2025 CVEs (page 269)
Page 269 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-34050 | | 2025-07-01 | A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious reques… | |
CVE-2025-6956 | High | 7.3 | 2025-07-01 | A vulnerability was found in Campcodes Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /changepass… |
CVE-2025-6955 | High | 7.3 | 2025-07-01 | A vulnerability was found in Campcodes Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-6954 | High | 7.3 | 2025-07-01 | A vulnerability has been found in Campcodes Employee Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-6953 | High | 8.8 | 2025-07-01 | A vulnerability, which was classified as critical, was found in TOTOLINK A3002RU 3.0.0-B20230809.1615. Affected is an unknown function of the file /boafrm/form… |
CVE-2025-6920 | Medium | 5.3 | 2025-07-01 | A flaw was found in the authentication enforcement mechanism of a model inference API in ai-inference-server. All /v1/* endpoints are expected to enforce API k… |
CVE-2025-49029 | Critical | 9.1 | 2025-07-01 | Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code… |
CVE-2025-45872 | Critical | 9.8 | 2025-07-01 | zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter. |
CVE-2025-37097 | High | 7.5 | 2025-07-01 | A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service |
CVE-2025-36582 | Medium | 4.8 | 2025-07-01 | Dell NetWorker, versions 19.12.0.1 and prior, contains a Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') vulnerability. An unauth… |
CVE-2025-6952 | Low | 3.3 | 2025-07-01 | A vulnerability, which was classified as problematic, has been found in Open5GS up to 2.7.5. This issue affects the function amf_state_operational of the file… |
CVE-2025-6951 | Medium | 4.3 | 2025-07-01 | A vulnerability classified as problematic was found in SAFECAM X300 up to 20250611. This vulnerability affects unknown code of the component FTP Service. The m… |
CVE-2025-5314 | Medium | 6.1 | 2025-07-01 | The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pd… |
CVE-2025-49483 | Medium | 5.4 | 2025-07-01 | Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069 modules allows Resource Leak Exposure. This vulnerability is associated with… |
CVE-2025-49482 | Medium | 5.4 | 2025-07-01 | Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069 modules allows Resource Leak Exposure. This vulnerability is associated with… |
CVE-2025-49481 | Medium | 5.4 | 2025-07-01 | Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in router modules allows Resource Leak Exposure. This vulnerability is associated with… |
CVE-2025-49480 | High | 7.4 | 2025-07-01 | Out-of-bounds access in ASR180x 、ASR190x in lte-telephony, This vulnerability is associated with program files apps/lzma/src/LzmaEnc.c. This issue affects F… |
CVE-2025-6224 | Medium | 6.5 | 2025-07-01 | Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the netw… |
CVE-2025-49492 | High | 7.4 | 2025-07-01 | Out-of-bounds write in ASR180x in lte-telephony, May cause a buffer underrun. This vulnerability is associated with program files apps/atcmd_server/src/dev_a… |
CVE-2025-49491 | Medium | 5.4 | 2025-07-01 | Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (traffic_stat modules) allows Resource Leak Exposure. Th… |
CVE-2025-49488 | Medium | 5.4 | 2025-07-01 | Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in router components allows Resource Leak Exposure. This vulnerability is associate… |
CVE-2025-6756 | Medium | 6.4 | 2025-07-01 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all ver… |
CVE-2025-49490 | Medium | 5.4 | 2025-07-01 | Resource leak vulnerability in ASR180x in router allows Resource Leak Exposure. This vulnerability is associated with program files router/sms/sms.c. This i… |
CVE-2025-49489 | Medium | 5.4 | 2025-07-01 | Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (con_mgr components) allows Resource Leak Exposure. Th… |
CVE-2025-5072 | Medium | 5.4 | 2025-07-01 | Resource leak vulnerability in ASR180x、ASR190x in con_mgr allows Resource Leak Exposure.This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536. |
CVE-2025-41656 | Critical | 10.0 | 2025-07-01 | An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server i… |
CVE-2025-41648 | Critical | 9.8 | 2025-07-01 | An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available se… |
CVE-2025-6934 | Critical | 9.8 | 2025-07-01 | The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to… |
CVE-2025-6081 | Medium | 6.8 | 2025-07-01 | Insufficiently Protected Credentials in LDAP in Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earlier allows an attacker can reconfigure t… |
CVE-2025-5967 | | 2025-07-01 | A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan Name field, resultin… | |
CVE-2025-6940 | High | 8.8 | 2025-07-01 | A vulnerability classified as critical was found in TOTOLINK A702R 4.0.0-B20230721.1521. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-6939 | High | 8.8 | 2025-07-01 | A vulnerability classified as critical has been found in TOTOLINK A3002RU 3.0.0-B20230809.1615. Affected is an unknown function of the file /boafrm/formWlSiteS… |
CVE-2025-6938 | High | 7.3 | 2025-07-01 | A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2025-53096 | Medium | 5.4 | 2025-07-01 | Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks… |
CVE-2025-53095 | Critical | 9.6 | 2025-07-01 | Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Cross-Site Request Fo… |
CVE-2025-53003 | | 2025-07-01 | The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verif… | |
CVE-2025-6937 | High | 7.3 | 2025-07-01 | A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been declared as critical. This vulnerability affects unknown code of the f… |
CVE-2025-53005 | Critical | 9.8 | 2025-07-01 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in Dataease's PostgreSQ… |
CVE-2025-36056 | Medium | 5.4 | 2025-07-01 | IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.11… |
CVE-2025-2141 | Medium | 6.1 | 2025-07-01 | IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.11… |
CVE-2025-6936 | High | 7.3 | 2025-07-01 | A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /addp… |
CVE-2025-6935 | High | 7.3 | 2025-07-01 | A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-6932 | Low | 3.7 | 2025-06-30 | A vulnerability, which was classified as problematic, was found in D-Link DCS-7517 up to 2.02.0. This affects the function g_F_n_GenPassForQlync of the file /b… |
CVE-2025-6931 | Low | 3.7 | 2025-06-30 | A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_… |
CVE-2025-6930 | Medium | 6.3 | 2025-06-30 | A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/manage-foreig… |
CVE-2025-6554 | High | 8.1 | 2025-06-30 | Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium secur… |
CVE-2025-6929 | Medium | 6.3 | 2025-06-30 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /admin… |
CVE-2025-53004 | Critical | 9.8 | 2025-06-30 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in Dataease's Redshift… |
CVE-2025-49521 | High | 8.8 | 2025-06-30 | A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. T… |
CVE-2025-49520 | High | 8.8 | 2025-06-30 | A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerab… |
CVE-2025-32463 | Critical | 9.3 | 2025-06-30 | Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. |
CVE-2025-32462 | Low | 2.8 | 2025-06-30 | Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on… |
CVE-2025-52997 | Medium | 5.9 | 2025-06-30 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2025-52996 | Low | 3.1 | 2025-06-30 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions… |
CVE-2025-52995 | High | 8.0 | 2025-06-30 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2025-52901 | Medium | 4.5 | 2025-06-30 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2025-52491 | Medium | 5.8 | 2025-06-30 | Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF. |
CVE-2025-49493 | Medium | 5.8 | 2025-06-30 | Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. |
CVE-2025-36593 | High | 8.8 | 2025-06-30 | Dell OpenManage Network Integration, versions prior to 3.8, contains an Authentication Bypass by Capture-replay vulnerability in the RADIUS protocol. An attac… |
CVE-2025-6925 | Medium | 5.3 | 2025-06-30 | A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-6917 | High | 7.3 | 2025-06-30 | A vulnerability has been found in code-projects Online Hotel Booking 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin… |
CVE-2025-52898 | High | 8.8 | 2025-06-30 | Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting ac… |
CVE-2025-6916 | High | 8.8 | 2025-06-30 | A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginA… |
CVE-2025-6915 | Medium | 6.3 | 2025-06-30 | A vulnerability, which was classified as critical, has been found in PHPGurukul Student Record System 3.2. Affected by this issue is some unknown functionality… |
CVE-2025-52896 | Medium | 5.4 | 2025-06-30 | Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via… |
CVE-2025-52895 | High | 7.5 | 2025-06-30 | Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which… |
CVE-2025-47871 | Medium | 4.3 | 2025-06-30 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when… |
CVE-2025-46702 | Medium | 5.4 | 2025-06-30 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member managemen… |
CVE-2025-45931 | Critical | 9.8 | 2025-06-30 | An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in the bin/goahead file |
CVE-2025-45143 | High | 7.0 | 2025-06-30 | string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input. |
CVE-2025-26074 | Critical | 9.8 | 2025-06-30 | Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes. |
CVE-2025-6914 | Medium | 6.3 | 2025-06-30 | A vulnerability classified as critical was found in PHPGurukul Student Record System 3.2. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-6913 | Medium | 6.3 | 2025-06-30 | A vulnerability classified as critical has been found in PHPGurukul Student Record System 3.2. Affected is an unknown function of the file /admin-profile.php… |
CVE-2025-6912 | Medium | 6.3 | 2025-06-30 | A vulnerability was found in PHPGurukul Student Record System 3.2. It has been rated as critical. This issue affects some unknown processing of the file /manag… |
CVE-2025-6911 | Medium | 6.3 | 2025-06-30 | A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code of the file /manag… |
CVE-2025-2895 | Medium | 5.4 | 2025-06-30 | IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection. A remote attacker coul… |
CVE-2025-6910 | Medium | 6.3 | 2025-06-30 | A vulnerability was found in PHPGurukul Student Record System 3.2. It has been classified as critical. This affects an unknown part of the file /session.php. T… |
CVE-2025-6909 | Medium | 6.3 | 2025-06-30 | A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2025-6908 | Medium | 6.3 | 2025-06-30 | A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /adm… |
CVE-2025-6907 | High | 7.3 | 2025-06-30 | A vulnerability classified as critical was found in code-projects Car Rental System 1.0. This vulnerability affects unknown code of the file /book_car.php. The… |
CVE-2025-6906 | High | 7.3 | 2025-06-30 | A vulnerability classified as critical has been found in code-projects Car Rental System 1.0. This affects an unknown part of the file /login.php. The manipula… |
CVE-2025-6905 | High | 7.3 | 2025-06-30 | A vulnerability, which was classified as critical, has been found in code-projects Car Rental System 1.0. This issue affects some unknown processing of the fil… |
CVE-2025-4407 | Medium | 6.7 | 2025-06-30 | Insufficient Session Expiration vulnerability in ABB Lite Panel Pro.This issue affects Lite Panel Pro: through 1.0.1. |
CVE-2025-6904 | High | 7.3 | 2025-06-30 | A vulnerability was found in code-projects Car Rental System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2025-6903 | High | 7.3 | 2025-06-30 | A vulnerability was found in code-projects Car Rental System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-40710 | | 2025-06-30 | Host Header Injection (HHI) vulnerability in the Hotspot Shield VPN client, which can induce unexpected behaviour when accessing third-party web applications t… | |
CVE-2025-6902 | High | 7.3 | 2025-06-30 | A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ph… |
CVE-2025-6901 | High | 7.3 | 2025-06-30 | A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /… |
CVE-2025-53416 | High | 7.8 | 2025-06-30 | Delta Electronics DTN Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution |
CVE-2025-41439 | Medium | 6.1 | 2025-06-30 | A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vulnerability is expl… |
CVE-2025-6900 | Medium | 6.3 | 2025-06-30 | A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-book.ph… |
CVE-2025-6899 | Medium | 6.3 | 2025-06-30 | A vulnerability, which was classified as critical, was found in D-Link DI-7300G+ and DI-8200G 17.12.20A1/19.12.25A1. This affects an unknown part of the file m… |
CVE-2025-53415 | High | 7.8 | 2025-06-30 | Delta Electronics DTM Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution |
CVE-2025-40734 | Medium | 6.1 | 2025-06-30 | Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a… |
CVE-2025-40733 | Medium | 6.1 | 2025-06-30 | Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a… |
CVE-2025-40732 | High | 7.5 | 2025-06-30 | user enumeration vulnerability in Daily Expense Manager v1.0. To exploit this vulnerability a POST request must be sent using the name parameter in /check.php |
CVE-2025-40731 | Critical | 9.8 | 2025-06-30 | SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the p… |
CVE-2025-6898 | Medium | 6.3 | 2025-06-30 | A vulnerability, which was classified as critical, has been found in D-Link DI-7300G+ 19.12.25A1. Affected by this issue is some unknown functionality of the f… |
CVE-2025-6897 | Medium | 5.5 | 2025-06-30 | A vulnerability classified as critical was found in D-Link DI-7300G+ 19.12.25A1. Affected by this vulnerability is an unknown functionality of the file httpd_d… |
CVE-2025-38090 | High | 7.8 | 2025-06-30 | In the Linux kernel, the following vulnerability has been resolved: drivers/rapidio/rio_cm.c: prevent possible heap overwrite In riocm_cdev_ioctl(RIO_CM_CHA… |