2025 CVEs (page 245)
Page 245 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7962 | High | 7.5 | 2025-07-21 | In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. |
CVE-2025-7933 | High | 7.3 | 2025-07-21 | A vulnerability classified as critical was found in Campcodes Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/settin… |
CVE-2025-52575 | Medium | 6.5 | 2025-07-21 | EspoCRM is an Open Source CRM (Customer Relationship Management) software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP… |
CVE-2025-44654 | Critical | 9.8 | 2025-07-21 | In Linksys E2500 3.0.04.002, the chroot_local_user option is enabled in the vsftpd configuration file. This could lead to unauthorized access to system files… |
CVE-2025-44652 | High | 7.5 | 2025-07-21 | In Netgear RAX30 V1.0.10.94_3, the USERLIMIT_GLOBAL option is set to 0 in multiple bftpd-related configuration files. This can cause DoS attacks when unlimited… |
CVE-2025-36846 | Critical | 9.8 | 2025-07-21 | An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that… |
CVE-2025-36845 | High | 8.6 | 2025-07-21 | An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSRF). The endpoint t… |
CVE-2025-36107 | Medium | 5.9 | 2025-07-21 | IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to obtain sensitive information due to the cleartext transmission of data. |
CVE-2025-7932 | Medium | 6.3 | 2025-07-21 | A vulnerability classified as critical has been found in D-Link DIR‑817L up to 1.04B01. This affects the function lxmldbc_system of the file ssdpcgi. The manip… |
CVE-2025-7931 | High | 7.3 | 2025-07-21 | A vulnerability was found in code-projects Church Donation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2025-7717 | High | 7.5 | 2025-07-21 | Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 befo… |
CVE-2025-7716 | Medium | 6.1 | 2025-07-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripti… |
CVE-2025-7715 | Medium | 6.1 | 2025-07-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Attributes allows Cross-Site Scripting (XSS)… |
CVE-2025-7393 | Critical | 9.8 | 2025-07-21 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 befor… |
CVE-2025-7392 | Medium | 6.1 | 2025-07-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).T… |
CVE-2025-54082 | | 2025-07-21 | marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-pack… | |
CVE-2025-44653 | High | 7.5 | 2025-07-21 | In H3C GR2200 MiniGR1A0V100R016, the USERLIMIT_GLOBAL option is set to 0 in the /etc/bftpd.conf. This can cause DoS attacks when unlimited users are connected. |
CVE-2025-44649 | High | 7.5 | 2025-07-21 | In the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage_mode is set to aggressive. Aggressive mode in IKE Phase 1 ex… |
CVE-2025-43720 | Medium | 6.5 | 2025-07-21 | Headwind MDM before 5.33.1 makes configuration details accessible to unauthorized users. The Configuration profile is exposed to the Observer user role, reveal… |
CVE-2025-36603 | Medium | 4.2 | 2025-07-21 | Dell AppSync, version(s) 4.6.0.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access… |
CVE-2025-32744 | Medium | 6.6 | 2025-07-21 | Dell AppSync, version(s) 4.6.0.0, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access coul… |
CVE-2025-30477 | Medium | 4.4 | 2025-07-21 | Dell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. A high privileged attacker with r… |
CVE-2025-7930 | High | 7.3 | 2025-07-21 | A vulnerability was found in code-projects Church Donation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2025-7929 | High | 7.3 | 2025-07-21 | A vulnerability was found in code-projects Church Donation System 1.0. It has been classified as critical. Affected is an unknown function of the file /members… |
CVE-2025-52374 | Medium | 4.6 | 2025-07-21 | Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.e… |
CVE-2025-52373 | Medium | 4.6 | 2025-07-21 | Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from h… |
CVE-2025-52372 | Medium | 5.1 | 2025-07-21 | An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installation/hMailServerInnoExtension.iss and hMail… |
CVE-2025-44658 | Critical | 9.8 | 2025-07-21 | In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An att… |
CVE-2025-44657 | Low | 3.9 | 2025-07-21 | In Linksys EA6350 V2.1.2, the chroot_local_user option is enabled in the dynamically generated vsftpd configuration file. This could lead to unauthorized acces… |
CVE-2025-44655 | Critical | 9.8 | 2025-07-21 | In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to syst… |
CVE-2025-44651 | High | 7.5 | 2025-07-21 | In TRENDnet TPL-430AP FW1.0, the USERLIMIT_GLOBAL option is set to 0 in the bftpd-related configuration file. This can cause DoS attacks when unlimited users a… |
CVE-2025-44650 | High | 7.5 | 2025-07-21 | In Netgear R7000 V1.3.1.64_10.1.36 and EAX80 V1.0.1.70_1.0.2, the USERLIMIT_GLOBAL option is set to 0 in the bftpd.conf configuration file. This can cause DoS… |
CVE-2025-44647 | High | 7.3 | 2025-07-21 | In TRENDnet TEW-WLC100P 2.03b03, the i_dont_care_about_security_and_use_aggressive_mode_psk option is enabled in the strongSwan configuration file, so that IKE… |
CVE-2025-7928 | High | 7.3 | 2025-07-21 | A vulnerability was found in code-projects Church Donation System 1.0 and classified as critical. This issue affects some unknown processing of the file /membe… |
CVE-2025-7927 | Medium | 6.3 | 2025-07-21 | A vulnerability has been found in PHPGurukul Online Banquet Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-46123 | High | 7.2 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where the… |
CVE-2025-46122 | Critical | 9.1 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cm… |
CVE-2025-46121 | Critical | 9.8 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `s… |
CVE-2025-46120 | Critical | 9.8 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a pa… |
CVE-2025-46119 | Medium | 6.3 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where an a… |
CVE-2025-46118 | Medium | 5.3 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1.0.279, where hard-… |
CVE-2025-46117 | Critical | 9.1 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where a hi… |
CVE-2025-46116 | High | 8.8 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an a… |
CVE-2025-43977 | Medium | 5.5 | 2025-07-21 | The com.skt.prod.dialer application through 12.5.0 for Android enables any installed application (with no permissions) to place phone calls without user intera… |
CVE-2025-43976 | Medium | 5.5 | 2025-07-21 | The com.enflick.android.tn2ndLine application through 24.17.1.0 for Android enables any installed application (with no permissions) to place phone calls withou… |
CVE-2025-7926 | Low | 3.5 | 2025-07-21 | A vulnerability, which was classified as problematic, was found in PHPGurukul Online Banquet Booking System 1.0. This affects an unknown part of the file /admi… |
CVE-2025-7624 | Critical | 9.8 | 2025-07-21 | An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code executio… |
CVE-2025-7382 | High | 8.8 | 2025-07-21 | A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code e… |
CVE-2025-6704 | Critical | 9.8 | 2025-07-21 | An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth… |
CVE-2025-6235 | Medium | 6.1 | 2025-07-21 | In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems f… |
CVE-2025-4130 | High | 7.5 | 2025-07-21 | Use of Hard-coded Credentials vulnerability in PAVO Inc. PAVO Pay allows Read Sensitive Constants Within an Executable. This issue affects PAVO Pay: before 13… |
CVE-2025-4129 | High | 7.5 | 2025-07-21 | Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay… |
CVE-2025-7925 | Medium | 4.3 | 2025-07-21 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Online Banquet Booking System 1.0. Affected by this issue is some unknown fu… |
CVE-2025-4040 | High | 7.1 | 2025-07-21 | Authorization Bypass Through User-Controlled Key vulnerability in Turpak Automatic Station Monitoring System allows Privilege Escalation. This issue affects A… |
CVE-2025-41100 | | 2025-07-21 | Incorrect authentication vulnerability in ParkingDoor. Through this vulnerability it is possible to operate the device without the access being logged in the a… | |
CVE-2025-30192 | High | 7.5 | 2025-07-21 | An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. The updated version… |
CVE-2025-2301 | Medium | 4.4 | 2025-07-21 | Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Identifiers. This iss… |
CVE-2025-7924 | Low | 3.5 | 2025-07-21 | A vulnerability classified as problematic was found in PHPGurukul Online Banquet Booking System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2025-5681 | Medium | 6.5 | 2025-07-21 | Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek… |
CVE-2025-41459 | High | 7.8 | 2025-07-21 | Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local… |
CVE-2025-41458 | Medium | 5.5 | 2025-07-21 | Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s fi… |
CVE-2025-50151 | High | 8.8 | 2025-07-21 | File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. U… |
CVE-2025-49656 | High | 7.5 | 2025-07-21 | Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. U… |
CVE-2025-41681 | Medium | 4.8 | 2025-07-21 | A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content. |
CVE-2025-41679 | Medium | 5.3 | 2025-07-21 | An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initia… |
CVE-2025-41678 | Medium | 6.5 | 2025-07-21 | A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL state… |
CVE-2025-41677 | Medium | 4.9 | 2025-07-21 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast successio… |
CVE-2025-41676 | Medium | 4.9 | 2025-07-21 | A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession. |
CVE-2025-41675 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralizatio… |
CVE-2025-41674 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special el… |
CVE-2025-41673 | High | 7.2 | 2025-07-21 | A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elem… |
CVE-2025-1469 | High | 7.5 | 2025-07-21 | Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek… |
CVE-2025-7369 | Medium | 6.1 | 2025-07-21 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. Th… |
CVE-2025-7354 | Medium | 6.4 | 2025-07-21 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up… |
CVE-2025-4685 | Medium | 6.4 | 2025-07-21 | The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML data attribu… |
CVE-2025-4570 | | 2025-07-21 | An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with c… | |
CVE-2025-4569 | | 2025-07-21 | An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with c… | |
CVE-2025-4049 | | 2025-07-21 | Use of hard-coded, the same among all vulnerable installations SQLite credentials vulnerability in SIGNUM-NET FARA allows to read and manipulate local-stored d… | |
CVE-2025-7921 | Critical | 9.8 | 2025-07-21 | Certain modem models developed by Askey has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's exe… |
CVE-2025-7920 | Medium | 6.1 | 2025-07-21 | WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute… |
CVE-2025-7919 | Medium | 6.5 | 2025-07-21 | WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL com… |
CVE-2025-7344 | High | 8.8 | 2025-07-21 | The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to adminis… |
CVE-2025-7343 | Critical | 9.8 | 2025-07-21 | The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and… |
CVE-2025-24938 | High | 8.4 | 2025-07-21 | The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access (adm… |
CVE-2025-24937 | Critical | 9.0 | 2025-07-21 | File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise… |
CVE-2025-24936 | Critical | 9.0 | 2025-07-21 | The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the net… |
CVE-2025-0664 | | 2025-07-21 | A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrary local library. Th… | |
CVE-2025-7918 | Critical | 9.8 | 2025-07-21 | WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL com… |
CVE-2025-7917 | High | 7.2 | 2025-07-21 | WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to u… |
CVE-2025-7916 | Critical | 9.8 | 2025-07-21 | WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code o… |
CVE-2025-54352 | Low | 3.7 | 2025-07-21 | WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not ch… |
CVE-2025-7915 | High | 7.3 | 2025-07-21 | A vulnerability was found in Chanjet CRM 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /mail/mailinactive.ph… |
CVE-2025-7914 | High | 8.8 | 2025-07-21 | A vulnerability has been found in Tenda AC6 15.03.06.50 and classified as critical. Affected by this vulnerability is the function setparentcontrolinfo of the… |
CVE-2025-7913 | High | 8.8 | 2025-07-21 | A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. Affected is the function updateWifiInfo of the component MQT… |
CVE-2025-7912 | High | 8.8 | 2025-07-20 | A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748_B20211015. This issue affects the function recvSlaveUpgstatus of t… |
CVE-2025-7911 | High | 8.8 | 2025-07-20 | A vulnerability classified as critical was found in D-Link DI-8100 1.0. This vulnerability affects the function sprintf of the file /upnp_ctrl.asp of the compo… |
CVE-2025-53771 | Medium | 6.5 | 2025-07-20 | Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-7910 | High | 8.8 | 2025-07-20 | A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function sprintf of the file /goform/formSetWanNonLogin of the c… |
CVE-2025-7909 | High | 8.8 | 2025-07-20 | A vulnerability was found in D-Link DIR-513 1.0. It has been rated as critical. Affected by this issue is the function sprintf of the file /goform/formLanSetup… |
CVE-2025-7908 | High | 8.8 | 2025-07-20 | A vulnerability was found in D-Link DI-8100 1.0. It has been declared as critical. Affected by this vulnerability is the function sprintf of the file /ddns.asp… |