2025 CVEs (page 260)
Page 260 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7173 | High | 7.3 | 2025-07-08 | A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-student… |
CVE-2025-7172 | High | 7.3 | 2025-07-08 | A vulnerability, which was classified as critical, was found in code-projects Crime Reporting System 1.0. This affects an unknown part of the file /headlogin.p… |
CVE-2025-6744 | High | 7.3 | 2025-07-08 | The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.2.3. This is due to the software al… |
CVE-2025-7171 | High | 7.3 | 2025-07-08 | A vulnerability, which was classified as critical, has been found in code-projects Crime Reporting System 1.0. Affected by this issue is some unknown functiona… |
CVE-2025-7170 | High | 7.3 | 2025-07-08 | A vulnerability classified as critical was found in code-projects Crime Reporting System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-7169 | High | 7.3 | 2025-07-08 | A vulnerability classified as critical has been found in code-projects Crime Reporting System 1.0. Affected is an unknown function of the file /complainer_page… |
CVE-2025-7168 | High | 7.3 | 2025-07-08 | A vulnerability was found in code-projects Crime Reporting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /u… |
CVE-2025-38237 | Medium | 5.5 | 2025-07-08 | In the Linux kernel, the following vulnerability has been resolved: media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() In fimc_i… |
CVE-2025-38236 | High | 7.8 | 2025-07-08 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free i… |
CVE-2025-7346 | | 2025-07-08 | Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages | |
CVE-2025-7167 | Medium | 6.3 | 2025-07-08 | A vulnerability was found in code-projects Responsive Blog Site 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cat… |
CVE-2025-7166 | Medium | 6.3 | 2025-07-08 | A vulnerability was found in code-projects Responsive Blog Site 1.0. It has been classified as critical. This affects an unknown part of the file /single.php… |
CVE-2025-6746 | High | 8.8 | 2025-07-08 | The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it p… |
CVE-2025-6743 | Medium | 6.4 | 2025-07-08 | The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiple_markers' attribute in all versions up to, and includin… |
CVE-2025-42956 | Medium | 6.1 | 2025-07-08 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make publicly available. W… |
CVE-2025-41668 | High | 8.8 | 2025-07-08 | A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute acc… |
CVE-2025-41667 | High | 8.8 | 2025-07-08 | A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file… |
CVE-2025-41666 | High | 8.8 | 2025-07-08 | A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the dev… |
CVE-2025-41665 | Medium | 6.5 | 2025-07-08 | An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file. |
CVE-2025-25271 | High | 8.8 | 2025-07-08 | An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface. |
CVE-2025-25270 | Critical | 9.8 | 2025-07-08 | An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations. |
CVE-2025-25269 | High | 8.4 | 2025-07-08 | An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation. |
CVE-2025-25268 | High | 8.8 | 2025-07-08 | An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing… |
CVE-2025-24006 | High | 7.8 | 2025-07-08 | A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root. |
CVE-2025-24005 | High | 7.8 | 2025-07-08 | A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation. |
CVE-2025-24004 | Medium | 5.2 | 2025-07-08 | A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss… |
CVE-2025-24003 | High | 8.2 | 2025-07-08 | An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting… |
CVE-2025-24002 | Medium | 5.3 | 2025-07-08 | An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporar… |
CVE-2025-7327 | High | 8.8 | 2025-07-08 | The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter… |
CVE-2025-7165 | High | 7.3 | 2025-07-08 | A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0 and classified as critical. Affected by this issue is some unknown functiona… |
CVE-2025-7164 | High | 7.3 | 2025-07-08 | A vulnerability has been found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0 and classified as critical. Affected by this vulnerability is an unknow… |
CVE-2025-7163 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, was found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/add-an… |
CVE-2025-7162 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, has been found in PHPGurukul Zoo Management System 2.1. This issue affects some unknown processing of the fi… |
CVE-2025-5957 | Medium | 5.3 | 2025-07-08 | The Guest Support – Complete customer support ticket system for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capa… |
CVE-2025-5537 | Medium | 6.4 | 2025-07-08 | The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versi… |
CVE-2025-7161 | Medium | 6.3 | 2025-07-08 | A vulnerability classified as critical was found in PHPGurukul Zoo Management System 2.1. This vulnerability affects unknown code of the file /admin/add-normal… |
CVE-2025-7160 | High | 7.3 | 2025-07-08 | A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. This affects an unknown part of the file /admin/index.php. The m… |
CVE-2025-7159 | Medium | 6.3 | 2025-07-08 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-7158 | Medium | 6.3 | 2025-07-08 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-7157 | High | 7.3 | 2025-07-08 | A vulnerability was found in code-projects Online Note Sharing 1.0. It has been classified as critical. Affected is an unknown function of the file /login.php… |
CVE-2025-6244 | Medium | 6.4 | 2025-07-08 | The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via `Cal… |
CVE-2025-5570 | Medium | 5.4 | 2025-07-08 | The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and includ… |
CVE-2025-20695 | Medium | 6.5 | 2025-07-08 | In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-20694 | Medium | 6.5 | 2025-07-08 | In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-20693 | Medium | 6.5 | 2025-07-08 | In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosu… |
CVE-2025-20692 | Medium | 5.5 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution… |
CVE-2025-20691 | Medium | 5.5 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution… |
CVE-2025-20690 | Medium | 5.5 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution… |
CVE-2025-20689 | Medium | 5.5 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution… |
CVE-2025-20688 | Medium | 5.5 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution… |
CVE-2025-20687 | Medium | 5.5 | 2025-07-08 | In Bluetooth driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local denial of service with User execution pr… |
CVE-2025-20686 | High | 8.8 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with… |
CVE-2025-20685 | High | 8.8 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with… |
CVE-2025-20684 | Critical | 9.8 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20683 | Critical | 9.8 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20682 | Critical | 9.8 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20681 | Critical | 9.8 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20680 | Critical | 9.8 | 2025-07-08 | In Bluetooth driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execu… |
CVE-2025-7156 | Medium | 6.3 | 2025-07-08 | A vulnerability has been found in hitsz-ids airda 0.0.3 and classified as critical. This vulnerability affects the function execute of the file /v1/chat/comple… |
CVE-2025-7146 | High | 7.5 | 2025-07-08 | The iPublish System developed by Jhenggao has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to read arbitrary system file. |
CVE-2025-7155 | High | 7.3 | 2025-07-08 | A vulnerability, which was classified as critical, was found in PHPGurukul Online Notes Sharing System 1.0. This affects an unknown part of the file /Dashboard… |
CVE-2025-7154 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, has been found in TOTOLINK N200RE 9.3.5u.6095_B20200916/9.3.5u.6139_B20201216. Affected by this issue is the… |
CVE-2025-43001 | Medium | 6.9 | 2025-07-08 | SAPCAR allows an attacker logged in with high privileges to override the permissions of the current and parent directories of the user or process extracting th… |
CVE-2025-42992 | Medium | 6.9 | 2025-07-08 | SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to exploit critical files… |
CVE-2025-42986 | Medium | 4.3 | 2025-07-08 | Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Func… |
CVE-2025-42985 | Medium | 6.1 | 2025-07-08 | Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a vict… |
CVE-2025-42981 | Medium | 6.1 | 2025-07-08 | Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script… |
CVE-2025-42980 | Critical | 9.1 | 2025-07-08 | SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialize… |
CVE-2025-42979 | Medium | 5.6 | 2025-07-08 | The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credential… |
CVE-2025-42978 | Low | 3.5 | 2025-07-08 | The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used… |
CVE-2025-42974 | Medium | 4.3 | 2025-07-08 | Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable acces… |
CVE-2025-42973 | Medium | 5.4 | 2025-07-08 | Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associate… |
CVE-2025-42971 | Medium | 4.0 | 2025-07-08 | A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim extracts this malicio… |
CVE-2025-42970 | Medium | 5.8 | 2025-07-08 | SAPCAR improperly sanitizes the file paths while extracting SAPCAR archives. Due to this, an attacker could craft a malicious SAPCAR archive containing directo… |
CVE-2025-42969 | Medium | 6.1 | 2025-07-08 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The vic… |
CVE-2025-42968 | Medium | 5.0 | 2025-07-08 | SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information… |
CVE-2025-42967 | Critical | 9.9 | 2025-07-08 | SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privileges to create a new… |
CVE-2025-42966 | Critical | 9.1 | 2025-07-08 | SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerabil… |
CVE-2025-42965 | Medium | 4.1 | 2025-07-08 | SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configurat… |
CVE-2025-42964 | Critical | 9.1 | 2025-07-08 | SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could p… |
CVE-2025-42963 | Critical | 9.1 | 2025-07-08 | A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deseri… |
CVE-2025-42962 | Medium | 6.1 | 2025-07-08 | SAP Business Warehouse (Business Explorer Web) allows an attacker to create a malicious link. If an authenticated user clicks on this link, the injected script… |
CVE-2025-42961 | Medium | 4.9 | 2025-07-08 | Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient va… |
CVE-2025-42960 | Medium | 4.3 | 2025-07-08 | SAP Business Warehouse and SAP BW/4HANA BEx Tools allow an authenticated attacker to gain higher access levels than intended by exploiting improper authorizati… |
CVE-2025-42959 | High | 8.1 | 2025-07-08 | An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system missing specific secur… |
CVE-2025-42954 | Low | 2.7 | 2025-07-08 | SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any… |
CVE-2025-42953 | High | 8.1 | 2025-07-08 | SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could… |
CVE-2025-42952 | High | 7.7 | 2025-07-08 | SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structures, potentially ren… |
CVE-2025-31326 | Medium | 4.1 | 2025-07-08 | SAP�BusinessObjects Business�Intelligence Platform (Web Intelligence) is vulnerable to HTML Injection, allowing an attacker with basic user privileges to injec… |
CVE-2025-7153 | Low | 3.5 | 2025-07-08 | A vulnerability classified as problematic was found in CodeAstro Simple Hospital Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-7152 | Medium | 6.3 | 2025-07-08 | A vulnerability classified as critical has been found in Campcodes Advanced Online Voting System 1.0. Affected is an unknown function of the file /admin/candid… |
CVE-2025-7151 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-7150 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2025-7149 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/c… |
CVE-2025-7148 | Low | 3.5 | 2025-07-07 | A vulnerability was found in CodeAstro Simple Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionalit… |
CVE-2025-7147 | High | 7.3 | 2025-07-07 | A vulnerability has been found in CodeAstro Patient Record Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown funct… |
CVE-2025-7144 | Low | 2.4 | 2025-07-07 | A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the… |
CVE-2025-7143 | Low | 2.4 | 2025-07-07 | A vulnerability, which was classified as problematic, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /p… |
CVE-2025-7142 | Low | 2.4 | 2025-07-07 | A vulnerability, which was classified as problematic, has been found in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown… |
CVE-2025-53543 | Medium | 4.2 | 2025-07-07 | Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP re… |