2025 CVEs (page 255)
Page 255 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2942 | Medium | 4.3 | 2025-07-11 | The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action… |
CVE-2025-7401 | Critical | 9.8 | 2025-07-11 | The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and write due to the existence of an insuffi… |
CVE-2025-7436 | High | 7.3 | 2025-07-11 | A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2025-7435 | Low | 3.5 | 2025-07-11 | A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4. It has been classified as problematic. Thi… |
CVE-2025-53864 | Medium | 5.8 | 2025-07-11 | Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON objec… |
CVE-2025-7434 | High | 8.8 | 2025-07-11 | A vulnerability was found in Tenda FH451 up to 1.0.0.9 and classified as critical. Affected by this issue is the function fromAddressNat of the file /goform/ad… |
CVE-2025-7423 | High | 8.8 | 2025-07-11 | A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). Affected by this vulnerability is the function formWifiMacFilterSet of the file… |
CVE-2025-7422 | High | 8.8 | 2025-07-11 | A vulnerability classified as critical has been found in Tenda O3V2 1.0.0.12(3880). Affected is the function setAutoReboot of the file /goform/setNetworkServic… |
CVE-2025-7421 | High | 8.8 | 2025-07-11 | A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been rated as critical. This issue affects the function fromMacFilterModify of the file /goform/… |
CVE-2025-5241 | Medium | 5.3 | 2025-07-11 | Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lo… |
CVE-2025-7420 | High | 8.8 | 2025-07-11 | A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been declared as critical. This vulnerability affects the function formWifiBasicSet of the file… |
CVE-2025-53519 | Medium | 5.4 | 2025-07-11 | A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulati… |
CVE-2025-53515 | High | 8.8 | 2025-07-11 | A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap(). This issue requires a… |
CVE-2025-53509 | Medium | 6.5 | 2025-07-11 | A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires an authenticated at… |
CVE-2025-53475 | High | 8.8 | 2025-07-11 | A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue r… |
CVE-2025-53471 | Medium | 5.1 | 2025-07-11 | Emerson ValveLink products receive input or data, but does not validate or incorrectly validates that the input has the properties that are required to proce… |
CVE-2025-53397 | Medium | 5.4 | 2025-07-11 | A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By exploiting… |
CVE-2025-52579 | Critical | 9.4 | 2025-07-11 | Emerson ValveLink Products store sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, or remain… |
CVE-2025-52577 | High | 8.8 | 2025-07-11 | A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange(). This issue requ… |
CVE-2025-52459 | Medium | 6.5 | 2025-07-11 | A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase(). This issue requires an authenticated attacke… |
CVE-2025-50109 | High | 7.7 | 2025-07-11 | Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere. |
CVE-2025-48891 | High | 7.6 | 2025-07-11 | A vulnerability exists in Advantech iView that could allow for SQL injection through the CUtils.checkSQLInjection() function. This vulnerability can be explo… |
CVE-2025-48496 | Medium | 5.1 | 2025-07-11 | Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of uninte… |
CVE-2025-46704 | Medium | 4.3 | 2025-07-11 | A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest() that could allow for a directory traversal attack. This issue requires an… |
CVE-2025-46358 | High | 7.7 | 2025-07-11 | Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the produc… |
CVE-2025-41442 | Medium | 5.4 | 2025-07-11 | A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulati… |
CVE-2025-7419 | High | 8.8 | 2025-07-10 | A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been classified as critical. This affects the function fromSpeedTestSet of the file /goform/setR… |
CVE-2025-7418 | High | 8.8 | 2025-07-10 | A vulnerability was found in Tenda O3V2 1.0.0.12(3880) and classified as critical. Affected by this issue is the function fromPingResultGet of the file /goform… |
CVE-2025-31267 | Medium | 4.6 | 2025-07-10 | An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlo… |
CVE-2025-1727 | High | 8.1 | 2025-07-10 | The protocol used for remote linking over RF for End-of-Train and Head-of-Train (also known as a FRED) relies on a BCH checksum for packet creation. It is po… |
CVE-2025-7417 | High | 8.8 | 2025-07-10 | A vulnerability has been found in Tenda O3V2 1.0.0.12(3880) and classified as critical. Affected by this vulnerability is the function fromNetToolGet of the fi… |
CVE-2025-7416 | High | 8.8 | 2025-07-10 | A vulnerability, which was classified as critical, was found in Tenda O3V2 1.0.0.12(3880). Affected is the function fromSysToolTime of the file /goform/setSysT… |
CVE-2025-6392 | Medium | 4.4 | 2025-07-10 | Brocade SANnav before Brocade SANnav 2.4.0a could log database passwords in clear text in audit logs when the daily data dump collector invokes docker exec com… |
CVE-2025-53637 | Medium | 4.1 | 2025-07-10 | Meshtastic is an open source mesh networking solution. The main_matrix.yml GitHub Action is triggered by the pull_request_target event, which has extensive per… |
CVE-2025-24798 | Medium | 4.3 | 2025-07-10 | Meshtastic is an open source mesh networking solution. From 1.2.1 until 2.6.2, a packet sent to the routing module that contains want_response==true causes a c… |
CVE-2025-7415 | Medium | 6.3 | 2025-07-10 | A vulnerability, which was classified as critical, has been found in Tenda O3V2 1.0.0.12(3880). This issue affects the function fromTraceroutGet of the file /g… |
CVE-2025-7414 | Medium | 6.3 | 2025-07-10 | A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). This vulnerability affects the function fromNetToolGet of the file /goform/setPi… |
CVE-2025-6390 | Medium | 4.4 | 2025-07-10 | Brocade SANnav before SANnav 2.4.0a logs passwords and pbe keys in the Brocade SANnav server audit logs after installation and under specific conditions. These… |
CVE-2025-4662 | Medium | 4.4 | 2025-07-10 | Brocade SANnav before SANnav 2.4.0a logs plaintext passphrases in the Brocade SANnav host server audit logs while executing OpenSSL command using a passphrase… |
CVE-2025-3947 | High | 8.2 | 2025-07-10 | The Honeywell Experion PKS contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit th… |
CVE-2025-3946 | High | 8.2 | 2025-07-10 | The Honeywell Experion PKS and OneWireless WDM contains a Deployment of Wrong Handler vulnerability in the component Control Data Access (CDA). An att… |
CVE-2025-2523 | Critical | 9.4 | 2025-07-10 | The Honeywell Experion PKS and OneWireless WDM contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker cou… |
CVE-2025-2522 | Medium | 6.5 | 2025-07-10 | The Honeywell Experion PKS and OneWireless WDM contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attac… |
CVE-2025-2521 | High | 8.6 | 2025-07-10 | The Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially… |
CVE-2025-7413 | Medium | 6.3 | 2025-07-10 | A vulnerability classified as critical has been found in code-projects Library System 1.0. This affects an unknown part of the file /user/teacher/profile.php… |
CVE-2025-7412 | Medium | 6.3 | 2025-07-10 | A vulnerability was found in code-projects Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-7021 | Medium | 6.5 | 2025-07-10 | Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture… |
CVE-2025-53634 | High | 7.5 | 2025-07-10 | Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. The HTTP Gateway processes headers, but with no timeout set. With a… |
CVE-2025-53633 | Critical | 9.8 | 2025-07-10 | Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the size of the deco… |
CVE-2025-53632 | Critical | 9.1 | 2025-07-10 | Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file… |
CVE-2025-53630 | | 2025-07-10 | llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead to Heap Out-o… | |
CVE-2025-53629 | High | 7.5 | 2025-07-10 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.23.0, incoming requests using Transfer-Encoding: chunked in the he… |
CVE-2025-53628 | High | 8.8 | 2025-07-10 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitt… |
CVE-2025-53506 | High | 7.5 | 2025-07-10 | Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum pe… |
CVE-2025-45662 | Medium | 6.1 | 2025-07-10 | A cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attackers to execute arbitrary Javascript in… |
CVE-2025-34102 | | 2025-07-10 | A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploitation of SQL injection and command inj… | |
CVE-2025-34101 | | 2025-07-10 | An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed… | |
CVE-2025-34100 | | 2025-07-10 | An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upl… | |
CVE-2025-34099 | | 2025-07-10 | An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when pa… | |
CVE-2025-34098 | | 2025-07-10 | A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering… | |
CVE-2025-34097 | | 2025-07-10 | An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with… | |
CVE-2025-34096 | | 2025-07-10 | A stack-based buffer overflow vulnerability exists in Easy File Sharing HTTP Server version 7.2. The flaw is triggered when a crafted POST request is sent to t… | |
CVE-2025-34095 | | 2025-07-10 | An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp… | |
CVE-2025-34093 | | 2025-07-10 | An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command in… | |
CVE-2025-2520 | High | 7.5 | 2025-07-10 | The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit… |
CVE-2025-7411 | High | 7.3 | 2025-07-10 | A vulnerability was found in code-projects LifeStyle Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-53709 | Medium | 5.4 | 2025-07-10 | Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small numbe… |
CVE-2025-53626 | Medium | 6.1 | 2025-07-10 | pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allow… |
CVE-2025-53625 | | 2025-07-10 | The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several #dpl par… | |
CVE-2025-53549 | | 2025-07-10 | The Matrix Rust SDK is a collection of libraries that make it easier to build Matrix clients in Rust. An SQL injection vulnerability in the EventCache::find_ev… | |
CVE-2025-53542 | High | 7.7 | 2025-07-10 | Headlamp is an extensible Kubernetes web UI. A command injection vulnerability was discovered in the codeSign.js script used in the macOS packaging workflow of… |
CVE-2025-53503 | High | 7.8 | 2025-07-10 | Trend Micro Cleaner One Pro is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend… |
CVE-2025-53378 | High | 7.6 | 2025-07-10 | A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthenticated attacker to rem… |
CVE-2025-52837 | High | 7.8 | 2025-07-10 | Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an a… |
CVE-2025-52521 | High | 7.8 | 2025-07-10 | Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentio… |
CVE-2025-52520 | High | 7.5 | 2025-07-10 | For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. Thi… |
CVE-2025-52473 | Medium | 5.9 | 2025-07-10 | liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Multiple secret-dependent branches have bee… |
CVE-2025-52434 | High | 7.5 | 2025-07-10 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector… |
CVE-2025-28245 | Medium | 6.1 | 2025-07-10 | Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification bod… |
CVE-2025-28244 | High | 8.8 | 2025-07-10 | Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localSt… |
CVE-2025-28243 | High | 8.0 | 2025-07-10 | An issue in Alteryx Server v.2023.1.1.460 allows HTML injection via a crafted script to the pages component. |
CVE-2025-53371 | Critical | 9.1 | 2025-07-10 | DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotifications allows sending r… |
CVE-2025-7410 | High | 7.3 | 2025-07-10 | A vulnerability was found in code-projects LifeStyle Store 1.0. It has been classified as critical. Affected is an unknown function of the file /cart_remove.ph… |
CVE-2025-7409 | High | 7.3 | 2025-07-10 | A vulnerability was found in code-projects Mobile Shop 1.0 and classified as critical. This issue affects some unknown processing of the file /LoginAsAdmin.php… |
CVE-2025-53020 | High | 7.5 | 2025-07-10 | Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users a… |
CVE-2025-49812 | High | 7.4 | 2025-07-10 | In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack… |
CVE-2025-49630 | High | 7.5 | 2025-07-10 | In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients… |
CVE-2025-49464 | Medium | 6.5 | 2025-07-10 | Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via network access. |
CVE-2025-49463 | Medium | 6.5 | 2025-07-10 | Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of informat… |
CVE-2025-49462 | Low | 3.5 | 2025-07-10 | Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information via network access. |
CVE-2025-47813 | Medium | 4.3 | 2025-07-10 | loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. |
CVE-2025-47812 | Critical | 10.0 | 2025-07-10 | In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session… |
CVE-2025-47811 | Medium | 4.1 | 2025-07-10 | In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application i… |
CVE-2025-27889 | Low | 3.4 | 2025-07-10 | Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary li… |
CVE-2025-23048 | Critical | 9.1 | 2025-07-10 | In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session re… |
CVE-2025-6395 | Medium | 6.5 | 2025-07-10 | A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite(). |
CVE-2025-53364 | Medium | 5.3 | 2025-07-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Starting in 5.3.0 and before 7.5.3 and 8.2.2, the Parse… |
CVE-2025-46789 | Medium | 6.5 | 2025-07-10 | Classic buffer overflow in certain Zoom Clients for Windows may allow an authorized user to conduct a denial of service via network access. |
CVE-2025-46788 | High | 7.4 | 2025-07-10 | Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unauthorized user to conduct an information disclosure via netwo… |
CVE-2025-7408 | Low | 3.5 | 2025-07-10 | A vulnerability has been found in SourceCodester Zoo Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /… |