2025 CVEs (page 272)
Page 272 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-52902 | High | 7.6 | 2025-06-26 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown… |
CVE-2025-52900 | Medium | 5.5 | 2025-06-26 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file acc… |
CVE-2025-52887 | High | 7.5 | 2025-06-26 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http headers fields are passed in, the library d… |
CVE-2025-51672 | High | 8.0 | 2025-06-26 | A time-based blind SQL injection vulnerability was identified in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability exists in the manage-c… |
CVE-2025-29331 | Critical | 9.8 | 2025-06-26 | An issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute arbitrary code via the management script x-ui passes the no check cert… |
CVE-2025-6710 | High | 7.5 | 2025-06-26 | MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recu… |
CVE-2025-6709 | High | 7.5 | 2025-06-26 | The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentic… |
CVE-2025-6707 | Medium | 4.2 | 2025-06-26 | Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This… |
CVE-2025-6706 | Medium | 5.0 | 2025-06-26 | An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have author… |
CVE-2025-6695 | Low | 3.5 | 2025-06-26 | A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This issue affects some unknown processing of the file /html/matPat/adi… |
CVE-2025-6694 | Low | 3.5 | 2025-06-26 | A vulnerability has been found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This vulnerability affects unknown code of the file /html/matPat/a… |
CVE-2025-6677 | Medium | 5.4 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs table allows Cross-Site Scripting (XSS)… |
CVE-2025-6676 | Medium | 5.4 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting (XS… |
CVE-2025-6675 | Medium | 4.8 | 2025-06-26 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affect… |
CVE-2025-6674 | Medium | 6.1 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting (XSS… |
CVE-2025-5682 | Medium | 4.3 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Sit… |
CVE-2025-52573 | Medium | 6.0 | 2025-06-26 | iOS Simulator MCP Server (ios-simulator-mcp) is a Model Context Protocol (MCP) server for interacting with iOS simulators. Versions prior to 1.3.3 are written… |
CVE-2025-49003 | Critical | 9.8 | 2025-06-26 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java… |
CVE-2025-48923 | Medium | 6.1 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issu… |
CVE-2025-48922 | Medium | 6.1 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This i… |
CVE-2025-48921 | High | 8.8 | 2025-06-26 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3… |
CVE-2025-6693 | High | 7.8 | 2025-06-26 | A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sys_device_open/sys_device_read/sys_device_con… |
CVE-2025-6562 | High | 8.8 | 2025-06-26 | Certain hybrid DVR models (HBF-09KD and HBF-16NK) from Hunt Electronic have an OS Command Injection vulnerability, allowing remote attackers with regular privi… |
CVE-2025-5966 | High | 8.1 | 2025-06-26 | Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report. |
CVE-2025-5366 | High | 8.1 | 2025-06-26 | Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report. |
CVE-2025-6561 | Critical | 9.8 | 2025-06-26 | Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remo… |
CVE-2025-3773 | Medium | 5.5 | 2025-06-26 | A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin local user to extract se… |
CVE-2025-3771 | High | 7.1 | 2025-06-26 | A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with… |
CVE-2025-3722 | Medium | 4.4 | 2025-06-26 | A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post… |
CVE-2025-6703 | Medium | 6.5 | 2025-06-26 | Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo: from 0.4.24 through 0.13.2. |
CVE-2025-6212 | High | 7.2 | 2025-06-26 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due… |
CVE-2025-5842 | Medium | 6.4 | 2025-06-26 | The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1… |
CVE-2025-5338 | Medium | 6.4 | 2025-06-26 | The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.7.102… |
CVE-2025-5459 | High | 8.8 | 2025-06-26 | A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It a… |
CVE-2025-5846 | Low | 2.7 | 2025-06-26 | An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed… |
CVE-2025-5315 | Medium | 4.3 | 2025-06-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowe… |
CVE-2025-48497 | Medium | 4.3 | 2025-06-26 | Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL while being logged in… |
CVE-2025-41404 | Medium | 4.3 | 2025-06-26 | Direct request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. If this vulnerability is exploited, non-public contents may be vi… |
CVE-2025-3279 | Medium | 6.5 | 2025-06-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowe… |
CVE-2025-37101 | High | 8.7 | 2025-06-26 | A potential security vulnerability has been identified in HPE OneView for VMware vCenter (OV4VC). This vulnerability could be exploited allowing an attacker wi… |
CVE-2025-2938 | Low | 3.1 | 2025-06-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowe… |
CVE-2025-1754 | Medium | 5.3 | 2025-06-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowe… |
CVE-2025-6624 | High | 7.2 | 2025-06-26 | Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Re… |
CVE-2025-6546 | Medium | 6.4 | 2025-06-26 | The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and includ… |
CVE-2025-6540 | Medium | 6.4 | 2025-06-26 | The web-cam plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 3.0 due to insuffi… |
CVE-2025-6537 | Medium | 6.4 | 2025-06-26 | The Namasha By Mdesign plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘playicon_title’ parameter in all versions up to, and includin… |
CVE-2025-5932 | Medium | 4.3 | 2025-06-26 | The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.30. This is due to missing or incorre… |
CVE-2025-5929 | Medium | 6.4 | 2025-06-26 | The The Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘clientId’ parameter in all versions up to, and including, 2.0.1 du… |
CVE-2025-5813 | Medium | 5.3 | 2025-06-26 | The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcta2w_get_… |
CVE-2025-5275 | Medium | 4.4 | 2025-06-26 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-6538 | Medium | 6.4 | 2025-06-26 | The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1… |
CVE-2025-6383 | Medium | 6.4 | 2025-06-26 | The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, and including, 1.2… |
CVE-2025-6378 | Medium | 6.4 | 2025-06-26 | The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shortcode in all versio… |
CVE-2025-6290 | Medium | 6.4 | 2025-06-26 | The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to… |
CVE-2025-6258 | Medium | 6.4 | 2025-06-26 | The WP SoundSystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode in all versions up to, and includi… |
CVE-2025-5812 | Medium | 4.3 | 2025-06-26 | The VG WORT METIS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gutenberg_save_post() functi… |
CVE-2025-5590 | High | 8.8 | 2025-06-26 | The Owl carousel responsive plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.9 due… |
CVE-2025-5588 | Medium | 6.4 | 2025-06-26 | The Image Editor by Pixo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘download’ parameter in all versions up to, and including, 2… |
CVE-2025-5564 | Medium | 6.4 | 2025-06-26 | The GC Social Wall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gc_social_wall' shortcode in all versions up to, and inc… |
CVE-2025-5559 | Medium | 6.4 | 2025-06-26 | The TimeZoneCalculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'timezonecalculator_output' shortcode in all versions… |
CVE-2025-5540 | Medium | 6.4 | 2025-06-26 | The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in… |
CVE-2025-5535 | Medium | 6.4 | 2025-06-26 | The e.nigma buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including… |
CVE-2025-5488 | Medium | 6.4 | 2025-06-26 | The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all versions up to, and… |
CVE-2025-4334 | Critical | 9.8 | 2025-06-26 | The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient… |
CVE-2025-3863 | Medium | 4.3 | 2025-06-26 | The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_pro… |
CVE-2025-6669 | Low | 3.7 | 2025-06-25 | A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file middlewar… |
CVE-2025-6668 | High | 7.3 | 2025-06-25 | A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /php_a… |
CVE-2025-6667 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in code-projects Car Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-6662 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6661 | High | 7.8 | 2025-06-25 | PDF-XChange Editor App Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec… |
CVE-2025-6660 | High | 7.8 | 2025-06-25 | PDF-XChange Editor GIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit… |
CVE-2025-6659 | High | 7.8 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-6658 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6657 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6656 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6655 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6654 | High | 7.8 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-6653 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6652 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6651 | High | 7.8 | 2025-06-25 | PDF-XChange Editor JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-6650 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6649 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6648 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6647 | High | 7.8 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-6646 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive infor… |
CVE-2025-6645 | High | 7.8 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2025-6644 | High | 7.8 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2025-6643 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6642 | High | 7.8 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2025-6641 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6640 | High | 7.8 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2025-6443 | High | 7.2 | 2025-06-25 | Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected i… |
CVE-2025-6665 | High | 7.3 | 2025-06-25 | A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2025-6664 | Medium | 4.3 | 2025-06-25 | A vulnerability, which was classified as problematic, was found in CodeAstro Patient Record Management System 1.0. Affected is an unknown function. The manipul… |
CVE-2025-36038 | Critical | 9.0 | 2025-06-25 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of seriali… |
CVE-2025-45333 | High | 7.5 | 2025-06-25 | berkeley-abc abc 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the Abc_NtkCecFraigPart function of its data processing module, leading to unpr… |
CVE-2025-6627 | High | 8.8 | 2025-06-25 | A vulnerability has been found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. This vulnerability affects unknown code of the file /boafrm/f… |
CVE-2025-6678 | High | 7.5 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose… |
CVE-2025-6621 | Medium | 6.3 | 2025-06-25 | A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c.884. This affects the function QuickSetting of the file ap.so. The manipulatio… |
CVE-2025-6620 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been rated as critical. Affected by this issue is the function setUpgradeUboot of the file upg… |