2025 CVEs (page 248)
Page 248 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7431 | Medium | 4.4 | 2025-07-18 | The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin slug setting in all versions up to, and including, 2.3.1 du… |
CVE-2025-7767 | Low | 3.5 | 2025-07-18 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Art Gallery Management System 1.1. Affected by this issue is some unknown fu… |
CVE-2025-6185 | Critical | 9.3 | 2025-07-18 | Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in UR… |
CVE-2025-7765 | High | 7.3 | 2025-07-17 | A vulnerability classified as critical was found in code-projects Online Appointment Booking System 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2025-7764 | High | 7.3 | 2025-07-17 | A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. Affected is an unknown function of the file /admi… |
CVE-2025-7763 | Medium | 4.3 | 2025-07-17 | A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com… |
CVE-2025-7762 | High | 8.8 | 2025-07-17 | A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1. This issue affects some unknown processing of the file /menu_na… |
CVE-2025-7759 | Medium | 6.3 | 2025-07-17 | A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/java/com/jeesite/com… |
CVE-2025-7758 | High | 8.8 | 2025-07-17 | A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnos… |
CVE-2025-7398 | Critical | 9.1 | 2025-07-17 | Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036. |
CVE-2025-7397 | High | 7.1 | 2025-07-17 | A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface (CLI) in plain text within the comma… |
CVE-2025-6391 | Critical | 9.1 | 2025-07-17 | Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with securit… |
CVE-2025-7757 | High | 7.3 | 2025-07-17 | A vulnerability classified as critical was found in PHPGurukul Land Record System 1.0. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2025-7756 | Medium | 4.3 | 2025-07-17 | A vulnerability classified as problematic has been found in code-projects E-Commerce Site 1.0. Affected is an unknown function. The manipulation leads to cross… |
CVE-2025-7755 | Medium | 6.3 | 2025-07-17 | A vulnerability was found in code-projects Online Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /a… |
CVE-2025-23269 | Medium | 4.7 | 2025-07-17 | NVIDIA Jetson Linux contains a vulnerability in the kernel where an attacker may cause an exposure of sensitive information due to a shared microarchitectural… |
CVE-2025-7754 | Medium | 6.3 | 2025-07-17 | A vulnerability was found in code-projects Patient Record Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2025-7753 | High | 7.3 | 2025-07-17 | A vulnerability was found in code-projects Online Appointment Booking System 1.0. It has been classified as critical. This affects an unknown part of the file… |
CVE-2025-7752 | High | 7.3 | 2025-07-17 | A vulnerability was found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionali… |
CVE-2025-7751 | High | 7.3 | 2025-07-17 | A vulnerability has been found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2025-7433 | High | 8.8 | 2025-07-17 | A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution. |
CVE-2025-6249 | Medium | 6.7 | 2025-07-17 | An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions access to applicati… |
CVE-2025-6248 | High | 7.4 | 2025-07-17 | A cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information if a user visits a w… |
CVE-2025-6232 | High | 7.8 | 2025-07-17 | An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated pe… |
CVE-2025-6231 | High | 7.8 | 2025-07-17 | An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated pe… |
CVE-2025-6230 | Medium | 5.3 | 2025-07-17 | A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite c… |
CVE-2025-53964 | Critical | 9.6 | 2025-07-17 | GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary and then searches for… |
CVE-2025-4657 | Medium | 6.7 | 2025-07-17 | A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Lenovo Browser, and Le… |
CVE-2025-3753 | High | 7.8 | 2025-07-17 | A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier… |
CVE-2025-2818 | Low | 3.5 | 2025-07-17 | A vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart Connect Android Application that could al… |
CVE-2025-23270 | High | 7.1 | 2025-07-17 | NVIDIA Jetson Linux contains a vulnerability in UEFI Management mode, where an unprivileged local attacker may cause exposure of sensitive information via a si… |
CVE-2025-23267 | High | 8.5 | 2025-07-17 | NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link following by using a speci… |
CVE-2025-23266 | Critical | 9.0 | 2025-07-17 | NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary c… |
CVE-2025-1729 | Medium | 6.7 | 2025-07-17 | A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker to escalate privilege… |
CVE-2025-1700 | High | 7.0 | 2025-07-17 | A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate pr… |
CVE-2025-0886 | High | 7.8 | 2025-07-17 | An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escalate privileges. |
CVE-2025-7750 | High | 7.3 | 2025-07-17 | A vulnerability, which was classified as critical, was found in code-projects Online Appointment Booking System 1.0. Affected is an unknown function of the fil… |
CVE-2025-7472 | High | 7.5 | 2025-07-17 | A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges… |
CVE-2025-54070 | | 2025-07-17 | OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the `lastIndexOf(bytes,byte,ui… | |
CVE-2025-54068 | Critical | 9.8 | 2025-07-17 | Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote c… |
CVE-2025-53817 | High | 7.5 | 2025-07-17 | 7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference… |
CVE-2025-53816 | High | 7.5 | 2025-07-17 | 7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service… |
CVE-2025-50240 | Critical | 9.8 | 2025-07-17 | nbcio-boot v1.0.3 was discovered to contain a SQL injection vulnerability via the userIds parameter at /sys/user/deleteRecycleBin. |
CVE-2025-46102 | Medium | 5.4 | 2025-07-17 | Cross Site Scripting vulnerability in Beakon Software Beakon Learning Management System Sharable Content Object Reference Model (SCORM) version V.5.4.3 allows… |
CVE-2025-7749 | High | 7.3 | 2025-07-17 | A vulnerability, which was classified as critical, has been found in code-projects Online Appointment Booking System 1.0. This issue affects some unknown proce… |
CVE-2025-7748 | Low | 3.5 | 2025-07-17 | A vulnerability classified as problematic was found in ZCMS 3.6.0. This vulnerability affects unknown code of the component Create Article Page. The manipulati… |
CVE-2025-7747 | High | 8.8 | 2025-07-17 | A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. This affects the function fromWizardHandle of the file /goform/WizardHandle of th… |
CVE-2025-53644 | Critical | 9.8 | 2025-07-17 | OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap bu… |
CVE-2025-53638 | | 2025-07-17 | Solady is software that provides Solidity snippets with APIs. Starting in version 0.0.125 and prior to version 0.1.24, when an account is deployed via a proxy… | |
CVE-2025-51497 | Medium | 5.5 | 2025-07-17 | An issue was discovered in AdGuard plugin before 1.11.22 for Safari on MacOS. AdGaurd verbosely logged each url that Safari accessed when the plugin was active… |
CVE-2025-23263 | High | 7.6 | 2025-07-17 | NVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature, where an attacker on a VM might cause escalation of privileges and denial of se… |
CVE-2025-7339 | Low | 3.4 | 2025-07-17 | on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being… |
CVE-2025-7338 | High | 7.5 | 2025-07-17 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 a… |
CVE-2025-53867 | Critical | 9.8 | 2025-07-17 | Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL. |
CVE-2025-52046 | Critical | 9.8 | 2025-07-17 | Totolink A3300R V17.0.0cu.596_B20250515 was found to contain a command injection vulnerability in the sub_4197C0 function via the mac and desc parameters. This… |
CVE-2025-25257 | Critical | 9.8 | 2025-07-17 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through… |
CVE-2025-54066 | Medium | 4.7 | 2025-07-17 | DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request tha… |
CVE-2025-54064 | | 2025-07-17 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. The com… | |
CVE-2025-54062 | High | 8.8 | 2025-07-17 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versio… |
CVE-2025-54061 | High | 8.8 | 2025-07-17 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versio… |
CVE-2025-54060 | High | 8.8 | 2025-07-17 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versio… |
CVE-2025-54058 | High | 8.8 | 2025-07-17 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versio… |
CVE-2025-47189 | Medium | 6.1 | 2025-07-17 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data of certain user flows, a different… |
CVE-2025-53946 | High | 8.8 | 2025-07-17 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versio… |
CVE-2025-53941 | Medium | 6.1 | 2025-07-17 | Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be su… |
CVE-2025-53928 | Medium | 4.6 | 2025-07-17 | MaxKB is an open-source AI assistant for enterprise. Prior to versions 1.10.9-lts and 2.0.0, a Remote Command Execution vulnerability exists in the MCP call. V… |
CVE-2025-53927 | Medium | 4.6 | 2025-07-17 | MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because MaxKB only restricts the executio… |
CVE-2025-53909 | Critical | 9.1 | 2025-07-17 | mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to… |
CVE-2025-51630 | Critical | 9.8 | 2025-07-17 | TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a buffer overflow via the ePort parameter in the function setIpPortFilterRules. |
CVE-2025-40924 | Medium | 6.5 | 2025-07-17 | Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely. The session id is generated from a (usually SHA-1) hash of a simple c… |
CVE-2025-1713 | High | 7.5 | 2025-07-17 | When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required. This lookup, itself inv… |
CVE-2025-5346 | | 2025-07-17 | Bluebird devices contain a pre-loaded barcode scanner application. This application exposes an unsecured broadcast receiver "kr.co.bluebird.android.bbsettings… | |
CVE-2025-5345 | | 2025-07-17 | Bluebird devices contain a pre-loaded file manager application. This application exposes an unsecured service provider "com.bluebird.system.koreanpost.IsdcardR… | |
CVE-2025-5344 | | 2025-07-17 | Bluebird devices contain a pre-loaded kiosk application. This application exposes an unsecured service provider "com.bluebird.kiosk.launcher.IpartnerKioskRemot… | |
CVE-2025-3415 | Medium | 4.3 | 2025-07-17 | Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed… |
CVE-2025-4302 | Medium | 5.3 | 2025-07-17 | The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users. However, this can be b… |
CVE-2025-7735 | High | 7.5 | 2025-07-17 | The Hospital Information System developed by UNIMAX has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL comman… |
CVE-2025-7712 | Critical | 9.1 | 2025-07-17 | The Madara - Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wp_manga_delete_zip() function… |
CVE-2025-7729 | Low | 3.5 | 2025-07-17 | A vulnerability classified as problematic was found in Scada-LTS up to 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file usersPro… |
CVE-2025-7728 | Low | 3.5 | 2025-07-17 | A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. Affected is an unknown function of the file users.shtm. The manipulation o… |
CVE-2025-5396 | Critical | 9.8 | 2025-07-17 | The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.0. This is due to the bbackup_ajax_handl… |
CVE-2025-34132 | | 2025-07-16 | A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NT… | |
CVE-2025-34130 | | 2025-07-16 | An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html… | |
CVE-2025-34129 | | 2025-07-16 | A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 due to insufficient sanitizati… | |
CVE-2025-34128 | | 2025-07-16 | A buffer overflow vulnerability exists in the X360 VideoPlayer ActiveX control (VideoPlayer.ocx) version 2.6 when handling overly long arguments to the Convert… | |
CVE-2025-34127 | | 2025-07-16 | A stack-based buffer overflow exists in Achat v0.150 in its default configuration. By sending a specially crafted message to the UDP port 9256, an attacker can… | |
CVE-2025-34126 | | 2025-07-16 | A path traversal vulnerability exists in RIPS Scanner version 0.54. The vulnerability allows remote attackers to read arbitrary files on the system with the pr… | |
CVE-2025-34125 | | 2025-07-16 | An unauthenticated command injection vulnerability exists in the cookie handling process of the lighttpd web server on D-Link DSP-W110A1 firmware version 1.05B… | |
CVE-2025-34124 | | 2025-07-16 | A buffer overflow vulnerability exists in Heroes of Might and Magic III Complete 4.0.0.0, HD Mod 3.808 build 9, and Demo 1.0.0.0 via malicious .h3m map files t… | |
CVE-2025-34123 | | 2025-07-16 | A stack-based buffer overflow vulnerability exists in VideoCharge Studio 2.12.3.685 when processing a specially crafted .VSC configuration file. The issue occu… | |
CVE-2025-34121 | | 2025-07-16 | An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php`… | |
CVE-2025-34120 | | 2025-07-16 | An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validat… | |
CVE-2025-34119 | | 2025-07-16 | A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. The server listens f… | |
CVE-2025-34118 | | 2025-07-16 | A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticate… | |
CVE-2025-34117 | | 2025-07-16 | A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an… | |
CVE-2025-6983 | | 2025-07-16 | A Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into performing unintended actions via rendered UI… | |
CVE-2025-6982 | | 2025-07-16 | Use of Hard-coded Credentials in TP-Link Archer C50 V3( <= 180703)/V4( <= 250117 )/V5( <= 200407 ), and C20 V5 (<US_V5_260419 or <EU_V5_260317) all… | |
CVE-2025-53908 | | 2025-07-16 | RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` en… | |
CVE-2025-40777 | High | 7.5 | 2025-07-16 | If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other… |
CVE-2025-37107 | High | 7.3 | 2025-07-16 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |