2025 CVEs (page 249)
Page 249 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-37105 | High | 7.5 | 2025-07-16 | An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-36097 | High | 7.5 | 2025-07-16 | IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stac… |
CVE-2025-53904 | | 2025-07-16 | The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/admin.js` contains code that could make the website… | |
CVE-2025-20337 | Critical | 10.0 | 2025-07-16 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying op… |
CVE-2025-20288 | Medium | 5.8 | 2025-07-16 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-… |
CVE-2025-20285 | Medium | 4.1 | 2025-07-16 | A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP acces… |
CVE-2025-20284 | Medium | 6.5 | 2025-07-16 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying oper… |
CVE-2025-20283 | Medium | 6.5 | 2025-07-16 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying oper… |
CVE-2025-20274 | Medium | 6.3 | 2025-07-16 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary fi… |
CVE-2025-20272 | Medium | 4.3 | 2025-07-16 | A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-… |
CVE-2025-7357 | | 2025-07-16 | LITEON IC48A firmware versions prior to 01.00.19r and LITEON IC80A firmware versions prior to 01.01.12e store FTP-server-access-credentials in cleartext in the… | |
CVE-2025-53943 | | 2025-07-16 | VoidBot Open-Source is a customizable Discord bot. VoidBot Open-Source versions 0.0.1 through 0.8.1 contain a vulnerability in the command handler where permis… | |
CVE-2025-53938 | High | 7.5 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Authentication Bypass vulnerability was identified… |
CVE-2025-53937 | Critical | 9.8 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the `/… |
CVE-2025-53936 | Medium | 6.1 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-53935 | Medium | 6.1 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-53934 | Medium | 5.4 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was… |
CVE-2025-53933 | Medium | 5.4 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was… |
CVE-2025-53932 | Medium | 6.1 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-53931 | Medium | 5.4 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was… |
CVE-2025-53930 | Medium | 5.4 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was… |
CVE-2025-53929 | Medium | 5.4 | 2025-07-16 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was… |
CVE-2025-53926 | Medium | 6.1 | 2025-07-16 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to… |
CVE-2025-47053 | Medium | 5.4 | 2025-07-16 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low privileged attacker could expl… |
CVE-2025-46959 | Medium | 5.4 | 2025-07-16 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low privileged attacker could expl… |
CVE-2025-5994 | | 2025-07-16 | A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound… | |
CVE-2025-53925 | Medium | 5.4 | 2025-07-16 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote… |
CVE-2025-37104 | High | 7.1 | 2025-07-16 | A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQ… |
CVE-2025-32874 | High | 7.5 | 2025-07-16 | An issue was discovered in Kaseya Rapid Fire Tools Network Detective through 2.0.16.0. A vulnerability exists in the EncryptionUtil class because symmetric enc… |
CVE-2025-32353 | High | 8.2 | 2025-07-16 | Kaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials (for privileged access) stored in the collector.txt configuration file. |
CVE-2025-53924 | Medium | 6.9 | 2025-07-16 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote… |
CVE-2025-53923 | High | 8.2 | 2025-07-16 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to… |
CVE-2025-53892 | | 2025-07-16 | Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection b… | |
CVE-2025-53840 | Low | 2.4 | 2025-07-16 | Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependenc… |
CVE-2025-40919 | Medium | 6.5 | 2025-07-16 | Authen::DigestMD5 versions 0.01 through 0.02 for Perl generate the cnonce insecurely. The cnonce (client nonce) is generated from an MD5 hash of the PID, the… |
CVE-2025-40918 | Medium | 6.5 | 2025-07-16 | Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely. The cnonce (client nonce) is generated from an MD5 hash… |
CVE-2025-40913 | Medium | 6.5 | 2025-07-16 | Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow. Net::Dropbear embeds a version of the libto… |
CVE-2025-40776 | High | 8.6 | 2025-07-16 | A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9… |
CVE-2025-3871 | Medium | 5.3 | 2025-07-16 | Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere On… |
CVE-2025-40923 | High | 7.3 | 2025-07-16 | Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the… |
CVE-2025-34300 | | 2025-07-16 | A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web app… | |
CVE-2025-53758 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to use of default admin credentials at its web management interface. An attacker with physical acce… | |
CVE-2025-53757 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router… | |
CVE-2025-53756 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to cleartext transmission of credentials in its web management interface. A remote attacker could e… | |
CVE-2025-53755 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to storage of credentials and PINS without encryption in the device firmware. An attacker with phys… | |
CVE-2025-53754 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to hard-coded Root Access Credentials in system configuration of the device firmware. An attacker w… | |
CVE-2025-52836 | Critical | 9.8 | 2025-07-16 | Incorrect Privilege Assignment vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Privilege Escalation.This issue affects T… |
CVE-2025-52819 | High | 8.5 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pakkemx Pakke Envíos pakke allows SQL Injection.This issu… |
CVE-2025-52804 | High | 7.5 | 2025-07-16 | Missing Authorization vulnerability in uxper Nuss nuss allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Nuss: from n/a throug… |
CVE-2025-52803 | High | 7.5 | 2025-07-16 | Missing Authorization vulnerability in uxper Sala allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sala: from n/a through 1… |
CVE-2025-52787 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EZiHosting Tennis Court Bookings tennis-court-bookings al… |
CVE-2025-52786 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kingdom Creation Media Folder media-folder allows Reflect… |
CVE-2025-52779 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc… |
CVE-2025-52777 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7… |
CVE-2025-52714 | Critical | 9.3 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows SQL Injection.This is… |
CVE-2025-50028 | Medium | 6.5 | 2025-07-16 | Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-49888 | High | 7.1 | 2025-07-16 | Missing Authorization vulnerability in pimwick PW WooCommerce On Sale! pw-woocommerce-on-sale allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-49884 | Medium | 6.5 | 2025-07-16 | Missing Authorization vulnerability in alexvtn Internal Linking of Related Contents internal-linking-of-related-contents allows Exploiting Incorrectly Configur… |
CVE-2025-49876 | High | 8.5 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-a… |
CVE-2025-49319 | Medium | 6.5 | 2025-07-16 | Missing Authorization vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-49034 | High | 7.6 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows SQ… |
CVE-2025-49031 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefan M. SMu Manual DoFollow manuall-dofollow allows Ref… |
CVE-2025-48345 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft Contact Form 7 Editor Button cf7-editor-button al… |
CVE-2025-48339 | Medium | 6.5 | 2025-07-16 | Missing Authorization vulnerability in activity-log.com Profiler - What Slowing Down Your WP allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-48300 | Critical | 9.1 | 2025-07-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Adrian Tobey Groundhogg groundhogg allows Upload a Web Shell to a Web Server.This issue affect… |
CVE-2025-48291 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Galle… |
CVE-2025-47652 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected… |
CVE-2025-47645 | High | 8.5 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products… |
CVE-2025-47554 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress cs… |
CVE-2025-46500 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows… |
CVE-2025-32574 | High | 8.5 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPGYM allows SQL Injection. This issue affects W… |
CVE-2025-31427 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Invico - WordPress Consulting Business Theme… |
CVE-2025-31422 | High | 8.8 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in designthemes Visual Art | Gallery WordPress Theme visual-arts allows Object Injection.This issue affects Vis… |
CVE-2025-31072 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Ofiz - WordPress Business Consulting Theme o… |
CVE-2025-31070 | High | 7.5 | 2025-07-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon l… |
CVE-2025-31055 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vergatheme Electrician - Electrical Service WordPress ele… |
CVE-2025-30973 | Critical | 9.8 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in Codexpert, Inc CoSchool LMS coschool allows Object Injection.This issue affects CoSchool LMS: from n/a throu… |
CVE-2025-30959 | Medium | 6.5 | 2025-07-16 | Missing Authorization vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Exploiting Incorrectly Confi… |
CVE-2025-30955 | High | 7.1 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes ListingEasy listingeasy allows Reflected XSS.Th… |
CVE-2025-30949 | Critical | 9.8 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in Guru Team Site Chat on Telegram site-chat-on-telegram allows Object Injection.This issue affects Site Chat o… |
CVE-2025-30936 | Critical | 9.3 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Torod Company for Information Technology Torod torod allo… |
CVE-2025-29009 | Critical | 10.0 | 2025-07-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescription Attachment Plugin for WooCommerce medical-prescription-attachment-… |
CVE-2025-29000 | High | 7.5 | 2025-07-16 | Missing Authorization vulnerability in August Infotech Multi-language Responsive Contact Form responsive-contact-form allows Accessing Functionality Not Proper… |
CVE-2025-28982 | Critical | 9.3 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress WP Pipes allows SQL Injection. This issue affec… |
CVE-2025-28965 | High | 8.6 | 2025-07-16 | Missing Authorization vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Accessing Functionality Not Properly Constrained by ACLs.This issue… |
CVE-2025-28961 | Critical | 9.8 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Object Injection.This issue affects URL Shortener: from… |
CVE-2025-28959 | Critical | 9.3 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows SQL… |
CVE-2025-28955 | High | 7.5 | 2025-07-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FWDesign Easy Video Player Wordpress & WooCommerce fwdevp allow… |
CVE-2025-24779 | High | 8.8 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in NooTheme Yogi yogi allows Object Injection.This issue affects Yogi: from n/a through < 2.9.3. |
CVE-2025-24777 | High | 8.8 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in awethemes Hillter allows Object Injection. This issue affects Hillter: from n/a through 3.0.7. |
CVE-2025-24759 | Critical | 9.3 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-Busin… |
CVE-2025-54051 | Medium | 6.5 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS… |
CVE-2025-54050 | Medium | 6.5 | 2025-07-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-ad… |
CVE-2025-54047 | Medium | 4.3 | 2025-07-16 | Missing Authorization vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-54043 | High | 7.6 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for Amazon SES smtp-amazon-ses allows SQ… |
CVE-2025-54042 | Medium | 4.3 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in Xfinitysoft WP Post Hide wp-post-hide allows Cross Site Request Forgery.This issue affects WP Post Hide: fro… |
CVE-2025-54041 | Medium | 4.3 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Cross Site Request Forgery.This… |
CVE-2025-54039 | Medium | 4.3 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Animator scroll-triggered-animations allows Cross Site Request Forgery.This issue affects Anim… |
CVE-2025-54038 | Medium | 5.4 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows Cross Site Request Forgery.This issue aff… |
CVE-2025-54037 | Medium | 5.4 | 2025-07-16 | Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control… |