2025 CVEs (page 271)
Page 271 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-45851 | High | 7.5 | 2025-06-27 | An issue in Hikvision DS-2CD1321-I V5.7.21 build 230819 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST request to the endpoint… |
CVE-2025-39488 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sneeit MagOne magone allows Reflected XSS.This issue affe… |
CVE-2025-39478 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartiolabs Smart Notification allows Reflected XSS. This… |
CVE-2025-39474 | Critical | 9.3 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Amely amely allows SQL Injection.This issue aff… |
CVE-2025-32298 | High | 7.5 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case-Themes CTUsers ctuser allows PHP… |
CVE-2025-32281 | Medium | 4.3 | 2025-06-27 | Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite darkmysite allows Cross Site Request Forgery.This issue affects DarkMySite: from n/a t… |
CVE-2025-31428 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddhaThemes HYDRO hydro allows Reflected XSS.This issue… |
CVE-2025-31067 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Seven Stars allows Stored XSS. This issue affect… |
CVE-2025-30992 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Puca puca allows PHP Local Fil… |
CVE-2025-30972 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iamapinan Woocommerce Line Notify woo-line-notify allows… |
CVE-2025-28998 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in serpednet SERPed.net serped-net allows… |
CVE-2025-28993 | High | 8.6 | 2025-06-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in Jose Mortellaro Content No Cache content-no-cache allows Code Injection.This issue a… |
CVE-2025-28990 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme SNS Vicky snsvicky allows PHP… |
CVE-2025-28988 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aharonyan WP Front User Submit / Front Editor front-edito… |
CVE-2025-28970 | Critical | 9.8 | 2025-06-27 | Deserialization of Untrusted Data vulnerability in pep.vn WP Optimize By xTraffic wp-optimize-by-xtraffic allows Object Injection.This issue affects WP Optimiz… |
CVE-2025-28960 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in regibaer Evangelische Termine evangtermine allows Reflect… |
CVE-2025-28956 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphobby Backwp backwp allows Reflected XSS.This issue aff… |
CVE-2025-28947 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme MBStore - Digital WooCommerce… |
CVE-2025-28946 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme PrintXtore bw-printxtore allo… |
CVE-2025-27361 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thhake Photo Express for Google photo-express-for-google… |
CVE-2025-25173 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FasterThemes FastBook fastbook-responsive-appointment-boo… |
CVE-2025-25171 | High | 8.8 | 2025-06-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Convers Lab WP SmartPay smartpay allows Authentication Abuse.This issue affects WP Sm… |
CVE-2025-24774 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce w… |
CVE-2025-24769 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Zenny bw-zenny allows PHP Loc… |
CVE-2025-24765 | High | 7.7 | 2025-06-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RobMarsh Image Shadow image-shadow allows Path Traversal.This i… |
CVE-2025-24760 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Sofass sofass allows PHP Lo… |
CVE-2025-23973 | High | 7.1 | 2025-06-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dugudlabs SpecFit-Virtual Try On Woocommerce try-on-for-w… |
CVE-2025-23967 | Critical | 9.3 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpopal GG Bought Together for WooCommerce gg-bought-toget… |
CVE-2025-6761 | High | 7.3 | 2025-06-27 | A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function… |
CVE-2025-5398 | Medium | 6.4 | 2025-06-27 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating en… |
CVE-2025-2940 | High | 7.2 | 2025-06-27 | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via t… |
CVE-2025-6689 | Medium | 6.4 | 2025-06-27 | The FL3R Accessibility Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode in all version… |
CVE-2025-6688 | Critical | 9.8 | 2025-06-27 | The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a u… |
CVE-2025-6550 | Medium | 6.4 | 2025-06-27 | The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and in… |
CVE-2025-5940 | Medium | 6.4 | 2025-06-27 | The Osom Blocks – Custom Post Type listing block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versio… |
CVE-2025-5936 | Medium | 4.3 | 2025-06-27 | The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorre… |
CVE-2025-5306 | Critical | 9.8 | 2025-06-27 | Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778 |
CVE-2025-4587 | Medium | 6.4 | 2025-06-27 | The A/B Testing for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ab-testing-for-wp/ab-test-block' block in all… |
CVE-2025-5526 | Medium | 4.3 | 2025-06-27 | The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user |
CVE-2025-5194 | Medium | 4.8 | 2025-06-27 | The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the blo… |
CVE-2025-5093 | Medium | 5.4 | 2025-06-27 | The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting… |
CVE-2025-5035 | Medium | 5.4 | 2025-06-27 | The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users… |
CVE-2025-41418 | Medium | 5.3 | 2025-06-27 | Buffer Overflow vulnerability exists in multiple versions of TB-eye network recorders and AHD recorders. The CGI process may be terminated abnormally by proces… |
CVE-2025-36529 | High | 7.2 | 2025-06-27 | An OS command injection issue exists in multiple versions of TB-eye network recorders and AHD recorders. If this vulnerability is exploited, an arbitrary OS co… |
CVE-2025-6753 | Medium | 6.3 | 2025-06-27 | A vulnerability was found in huija bicycleSharingServer 1.0 and classified as critical. This issue affects the function selectAdminByNameLike of the file Admin… |
CVE-2025-6488 | Medium | 6.4 | 2025-06-27 | The isMobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ parameter in all versions up to, and including, 1.1.1 due to in… |
CVE-2025-45737 | Medium | 6.5 | 2025-06-27 | An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending crafted IOCTL commands to… |
CVE-2025-6752 | High | 8.8 | 2025-06-27 | A vulnerability has been found in Linksys WRT1900ACS, EA7200, EA7450 and EA7500 up to 20250619 and classified as critical. This vulnerability affects the funct… |
CVE-2025-6751 | High | 8.8 | 2025-06-27 | A vulnerability, which was classified as critical, was found in Linksys E8450 up to 1.2.00.360516. This affects the function set_device_language of the file po… |
CVE-2025-6750 | Low | 3.3 | 2025-06-27 | A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. Affected by this issue is the function H5O__mtime_new_encode of the file s… |
CVE-2025-47824 | Low | 2.0 | 2025-06-27 | Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code. |
CVE-2025-47823 | Low | 2.2 | 2025-06-27 | Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system. |
CVE-2025-47822 | Medium | 6.4 | 2025-06-27 | Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control. |
CVE-2025-47821 | Low | 2.2 | 2025-06-27 | Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system. |
CVE-2025-6749 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical was found in huija bicycleSharingServer up to 7b8a3ba48ad618604abd4797d2e7cf3b5ac7625a. Affected by this vulnerability i… |
CVE-2025-6748 | Low | 2.1 | 2025-06-27 | A vulnerability classified as problematic has been found in Bharti Airtel Thanks App 4.105.4 on Android. Affected is an unknown function of the file /Android/d… |
CVE-2025-47820 | Low | 2.0 | 2025-06-27 | Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code. |
CVE-2025-47819 | Medium | 6.4 | 2025-06-27 | Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control. |
CVE-2025-47818 | Low | 2.2 | 2025-06-27 | Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection. |
CVE-2025-6738 | Medium | 6.3 | 2025-06-27 | A vulnerability, which was classified as critical, has been found in huija bicycleSharingServer up to 7b8a3ba48ad618604abd4797d2e7cf3b5ac7625a. Affected by thi… |
CVE-2025-6736 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical was found in juzaweb CMS 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/theme/i… |
CVE-2025-6735 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical has been found in juzaweb CMS 3.4.2. Affected is an unknown function of the file /admin-cp/imports of the component Impo… |
CVE-2025-6734 | High | 8.8 | 2025-06-26 | A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been rated as critical. This issue affects the function sub_484E40 of the file /goform/f… |
CVE-2025-6733 | High | 8.8 | 2025-06-26 | A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been declared as critical. This vulnerability affects the function sub_416928 of the fil… |
CVE-2025-3699 | Critical | 9.8 | 2025-06-26 | Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-50A all versions, GB-50… |
CVE-2025-6732 | High | 8.8 | 2025-06-26 | A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been classified as critical. This affects the function strcpy of the file /goform/setSys… |
CVE-2025-6731 | Medium | 6.3 | 2025-06-26 | A vulnerability was found in yzcheng90 X-SpringBoot up to 5.0 and classified as critical. Affected by this issue is the function uploadApk of the file /sys/oss… |
CVE-2025-5731 | Medium | 5.5 | 2025-06-26 | A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command… |
CVE-2025-52555 | Medium | 6.5 | 2025-06-26 | Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can… |
CVE-2025-5995 | | 2025-06-26 | Canon EOS Webcam Utility Pro for MAC OS version 2.3d (2.3.29) and earlier contains an improper directory permissions vulnerability. Exploitation of this vulner… | |
CVE-2025-53122 | | 2025-06-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenNMS Horizon and Meridian applications allows SQL Inje… | |
CVE-2025-49592 | Medium | 4.6 | 2025-06-26 | n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to… |
CVE-2025-53121 | | 2025-06-26 | Multiple stored XSS were found on different nodes with unsanitized parameters in OpenMNS Horizon 33.0.8 and versions earlier than 33.1.6 on multiple platforms… | |
CVE-2025-52904 | High | 8.0 | 2025-06-26 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions… |
CVE-2025-52903 | High | 8.0 | 2025-06-26 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions… |
CVE-2025-53013 | Medium | 5.2 | 2025-06-26 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to aut… |
CVE-2025-49603 | Critical | 9.1 | 2025-06-26 | Northern.tech Mender Server before 3.7.11 and 4.x before 4.0.1 has Incorrect Access Control. |
CVE-2025-52477 | High | 8.6 | 2025-06-26 | Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SS… |
CVE-2025-30131 | Critical | 9.8 | 2025-06-26 | An issue was discovered on IROAD Dashcam FX2 devices. An unauthenticated file upload endpoint can be leveraged to execute arbitrary commands by uploading a CGI… |
CVE-2025-6702 | Medium | 4.3 | 2025-06-26 | A vulnerability, which was classified as problematic, was found in linlinjava litemall 1.8.0. Affected is an unknown function of the file /wx/comment/post. The… |
CVE-2025-6701 | Low | 3.5 | 2025-06-26 | A vulnerability, which was classified as problematic, has been found in Xuxueli xxl-sso 1.1.0. This issue affects some unknown processing of the file /xxl-sso-… |
CVE-2025-6700 | Medium | 4.3 | 2025-06-26 | A vulnerability classified as problematic was found in Xuxueli xxl-sso 1.1.0. This vulnerability affects unknown code of the file /xxl-sso-server/login. The ma… |
CVE-2025-6699 | Low | 3.5 | 2025-06-26 | A vulnerability classified as problematic has been found in LabRedesCefetRJ WeGIA 3.4.0. This affects an unknown part of the file /html/funcionario/cadastro_fu… |
CVE-2025-51671 | Medium | 5.4 | 2025-06-26 | A SQL injection vulnerability was discovered in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability allows remote attackers to execute arbi… |
CVE-2025-50350 | Medium | 5.4 | 2025-06-26 | PHPGurukul Pre-School Enrollment System Project v1.0 is vulnerable to Directory Traversal in manage-classes.php. |
CVE-2025-44141 | Medium | 6.1 | 2025-06-26 | A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30. |
CVE-2025-36034 | Medium | 5.3 | 2025-06-26 | IBM InfoSphere DataStage Flow Designer in IBM InfoSphere Information Server 11.7 discloses sensitive user information in API requests in clear text that could… |
CVE-2025-34049 | | 2025-06-26 | An OS command injection vulnerability exists in the OptiLink ONT1GEW GPON router firmware version V2.1.11_X101 Build 1127.190306 and earlier. The router’s web… | |
CVE-2025-34048 | | 2025-06-26 | A path traversal vulnerability exists in the web management interface of D-Link DSL-2730U, DSL-2750U, and DSL-2750E ADSL routers with firmware versions IN_1.02… | |
CVE-2025-34047 | | 2025-06-26 | A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the unde… | |
CVE-2025-34046 | | 2025-06-26 | An unauthenticated file upload vulnerability exists in the Fanwei E-Office <= v9.4 web management interface. The vulnerability affects the /general/index/Uploa… | |
CVE-2025-34045 | High | 7.5 | 2025-06-26 | A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform development framework by Shenzhen Yuanmengyun Technology Co… |
CVE-2025-34044 | | 2025-06-26 | A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET reques… | |
CVE-2025-34043 | | 2025-06-26 | A remote command injection vulnerability exists in Vacron Network Video Recorder (NVR) devices v1.4 due to improper input sanitization in the board.cgi script… | |
CVE-2025-34042 | | 2025-06-26 | An authenticated command injection vulnerability exists in the Beward N100 IP Camera firmware version M2.1.6.04C014 via the ServerName and TimeZone parameters… | |
CVE-2025-6698 | Low | 3.5 | 2025-06-26 | A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /h… |
CVE-2025-6697 | Low | 3.5 | 2025-06-26 | A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-6696 | Low | 3.5 | 2025-06-26 | A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been classified as problematic. Affected is an unknown function of the file /html/atendido/Cad… |
CVE-2025-53007 | | 2025-06-26 | arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response Splitting vulnerability. The `sendHeader` f… | |
CVE-2025-53002 | High | 8.3 | 2025-06-26 | LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including… |