2025 CVEs (page 270)
Page 270 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53295 | Medium | 5.3 | 2025-06-27 | Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2025-53294 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smart Agenda Smart Agenda smart-agenda-prise-de-rendez-vo… |
CVE-2025-53293 | Medium | 4.3 | 2025-06-27 | Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar dashboard-widget-sidebar allows Exploiting Incorrectly Configured Acce… |
CVE-2025-53292 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk WP DataTable wp-datatable allows DOM-Based XSS.This… |
CVE-2025-53290 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MS WP Visual Sitemap wp-visual-sitemap allows Stored XSS… |
CVE-2025-53288 | Medium | 4.3 | 2025-06-27 | Missing Authorization vulnerability in Adrian Ladó PlatiOnline Payments plationline allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-53287 | Medium | 5.9 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Cummings Quick Favicon quick-favicon allows Stored… |
CVE-2025-53285 | Medium | 5.9 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Website Flip Add & Replace Affiliate Links for Amazon… |
CVE-2025-53284 | Medium | 6.5 | 2025-06-27 | Missing Authorization vulnerability in pankaj.sakaria CMS Blocks cms-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-53282 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Thumbnail Editor thumbnail-editor allows S… |
CVE-2025-53281 | High | 7.5 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPBean WPB Category Slider for WooComm… |
CVE-2025-53280 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.Th… |
CVE-2025-53279 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-fo… |
CVE-2025-53278 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue… |
CVE-2025-53277 | High | 8.8 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Infigo Software IS-theme-companion weblizar-companion allows Object Injection.This issue affects IS-theme-co… |
CVE-2025-53276 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows DOM-Based XSS.Th… |
CVE-2025-53275 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows DOM-Based XSS.This issue… |
CVE-2025-53274 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Hossin Asaadi WP Permalink Translator wp-permalink-translator allows Stored XSS.This issue affects WP Permal… |
CVE-2025-53273 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Slickstream Slickstream slick-engagement allows Cross Site Request Forgery.This issue affects Slickstream: f… |
CVE-2025-53272 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in opicron Image Cleanup image-cleanup allows Cross Site Request Forgery.This issue affects Image Cleanup: from… |
CVE-2025-53271 | High | 7.1 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Anton Bond Additional Order Filters for WooCommerce additional-order-filters-for-woocommerce allows Stored X… |
CVE-2025-53270 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress… |
CVE-2025-53269 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in imw3 My Wp Brand my-wp-brand allows Cross Site Request Forgery.This issue affects My Wp Brand: from n/a thro… |
CVE-2025-53268 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Cross Site Request Forgery.This… |
CVE-2025-53267 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Aftab Husain Hide Admin Bar From Front End hide-admin-bar-from-front-end allows Cross Site Request Forgery.T… |
CVE-2025-53266 | Medium | 4.3 | 2025-06-27 | Missing Authorization vulnerability in EdwardBock Cron Logger cron-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-53265 | Medium | 5.4 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Virusdie Virusdie virusdie allows Cross Site Request Forgery.This issue affects Virusdie: from n/a through <… |
CVE-2025-53264 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Konrád Koller ONet Regenerate Thumbnails onet-regenerate-thumbnails allows Cross Site Request Forgery.This i… |
CVE-2025-53263 | Medium | 5.4 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in PluginsCafe Address Autocomplete via Google for Gravity Forms gf-google-address-autocomplete allows Cross Si… |
CVE-2025-53262 | Medium | 5.4 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Writesonic Writesonic writesonic allows Cross Site Request Forgery.This issue affects Writesonic: from n/a t… |
CVE-2025-53261 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in macbookandrew WP YouTube Live wp-youtube-live allows Cross Site Request Forgery.This issue affects WP YouTub… |
CVE-2025-53260 | Critical | 9.1 | 2025-06-27 | Unrestricted Upload of File with Dangerous Type vulnerability in getredhawkstudio File Manager Plugin For Wordpress file-manager-plugin-for-wordpress allows Up… |
CVE-2025-53259 | High | 7.5 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allow… |
CVE-2025-53258 | High | 7.6 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wow-Company Hover Effects hover-effects allows SQL Inject… |
CVE-2025-53257 | High | 7.5 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Serhii Pasyuk Gmedia Photo Gallery gra… |
CVE-2025-53256 | High | 7.6 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP yaysmtp allows SQL Injection.This iss… |
CVE-2025-53255 | Medium | 5.3 | 2025-06-27 | Missing Authorization vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-53254 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Cyrlitera cyrlitera allows Cross Site Request Forgery.This issue affects Cyrlitera: from n/a throu… |
CVE-2025-53253 | Medium | 5.9 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh WP Edit wp-edit allows Stored XSS.This issue affects… |
CVE-2025-53211 | Medium | 5.3 | 2025-06-27 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allo… |
CVE-2025-53206 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Bu… |
CVE-2025-53203 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Cross Site Request Forgery.This is… |
CVE-2025-53202 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-add… |
CVE-2025-53200 | Medium | 4.3 | 2025-06-27 | Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-53199 | Medium | 6.5 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Slider For Elementor ht-slider-for-elemento… |
CVE-2025-53197 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in cookiebot Cookiebot cookiebot allows Cross Site Request Forgery.This issue affects Cookiebot: from n/a throu… |
CVE-2025-53193 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in Burst Statistics B.V. Burst Statistics burst-statistics allows Cross Site Request Forgery.This issue affects… |
CVE-2025-52993 | Medium | 5.6 | 2025-06-27 | A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbl… |
CVE-2025-52992 | Low | 3.2 | 2025-06-27 | The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the conten… |
CVE-2025-52991 | Low | 3.2 | 2025-06-27 | The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard user… |
CVE-2025-50528 | High | 7.3 | 2025-06-27 | A buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 <=V15.03.05.19 via the page parameter. |
CVE-2025-46416 | Low | 2.9 | 2025-06-27 | The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld… |
CVE-2025-46415 | Low | 3.2 | 2025-06-27 | A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28… |
CVE-2025-45729 | Medium | 6.3 | 2025-06-27 | D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services. |
CVE-2025-44163 | Medium | 6.3 | 2025-06-27 | RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request wit… |
CVE-2025-36595 | High | 7.2 | 2025-06-27 | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vu… |
CVE-2025-6767 | Medium | 6.3 | 2025-06-27 | A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been rated as critical. This issue affects the function… |
CVE-2025-6766 | Medium | 6.3 | 2025-06-27 | A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been declared as critical. This vulnerability affects t… |
CVE-2025-53018 | Low | 3.0 | 2025-06-27 | Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v… |
CVE-2025-40910 | Medium | 6.5 | 2025-06-27 | Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access… |
CVE-2025-6765 | Medium | 6.3 | 2025-06-27 | A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/… |
CVE-2025-6763 | High | 8.1 | 2025-06-27 | A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown… |
CVE-2025-6762 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP H… |
CVE-2025-52834 | Critical | 9.3 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in favethemes Homey homey allows SQL Injection.This issue af… |
CVE-2025-52829 | Critical | 9.3 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DirectIQ DirectIQ Email Marketing directiq-wp allows SQL… |
CVE-2025-52827 | High | 8.8 | 2025-06-27 | Deserialization of Untrusted Data vulnerability in uxper Nuss nuss allows Object Injection.This issue affects Nuss: from n/a through <= 1.3.3. |
CVE-2025-52826 | High | 8.8 | 2025-06-27 | Deserialization of Untrusted Data vulnerability in uxper Sala allows Object Injection. This issue affects Sala: from n/a through 1.1.3. |
CVE-2025-52824 | High | 8.8 | 2025-06-27 | Missing Authorization vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-52818 | High | 8.2 | 2025-06-27 | Missing Authorization vulnerability in Dejan Jasnic Trusty Whistleblowing trusty-whistleblowing-solution allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-52817 | High | 8.2 | 2025-06-27 | Missing Authorization vulnerability in ZealousWeb Abandoned Contact Form 7 abandoned-contact-form-7 allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-52816 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehunk Zita zita allows PHP Local F… |
CVE-2025-52815 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes CityGov citygov allows PH… |
CVE-2025-52814 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme BRW ova-brw allows PHP Local… |
CVE-2025-52812 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Domnoo domnoo allows PHP Local… |
CVE-2025-52811 | High | 8.1 | 2025-06-27 | Path Traversal: '.../...//' vulnerability in Creanncy Davenport - Versatile Blog and Magazine WordPress Theme davenport allows PHP Local File Inclusion.This is… |
CVE-2025-52810 | High | 8.1 | 2025-06-27 | Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1. |
CVE-2025-52809 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Russell National Weather Service… |
CVE-2025-52808 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in real-web RealtyElite realtyelite allow… |
CVE-2025-52799 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes LMS lms allows Reflected XSS.This issue affe… |
CVE-2025-52778 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-dictionary xili-dictionary al… |
CVE-2025-52774 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected… |
CVE-2025-52729 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local Fil… |
CVE-2025-52727 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs CSS3 Vertical Web Pricing Tables css3_vertic… |
CVE-2025-52726 | High | 8.6 | 2025-06-27 | Incorrect Privilege Assignment vulnerability in pebas CouponXxL Custom Post Types couponxxl-cpt allows Privilege Escalation.This issue affects CouponXxL Custom… |
CVE-2025-52725 | Critical | 9.8 | 2025-06-27 | Deserialization of Untrusted Data vulnerability in pebas CouponXxL couponxxl allows Object Injection.This issue affects CouponXxL: from n/a through <= 3.0.0. |
CVE-2025-52724 | Critical | 9.8 | 2025-06-27 | Deserialization of Untrusted Data vulnerability in BoldThemes Amwerk amwerk allows Object Injection.This issue affects Amwerk: from n/a through <= 1.2.0. |
CVE-2025-52723 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codesupplyco Networker networker allow… |
CVE-2025-52722 | Critical | 9.3 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoinWebs Classiera classiera allows SQL Injection.This is… |
CVE-2025-52717 | Critical | 9.3 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS lifterlms allows SQL Injection.Thi… |
CVE-2025-50052 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexostudio Flexo Counter flexo-countdown allows Reflecte… |
CVE-2025-49886 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebGeniusLab Zikzag Core zikzag-core a… |
CVE-2025-49885 | Critical | 10.0 | 2025-06-27 | Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce drag-and-drop-file-upload-wc-… |
CVE-2025-49883 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Greenmart greenmart allows PHP… |
CVE-2025-49448 | High | 8.6 | 2025-06-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Food Menu allows Path Traversal. This issue aff… |
CVE-2025-49423 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Tahir Ali Jan Bulk YouTube Post Creator bulk-youtube… |
CVE-2025-49416 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fastw3b LLC FW Gallery fw-gallery allo… |
CVE-2025-49321 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Eventin wp-event-solution allows Reflected XSS… |
CVE-2025-49290 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off… |
CVE-2025-47654 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms formlift… |
CVE-2025-47574 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management allows Reflected XSS. This iss… |