2025 CVEs (page 247)
Page 247 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27209 | High | 7.5 | 2025-07-18 | The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability… |
CVE-2025-7814 | High | 7.3 | 2025-07-18 | A vulnerability classified as critical was found in code-projects Food Ordering Review System 1.0. This vulnerability affects unknown code of the file /pages/s… |
CVE-2025-7807 | High | 8.8 | 2025-07-18 | A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. This issue affects the function fromSafeUrlFilter of the file /goform… |
CVE-2025-7806 | High | 8.8 | 2025-07-18 | A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeC… |
CVE-2025-50583 | Medium | 4.8 | 2025-07-18 | StudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Student module. |
CVE-2025-50582 | Medium | 4.8 | 2025-07-18 | StudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Course module. |
CVE-2025-50581 | Medium | 4.8 | 2025-07-18 | MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do. |
CVE-2025-7805 | High | 8.8 | 2025-07-18 | A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. This affects the function fromPptpUserSetting of the file /goform/PPTPUserSetting… |
CVE-2025-7803 | Low | 3.5 | 2025-07-18 | A vulnerability was found in descreekert wx-discuz up to 12bd4745c63ec203cb32119bf77ead4a923bf277. It has been classified as problematic. This affects the func… |
CVE-2025-54310 | Medium | 4.0 | 2025-07-18 | qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidget.cpp and searchjobwidget.cpp. |
CVE-2025-50708 | High | 7.5 | 2025-07-18 | An issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information via the token component in the shared chat URL |
CVE-2025-50584 | Medium | 4.8 | 2025-07-18 | StudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Teacher module. |
CVE-2025-7802 | Low | 3.5 | 2025-07-18 | A vulnerability was found in PHPGurukul Complaint Management System 2.0 and classified as problematic. Affected by this issue is some unknown functionality of… |
CVE-2025-7801 | High | 7.3 | 2025-07-18 | A vulnerability has been found in BossSoft CRM 6.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /crm/modu… |
CVE-2025-7800 | Low | 3.5 | 2025-07-18 | A vulnerability classified as problematic was found in cgpandey hotelmis up to c572198e6c4780fccc63b1d3e8f3f72f825fc94e. This vulnerability affects unknown cod… |
CVE-2025-7798 | Medium | 6.3 | 2025-07-18 | A vulnerability classified as critical has been found in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System up to 8.2. This affec… |
CVE-2025-54309 | Critical | 9.0 | 2025-07-18 | CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers t… |
CVE-2025-52169 | High | 7.1 | 2025-07-18 | agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability. |
CVE-2025-52163 | Medium | 6.5 | 2025-07-18 | A Server-Side Request Forgery (SSRF) in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully… |
CVE-2025-50585 | High | 8.8 | 2025-07-18 | StudentManage v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/adminStudentUrl. |
CVE-2025-33014 | Medium | 5.4 | 2025-07-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an e… |
CVE-2025-7797 | Medium | 5.3 | 2025-07-18 | A vulnerability was found in GPAC up to 2.4. It has been rated as problematic. Affected by this issue is the function gf_dash_download_init_segment of the file… |
CVE-2025-7796 | High | 8.8 | 2025-07-18 | A vulnerability, which was classified as critical, was found in Tenda FH451 1.0.0.9. This affects the function fromPptpUserAdd of the file /goform/PPTPDClient… |
CVE-2025-7795 | High | 8.8 | 2025-07-18 | A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. Affected by this issue is the function fromP2pListFilter of the file… |
CVE-2025-53901 | Low | 3.5 | 2025-07-18 | Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions c… |
CVE-2025-52168 | Medium | 6.5 | 2025-07-18 | Incorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows unauthenticated attackers to access… |
CVE-2025-52166 | Medium | 6.5 | 2025-07-18 | Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to Administrator and access… |
CVE-2025-52164 | High | 8.2 | 2025-07-18 | Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext. |
CVE-2025-7794 | High | 8.8 | 2025-07-18 | A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function fromNatStaticSetting of the file /gofor… |
CVE-2025-7793 | High | 8.8 | 2025-07-18 | A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary. T… |
CVE-2025-7792 | High | 8.8 | 2025-07-18 | A vulnerability was found in Tenda FH451 1.0.0.9. It has been rated as critical. This issue affects the function formSafeEmailFilter of the file /goform/SafeEm… |
CVE-2025-7783 | | 2025-07-18 | Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/f… | |
CVE-2025-53762 | High | 8.7 | 2025-07-18 | Permissive list of allowed inputs in Microsoft Purview allows an authorized attacker to elevate privileges over a network. |
CVE-2025-52162 | Medium | 6.5 | 2025-07-18 | agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. This vulnerability… |
CVE-2025-50586 | Medium | 6.5 | 2025-07-18 | StudentManage v1.0 was discovered to contain Cross-Site Request Forgery (CSRF). |
CVE-2025-49747 | Critical | 9.9 | 2025-07-18 | Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. |
CVE-2025-49746 | Critical | 9.9 | 2025-07-18 | Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. |
CVE-2025-47995 | Medium | 6.5 | 2025-07-18 | Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. |
CVE-2025-47158 | Critical | 9.0 | 2025-07-18 | Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-45157 | Medium | 6.5 | 2025-07-18 | Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users. |
CVE-2025-45156 | Medium | 5.3 | 2025-07-18 | Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users. |
CVE-2025-7791 | Low | 3.5 | 2025-07-18 | A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0. It has been declared as problematic. This vulnerability affects unknown code… |
CVE-2025-7790 | High | 8.8 | 2025-07-18 | A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been classified as critical. This affects an unknown part of the file /menu_nat.asp of the compo… |
CVE-2025-7789 | Low | 3.7 | 2025-07-18 | A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/j… |
CVE-2025-54079 | High | 8.8 | 2025-07-18 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versio… |
CVE-2025-54078 | Medium | 6.5 | 2025-07-18 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-54077 | Medium | 6.5 | 2025-07-18 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-54076 | Medium | 6.5 | 2025-07-18 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-54075 | High | 8.3 | 2025-07-18 | MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored… |
CVE-2025-54073 | High | 7.5 | 2025-07-18 | mcp-package-docs is an MCP (Model Context Protocol) server that provides LLMs with efficient access to package documentation across multiple programming langua… |
CVE-2025-54059 | Medium | 4.4 | 2025-07-18 | melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange… |
CVE-2025-53945 | High | 7.0 | 2025-07-18 | apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files wer… |
CVE-2025-53888 | Critical | 9.8 | 2025-07-18 | RIOT-OS, an operating system that supports Internet of Things devices, has an ineffective size check implemented with `assert()` can lead to buffer overflow in… |
CVE-2025-7788 | Medium | 6.3 | 2025-07-18 | A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of t… |
CVE-2025-7787 | Medium | 6.3 | 2025-07-18 | A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\… |
CVE-2025-46732 | Medium | 5.4 | 2025-07-18 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQ… |
CVE-2025-46000 | Medium | 6.5 | 2025-07-18 | An arbitrary file upload vulnerability in the component /rsc/filemanager.rsc.class.php of Filemanager commit c75b914 v.2.5.0 allows attackers to execute arbitr… |
CVE-2025-7786 | Low | 3.5 | 2025-07-18 | A vulnerability, which was classified as problematic, has been found in Gnuboard g6 up to 6.0.10. This issue affects some unknown processing of the file /bbs/s… |
CVE-2025-7784 | Medium | 6.5 | 2025-07-18 | A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the… |
CVE-2025-46002 | Medium | 6.5 | 2025-07-18 | An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint. |
CVE-2025-46001 | Critical | 9.8 | 2025-07-18 | An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a… |
CVE-2025-7785 | Medium | 4.3 | 2025-07-18 | A vulnerability classified as problematic was found in thinkgem JeeSite up to 5.12.0. This vulnerability affects the function sso of the file src/main/java/com… |
CVE-2025-6227 | Low | 2.2 | 2025-07-18 | Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite… |
CVE-2025-6233 | Medium | 6.8 | 2025-07-18 | Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import… |
CVE-2025-50126 | | 2025-07-18 | A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered. The issue allows remote authenticated users to inject arbitrary web sc… | |
CVE-2025-50058 | | 2025-07-18 | A stored XSS vulnerability in the RSDirectory! component 1.0.0-2.2.8 Joomla was discovered. The issue allows remote authenticated attackers to inject arbitrary… | |
CVE-2025-50057 | | 2025-07-18 | A DOS vulnerability in RSFiles! component 1.16.3-1.17.7 Joomla was discovered. The issue allows unauthenticated remote attackers to deny access to service via… | |
CVE-2025-50056 | | 2025-07-18 | A reflected XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 28 Joomla was discovered. The issue allows remote attackers to inject arbitrary web script… | |
CVE-2025-49486 | | 2025-07-18 | A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items. | |
CVE-2025-49485 | | 2025-07-18 | A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' param… | |
CVE-2025-49484 | | 2025-07-18 | A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid'… | |
CVE-2025-2425 | | 2025-07-18 | Time-of-check to time-of-use race condition vulnerability potentially allowed an attacker to use the installed ESET security software to clear the content of a… | |
CVE-2025-7444 | Critical | 9.8 | 2025-07-18 | The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verific… |
CVE-2025-6226 | Medium | 6.5 | 2025-07-18 | Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by Pendin… |
CVE-2025-6197 | Medium | 4.2 | 2025-07-18 | An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizat… |
CVE-2025-6023 | High | 7.6 | 2025-07-18 | An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11… |
CVE-2025-38349 | High | 7.8 | 2025-07-18 | In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points… |
CVE-2025-26855 | Critical | 9.8 | 2025-07-18 | A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands. |
CVE-2025-26854 | Critical | 9.8 | 2025-07-18 | A SQL injection in Articles Good Search extension 1.0.0 - 1.2.4.0011 for Joomla allows attackers to execute arbitrary SQL commands. |
CVE-2025-7772 | Medium | 6.5 | 2025-07-18 | The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and inc… |
CVE-2025-7438 | High | 7.5 | 2025-07-18 | The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plug… |
CVE-2025-7643 | Critical | 9.1 | 2025-07-18 | The Attachment Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_actions() function… |
CVE-2025-6726 | Medium | 4.3 | 2025-07-18 | The Block Editor Gallery Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the classic_galler… |
CVE-2025-6719 | Medium | 4.4 | 2025-07-18 | The Terms descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.4.8 due to… |
CVE-2025-6718 | High | 8.8 | 2025-07-18 | The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1_run_query AJAX action in all versions up to, and incl… |
CVE-2025-6717 | Medium | 6.5 | 2025-07-18 | The B1.lt plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 2.2.56 due to insufficient escaping… |
CVE-2025-6222 | Critical | 9.8 | 2025-07-18 | The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploa… |
CVE-2025-5811 | Medium | 5.3 | 2025-07-18 | The Listly: Listicles For WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Init() fun… |
CVE-2025-5800 | Medium | 6.4 | 2025-07-18 | The Testimonial Post type plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter in all versions up to, and including… |
CVE-2025-5767 | Medium | 6.4 | 2025-07-18 | The Crowdfunding for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and includi… |
CVE-2025-5754 | Medium | 6.4 | 2025-07-18 | The Useful Tab Block – Responsive & AMP-Compatible plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versi… |
CVE-2025-5752 | Medium | 6.4 | 2025-07-18 | The Vertical scroll image slideshow gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to… |
CVE-2025-7660 | Medium | 6.4 | 2025-07-18 | The Map My Locations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'map_my_locations' shortcode in all versions up to, and… |
CVE-2025-7648 | Medium | 6.4 | 2025-07-18 | The Ruven Themes: Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ruven_button' shortcode in all versions up to… |
CVE-2025-7638 | Medium | 4.9 | 2025-07-18 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the `order_by` param… |
CVE-2025-6813 | High | 8.8 | 2025-07-18 | The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versi… |
CVE-2025-6781 | Medium | 4.3 | 2025-07-18 | The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This… |
CVE-2025-6053 | Medium | 6.1 | 2025-07-18 | The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missin… |
CVE-2025-5816 | Medium | 4.3 | 2025-07-18 | The Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version… |
CVE-2025-3740 | High | 8.8 | 2025-07-18 | The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 93.1.0 via the 'pag… |