_token of the fil… |
CVE-2025-7896 | Medium | 6.3 | 2025-07-20 | A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this vulnerability is the function download_v… |
CVE-2025-7895 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, was found in harry0703 MoneyPrinterTurbo up to 1.2.6. Affected is the function upload_bgm_file of the file a… |
CVE-2025-46385 | High | 8.6 | 2025-07-20 | CWE-918 Server-Side Request Forgery (SSRF) |
CVE-2025-46384 | High | 8.8 | 2025-07-20 | CWE-434 Unrestricted Upload of File with Dangerous Type |
CVE-2025-46383 | Medium | 6.1 | 2025-07-20 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-46382 | Medium | 5.3 | 2025-07-20 | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2025-7894 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, has been found in Onyx up to 0.29.1. This issue affects the function generate_simple_sql of the file backend… |
CVE-2025-7893 | Medium | 5.3 | 2025-07-20 | A vulnerability classified as problematic was found in Foresight News App up to 2.6.4 on Android. This vulnerability affects unknown code of the file AndroidMa… |
CVE-2025-7892 | Medium | 5.3 | 2025-07-20 | A vulnerability classified as problematic has been found in IDnow App up to 9.6.0 on Android. This affects an unknown part of the file AndroidManifest.xml of t… |
CVE-2025-7891 | Medium | 5.3 | 2025-07-20 | A vulnerability was found in InstantBits Web Video Cast App up to 5.12.4 on Android. It has been rated as problematic. Affected by this issue is some unknown f… |
CVE-2025-7890 | Medium | 5.3 | 2025-07-20 | A vulnerability was found in Dunamu StockPlus App up to 7.62.10 on Android. It has been declared as problematic. Affected by this vulnerability is an unknown f… |
CVE-2025-7889 | Medium | 5.3 | 2025-07-20 | A vulnerability was found in CallApp Caller ID App up to 2.0.4 on Android. It has been classified as problematic. Affected is an unknown function of the file A… |
CVE-2025-7888 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in TDuckCloud tduck-platform 5.1 and classified as critical. This issue affects the function UserFormDataMapper of the file src/main/… |
CVE-2025-7887 | Medium | 4.3 | 2025-07-20 | A vulnerability has been found in Zavy86 WikiDocs up to 1.0.78 and classified as problematic. This vulnerability affects unknown code of the file template.inc… |
CVE-2025-7886 | High | 7.3 | 2025-07-20 | A vulnerability, which was classified as critical, was found in pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486. This affec… |
CVE-2025-7885 | Medium | 4.3 | 2025-07-20 | A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of… |
CVE-2025-7884 | Low | 3.3 | 2025-07-20 | A vulnerability classified as problematic was found in Eluktronics Control Center 5.23.51.41. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-7883 | High | 7.8 | 2025-07-20 | A vulnerability classified as critical has been found in Eluktronics Control Center 5.23.51.41. Affected is an unknown function of the file \AiStoneService\MyC… |
CVE-2025-7882 | Low | 3.1 | 2025-07-20 | A vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n. It has been rated as problematic. This issue affects some unknown processing of the… |
CVE-2025-7881 | Low | 2.7 | 2025-07-20 | A vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n. It has been declared as problematic. This vulnerability affects unknown code of the… |
CVE-2025-7880 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this issue is some unknown functionality of the file /bu… |
CVE-2025-7879 | Medium | 6.3 | 2025-07-20 | A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-7878 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, was found in Metasoft 美特软件 MetaCRM up to 6.4.2. Affected is an unknown function of the file /common/jsp/uplo… |
CVE-2025-7877 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This issue affects some unknown processing of the file… |
CVE-2025-7876 | Medium | 6.3 | 2025-07-20 | A vulnerability classified as critical was found in Metasoft 美特软件 MetaCRM up to 6.4.2. This vulnerability affects the function AnalyzeParam of the file downloa… |
CVE-2025-7875 | High | 7.3 | 2025-07-20 | A vulnerability classified as critical has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This affects an unknown part of the file /debug.jsp. The manipulati… |
CVE-2025-7874 | Medium | 5.3 | 2025-07-20 | A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-7873 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-7872 | Low | 3.5 | 2025-07-20 | A vulnerability was found in Portabilis i-Diario 1.5.0 and classified as problematic. This issue affects some unknown processing of the file /justificativas-de… |
CVE-2025-7871 | Low | 3.5 | 2025-07-20 | A vulnerability has been found in Portabilis i-Diario 1.5.0 and classified as problematic. This vulnerability affects unknown code of the file /conteudos. The… |
CVE-2025-7870 | Low | 3.5 | 2025-07-20 | A vulnerability, which was classified as problematic, was found in Portabilis i-Diario 1.5.0. This affects an unknown part of the component justificativas-de-f… |
CVE-2025-7869 | Low | 3.5 | 2025-07-20 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the… |
CVE-2025-7868 | Low | 3.5 | 2025-07-20 | A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_calendario_dia_motivo_cad… |
CVE-2025-7867 | Low | 3.5 | 2025-07-20 | A vulnerability has been found in Portabilis i-Educar 2.9.0/2.10.0. This vulnerability affects unknown code of the file /intranet/agenda.php of the component A… |
CVE-2025-7866 | Low | 3.5 | 2025-07-20 | A vulnerability was found in Portabilis i-Educar 2.9.0. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/educ… |
CVE-2025-7865 | Low | 3.5 | 2025-07-20 | A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been declared as problematic. This vulnerability affects the function xssFilter of the file… |