2025 CVEs (page 247)
Page 247 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-23263 | High | 7.6 | 2025-07-17 | NVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature, where an attacker on a VM might cause escalation of privileges and denial of se… |
CVE-2025-7339 | Low | 3.4 | 2025-07-17 | on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being… |
CVE-2025-7338 | High | 7.5 | 2025-07-17 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 a… |
CVE-2025-53867 | Critical | 9.8 | 2025-07-17 | Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL. |
CVE-2025-52046 | Critical | 9.8 | 2025-07-17 | Totolink A3300R V17.0.0cu.596_B20250515 was found to contain a command injection vulnerability in the sub_4197C0 function via the mac and desc parameters. This… |
CVE-2025-25257 | Critical | 9.8 | 2025-07-17 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through… |
CVE-2025-54066 | Medium | 4.7 | 2025-07-17 | DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request tha… |
CVE-2025-54064 | | 2025-07-17 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. The com… | |
CVE-2025-54062 | High | 8.8 | 2025-07-17 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versio… |
CVE-2025-54061 | High | 8.8 | 2025-07-17 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versio… |
CVE-2025-54060 | High | 8.8 | 2025-07-17 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versio… |
CVE-2025-54058 | High | 8.8 | 2025-07-17 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versio… |
CVE-2025-47189 | Medium | 6.1 | 2025-07-17 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data of certain user flows, a different… |
CVE-2025-53946 | High | 8.8 | 2025-07-17 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versio… |
CVE-2025-53941 | Medium | 6.1 | 2025-07-17 | Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be su… |
CVE-2025-53928 | Medium | 4.6 | 2025-07-17 | MaxKB is an open-source AI assistant for enterprise. Prior to versions 1.10.9-lts and 2.0.0, a Remote Command Execution vulnerability exists in the MCP call. V… |
CVE-2025-53927 | Medium | 4.6 | 2025-07-17 | MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because MaxKB only restricts the executio… |
CVE-2025-53909 | Critical | 9.1 | 2025-07-17 | mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to… |
CVE-2025-51630 | Critical | 9.8 | 2025-07-17 | TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a buffer overflow via the ePort parameter in the function setIpPortFilterRules. |
CVE-2025-40924 | Medium | 6.5 | 2025-07-17 | Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely. The session id is generated from a (usually SHA-1) hash of a simple c… |
CVE-2025-1713 | High | 7.5 | 2025-07-17 | When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required. This lookup, itself inv… |
CVE-2025-5346 | | 2025-07-17 | Bluebird devices contain a pre-loaded barcode scanner application. This application exposes an unsecured broadcast receiver "kr.co.bluebird.android.bbsettings… | |
CVE-2025-5345 | | 2025-07-17 | Bluebird devices contain a pre-loaded file manager application. This application exposes an unsecured service provider "com.bluebird.system.koreanpost.IsdcardR… | |
CVE-2025-5344 | | 2025-07-17 | Bluebird devices contain a pre-loaded kiosk application. This application exposes an unsecured service provider "com.bluebird.kiosk.launcher.IpartnerKioskRemot… | |
CVE-2025-3415 | Medium | 4.3 | 2025-07-17 | Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed… |
CVE-2025-4302 | Medium | 5.3 | 2025-07-17 | The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users. However, this can be b… |
CVE-2025-7735 | High | 7.5 | 2025-07-17 | The Hospital Information System developed by UNIMAX has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL comman… |
CVE-2025-7712 | Critical | 9.1 | 2025-07-17 | The Madara - Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wp_manga_delete_zip() function… |
CVE-2025-7729 | Low | 3.5 | 2025-07-17 | A vulnerability classified as problematic was found in Scada-LTS up to 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file usersPro… |
CVE-2025-7728 | Low | 3.5 | 2025-07-17 | A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. Affected is an unknown function of the file users.shtm. The manipulation o… |
CVE-2025-5396 | Critical | 9.8 | 2025-07-17 | The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.0. This is due to the bbackup_ajax_handl… |
CVE-2025-34132 | | 2025-07-16 | A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NT… | |
CVE-2025-34130 | | 2025-07-16 | An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html… | |
CVE-2025-34129 | | 2025-07-16 | A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 due to insufficient sanitizati… | |
CVE-2025-34128 | | 2025-07-16 | A buffer overflow vulnerability exists in the X360 VideoPlayer ActiveX control (VideoPlayer.ocx) version 2.6 when handling overly long arguments to the Convert… | |
CVE-2025-34127 | | 2025-07-16 | A stack-based buffer overflow exists in Achat v0.150 in its default configuration. By sending a specially crafted message to the UDP port 9256, an attacker can… | |
CVE-2025-34126 | | 2025-07-16 | A path traversal vulnerability exists in RIPS Scanner version 0.54. The vulnerability allows remote attackers to read arbitrary files on the system with the pr… | |
CVE-2025-34125 | | 2025-07-16 | An unauthenticated command injection vulnerability exists in the cookie handling process of the lighttpd web server on D-Link DSP-W110A1 firmware version 1.05B… | |
CVE-2025-34124 | | 2025-07-16 | A buffer overflow vulnerability exists in Heroes of Might and Magic III Complete 4.0.0.0, HD Mod 3.808 build 9, and Demo 1.0.0.0 via malicious .h3m map files t… | |
CVE-2025-34123 | | 2025-07-16 | A stack-based buffer overflow vulnerability exists in VideoCharge Studio 2.12.3.685 when processing a specially crafted .VSC configuration file. The issue occu… | |
CVE-2025-34121 | | 2025-07-16 | An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php`… | |
CVE-2025-34120 | | 2025-07-16 | An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validat… | |
CVE-2025-34119 | | 2025-07-16 | A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. The server listens f… | |
CVE-2025-34118 | | 2025-07-16 | A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticate… | |
CVE-2025-34117 | | 2025-07-16 | A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an… | |
CVE-2025-6983 | | 2025-07-16 | A Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into performing unintended actions via rendered UI… | |
CVE-2025-6982 | | 2025-07-16 | Use of Hard-coded Credentials in TP-Link Archer C50 V3( <= 180703)/V4( <= 250117 )/V5( <= 200407 ), and C20 V5 (<US_V5_260419 or <EU_V5_260317) all… | |
CVE-2025-53908 | | 2025-07-16 | RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` en… | |
CVE-2025-40777 | High | 7.5 | 2025-07-16 | If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other… |
CVE-2025-37107 | High | 7.3 | 2025-07-16 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-37106 | High | 7.3 | 2025-07-16 | An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-37105 | High | 7.5 | 2025-07-16 | An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-36097 | High | 7.5 | 2025-07-16 | IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stac… |
CVE-2025-53904 | | 2025-07-16 | The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/admin.js` contains code that could make the website… | |
CVE-2025-20337 | Critical | 10.0 | 2025-07-16 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying op… |
CVE-2025-20288 | Medium | 5.8 | 2025-07-16 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-… |
CVE-2025-20285 | Medium | 4.1 | 2025-07-16 | A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP acces… |
CVE-2025-20284 | Medium | 6.5 | 2025-07-16 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying oper… |
CVE-2025-20283 | Medium | 6.5 | 2025-07-16 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying oper… |
CVE-2025-20274 | Medium | 6.3 | 2025-07-16 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary fi… |
CVE-2025-20272 | Medium | 4.3 | 2025-07-16 | A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-… |
CVE-2025-7357 | | 2025-07-16 | LITEON IC48A firmware versions prior to 01.00.19r and LITEON IC80A firmware versions prior to 01.01.12e store FTP-server-access-credentials in cleartext in the… | |
CVE-2025-53943 | | 2025-07-16 | VoidBot Open-Source is a customizable Discord bot. VoidBot Open-Source versions 0.0.1 through 0.8.1 contain a vulnerability in the command handler where permis… | |
CVE-2025-53938 | High | 7.5 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Authentication Bypass vulnerability was identified… |
CVE-2025-53937 | Critical | 9.8 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the `/… |
CVE-2025-53936 | Medium | 6.1 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-53935 | Medium | 6.1 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-53934 | Medium | 5.4 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was… |
CVE-2025-53933 | Medium | 5.4 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was… |
CVE-2025-53932 | Medium | 6.1 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-53931 | Medium | 5.4 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was… |
CVE-2025-53930 | Medium | 5.4 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was… |
CVE-2025-53929 | Medium | 5.4 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was… |
CVE-2025-53926 | Medium | 6.1 | 2025-07-16 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to… |
CVE-2025-47053 | Medium | 5.4 | 2025-07-16 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low privileged attacker could expl… |
CVE-2025-46959 | Medium | 5.4 | 2025-07-16 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low privileged attacker could expl… |
CVE-2025-5994 | | 2025-07-16 | A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound… | |
CVE-2025-53925 | Medium | 5.4 | 2025-07-16 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote… |
CVE-2025-37104 | High | 7.1 | 2025-07-16 | A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQ… |
CVE-2025-32874 | High | 7.5 | 2025-07-16 | An issue was discovered in Kaseya Rapid Fire Tools Network Detective through 2.0.16.0. A vulnerability exists in the EncryptionUtil class because symmetric enc… |
CVE-2025-32353 | High | 8.2 | 2025-07-16 | Kaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials (for privileged access) stored in the collector.txt configuration file. |
CVE-2025-53924 | Medium | 6.9 | 2025-07-16 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote… |
CVE-2025-53923 | High | 8.2 | 2025-07-16 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to… |
CVE-2025-53892 | | 2025-07-16 | Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection b… | |
CVE-2025-53840 | Low | 2.4 | 2025-07-16 | Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependenc… |
CVE-2025-40919 | Medium | 6.5 | 2025-07-16 | Authen::DigestMD5 versions 0.01 through 0.02 for Perl generate the cnonce insecurely. The cnonce (client nonce) is generated from an MD5 hash of the PID, the… |
CVE-2025-40918 | Medium | 6.5 | 2025-07-16 | Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely. The cnonce (client nonce) is generated from an MD5 hash… |
CVE-2025-40913 | Medium | 6.5 | 2025-07-16 | Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow. Net::Dropbear embeds a version of the libto… |
CVE-2025-40776 | High | 8.6 | 2025-07-16 | A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9… |
CVE-2025-3871 | Medium | 5.3 | 2025-07-16 | Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere On… |
CVE-2025-40923 | High | 7.3 | 2025-07-16 | Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the… |
CVE-2025-34300 | | 2025-07-16 | A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web app… | |
CVE-2025-53758 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to use of default admin credentials at its web management interface. An attacker with physical acce… | |
CVE-2025-53757 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router… | |
CVE-2025-53756 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to cleartext transmission of credentials in its web management interface. A remote attacker could e… | |
CVE-2025-53755 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to storage of credentials and PINS without encryption in the device firmware. An attacker with phys… | |
CVE-2025-53754 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to hard-coded Root Access Credentials in system configuration of the device firmware. An attacker w… | |
CVE-2025-52836 | Critical | 9.8 | 2025-07-16 | Incorrect Privilege Assignment vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Privilege Escalation.This issue affects T… |
CVE-2025-52819 | High | 8.5 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pakkemx Pakke Envíos pakke allows SQL Injection.This issu… |
CVE-2025-52804 | High | 7.5 | 2025-07-16 | Missing Authorization vulnerability in uxper Nuss nuss allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Nuss: from n/a throug… |