2025 CVEs (page 254)
Page 254 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7474 | High | 7.3 | 2025-07-12 | A vulnerability was found in code-projects Job Diary 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /sear… |
CVE-2025-7471 | High | 7.3 | 2025-07-12 | A vulnerability was found in code-projects Modern Bag 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-36104 | Medium | 6.5 | 2025-07-12 | IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited th… |
CVE-2025-7470 | High | 7.3 | 2025-07-12 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/p… |
CVE-2025-7469 | High | 7.3 | 2025-07-12 | A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages… |
CVE-2025-7518 | Medium | 4.9 | 2025-07-12 | The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the get_local_filename() function. This m… |
CVE-2025-7504 | High | 7.5 | 2025-07-12 | The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the query_vars parameter This… |
CVE-2025-7468 | High | 8.8 | 2025-07-12 | A vulnerability has been found in Tenda FH1201 1.2.0.14 and classified as critical. This vulnerability affects the function fromSafeUrlFilter of the file /gofo… |
CVE-2025-7467 | High | 7.3 | 2025-07-12 | A vulnerability, which was classified as critical, was found in code-projects Modern Bag 1.0. This affects an unknown part of the file /product-detail.php. The… |
CVE-2025-7466 | High | 7.3 | 2025-07-12 | A vulnerability, which was classified as critical, has been found in 1000projects ABC Courier Management 1.0. Affected by this issue is some unknown functional… |
CVE-2025-6423 | High | 8.8 | 2025-07-12 | The BeeTeam368 Extensions plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_submit_upload_file() f… |
CVE-2025-7465 | High | 8.8 | 2025-07-12 | A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14. Affected by this vulnerability is the function fromRouteStatic of the file /goform/f… |
CVE-2025-7464 | Low | 3.7 | 2025-07-12 | A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The m… |
CVE-2025-7463 | High | 8.8 | 2025-07-12 | A vulnerability was found in Tenda FH1201 1.2.0.14. It has been declared as critical. This vulnerability affects the function formWrlsafeset of the file /gofor… |
CVE-2025-7462 | Medium | 4.3 | 2025-07-12 | A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function… |
CVE-2025-1313 | High | 8.8 | 2025-07-12 | The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6… |
CVE-2025-7461 | High | 7.3 | 2025-07-12 | A vulnerability was found in code-projects Modern Bag 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /action… |
CVE-2025-6058 | Critical | 9.8 | 2025-07-12 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via… |
CVE-2025-6057 | High | 8.8 | 2025-07-12 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all vers… |
CVE-2025-24294 | High | 7.5 | 2025-07-12 | The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name with… |
CVE-2025-5199 | High | 7.3 | 2025-07-12 | In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying fi… |
CVE-2025-7460 | High | 8.8 | 2025-07-11 | A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setWiFiAclRules… |
CVE-2025-53636 | Medium | 5.4 | 2025-07-11 | Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create… |
CVE-2025-7459 | High | 7.3 | 2025-07-11 | A vulnerability classified as critical was found in code-projects Mobile Shop 1.0. This vulnerability affects unknown code of the file /EditMobile.php. The man… |
CVE-2025-7457 | High | 7.3 | 2025-07-11 | A vulnerability, which was classified as critical, was found in Campcodes Online Movie Theater Seat Reservation System 1.0. This affects an unknown part of the… |
CVE-2025-7456 | High | 7.3 | 2025-07-11 | A vulnerability, which was classified as critical, has been found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected by this issue is some… |
CVE-2025-7455 | High | 7.3 | 2025-07-11 | A vulnerability classified as critical was found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected by this vulnerability is an unknown fu… |
CVE-2025-7503 | | 2025-07-11 | An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented, default credentials. The… | |
CVE-2025-7454 | High | 7.3 | 2025-07-11 | A vulnerability classified as critical has been found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected is an unknown function of the fil… |
CVE-2025-7453 | Low | 3.7 | 2025-07-11 | A vulnerability was found in saltbo zpan up to 1.6.5/1.7.0-beta2. It has been rated as problematic. This issue affects the function NewToken of the file zpan/i… |
CVE-2025-3631 | Medium | 6.5 | 2025-07-11 | An IBM MQ 9.3 and 9.4 Client connecting to an MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it. |
CVE-2025-30403 | High | 8.1 | 2025-07-11 | A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v20… |
CVE-2025-7452 | Medium | 6.3 | 2025-07-11 | A vulnerability was found in kone-net go-chat up to f9e58d0afa9bbdb31faf25e7739da330692c4c63. It has been declared as critical. This vulnerability affects the… |
CVE-2025-53642 | Medium | 4.8 | 2025-07-11 | haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Ad… |
CVE-2025-53641 | High | 8.2 | 2025-07-11 | Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into t… |
CVE-2025-30402 | High | 8.1 | 2025-07-11 | A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other unde… |
CVE-2025-7450 | Medium | 5.4 | 2025-07-11 | A vulnerability was found in letseeqiji gorobbs up to 1.0.8. It has been classified as critical. This affects the function ResetUserAvatar of the file controll… |
CVE-2025-47964 | Medium | 5.4 | 2025-07-11 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-47963 | Medium | 6.3 | 2025-07-11 | No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-47182 | Medium | 5.6 | 2025-07-11 | Improper input validation in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally. |
CVE-2025-45582 | Medium | 4.1 | 2025-07-11 | GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an… |
CVE-2025-43856 | | 2025-07-11 | immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to account hijacking through oauth2, becau… | |
CVE-2025-7029 | High | 8.2 | 2025-07-11 | A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used to derive pointers (OcHea… |
CVE-2025-7028 | High | 7.8 | 2025-07-11 | A vulnerability in the Software SMI handler (SwSmiInputValue 0x20) allows a local attacker to supply a crafted pointer (FuncBlock) through RBX and RCX register… |
CVE-2025-7027 | High | 8.2 | 2025-07-11 | A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control both the read and write addresses used by the CommandRcx1… |
CVE-2025-7026 | High | 8.2 | 2025-07-11 | A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used as an unchecked pointer i… |
CVE-2025-6549 | Medium | 6.5 | 2025-07-11 | An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reac… |
CVE-2025-52989 | Medium | 5.1 | 2025-07-11 | An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with… |
CVE-2025-52988 | Medium | 6.7 | 2025-07-11 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks Junos OS and Junos O… |
CVE-2025-52986 | Medium | 5.5 | 2025-07-11 | A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allow… |
CVE-2025-52985 | Medium | 5.3 | 2025-07-11 | A Use of Incorrect Operator vulnerability in the Routing Engine firewall of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacke… |
CVE-2025-52984 | Medium | 5.9 | 2025-07-11 | A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, netw… |
CVE-2025-52983 | High | 7.2 | 2025-07-11 | A UI Discrepancy for Security Feature vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker… |
CVE-2025-52982 | Medium | 5.9 | 2025-07-11 | An Improper Resource Shutdown or Release vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC allows an unauthenticated, network-… |
CVE-2025-52981 | High | 7.5 | 2025-07-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX1600, S… |
CVE-2025-52980 | High | 7.5 | 2025-07-11 | A Use of Incorrect Byte Ordering vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS on SRX300 Series allows an unauthenticated… |
CVE-2025-52994 | Medium | 4.9 | 2025-07-11 | gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709. |
CVE-2025-52964 | Medium | 6.5 | 2025-07-11 | A Reachable Assertion vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-b… |
CVE-2025-52963 | Medium | 5.5 | 2025-07-11 | An Improper Access Control vulnerability in the User Interface (UI) of Juniper Networks Junos OS allows a local, low-privileged attacker to bring down an inter… |
CVE-2025-52958 | Medium | 5.3 | 2025-07-11 | A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated … |
CVE-2025-52955 | Medium | 6.5 | 2025-07-11 | An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent… |
CVE-2025-52954 | High | 7.8 | 2025-07-11 | A Missing Authorization vulnerability in the internal virtual routing and forwarding (VRF) of Juniper Networks Junos OS Evolved allows a local, low-privileged… |
CVE-2025-52953 | Medium | 6.5 | 2025-07-11 | An Expected Behavior Violation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated a… |
CVE-2025-52952 | Medium | 6.5 | 2025-07-11 | An Out-of-bounds Write vulnerability in the connectivity fault management (CFM) daemon of Juniper Networks Junos OS on MX Series with MPC-BUILTIN, MPC1 through… |
CVE-2025-52951 | Medium | 5.8 | 2025-07-11 | A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic destined to the d… |
CVE-2025-52950 | Critical | 9.6 | 2025-07-11 | A Missing Authorization vulnerability in Juniper Networks Security Director allows an unauthenticated network-based attacker to read or tamper with multiple se… |
CVE-2025-52949 | Medium | 6.5 | 2025-07-11 | An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved all… |
CVE-2025-52948 | Medium | 5.9 | 2025-07-11 | An Improper Handling of Exceptional Conditions vulnerability in Berkeley Packet Filter (BPF) processing of Juniper Networks Junos OS allows an attacker, in rar… |
CVE-2025-52947 | Medium | 6.5 | 2025-07-11 | An Improper Handling of Exceptional Conditions vulnerability in route processing of Juniper Networks Junos OS on specific end-of-life (EOL) ACX Series platform… |
CVE-2025-52946 | High | 7.5 | 2025-07-11 | A Use After Free vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an attacker sendi… |
CVE-2025-52089 | High | 8.8 | 2025-07-11 | A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS… |
CVE-2025-48924 | Medium | 5.3 | 2025-07-11 | Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and… |
CVE-2025-30661 | High | 7.3 | 2025-07-11 | An Incorrect Permission Assignment for Critical Resource vulnerability in line card script processing of Juniper Networks Junos OS allows a local, low-privileg… |
CVE-2025-51591 | Low | 3.7 | 2025-07-11 | A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted if… |
CVE-2025-53862 | Low | 3.5 | 2025-07-11 | A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious user to access data… |
CVE-2025-53861 | Low | 3.1 | 2025-07-11 | A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and Cross-site scripting… |
CVE-2025-6788 | | 2025-07-11 | A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providing other authentic… | |
CVE-2025-50125 | | 2025-07-11 | A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via th… | |
CVE-2025-50124 | | 2025-07-11 | A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account vi… | |
CVE-2025-50123 | | 2025-07-11 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a privileged account whe… | |
CVE-2025-50122 | | 2025-07-11 | A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with… | |
CVE-2025-50121 | | 2025-07-11 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remo… | |
CVE-2025-3933 | Medium | 5.3 | 2025-07-11 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor cl… |
CVE-2025-6851 | High | 7.2 | 2025-07-11 | The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() fu… |
CVE-2025-6838 | Medium | 4.1 | 2025-07-11 | The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later export… |
CVE-2025-6438 | | 2025-07-11 | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external e… | |
CVE-2025-7442 | High | 7.5 | 2025-07-11 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to SQL Injection via several parameters in the MJ_gmgt_delete_class_limit_for_me… |
CVE-2025-6745 | Medium | 5.3 | 2025-07-11 | The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() funct… |
CVE-2025-6068 | Medium | 6.4 | 2025-07-11 | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2025-5530 | Medium | 6.4 | 2025-07-11 | The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versi… |
CVE-2025-4593 | Medium | 6.5 | 2025-07-11 | The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the… |
CVE-2025-6716 | Medium | 6.4 | 2025-07-11 | The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugi… |
CVE-2025-5992 | | 2025-07-11 | When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this can happen when passing… | |
CVE-2025-5392 | Critical | 9.8 | 2025-07-11 | The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdb_talk_to_front() function… |
CVE-2025-5028 | | 2025-07-11 | Installation file of ESET security products on Windows allow an attacker to misuse to delete an arbitrary file without having the permissions to do so. | |
CVE-2025-6200 | Medium | 5.9 | 2025-07-11 | The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2025-30026 | Critical | 9.8 | 2025-07-11 | The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required. |
CVE-2025-30025 | High | 7.8 | 2025-07-11 | The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalation. |
CVE-2025-30024 | Medium | 6.8 | 2025-07-11 | The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack. |
CVE-2025-30023 | Critical | 9.0 | 2025-07-11 | The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack. |