2025 CVEs (page 25)
Page 25 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13438 | Medium | 4.3 | 2026-02-19 | The Page Title, Description & Open Graph Updater plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.02. T… |
CVE-2025-13413 | Medium | 4.3 | 2026-02-19 | The Country Blocker for AdSense plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to miss… |
CVE-2025-13113 | Medium | 5.3 | 2026-02-19 | The Web Accessibility by accessiBe plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11. This is due… |
CVE-2025-13091 | Medium | 4.3 | 2026-02-19 | The Shopire theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the shopire_admin_install_plugin() func… |
CVE-2025-13079 | Medium | 5.3 | 2026-02-19 | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up t… |
CVE-2025-13048 | Medium | 6.4 | 2026-02-19 | The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's Nickname in all versions up to… |
CVE-2025-12975 | High | 7.2 | 2026-02-19 | The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability ch… |
CVE-2025-12884 | Medium | 4.3 | 2026-02-19 | The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.0.14. This is due to the… |
CVE-2025-12882 | Critical | 9.8 | 2026-02-19 | The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing user… |
CVE-2025-12845 | High | 8.8 | 2026-02-19 | The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads… |
CVE-2025-12821 | High | 8.8 | 2026-02-19 | The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.5.9. This is due to missing or incorrect nonce vali… |
CVE-2025-12707 | High | 7.5 | 2026-02-19 | The Library Management System plugin for WordPress is vulnerable to SQL Injection via the 'bid' parameter in all versions up to, and including, 3.2.1 due to in… |
CVE-2025-12500 | Medium | 5.3 | 2026-02-19 | The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to… |
CVE-2025-12451 | Medium | 4.4 | 2026-02-19 | The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 4.0 due to in… |
CVE-2025-12448 | Medium | 6.4 | 2026-02-19 | The Smartsupp – live chat, AI shopping assistant and chatbots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'code' parameter in all… |
CVE-2025-12375 | Medium | 6.4 | 2026-02-19 | The Printful Integration for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.11 via the… |
CVE-2025-12172 | Medium | 4.3 | 2026-02-19 | The Mailchimp List Subscribe Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.0. This is due to… |
CVE-2025-12117 | Medium | 6.4 | 2026-02-19 | The Renden theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.8.1 due to insufficient… |
CVE-2025-12116 | Medium | 6.4 | 2026-02-19 | The Drift theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.5.0 due to insufficient i… |
CVE-2025-12081 | Medium | 4.3 | 2026-02-19 | The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "acf_photo_gallery… |
CVE-2025-12027 | Medium | 4.3 | 2026-02-19 | The Mesmerize Companion plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the "openPageIn… |
CVE-2025-11754 | High | 7.5 | 2026-02-19 | The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'gdpr/v1/settings' REST API… |
CVE-2025-11725 | Medium | 6.5 | 2026-02-19 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the multiple functions in… |
CVE-2025-11706 | Medium | 6.1 | 2026-02-19 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the dbstatus parameter in all versions up to, and including, 3… |
CVE-2025-15585 | | 2026-02-19 | Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. Successful exploitation req… | |
CVE-2025-15581 | | 2026-02-18 | Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploit… | |
CVE-2025-12812 | | 2026-02-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Delinea Inc. Cloud Suite and Privileged Access Service. Remediation… | |
CVE-2025-12811 | | 2026-02-18 | Improper Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Delinea Inc. Cloud Suite and Privileged Access Service. If you're not usin… | |
CVE-2025-8860 | Low | 3.3 | 2026-02-18 | A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is… |
CVE-2025-1272 | High | 7.7 | 2026-02-18 | The Linux Kernel lockdown mode for kernel versions starting on 6.12 and above for Fedora Linux has the lockdown mode disabled without any warning. This may all… |
CVE-2025-14876 | Medium | 5.5 | 2026-02-18 | A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to un… |
CVE-2025-12343 | Low | 3.3 | 2026-02-18 | A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_model_tf() function, w… |
CVE-2025-10256 | Medium | 5.3 | 2026-02-18 | A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of a… |
CVE-2025-0577 | Medium | 4.8 | 2026-02-18 | An insufficient entropy vulnerability was found in glibc. The getrandom and arc4random family of functions may return predictable randomness if these functions… |
CVE-2025-70064 | High | 8.8 | 2026-02-18 | PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the Administrator… |
CVE-2025-70063 | Medium | 6.5 | 2026-02-18 | The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application f… |
CVE-2025-70062 | Medium | 6.5 | 2026-02-18 | PHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Doctor' module. The application fails to enfo… |
CVE-2025-69287 | Medium | 5.4 | 2026-02-18 | The BSV Blockchain SDK is a unified TypeScript SDK for developing scalable apps on the BSV Blockchain. Prior to version 2.0.0, a cryptographic vulnerability in… |
CVE-2025-70152 | Critical | 9.8 | 2026-02-18 | code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /ad… |
CVE-2025-70151 | High | 8.8 | 2026-02-18 | code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints update… |
CVE-2025-70150 | Critical | 9.8 | 2026-02-18 | CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delet… |
CVE-2025-70148 | High | 7.5 | 2026-02-18 | Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access… |
CVE-2025-14009 | High | 8.8 | 2026-02-18 | A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipf… |
CVE-2025-70149 | Critical | 9.8 | 2026-02-18 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter. |
CVE-2025-70147 | High | 7.5 | 2026-02-18 | Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitiv… |
CVE-2025-70146 | Critical | 9.1 | 2026-02-18 | Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perf… |
CVE-2025-70141 | Critical | 9.4 | 2026-02-18 | SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication… |
CVE-2025-71237 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: Fix potential block overflow that cause system hang When a user executes the FITR… |
CVE-2025-71236 | High | 7.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate sp before freeing associated memory System crash with the followi… |
CVE-2025-71235 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Delay module unload while fabric scan in progress System crash seen during… |
CVE-2025-71234 | High | 8.8 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add The driver does not set hw->st… |
CVE-2025-71233 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Avoid creating sub-groups asynchronously The asynchronous creation of sub-… |
CVE-2025-71232 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Free sp in error path to fix system crash System crash seen during load/un… |
CVE-2025-71231 | High | 7.1 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode The local variab… |
CVE-2025-71230 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: hfs: ensure sb->s_fs_info is always cleaned up When hfs was converted to the new mount ap… |
CVE-2025-71229 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() rtw_core_enable_beacon() rea… |
CVE-2025-70998 | Critical | 9.8 | 2026-02-18 | UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote… |
CVE-2025-65791 | Critical | 9.8 | 2026-02-18 | ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. N… |
CVE-2025-65519 | Medium | 6.5 | 2026-02-18 | mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing. The application fails to validate ne… |
CVE-2025-15579 | | 2026-02-18 | Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code executio… | |
CVE-2025-71227 | Medium | 5.5 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't WARN for connections on invalid channels It's not clear (to me) how… |
CVE-2025-71225 | Medium | 5.3 | 2026-02-18 | In the Linux kernel, the following vulnerability has been resolved: md: suspend array while updating raid_disks via sysfs In raid1_reshape(), freeze_array()… |
CVE-2025-61982 | High | 7.8 | 2026-02-18 | An arbitrary code execution vulnerability exists in the Code Stream directive functionality of OpenCFD OpenFOAM 2506. A specially crafted OpenFOAM simulation f… |
CVE-2025-8308 | Medium | 6.3 | 2026-02-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Key Software Solutions Inc. INFOREX- General Infor… |
CVE-2025-60038 | High | 7.8 | 2026-02-18 | A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated… |
CVE-2025-60037 | High | 7.8 | 2026-02-18 | A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated… |
CVE-2025-60036 | High | 7.8 | 2026-02-18 | A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw… |
CVE-2025-60035 | High | 7.8 | 2026-02-18 | A vulnerability has been identified in the OPC.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw… |
CVE-2025-59920 | | 2026-02-18 | When hours are entered in time@work, version 7.0.5, it performs a query to display the projects assigned to the user. If the query URL is copied and opened in… | |
CVE-2025-33253 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciously crafted file. A s… |
CVE-2025-33252 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to co… |
CVE-2025-33251 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to co… |
CVE-2025-33250 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to co… |
CVE-2025-33249 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework for all platforms contains a vulnerability in a voice-preprocessing script, where malicious input created by an attacker could cause a co… |
CVE-2025-33246 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework for all platforms contains a vulnerability in the ASR Evaluator utility, where a user could cause a command injection by supplying crafte… |
CVE-2025-33245 | High | 8.0 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution. A successful exploit of this vulnerability might lead to… |
CVE-2025-33243 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution in distributed environments. A successful exploit of this vu… |
CVE-2025-33241 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by loading a maliciously crafted file. A successful exploit… |
CVE-2025-33240 | High | 7.8 | 2026-02-18 | NVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code injection. A successful exploit of this… |
CVE-2025-33239 | High | 7.8 | 2026-02-18 | NVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code injection. A successful exploit of this vu… |
CVE-2025-33236 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where malicious data created by an attacker could cause code injection. A successful exploit of this vulnerabili… |
CVE-2025-14340 | | 2026-02-18 | Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator t… | |
CVE-2025-8781 | Medium | 4.9 | 2026-02-18 | The Bookster – WordPress Appointment Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘raw’ parameter in all versions up to, and incl… |
CVE-2025-7630 | Medium | 5.3 | 2026-02-18 | Improper Restriction of Excessive Authentication Attempts, Improper Authentication vulnerability in Doruk Communication and Automation Industry and Trade Inc… |
CVE-2025-14799 | Medium | 6.5 | 2026-02-18 | The Brevo - Email, SMS, Web Push, Chat, and more. plugin for WordPress is vulnerable to authorization bypass due to type juggling in all versions up to, and in… |
CVE-2025-14444 | Medium | 5.3 | 2026-02-18 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insuf… |
CVE-2025-13727 | Medium | 4.4 | 2026-02-18 | The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions u… |
CVE-2025-11185 | Medium | 6.4 | 2026-02-18 | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cmplz-accept-link shortcode in all… |
CVE-2025-12356 | Medium | 4.3 | 2026-02-18 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp… |
CVE-2025-12122 | Medium | 6.4 | 2026-02-18 | The Popup Box – Easily Create WordPress Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all… |
CVE-2025-11737 | Medium | 6.4 | 2026-02-18 | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_sns_title' parameter in all versions up to… |
CVE-2025-6460 | Medium | 6.4 | 2026-02-18 | The Display During Conditional Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, a… |
CVE-2025-13959 | Medium | 6.4 | 2026-02-18 | The Filestack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'filepicker' shortcode in all versions up to, and including, 2… |
CVE-2025-12075 | Medium | 4.3 | 2026-02-18 | The Order Splitter for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wos_troubleshoot… |
CVE-2025-12074 | Medium | 5.3 | 2026-02-18 | The Context Blog theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.5 via the 'context_blog_modal_popup' due t… |
CVE-2025-12071 | Medium | 4.3 | 2026-02-18 | The Frontend User Notes plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'funp_ajax_m… |
CVE-2025-12037 | Medium | 4.4 | 2026-02-18 | The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includ… |
CVE-2025-62183 | | 2026-02-17 | Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrat… | |
CVE-2025-13689 | High | 8.8 | 2026-02-17 | IBM DataStage on Cloud Pak for Data could allow an authenticated user to execute arbitrary commands and gain access to sensitive information due to unrestricte… |
CVE-2025-13333 | Medium | 4.4 | 2026-02-17 | IBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings. |