2025 CVEs (page 269)
Page 269 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6847 | Medium | 6.3 | 2025-06-29 | A vulnerability classified as critical was found in code-projects Simple Forum 1.0. This vulnerability affects unknown code of the file /forum_edit.php. The ma… |
CVE-2025-6846 | High | 7.3 | 2025-06-29 | A vulnerability classified as critical has been found in code-projects Simple Forum 1.0. This affects an unknown part of the file /forum_viewfile.php. The mani… |
CVE-2025-6845 | High | 7.3 | 2025-06-29 | A vulnerability was found in code-projects Simple Forum 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /r… |
CVE-2025-6462 | Medium | 6.4 | 2025-06-29 | The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode in all… |
CVE-2025-6844 | High | 7.3 | 2025-06-29 | A vulnerability was found in code-projects Simple Forum 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-6843 | High | 7.3 | 2025-06-29 | A vulnerability was found in code-projects Simple Photo Gallery 1.0. It has been classified as critical. Affected is an unknown function of the file /upload-ph… |
CVE-2025-6842 | Medium | 4.7 | 2025-06-29 | A vulnerability was found in code-projects Product Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /adm… |
CVE-2025-6841 | Medium | 4.7 | 2025-06-29 | A vulnerability has been found in code-projects Product Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /a… |
CVE-2025-6840 | High | 7.3 | 2025-06-29 | A vulnerability, which was classified as critical, was found in code-projects Product Inventory System 1.0. This affects an unknown part of the file /index.php… |
CVE-2025-6839 | Medium | 6.3 | 2025-06-29 | A vulnerability, which was classified as critical, has been found in Conjure Position Department Service Quality Evaluation System up to 1.0.11. Affected by th… |
CVE-2025-6837 | Medium | 6.3 | 2025-06-29 | A vulnerability classified as critical was found in code-projects Library System 1.0. Affected by this vulnerability is an unknown functionality of the file /p… |
CVE-2025-6836 | High | 7.3 | 2025-06-29 | A vulnerability classified as critical has been found in code-projects Library System 1.0. Affected is an unknown function of the file /profile.php. The manipu… |
CVE-2025-6835 | High | 7.3 | 2025-06-29 | A vulnerability was found in code-projects Library System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student-i… |
CVE-2025-6834 | High | 7.3 | 2025-06-29 | A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fi… |
CVE-2025-6829 | Medium | 6.3 | 2025-06-28 | A vulnerability was found in aaluoxiang oa_system up to c3a08168c144f27256a90838492c713f55f1b207 and classified as critical. This issue affects the function ou… |
CVE-2025-6828 | High | 7.3 | 2025-06-28 | A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-53393 | Medium | 6.0 | 2025-06-28 | In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics. |
CVE-2025-53392 | Medium | 5.0 | 2025-06-28 | In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE… |
CVE-2025-6827 | High | 7.3 | 2025-06-28 | A vulnerability, which was classified as critical, was found in code-projects Inventory Management System 1.0. This affects an unknown part of the file /php_ac… |
CVE-2025-53391 | Critical | 9.3 | 2025-06-28 | The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactive/allow_active sett… |
CVE-2025-6826 | High | 7.3 | 2025-06-28 | A vulnerability, which was classified as critical, has been found in code-projects Payroll Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2025-6825 | High | 8.8 | 2025-06-28 | A vulnerability classified as critical was found in TOTOLINK A702R up to 4.0.0-B20230721.1521. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-6824 | High | 8.8 | 2025-06-28 | A vulnerability classified as critical has been found in TOTOLINK X15 up to 1.0.0-B20230714.1105. Affected is an unknown function of the file /boafrm/formParen… |
CVE-2025-6823 | High | 7.3 | 2025-06-28 | A vulnerability was found in code-projects Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fi… |
CVE-2025-6822 | High | 7.3 | 2025-06-28 | A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fi… |
CVE-2025-32897 | Critical | 9.8 | 2025-06-28 | Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is the same as CVE-2024-47552, but the version range… |
CVE-2025-6821 | High | 7.3 | 2025-06-28 | A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /php_a… |
CVE-2025-6820 | High | 7.3 | 2025-06-28 | A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-6819 | High | 7.3 | 2025-06-28 | A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2025-6818 | Low | 3.3 | 2025-06-28 | A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5O__chunk_protect of the file /src/H5Ochunk.c. The ma… |
CVE-2025-1991 | High | 7.5 | 2025-06-28 | IBM Informix Dynamic Server 12.10,14.10, and15.0 could allow a remote attacker to cause a denial of service due to an integer underflow when processing packets. |
CVE-2025-6817 | Low | 3.3 | 2025-06-28 | A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5C__load_entry of the file /src/H5Centry… |
CVE-2025-6816 | Low | 3.3 | 2025-06-28 | A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5O__fsinfo_encode of the file /src/H5Ofsinfo.c. Th… |
CVE-2025-5937 | Medium | 4.3 | 2025-06-28 | The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all ve… |
CVE-2025-38086 | Medium | 5.5 | 2025-06-28 | In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the c… |
CVE-2025-38085 | High | 7.8 | 2025-06-28 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference… |
CVE-2025-38084 | High | 7.8 | 2025-06-28 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables during VMA split, not before Currently, __split_vma() tri… |
CVE-2025-6755 | High | 8.8 | 2025-06-28 | The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxDeleteTheme() fu… |
CVE-2025-5304 | Critical | 9.8 | 2025-06-28 | The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_add() function in ve… |
CVE-2025-6252 | Medium | 6.4 | 2025-06-28 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9… |
CVE-2025-6381 | High | 8.8 | 2025-06-28 | The BeeTeam368 Extensions plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_remove_temp_file… |
CVE-2025-6379 | High | 8.8 | 2025-06-28 | The BeeTeam368 Extensions Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_live_fn() fu… |
CVE-2025-6350 | Medium | 6.4 | 2025-06-28 | The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’… |
CVE-2025-36027 | Medium | 5.4 | 2025-06-28 | IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious… |
CVE-2025-36026 | Medium | 4.3 | 2025-06-28 | IBM Datacap 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie val… |
CVE-2025-53098 | High | 8.1 | 2025-06-27 | Roo Code is an AI-powered autonomous coding agent. The project-specific MCP configuration for the Roo Code agent is stored in the `.roo/mcp.json` file within t… |
CVE-2025-53097 | Medium | 5.9 | 2025-06-27 | Roo Code is an AI-powered autonomous coding agent. Prior to version 3.20.3, there was an issue where the Roo Code agent's `search_files` tool did not respect t… |
CVE-2025-6778 | Low | 2.4 | 2025-06-27 | A vulnerability, which was classified as problematic, was found in code-projects Food Distributor Site 1.0. Affected is an unknown function of the file /admin/… |
CVE-2025-6777 | High | 7.3 | 2025-06-27 | A vulnerability, which was classified as critical, has been found in code-projects Food Distributor Site 1.0. This issue affects some unknown processing of the… |
CVE-2025-6776 | High | 7.3 | 2025-06-27 | A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/pl… |
CVE-2025-6775 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function create_user of the file /app/api/v… |
CVE-2025-6774 | Medium | 6.3 | 2025-06-27 | A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been rated as critical. Affected by this issue is the function AddTemp of the file api/temp… |
CVE-2025-53094 | | 2025-06-27 | ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF (Ca… | |
CVE-2025-6773 | Medium | 5.3 | 2025-06-27 | A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir o… |
CVE-2025-6772 | High | 7.3 | 2025-06-27 | A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serv… |
CVE-2025-6522 | Medium | 5.4 | 2025-06-27 | Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP protocol available o… |
CVE-2025-5310 | Critical | 9.8 | 2025-06-27 | Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific po… |
CVE-2025-53093 | High | 8.6 | 2025-06-27 | TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HT… |
CVE-2025-6521 | High | 7.6 | 2025-06-27 | During the initial setup of the device the user connects to an access point broadcast by the Sight Bulb Pro. During the negotiation, AES Encryption keys are… |
CVE-2025-52207 | Critical | 9.9 | 2025-06-27 | PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory. |
CVE-2025-46708 | Medium | 4.3 | 2025-06-27 | Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU. |
CVE-2025-46707 | Medium | 5.2 | 2025-06-27 | Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU. |
CVE-2025-44559 | Medium | 6.5 | 2025-06-27 | An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a Denial of Service (DoS)… |
CVE-2025-44557 | High | 8.1 | 2025-06-27 | A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing process and authenticatio… |
CVE-2025-50370 | Medium | 6.5 | 2025-06-27 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the Inquiry Management functionality /mcgs/admin/readenq.php of the Phpgurukul Medical Card Generat… |
CVE-2025-50369 | Medium | 6.5 | 2025-06-27 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the Manage Card functionality (/mcgs/admin/manage-card.php) of PHPGurukul Medical Card Generation S… |
CVE-2025-50367 | Medium | 6.1 | 2025-06-27 | A stored blind XSS vulnerability exists in the Contact Page of the Phpgurukul Medical Card Generation System 1.0 mcgs/contact.php. The name field fails to prop… |
CVE-2025-6705 | Medium | 5.3 | 2025-06-27 | A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’… |
CVE-2025-53091 | Critical | 9.8 | 2025-06-27 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was dis… |
CVE-2025-52553 | Critical | 9.6 | 2025-06-27 | authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and… |
CVE-2025-6768 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is the function findAllHo… |
CVE-2025-53339 | High | 7.5 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in devnex Devnex Addons For Elementor dev… |
CVE-2025-53338 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in dor re.place replace allows Stored XSS.This issue affects re.place: from n/a through <= 0.2.1. |
CVE-2025-53336 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in abditsori My Resume Builder my-resume-builder allows Stor… |
CVE-2025-53332 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in ethoseo Track Everything track-everything allows Stored XSS.This issue affects Track Everything: from n/a th… |
CVE-2025-53331 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in samcharrington RSS Digest rss-digest allows Stored XSS.This issue affects RSS Digest: from n/a through <= 1… |
CVE-2025-53329 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in szajenw Społecznościowa 6 PL 2013 spolecznosciowa-6-pl-2013 allows Stored XSS.This issue affects Społecznośc… |
CVE-2025-53327 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in rui_mashita Aioseo Multibyte Descriptions aioseo-multibyte-descriptions allows Cross Site Request Forgery.Th… |
CVE-2025-53325 | Medium | 5.9 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dilip kumar Beauty Contact Popup Form beauty-contact-popu… |
CVE-2025-53323 | Medium | 4.3 | 2025-06-27 | Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist pre-publish-post-checklist allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-53322 | Medium | 5.3 | 2025-06-27 | Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Authorize.NET Payments Using Contact Form 7 accept-authorize-net-payments-… |
CVE-2025-53321 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raise The Money Raise The Money raise-the-money allows DO… |
CVE-2025-53320 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wp Enhanced Free Downloads EDD allows DOM-Based XSS. This… |
CVE-2025-53318 | Medium | 5.4 | 2025-06-27 | Missing Authorization vulnerability in WPManiax WP DB Booster wp-db-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-53317 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in AcmeeDesign WPShapere - WordPress admin theme wpshapere-lite allows Stored XSS.This issue affects WPShapere… |
CVE-2025-53315 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in alanft Relocate Upload relocate-upload allows Stored XSS.This issue affects Relocate Upload: from n/a throug… |
CVE-2025-53314 | Critical | 9.6 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through <= 2… |
CVE-2025-53313 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in plumwd Twitch TV Embed Suite twitch-tv-embed-suite allows Stored XSS.This issue affects Twitch TV Embed Suit… |
CVE-2025-53312 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Looks Awesome OnionBuzz onionbuzz-viral-quiz allows Stored XSS.This issue affects OnionBuzz: from n/a throug… |
CVE-2025-53311 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Amol Nirmala Waman Navayan Subscribe navayan-subscribe allows Stored XSS.This issue affects Navayan Subscrib… |
CVE-2025-53310 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Funnnny HidePost hidepost allows Reflected XSS.This issue affects HidePost: from n/a through <= 2.3.8. |
CVE-2025-53309 | Medium | 5.3 | 2025-06-27 | Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Stripe Payments Using Contact Form 7 accept-stripe-payments-using-contact-… |
CVE-2025-53308 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in gopi_plus Image Slider With Description image-slider-with-description allows Stored XSS.This issue affects I… |
CVE-2025-53306 | High | 7.6 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in lucidcrew WP Forum Server forum-server allows SQL Inject… |
CVE-2025-53305 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in lucidcrew WP Forum Server forum-server allows Stored XSS.This issue affects WP Forum Server: from n/a thro… |
CVE-2025-53304 | Medium | 5.3 | 2025-06-27 | Missing Authorization vulnerability in Rohil Contact Form – 7 : Hide Success Message contact-form-7-hide-success-message allows Accessing Functionality Not Pro… |
CVE-2025-53301 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Junkie Theme Junkie Team Content theme-junkie-team-… |
CVE-2025-53300 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in douglaskarr Podcast Feed Player Widget and Shortcode podc… |
CVE-2025-53298 | Medium | 4.9 | 2025-06-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gioni Plugin Inspector plugin-inspector allows Path Traversal.T… |
CVE-2025-53296 | Medium | 5.9 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ecoal95 EC Stars Rating ec-stars-rating allows Stored XSS… |