2025 CVEs (page 263)
Page 263 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53375 | Medium | 6.5 | 2025-07-07 | Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker… |
CVE-2025-53374 | Medium | 4.3 | 2025-07-07 | Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privi… |
CVE-2025-53373 | | 2025-07-07 | Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when r… | |
CVE-2025-52492 | High | 7.5 | 2025-07-07 | A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6. The firmware file, rootfs.tar.gz, contains hard-coded credentials for th… |
CVE-2025-48367 | High | 7.5 | 2025-07-07 | Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starv… |
CVE-2025-47202 | Critical | 9.1 | 2025-07-07 | In RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 9110, W920, W930… |
CVE-2025-45479 | Critical | 9.8 | 2025-07-07 | Insufficient security mechanisms for created containers in educoder challenges v1.0 allow attackers to execute arbitrary code via injecting crafted content int… |
CVE-2025-45065 | Critical | 9.8 | 2025-07-07 | employee record management system in php and mysql v1 was discovered to contain a SQL injection vulnerability via the loginerms.php endpoint. |
CVE-2025-43933 | Critical | 9.8 | 2025-07-07 | fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP he… |
CVE-2025-43932 | Critical | 9.8 | 2025-07-07 | JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTT… |
CVE-2025-43931 | Critical | 9.8 | 2025-07-07 | flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the… |
CVE-2025-32023 | High | 7.0 | 2025-07-07 | Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a special… |
CVE-2025-26780 | High | 7.5 | 2025-07-07 | An issue was discovered in L2 in Samsung Mobile Processor and Modem Exynos 2400 and Modem 5400. The lack of a length check leads to a Denial of Service via a m… |
CVE-2025-7133 | Medium | 4.3 | 2025-07-07 | A vulnerability classified as problematic has been found in CodeAstro Online Movie Ticket Booking System 1.0. This affects an unknown part. The manipulation le… |
CVE-2025-7132 | High | 7.3 | 2025-07-07 | A vulnerability was found in Campcodes Payroll Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-6811 | Critical | 9.8 | 2025-07-07 | Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attacke… |
CVE-2025-6810 | Critical | 9.8 | 2025-07-07 | Mescius ActiveReports.NET ReadValue Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2025-6807 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getDriverTmpPath Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sens… |
CVE-2025-6806 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole decryptFile Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary fil… |
CVE-2025-6805 | Critical | 9.1 | 2025-07-07 | Marvell QConvergeConsole deleteEventLogFile Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arb… |
CVE-2025-6804 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole compressFirmwareDumpFiles Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disc… |
CVE-2025-6803 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole compressDriverFiles Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2025-6802 | Critical | 9.8 | 2025-07-07 | Marvell QConvergeConsole getFileFromURL Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2025-6801 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole saveNICParamsToFile Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbit… |
CVE-2025-6800 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole restoreESwitchConfig Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose… |
CVE-2025-6799 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose se… |
CVE-2025-6798 | Critical | 9.1 | 2025-07-07 | Marvell QConvergeConsole deleteAppFile Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrar… |
CVE-2025-6797 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose se… |
CVE-2025-6796 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getAppFileBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensi… |
CVE-2025-6795 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getFileUploadSize Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sen… |
CVE-2025-6794 | Critical | 9.8 | 2025-07-07 | Marvell QConvergeConsole saveAsText Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-6793 | Critical | 9.4 | 2025-07-07 | Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability. This vulnerability allows rem… |
CVE-2025-6714 | High | 7.5 | 2025-07-07 | MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured… |
CVE-2025-6713 | High | 7.7 | 2025-07-07 | An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCu… |
CVE-2025-6712 | Medium | 6.5 | 2025-07-07 | MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in… |
CVE-2025-6711 | Medium | 4.4 | 2025-07-07 | An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered… |
CVE-2025-6663 | High | 7.8 | 2025-07-07 | GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2025-5987 | High | 8.1 | 2025-07-07 | A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detecte… |
CVE-2025-53486 | Medium | 5.4 | 2025-07-07 | The WikiCategoryTagCloud extension is vulnerable to reflected XSS via the linkstyle attribute, which is improperly concatenated into inline HTML without escapi… |
CVE-2025-43930 | Critical | 9.8 | 2025-07-07 | Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header. |
CVE-2025-7131 | High | 7.3 | 2025-07-07 | A vulnerability was found in Campcodes Payroll Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-7130 | High | 7.3 | 2025-07-07 | A vulnerability was found in Campcodes Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php… |
CVE-2025-7056 | Medium | 6.3 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UrlShortener Exte… |
CVE-2025-7129 | High | 7.3 | 2025-07-07 | A vulnerability was found in Campcodes Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.p… |
CVE-2025-7128 | High | 7.3 | 2025-07-07 | A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax… |
CVE-2025-6209 | High | 7.5 | 2025-07-07 | A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_ut… |
CVE-2025-7127 | Medium | 4.7 | 2025-07-07 | A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System up to 1.0. This affects an unknown part of the file /ad… |
CVE-2025-7126 | Medium | 6.3 | 2025-07-07 | A vulnerability, which was classified as critical, has been found in itsourcecode Employee Management System up to 1.0. Affected by this issue is some unknown… |
CVE-2025-7125 | Medium | 6.3 | 2025-07-07 | A vulnerability classified as critical was found in itsourcecode Employee Management System up to 1.0. Affected by this vulnerability is an unknown functionali… |
CVE-2025-7124 | Medium | 6.3 | 2025-07-07 | A vulnerability classified as critical has been found in code-projects Online Note Sharing 1.0. Affected is an unknown function of the file /dashboard/userprof… |
CVE-2025-7123 | Medium | 4.7 | 2025-07-07 | A vulnerability was found in Campcodes Complaint Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /… |
CVE-2025-7122 | High | 7.3 | 2025-07-07 | A vulnerability was found in Campcodes Complaint Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /… |
CVE-2025-6386 | High | 7.5 | 2025-07-07 | The parisneo/lollms repository is affected by a timing attack vulnerability in the `authenticate_user` function within the `lollms_authentication.py` file. Thi… |
CVE-2025-6210 | Medium | 6.2 | 2025-07-07 | A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in version 0.12.27, allows for hardlink-based path traversal… |
CVE-2025-5472 | Medium | 6.5 | 2025-07-07 | The JSONReader in run-llama/llama_index versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This vulnerability allow… |
CVE-2025-4779 | Medium | 6.1 | 2025-07-07 | lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can inject malicious JavaScript into… |
CVE-2025-3777 | Low | 3.5 | 2025-07-07 | Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability aris… |
CVE-2025-3705 | Medium | 6.8 | 2025-07-07 | A physical attacker with no privileges can gain full control of the affected device due to improper neutralization of special elements used in an OS Command ('… |
CVE-2025-3626 | Critical | 9.1 | 2025-07-07 | A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command ('OS… |
CVE-2025-3467 | Medium | 5.4 | 2025-07-07 | An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtai… |
CVE-2025-3466 | High | 7.2 | 2025-07-07 | langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions… |
CVE-2025-3264 | Medium | 5.3 | 2025-07-07 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` funct… |
CVE-2025-3263 | Medium | 5.3 | 2025-07-07 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_fi… |
CVE-2025-3262 | High | 7.5 | 2025-07-07 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vul… |
CVE-2025-3225 | High | 7.5 | 2025-07-07 | An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifica… |
CVE-2025-3046 | High | 7.5 | 2025-07-07 | A vulnerability in the `ObsidianReader` class of the run-llama/llama_index repository, versions 0.12.23 to 0.12.28, allows for arbitrary file read through symb… |
CVE-2025-3044 | Medium | 5.3 | 2025-07-07 | A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating… |
CVE-2025-7121 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in Campcodes Complaint Management System 1.0. It has been classified as critical. This affects an unknown part of the file /users/com… |
CVE-2025-7120 | High | 7.3 | 2025-07-07 | A vulnerability was found in Campcodes Complaint Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-3920 | | 2025-07-07 | A vulnerability was identified in SUR-FBD CMMS where hard-coded credentials were found within a compiled DLL file. These credentials correspond to a built-in a… | |
CVE-2025-7119 | High | 7.3 | 2025-07-07 | A vulnerability has been found in Campcodes Complaint Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-7118 | High | 8.8 | 2025-07-07 | A vulnerability, which was classified as critical, has been found in UTT HiPER 840G up to 3.1.1-190328. This issue affects some unknown processing of the file… |
CVE-2025-7117 | High | 8.8 | 2025-07-07 | A vulnerability classified as critical was found in UTT HiPER 840G up to 3.1.1-190328. This vulnerability affects unknown code of the file /goform/websWhiteLis… |
CVE-2025-7116 | High | 8.8 | 2025-07-07 | A vulnerability classified as critical has been found in UTT 进取 750W up to 3.2.2-191225. This affects an unknown part of the file /goform/Fast_wireless_conf. T… |
CVE-2025-41672 | Critical | 10.0 | 2025-07-07 | A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices. |
CVE-2025-7115 | High | 7.3 | 2025-07-07 | A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the f… |
CVE-2025-7114 | High | 7.3 | 2025-07-07 | A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as critical. Affected by this vulnerability i… |
CVE-2025-7113 | Low | 3.5 | 2025-07-07 | A vulnerability was found in Portabilis i-Educar 2.9.0. It has been classified as problematic. Affected is an unknown function of the file /module/ComponenteCu… |
CVE-2025-7112 | Low | 3.5 | 2025-07-07 | A vulnerability was found in Portabilis i-Educar 2.9.0 and classified as problematic. This issue affects some unknown processing of the file /intranet/educar_f… |
CVE-2025-7111 | Low | 3.5 | 2025-07-07 | A vulnerability has been found in Portabilis i-Educar 2.9.0 and classified as problematic. This vulnerability affects unknown code of the file /intranet/educar… |
CVE-2025-53473 | High | 7.3 | 2025-07-07 | Server-side request forgery (SSRF) vulnerability exists n multiple versions of Nimesa Backup and Recovery, If this vulnerability is exploited, unintended reque… |
CVE-2025-48501 | Critical | 9.8 | 2025-07-07 | An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed… |
CVE-2025-24508 | Medium | 6.4 | 2025-07-07 | Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage |
CVE-2025-7110 | Low | 3.5 | 2025-07-07 | A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9.0. This affects an unknown part of the file /intranet/educar_escola_… |
CVE-2025-7145 | High | 7.2 | 2025-07-07 | ThreatSonar Anti-Ransomware developed by TeamT5 has an OS Command Injection vulnerability, allowing remote attackers with product platform intermediate privile… |
CVE-2025-7109 | Low | 3.5 | 2025-07-07 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the… |
CVE-2025-7108 | Medium | 5.4 | 2025-07-07 | A vulnerability classified as critical was found in risesoft-y9 Digital-Infrastructure up to 9.6.7. Affected by this vulnerability is the function deleteFile o… |
CVE-2025-7107 | Medium | 5.3 | 2025-07-07 | A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLocalFile of the file apps/sim/app/api/fi… |
CVE-2025-53186 | Medium | 5.9 | 2025-07-07 | Vulnerability that allows third-party call apps to send broadcasts without verification in the audio framework module Impact: Successful exploitation of this v… |
CVE-2025-53185 | Medium | 6.6 | 2025-07-07 | Virtual address reuse issue in the memory management module, which can be exploited by non-privileged users to access released memory Impact: Successful exploi… |
CVE-2025-53184 | Medium | 6.5 | 2025-07-07 | Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability. |
CVE-2025-53183 | Medium | 6.5 | 2025-07-07 | Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability. |
CVE-2025-53182 | Medium | 6.5 | 2025-07-07 | Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability. |
CVE-2025-53181 | Medium | 6.5 | 2025-07-07 | Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability. |
CVE-2025-53180 | Medium | 6.5 | 2025-07-07 | Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability. |
CVE-2025-53179 | Medium | 6.5 | 2025-07-07 | Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability. |
CVE-2025-53178 | Medium | 4.8 | 2025-07-07 | Permission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the schedule reminder function… |
CVE-2025-53177 | Low | 3.9 | 2025-07-07 | Permission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the schedule syncing function o… |
CVE-2025-53176 | Low | 3.3 | 2025-07-07 | Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the file preview functio… |
CVE-2025-53175 | Medium | 4.0 | 2025-07-07 | Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the file preview functio… |