2025 CVEs (page 267)
Page 267 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49741 | High | 7.4 | 2025-07-01 | No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-52101 | Critical | 9.8 | 2025-07-01 | linjiashop <=0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the authentication and re… |
CVE-2025-45006 | Critical | 9.1 | 2025-07-01 | Improper mstatus.SUM bit retention (non-zero) in Open-Source RISC-V Processor commit f517abb violates privileged spec constraints, enabling potential physical… |
CVE-2025-6600 | Medium | 4.3 | 2025-07-01 | An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the names of private rep… |
CVE-2025-53104 | Critical | 9.1 | 2025-07-01 | gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS (NativeWind). Prior to commit e6b4271, a command injection vulnerab… |
CVE-2025-48379 | High | 7.1 | 2025-07-01 | Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with d… |
CVE-2025-46259 | Medium | 5.4 | 2025-07-01 | Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-27153 | Medium | 6.5 | 2025-07-01 | Escalade GLPI plugin is a ticket escalation process helper for GLPI. Prior to version 2.9.11, there is an improper access control vulnerability. This can lead… |
CVE-2025-53107 | High | 7.5 | 2025-07-01 | @cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories. Prior to version 2.1.5, there is a command injection vulnerability cause… |
CVE-2025-53103 | Medium | 5.8 | 2025-07-01 | JUnit is a testing framework for Java and the JVM. From version 5.12.0 to 5.13.1, JUnit's support for writing Open Test Reporting XML files can leak Git creden… |
CVE-2025-53100 | | 2025-07-01 | RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform. Prior to version 0.2.2, the MCP server is written in a way that is vulnerable t… | |
CVE-2025-52294 | Medium | 5.7 | 2025-07-01 | Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen and view the wallet… |
CVE-2025-45083 | Medium | 6.1 | 2025-07-01 | Incorrect access control in Ullu (Android version v2.9.929 and IOS version v2.8.0) allows attackers to bypass parental pin feature via unspecified vectors. |
CVE-2025-45081 | High | 8.8 | 2025-07-01 | Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data. |
CVE-2025-37099 | Critical | 9.8 | 2025-07-01 | A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. |
CVE-2025-34081 | High | 7.5 | 2025-07-01 | The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attack… |
CVE-2025-34080 | Medium | 6.1 | 2025-07-01 | The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable to Cross-Site Scripting (XSS) in the getqsetting.php functionality that could allow reflected exec… |
CVE-2025-6297 | High | 8.2 | 2025-07-01 | It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is document… |
CVE-2025-6963 | High | 7.3 | 2025-07-01 | A vulnerability has been found in Campcodes Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /myp… |
CVE-2025-6962 | High | 7.3 | 2025-07-01 | A vulnerability, which was classified as critical, was found in Campcodes Employee Management System 1.0. This affects an unknown part of the file /myprofileup… |
CVE-2025-6961 | High | 7.3 | 2025-07-01 | A vulnerability, which was classified as critical, has been found in Campcodes Employee Management System 1.0. Affected by this issue is some unknown functiona… |
CVE-2025-50641 | Medium | 6.5 | 2025-07-01 | Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the addWifiMacFilter function via the parameter deviceId. |
CVE-2025-6960 | High | 7.3 | 2025-07-01 | A vulnerability classified as critical was found in Campcodes Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-6959 | High | 7.3 | 2025-07-01 | A vulnerability classified as critical has been found in Campcodes Employee Management System 1.0. Affected is an unknown function of the file /eloginwel.php… |
CVE-2025-6958 | High | 7.3 | 2025-07-01 | A vulnerability was found in Campcodes Employee Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /e… |
CVE-2025-6957 | High | 7.3 | 2025-07-01 | A vulnerability was found in Campcodes Employee Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /p… |
CVE-2025-53099 | High | 7.5 | 2025-07-01 | Sentry is a developer-first error tracking and performance monitoring tool. Prior to version 25.5.0, an attacker with a malicious OAuth application registered… |
CVE-2025-50405 | Medium | 6.5 | 2025-07-01 | Intelbras RX1500 Router v2.2.17 and before is vulnerable to Incorrect Access Control in the FirmwareUpload function and GetFirmwareValidation function. |
CVE-2025-50404 | Medium | 5.3 | 2025-07-01 | Intelbras RX1500 Router v2.2.17 and before is vulnerable to Integer Overflow. The websReadEvent function incorrectly uses the int type when processing the "com… |
CVE-2025-37098 | High | 7.5 | 2025-07-01 | A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. |
CVE-2025-34066 | | 2025-07-01 | An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like… | |
CVE-2025-34065 | | 2025-07-01 | An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated acces… | |
CVE-2025-34064 | | 2025-07-01 | A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without… | |
CVE-2025-34063 | | 2025-07-01 | A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via th… | |
CVE-2025-34062 | | 2025-07-01 | An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with ac… | |
CVE-2025-34060 | | 2025-07-01 | A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image… | |
CVE-2025-34059 | | 2025-07-01 | An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLog… | |
CVE-2025-34058 | | 2025-07-01 | Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. Af… | |
CVE-2025-34056 | | 2025-07-01 | An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management ope… | |
CVE-2025-34055 | | 2025-07-01 | An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD dae… | |
CVE-2025-34054 | | 2025-07-01 | An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization all… | |
CVE-2025-34053 | | 2025-07-01 | An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" r… | |
CVE-2025-34051 | | 2025-07-01 | A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_q… | |
CVE-2025-34050 | | 2025-07-01 | A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious reques… | |
CVE-2025-6956 | High | 7.3 | 2025-07-01 | A vulnerability was found in Campcodes Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /changepass… |
CVE-2025-6955 | High | 7.3 | 2025-07-01 | A vulnerability was found in Campcodes Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-6954 | High | 7.3 | 2025-07-01 | A vulnerability has been found in Campcodes Employee Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-6953 | High | 8.8 | 2025-07-01 | A vulnerability, which was classified as critical, was found in TOTOLINK A3002RU 3.0.0-B20230809.1615. Affected is an unknown function of the file /boafrm/form… |
CVE-2025-6920 | Medium | 5.3 | 2025-07-01 | A flaw was found in the authentication enforcement mechanism of a model inference API in ai-inference-server. All /v1/* endpoints are expected to enforce API k… |
CVE-2025-49029 | Critical | 9.1 | 2025-07-01 | Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code… |
CVE-2025-45872 | Critical | 9.8 | 2025-07-01 | zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter. |
CVE-2025-37097 | High | 7.5 | 2025-07-01 | A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service |
CVE-2025-36582 | Medium | 4.8 | 2025-07-01 | Dell NetWorker, versions 19.12.0.1 and prior, contains a Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') vulnerability. An unauth… |
CVE-2025-6952 | Low | 3.3 | 2025-07-01 | A vulnerability, which was classified as problematic, has been found in Open5GS up to 2.7.5. This issue affects the function amf_state_operational of the file… |
CVE-2025-6951 | Medium | 4.3 | 2025-07-01 | A vulnerability classified as problematic was found in SAFECAM X300 up to 20250611. This vulnerability affects unknown code of the component FTP Service. The m… |
CVE-2025-5314 | Medium | 6.1 | 2025-07-01 | The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pd… |
CVE-2025-49483 | Medium | 5.4 | 2025-07-01 | Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069 modules allows Resource Leak Exposure. This vulnerability is associated with… |
CVE-2025-49482 | Medium | 5.4 | 2025-07-01 | Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069 modules allows Resource Leak Exposure. This vulnerability is associated with… |
CVE-2025-49481 | Medium | 5.4 | 2025-07-01 | Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in router modules allows Resource Leak Exposure. This vulnerability is associated with… |
CVE-2025-49480 | High | 7.4 | 2025-07-01 | Out-of-bounds access in ASR180x 、ASR190x in lte-telephony, This vulnerability is associated with program files apps/lzma/src/LzmaEnc.c. This issue affects F… |
CVE-2025-6224 | Medium | 6.5 | 2025-07-01 | Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the netw… |
CVE-2025-49492 | High | 7.4 | 2025-07-01 | Out-of-bounds write in ASR180x in lte-telephony, May cause a buffer underrun. This vulnerability is associated with program files apps/atcmd_server/src/dev_a… |
CVE-2025-49491 | Medium | 5.4 | 2025-07-01 | Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (traffic_stat modules) allows Resource Leak Exposure. Th… |
CVE-2025-49488 | Medium | 5.4 | 2025-07-01 | Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in router components allows Resource Leak Exposure. This vulnerability is associate… |
CVE-2025-6756 | Medium | 6.4 | 2025-07-01 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all ver… |
CVE-2025-49490 | Medium | 5.4 | 2025-07-01 | Resource leak vulnerability in ASR180x in router allows Resource Leak Exposure. This vulnerability is associated with program files router/sms/sms.c. This i… |
CVE-2025-49489 | Medium | 5.4 | 2025-07-01 | Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (con_mgr components) allows Resource Leak Exposure. Th… |
CVE-2025-5072 | Medium | 5.4 | 2025-07-01 | Resource leak vulnerability in ASR180x、ASR190x in con_mgr allows Resource Leak Exposure.This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536. |
CVE-2025-41656 | Critical | 10.0 | 2025-07-01 | An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server i… |
CVE-2025-41648 | Critical | 9.8 | 2025-07-01 | An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available se… |
CVE-2025-6934 | Critical | 9.8 | 2025-07-01 | The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to… |
CVE-2025-6081 | Medium | 6.8 | 2025-07-01 | Insufficiently Protected Credentials in LDAP in Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earlier allows an attacker can reconfigure t… |
CVE-2025-5967 | | 2025-07-01 | A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan Name field, resultin… | |
CVE-2025-6940 | High | 8.8 | 2025-07-01 | A vulnerability classified as critical was found in TOTOLINK A702R 4.0.0-B20230721.1521. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-6939 | High | 8.8 | 2025-07-01 | A vulnerability classified as critical has been found in TOTOLINK A3002RU 3.0.0-B20230809.1615. Affected is an unknown function of the file /boafrm/formWlSiteS… |
CVE-2025-6938 | High | 7.3 | 2025-07-01 | A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2025-53096 | Medium | 5.4 | 2025-07-01 | Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks… |
CVE-2025-53095 | Critical | 9.6 | 2025-07-01 | Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Cross-Site Request Fo… |
CVE-2025-53003 | | 2025-07-01 | The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verif… | |
CVE-2025-6937 | High | 7.3 | 2025-07-01 | A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been declared as critical. This vulnerability affects unknown code of the f… |
CVE-2025-53005 | Critical | 9.8 | 2025-07-01 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in Dataease's PostgreSQ… |
CVE-2025-36056 | Medium | 5.4 | 2025-07-01 | IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.11… |
CVE-2025-2141 | Medium | 6.1 | 2025-07-01 | IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.11… |
CVE-2025-6936 | High | 7.3 | 2025-07-01 | A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /addp… |
CVE-2025-6935 | High | 7.3 | 2025-07-01 | A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-6932 | Low | 3.7 | 2025-06-30 | A vulnerability, which was classified as problematic, was found in D-Link DCS-7517 up to 2.02.0. This affects the function g_F_n_GenPassForQlync of the file /b… |
CVE-2025-6931 | Low | 3.7 | 2025-06-30 | A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_… |
CVE-2025-6930 | Medium | 6.3 | 2025-06-30 | A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/manage-foreig… |
CVE-2025-6554 | High | 8.1 | 2025-06-30 | Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium secur… |
CVE-2025-6929 | Medium | 6.3 | 2025-06-30 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /admin… |
CVE-2025-53004 | Critical | 9.8 | 2025-06-30 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in Dataease's Redshift… |
CVE-2025-49521 | High | 8.8 | 2025-06-30 | A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. T… |
CVE-2025-49520 | High | 8.8 | 2025-06-30 | A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerab… |
CVE-2025-32463 | Critical | 9.3 | 2025-06-30 | Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. |
CVE-2025-32462 | Low | 2.8 | 2025-06-30 | Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on… |
CVE-2025-52997 | Medium | 5.9 | 2025-06-30 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2025-52996 | Low | 3.1 | 2025-06-30 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions… |
CVE-2025-52995 | High | 8.0 | 2025-06-30 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2025-52901 | Medium | 4.5 | 2025-06-30 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2025-52491 | Medium | 5.8 | 2025-06-30 | Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF. |