2025 CVEs (page 252)
Page 252 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-34103 | | 2025-07-15 | An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undo… | |
CVE-2025-34068 | | 2025-07-15 | An unauthenticated remote command execution vulnerability exists in Samsung WLAN AP WEA453e firmware prior to version 5.2.4.T1 via improper input validation in… | |
CVE-2025-7667 | High | 8.1 | 2025-07-15 | The Restrict File Access plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing o… |
CVE-2025-4369 | Medium | 5.5 | 2025-07-15 | The Companion Auto Update plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘update_delay_days’ parameter in all versions up to, and in… |
CVE-2025-24477 | Medium | 4.2 | 2025-07-15 | A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.4 through 7.2.12 allows an attacke… |
CVE-2025-7672 | Medium | 4.3 | 2025-07-15 | The improper default setting in JiranSoft CrossEditor4 on Windows, Linux, Unix (API modules) potentaily allows Stored XSS. This issue affects CrossEditor4: fro… |
CVE-2025-3621 | Critical | 9.6 | 2025-07-15 | Vulnerabilities* in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. * vulnerabilities: *… |
CVE-2025-7367 | Medium | 6.4 | 2025-07-15 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Custom Fields in all versions up to, and includin… |
CVE-2025-7360 | Critical | 9.1 | 2025-07-15 | The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file moving due to insu… |
CVE-2025-7341 | Critical | 9.1 | 2025-07-15 | The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to in… |
CVE-2025-7340 | Critical | 9.8 | 2025-07-15 | The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to mis… |
CVE-2025-5394 | Critical | 9.8 | 2025-07-15 | The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on th… |
CVE-2025-5393 | Critical | 9.1 | 2025-07-15 | The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validati… |
CVE-2025-6265 | High | 7.2 | 2025-07-15 | A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated a… |
CVE-2025-53891 | Medium | 4.3 | 2025-07-15 | The timelineofficial/Time-Line- repository contains the source code for the TIME LINE website. A vulnerability was found in the TIME LINE website where uploade… |
CVE-2025-53890 | Critical | 9.8 | 2025-07-15 | pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unau… |
CVE-2025-53889 | Medium | 6.5 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a… |
CVE-2025-53887 | Medium | 5.3 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus vers… |
CVE-2025-53886 | Medium | 4.5 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flo… |
CVE-2025-53885 | Medium | 4.2 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flo… |
CVE-2025-53839 | Medium | 4.0 | 2025-07-15 | DRACOON is a file sharing service, and the DRACOON Branding Service allows customers to customize their DRACOON interface with their brand. Versions of the DRA… |
CVE-2025-53836 | Critical | 9.9 | 2025-07-15 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting… |
CVE-2025-53835 | Critical | 9.0 | 2025-07-14 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting… |
CVE-2025-53834 | Medium | 6.3 | 2025-07-14 | Caido is a web security auditing toolkit. A reflected cross-site scripting (XSS) vulnerability was discovered in Caido’s toast UI component in versions prior t… |
CVE-2025-53833 | Critical | 10.0 | 2025-07-14 | LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side… |
CVE-2025-53825 | Critical | 9.4 | 2025-07-14 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to version 0.24.3, an unauthenticated preview deployment vulnerability in Dokploy allows a… |
CVE-2025-53824 | Medium | 5.4 | 2025-07-14 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-53823 | High | 8.8 | 2025-07-14 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Versions prior to 3.4.5 have a SQL Injection vulnerabi… |
CVE-2025-53822 | Medium | 6.5 | 2025-07-14 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-53821 | Medium | 4.7 | 2025-07-14 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Open Redirect vulnerability exists in the web appli… |
CVE-2025-53820 | Medium | 6.5 | 2025-07-14 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-53819 | High | 7.9 | 2025-07-14 | Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges (root), instead of the build… |
CVE-2025-53818 | | 2025-07-14 | GitHub Kanban MCP Server is a Model Context Protocol (MCP) server for managing GitHub issues in Kanban board format and streamlining LLM task management. Versi… | |
CVE-2025-53643 | High | 7.5 | 2025-07-14 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smugglin… |
CVE-2025-53640 | Medium | 6.5 | 2025-07-14 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3… |
CVE-2025-53639 | Critical | 9.8 | 2025-07-14 | MeterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validat… |
CVE-2025-53623 | | 2025-07-14 | The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vul… | |
CVE-2025-53101 | High | 7.4 | 2025-07-14 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `ma… |
CVE-2025-53019 | Low | 3.7 | 2025-07-14 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `ma… |
CVE-2025-53015 | High | 7.5 | 2025-07-14 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing… |
CVE-2025-7628 | Medium | 5.4 | 2025-07-14 | A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. It has been classified as critical. This affects t… |
CVE-2025-7627 | Medium | 6.3 | 2025-07-14 | A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this issue… |
CVE-2025-53014 | Low | 3.7 | 2025-07-14 | ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overf… |
CVE-2025-52363 | Medium | 6.8 | 2025-07-14 | Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-. An attacker with access to the firmware ima… |
CVE-2025-7626 | Medium | 4.3 | 2025-07-14 | A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this v… |
CVE-2025-7625 | Medium | 4.3 | 2025-07-14 | A vulnerability, which was classified as critical, was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. Affected is the… |
CVE-2025-51660 | Medium | 5.4 | 2025-07-14 | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.php. |
CVE-2025-51659 | Medium | 5.4 | 2025-07-14 | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.php. |
CVE-2025-51658 | Medium | 5.4 | 2025-07-14 | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView.php. |
CVE-2025-51657 | Medium | 5.4 | 2025-07-14 | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php. |
CVE-2025-51656 | Medium | 5.4 | 2025-07-14 | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php. |
CVE-2025-51655 | Medium | 5.4 | 2025-07-14 | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.php. |
CVE-2025-51654 | Medium | 5.4 | 2025-07-14 | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocategories.php. |
CVE-2025-51653 | Medium | 5.4 | 2025-07-14 | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php. |
CVE-2025-51652 | Medium | 5.4 | 2025-07-14 | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories.php. |
CVE-2025-51651 | Medium | 5.5 | 2025-07-14 | An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a c… |
CVE-2025-51650 | Medium | 5.6 | 2025-07-14 | An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows attackers to execute arbitrary code via uploading a… |
CVE-2025-7616 | Medium | 5.5 | 2025-07-14 | A vulnerability, which was classified as critical, has been found in gmg137 snap7-rs up to 1.142.1. Affected by this issue is the function pthread_cond_destroy… |
CVE-2025-7615 | Medium | 6.3 | 2025-07-14 | A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/c… |
CVE-2025-7614 | Medium | 6.3 | 2025-07-14 | A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2025-7613 | Medium | 6.3 | 2025-07-14 | A vulnerability was found in TOTOLINK T6 4.1.5cu.748. It has been rated as critical. This issue affects the function CloudSrvVersionCheck of the file /cgi-bin/… |
CVE-2025-7612 | High | 7.3 | 2025-07-14 | A vulnerability was found in code-projects Mobile Shop 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /login.php. T… |
CVE-2025-7611 | High | 7.3 | 2025-07-14 | A vulnerability was found in code-projects Wedding Reservation 1.0. It has been classified as critical. This affects an unknown part of the file /global.php. T… |
CVE-2025-50756 | Critical | 9.8 | 2025-07-14 | Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the newpass parameter. This vulnerability allow… |
CVE-2025-7610 | High | 7.3 | 2025-07-14 | A vulnerability was found in code-projects Electricity Billing System 1.0 and classified as critical. Affected by this issue is some unknown functionality of t… |
CVE-2025-7609 | High | 7.3 | 2025-07-14 | A vulnerability has been found in code-projects Simple Shopping Cart 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-7608 | High | 7.3 | 2025-07-14 | A vulnerability, which was classified as critical, was found in code-projects Simple Shopping Cart 1.0. Affected is an unknown function of the file /userlogin… |
CVE-2025-7607 | High | 7.3 | 2025-07-14 | A vulnerability, which was classified as critical, has been found in code-projects Simple Shopping Cart 1.0. This issue affects some unknown processing of the… |
CVE-2025-7519 | Medium | 6.7 | 2025-07-14 | A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lea… |
CVE-2025-7606 | High | 7.3 | 2025-07-14 | A vulnerability classified as critical has been found in code-projects AVL Rooms 1.0. This affects an unknown part of the file /city.php. The manipulation of t… |
CVE-2025-7605 | High | 7.3 | 2025-07-14 | A vulnerability was found in code-projects AVL Rooms 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /prof… |
CVE-2025-7604 | High | 7.3 | 2025-07-14 | A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-7603 | High | 7.2 | 2025-07-14 | A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been classified as critical. Affected is an unknown function of the file /jingx.asp of the compo… |
CVE-2025-27582 | High | 7.6 | 2025-07-14 | The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flawed security hardeni… |
CVE-2025-7602 | High | 7.2 | 2025-07-14 | A vulnerability was found in D-Link DI-8100 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /arp_sys.asp of the c… |
CVE-2025-7601 | Low | 3.5 | 2025-07-14 | A vulnerability has been found in PHPGurukul Online Library Management System 3.0 and classified as problematic. This vulnerability affects unknown code of the… |
CVE-2025-7600 | Medium | 6.3 | 2025-07-14 | A vulnerability, which was classified as critical, was found in PHPGurukul Online Library Management System 3.0. This affects an unknown part of the file /admi… |
CVE-2025-7599 | Medium | 6.3 | 2025-07-14 | A vulnerability, which was classified as critical, has been found in PHPGurukul Dairy Farm Shop Management System 1.3. Affected by this issue is some unknown f… |
CVE-2025-7618 | | 2025-07-14 | A stored Cross-Site Scripting (XSS) vulnerability vulnerability was found in the File Explorer and Text Editor of ADM. An attacker could exploit this vulnerabi… | |
CVE-2025-7598 | High | 8.8 | 2025-07-14 | A vulnerability classified as critical was found in Tenda AX1803 1.0.0.1. Affected by this vulnerability is the function formSetWifiMacFilterCfg of the file /g… |
CVE-2025-7597 | High | 8.8 | 2025-07-14 | A vulnerability classified as critical has been found in Tenda AX1803 1.0.0.1. Affected is the function formSetMacFilterCfg of the file /goform/setMacFilterCfg… |
CVE-2025-7596 | High | 8.8 | 2025-07-14 | A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been rated as critical. This issue affects the function formWifiExtraSet of the file /goform/Wif… |
CVE-2025-7595 | High | 7.3 | 2025-07-14 | A vulnerability was found in code-projects Job Diary 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /view-cad.php… |
CVE-2025-7594 | High | 7.3 | 2025-07-14 | A vulnerability was found in code-projects Job Diary 1.0. It has been classified as critical. This affects an unknown part of the file /view-emp.php. The manip… |
CVE-2025-7593 | High | 7.3 | 2025-07-14 | A vulnerability was found in code-projects Job Diary 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view-all… |
CVE-2025-7592 | Medium | 6.3 | 2025-07-14 | A vulnerability has been found in PHPGurukul Dairy Farm Shop Management System 1.3 and classified as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-53689 | High | 8.8 | 2025-07-14 | Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privi… |
CVE-2025-7591 | Medium | 6.3 | 2025-07-14 | A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System 1.3. Affected is an unknown function of the file v… |
CVE-2025-7590 | Medium | 6.3 | 2025-07-14 | A vulnerability, which was classified as critical, has been found in PHPGurukul Dairy Farm Shop Management System 1.3. This issue affects some unknown processi… |
CVE-2025-7589 | Medium | 6.3 | 2025-07-14 | A vulnerability classified as critical was found in PHPGurukul Dairy Farm Shop Management System 1.3. This vulnerability affects unknown code of the file edit-… |
CVE-2025-7588 | Medium | 6.3 | 2025-07-14 | A vulnerability classified as critical has been found in PHPGurukul Dairy Farm Shop Management System 1.3. This affects an unknown part of the file edit-produc… |
CVE-2025-7587 | High | 7.3 | 2025-07-14 | A vulnerability was found in code-projects Online Appointment Booking System 1.0. It has been rated as critical. Affected by this issue is some unknown functio… |
CVE-2025-24391 | Medium | 5.3 | 2025-07-14 | A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and… |
CVE-2025-7586 | High | 8.8 | 2025-07-14 | A vulnerability was found in Tenda AC500 2.0.1.9(1307). It has been declared as critical. Affected by this vulnerability is the function formSetAPCfg of the fi… |
CVE-2025-7585 | Medium | 6.3 | 2025-07-14 | A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been classified as critical. Affected is an unknown function of the file /admi… |
CVE-2025-7584 | Medium | 6.3 | 2025-07-14 | A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This issue affects some unknown processing of the file /ad… |
CVE-2025-7583 | Medium | 6.3 | 2025-07-14 | A vulnerability has been found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This vulnerability affects unknown code of the file /… |
CVE-2025-7582 | Medium | 6.3 | 2025-07-14 | A vulnerability, which was classified as critical, was found in PHPGurukul Online Fire Reporting System 1.2. This affects an unknown part of the file /admin/as… |
CVE-2025-7581 | Medium | 6.3 | 2025-07-14 | A vulnerability, which was classified as critical, has been found in code-projects Voting System 1.0. Affected by this issue is some unknown functionality of t… |
CVE-2025-7580 | Medium | 6.3 | 2025-07-14 | A vulnerability classified as critical was found in code-projects Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /ad… |