2025 CVEs (page 245)
Page 245 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7864 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been classified as critical. This affects the function Upload of the file src/main/java/com/… |
CVE-2025-7863 | Low | 3.5 | 2025-07-20 | A vulnerability was found in thinkgem JeeSite up to 5.12.0 and classified as problematic. Affected by this issue is the function redirectUrl of the file src/ma… |
CVE-2025-7862 | High | 7.3 | 2025-07-20 | A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of… |
CVE-2025-54314 | Low | 2.8 | 2025-07-20 | Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only… |
CVE-2025-7861 | High | 7.3 | 2025-07-20 | A vulnerability, which was classified as critical, was found in code-projects Church Donation System 1.0. Affected is an unknown function of the file /members/… |
CVE-2025-7860 | High | 7.3 | 2025-07-20 | A vulnerability, which was classified as critical, has been found in code-projects Church Donation System 1.0. This issue affects some unknown processing of th… |
CVE-2025-7859 | High | 7.3 | 2025-07-20 | A vulnerability classified as critical was found in code-projects Church Donation System 1.0. This vulnerability affects unknown code of the file /members/upda… |
CVE-2025-53770 | Critical | 9.8 | 2025-07-20 | Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware… |
CVE-2025-7858 | Low | 3.5 | 2025-07-20 | A vulnerability classified as problematic has been found in PHPGurukul Apartment Visitors Management System 1.0. This affects an unknown part of the file /admi… |
CVE-2025-7857 | Low | 3.5 | 2025-07-19 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown func… |
CVE-2025-7856 | Low | 3.5 | 2025-07-19 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unk… |
CVE-2025-7855 | High | 8.8 | 2025-07-19 | A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function fromqossetting of the file /goform/qoss… |
CVE-2025-7854 | High | 8.8 | 2025-07-19 | A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function fromVirtualSer of the file /goform/VirtualSer. The manip… |
CVE-2025-7853 | High | 8.8 | 2025-07-19 | A vulnerability was found in Tenda FH451 1.0.0.9. It has been rated as critical. This issue affects the function fromSetIpBind of the file /goform/SetIpBind. T… |
CVE-2025-7840 | Low | 3.5 | 2025-07-19 | A vulnerability was found in Campcodes Online Movie Theater Seat Reservation System 1.0. It has been classified as problematic. This affects an unknown part of… |
CVE-2025-7838 | High | 7.3 | 2025-07-19 | A vulnerability has been found in Campcodes Online Movie Theater Seat Reservation System 1.0 and classified as critical. This vulnerability affects unknown cod… |
CVE-2025-7837 | High | 8.8 | 2025-07-19 | A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this issue is the function recvSlaveStaInfo of the compo… |
CVE-2025-7836 | Medium | 6.3 | 2025-07-19 | A vulnerability has been found in D-Link DIR-816L up to 2.06B01 and classified as critical. Affected by this vulnerability is the function lxmldbc_system of th… |
CVE-2025-54313 | High | 7.5 | 2025-07-19 | eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an… |
CVE-2025-7834 | Medium | 4.3 | 2025-07-19 | A vulnerability, which was classified as problematic, was found in PHPGurukul Complaint Management System 2.0. Affected is an unknown function. The manipulatio… |
CVE-2025-7833 | High | 7.3 | 2025-07-19 | A vulnerability, which was classified as critical, has been found in code-projects Church Donation System 1.0. This issue affects some unknown processing of th… |
CVE-2025-7832 | High | 7.3 | 2025-07-19 | A vulnerability classified as critical was found in code-projects Church Donation System 1.0. This vulnerability affects unknown code of the file /members/offe… |
CVE-2025-7831 | High | 7.3 | 2025-07-19 | A vulnerability classified as critical has been found in code-projects Church Donation System 1.0. This affects an unknown part of the file /members/Tithes.php… |
CVE-2025-7830 | High | 7.3 | 2025-07-19 | A vulnerability was found in code-projects Church Donation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2025-7829 | High | 7.3 | 2025-07-19 | A vulnerability was found in code-projects Church Donation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2025-7824 | High | 7.3 | 2025-07-19 | A vulnerability was found in Jinher OA 1.1. It has been rated as problematic. This issue affects some unknown processing of the file XmlHttp.aspx. The manipula… |
CVE-2025-7823 | High | 7.3 | 2025-07-19 | A vulnerability was found in Jinher OA 1.2. It has been declared as problematic. This vulnerability affects unknown code of the file ProjectScheduleDelete.aspx… |
CVE-2025-7819 | Low | 2.4 | 2025-07-19 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been classified as problematic. This affects an unknown part of the fi… |
CVE-2025-7818 | Low | 3.5 | 2025-07-19 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as problematic. Affected by this issue is some unknown function… |
CVE-2025-7817 | Low | 3.5 | 2025-07-19 | A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as problematic. Affected by this vulnerability is an unkno… |
CVE-2025-38351 | Medium | 5.5 | 2025-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush In KVM guests with Hyp… |
CVE-2025-7816 | Low | 3.5 | 2025-07-19 | A vulnerability, which was classified as problematic, was found in PHPGurukul Apartment Visitors Management System 1.0. Affected is an unknown function of the… |
CVE-2025-7815 | Low | 2.4 | 2025-07-19 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Apartment Visitors Management System 1.0. This issue affects some unknown pr… |
CVE-2025-6997 | Medium | 6.4 | 2025-07-19 | The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due t… |
CVE-2025-38350 | High | 7.8 | 2025-07-19 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdis… |
CVE-2025-6721 | Medium | 5.3 | 2025-07-19 | The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the mrkv_vchasno_kasa_wc_do_metabox_act… |
CVE-2025-6720 | Medium | 5.3 | 2025-07-19 | The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_all_log() function in all versi… |
CVE-2025-29757 | | 2025-07-19 | An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer… | |
CVE-2025-7697 | Critical | 9.8 | 2025-07-19 | The Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all version… |
CVE-2025-7696 | Critical | 9.8 | 2025-07-19 | The Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up… |
CVE-2025-7669 | Medium | 6.1 | 2025-07-19 | The Avishi WP PayPal Payment Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to… |
CVE-2025-7661 | Medium | 6.4 | 2025-07-19 | The Partnerský systém Martinus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'martinus' shortcode in all versions up to, a… |
CVE-2025-7658 | Medium | 6.4 | 2025-07-19 | The Temporarily Hidden Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'temphc-start' shortcode in all versions up t… |
CVE-2025-7655 | Medium | 6.4 | 2025-07-19 | The Live Stream Badger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livestream' shortcode in all versions up to, and inc… |
CVE-2025-7653 | Medium | 6.4 | 2025-07-19 | The EPay.bg Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'epay' shortcode in all versions up to, and including… |
CVE-2025-52924 | Medium | 4.0 | 2025-07-19 | In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header. |
CVE-2025-7396 | Medium | 4.6 | 2025-07-18 | In wolfSSL release 5.8.2 blinding support is turned on by default for Curve25519 in applicable builds. The blinding configure option is only for the base C imp… |
CVE-2025-7395 | | 2025-07-18 | A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL… | |
CVE-2025-7394 | Critical | 9.8 | 2025-07-18 | In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for predictable values re… |
CVE-2025-27210 | High | 7.5 | 2025-07-18 | An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability… |
CVE-2025-27209 | High | 7.5 | 2025-07-18 | The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability… |
CVE-2025-7814 | High | 7.3 | 2025-07-18 | A vulnerability classified as critical was found in code-projects Food Ordering Review System 1.0. This vulnerability affects unknown code of the file /pages/s… |
CVE-2025-7807 | High | 8.8 | 2025-07-18 | A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. This issue affects the function fromSafeUrlFilter of the file /goform… |
CVE-2025-7806 | High | 8.8 | 2025-07-18 | A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeC… |
CVE-2025-50583 | Medium | 4.8 | 2025-07-18 | StudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Student module. |
CVE-2025-50582 | Medium | 4.8 | 2025-07-18 | StudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Course module. |
CVE-2025-50581 | Medium | 4.8 | 2025-07-18 | MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do. |
CVE-2025-7805 | High | 8.8 | 2025-07-18 | A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. This affects the function fromPptpUserSetting of the file /goform/PPTPUserSetting… |
CVE-2025-7803 | Low | 3.5 | 2025-07-18 | A vulnerability was found in descreekert wx-discuz up to 12bd4745c63ec203cb32119bf77ead4a923bf277. It has been classified as problematic. This affects the func… |
CVE-2025-54310 | Medium | 4.0 | 2025-07-18 | qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidget.cpp and searchjobwidget.cpp. |
CVE-2025-50708 | High | 7.5 | 2025-07-18 | An issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information via the token component in the shared chat URL |
CVE-2025-50584 | Medium | 4.8 | 2025-07-18 | StudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Teacher module. |
CVE-2025-7802 | Low | 3.5 | 2025-07-18 | A vulnerability was found in PHPGurukul Complaint Management System 2.0 and classified as problematic. Affected by this issue is some unknown functionality of… |
CVE-2025-7801 | High | 7.3 | 2025-07-18 | A vulnerability has been found in BossSoft CRM 6.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /crm/modu… |
CVE-2025-7800 | Low | 3.5 | 2025-07-18 | A vulnerability classified as problematic was found in cgpandey hotelmis up to c572198e6c4780fccc63b1d3e8f3f72f825fc94e. This vulnerability affects unknown cod… |
CVE-2025-7798 | Medium | 6.3 | 2025-07-18 | A vulnerability classified as critical has been found in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System up to 8.2. This affec… |
CVE-2025-54309 | Critical | 9.0 | 2025-07-18 | CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers t… |
CVE-2025-52169 | High | 7.1 | 2025-07-18 | agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability. |
CVE-2025-52163 | Medium | 6.5 | 2025-07-18 | A Server-Side Request Forgery (SSRF) in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully… |
CVE-2025-50585 | High | 8.8 | 2025-07-18 | StudentManage v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/adminStudentUrl. |
CVE-2025-33014 | Medium | 5.4 | 2025-07-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an e… |
CVE-2025-7797 | Medium | 5.3 | 2025-07-18 | A vulnerability was found in GPAC up to 2.4. It has been rated as problematic. Affected by this issue is the function gf_dash_download_init_segment of the file… |
CVE-2025-7796 | High | 8.8 | 2025-07-18 | A vulnerability, which was classified as critical, was found in Tenda FH451 1.0.0.9. This affects the function fromPptpUserAdd of the file /goform/PPTPDClient… |
CVE-2025-7795 | High | 8.8 | 2025-07-18 | A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. Affected by this issue is the function fromP2pListFilter of the file… |
CVE-2025-53901 | Low | 3.5 | 2025-07-18 | Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions c… |
CVE-2025-52168 | Medium | 6.5 | 2025-07-18 | Incorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows unauthenticated attackers to access… |
CVE-2025-52166 | Medium | 6.5 | 2025-07-18 | Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to Administrator and access… |
CVE-2025-52164 | High | 8.2 | 2025-07-18 | Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext. |
CVE-2025-7794 | High | 8.8 | 2025-07-18 | A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function fromNatStaticSetting of the file /gofor… |
CVE-2025-7793 | High | 8.8 | 2025-07-18 | A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary. T… |
CVE-2025-7792 | High | 8.8 | 2025-07-18 | A vulnerability was found in Tenda FH451 1.0.0.9. It has been rated as critical. This issue affects the function formSafeEmailFilter of the file /goform/SafeEm… |
CVE-2025-7783 | | 2025-07-18 | Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/f… | |
CVE-2025-53762 | High | 8.7 | 2025-07-18 | Permissive list of allowed inputs in Microsoft Purview allows an authorized attacker to elevate privileges over a network. |
CVE-2025-52162 | Medium | 6.5 | 2025-07-18 | agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. This vulnerability… |
CVE-2025-50586 | Medium | 6.5 | 2025-07-18 | StudentManage v1.0 was discovered to contain Cross-Site Request Forgery (CSRF). |
CVE-2025-49747 | Critical | 9.9 | 2025-07-18 | Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. |
CVE-2025-49746 | Critical | 9.9 | 2025-07-18 | Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. |
CVE-2025-47995 | Medium | 6.5 | 2025-07-18 | Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. |
CVE-2025-47158 | Critical | 9.0 | 2025-07-18 | Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-45157 | Medium | 6.5 | 2025-07-18 | Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users. |
CVE-2025-45156 | Medium | 5.3 | 2025-07-18 | Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users. |
CVE-2025-7791 | Low | 3.5 | 2025-07-18 | A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0. It has been declared as problematic. This vulnerability affects unknown code… |
CVE-2025-7790 | High | 8.8 | 2025-07-18 | A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been classified as critical. This affects an unknown part of the file /menu_nat.asp of the compo… |
CVE-2025-7789 | Low | 3.7 | 2025-07-18 | A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/j… |
CVE-2025-54079 | High | 8.8 | 2025-07-18 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versio… |
CVE-2025-54078 | Medium | 6.5 | 2025-07-18 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-54077 | Medium | 6.5 | 2025-07-18 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-54076 | Medium | 6.5 | 2025-07-18 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-54075 | High | 8.3 | 2025-07-18 | MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored… |
CVE-2025-54073 | High | 7.5 | 2025-07-18 | mcp-package-docs is an MCP (Model Context Protocol) server that provides LLMs with efficient access to package documentation across multiple programming langua… |