2025 CVEs (page 273)
Page 273 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-36529 | High | 7.2 | 2025-06-27 | An OS command injection issue exists in multiple versions of TB-eye network recorders and AHD recorders. If this vulnerability is exploited, an arbitrary OS co… |
CVE-2025-6753 | Medium | 6.3 | 2025-06-27 | A vulnerability was found in huija bicycleSharingServer 1.0 and classified as critical. This issue affects the function selectAdminByNameLike of the file Admin… |
CVE-2025-6488 | Medium | 6.4 | 2025-06-27 | The isMobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ parameter in all versions up to, and including, 1.1.1 due to in… |
CVE-2025-45737 | Medium | 6.5 | 2025-06-27 | An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending crafted IOCTL commands to… |
CVE-2025-6752 | High | 8.8 | 2025-06-27 | A vulnerability has been found in Linksys WRT1900ACS, EA7200, EA7450 and EA7500 up to 20250619 and classified as critical. This vulnerability affects the funct… |
CVE-2025-6751 | High | 8.8 | 2025-06-27 | A vulnerability, which was classified as critical, was found in Linksys E8450 up to 1.2.00.360516. This affects the function set_device_language of the file po… |
CVE-2025-6750 | Low | 3.3 | 2025-06-27 | A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. Affected by this issue is the function H5O__mtime_new_encode of the file s… |
CVE-2025-47824 | Low | 2.0 | 2025-06-27 | Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code. |
CVE-2025-47823 | Low | 2.2 | 2025-06-27 | Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system. |
CVE-2025-47822 | Medium | 6.4 | 2025-06-27 | Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control. |
CVE-2025-47821 | Low | 2.2 | 2025-06-27 | Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system. |
CVE-2025-6749 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical was found in huija bicycleSharingServer up to 7b8a3ba48ad618604abd4797d2e7cf3b5ac7625a. Affected by this vulnerability i… |
CVE-2025-6748 | Low | 2.1 | 2025-06-27 | A vulnerability classified as problematic has been found in Bharti Airtel Thanks App 4.105.4 on Android. Affected is an unknown function of the file /Android/d… |
CVE-2025-47820 | Low | 2.0 | 2025-06-27 | Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code. |
CVE-2025-47819 | Medium | 6.4 | 2025-06-27 | Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control. |
CVE-2025-47818 | Low | 2.2 | 2025-06-27 | Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection. |
CVE-2025-6738 | Medium | 6.3 | 2025-06-27 | A vulnerability, which was classified as critical, has been found in huija bicycleSharingServer up to 7b8a3ba48ad618604abd4797d2e7cf3b5ac7625a. Affected by thi… |
CVE-2025-6736 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical was found in juzaweb CMS 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/theme/i… |
CVE-2025-6735 | Medium | 6.3 | 2025-06-27 | A vulnerability classified as critical has been found in juzaweb CMS 3.4.2. Affected is an unknown function of the file /admin-cp/imports of the component Impo… |
CVE-2025-6734 | High | 8.8 | 2025-06-26 | A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been rated as critical. This issue affects the function sub_484E40 of the file /goform/f… |
CVE-2025-6733 | High | 8.8 | 2025-06-26 | A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been declared as critical. This vulnerability affects the function sub_416928 of the fil… |
CVE-2025-3699 | Critical | 9.8 | 2025-06-26 | Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-50A all versions, GB-50… |
CVE-2025-6732 | High | 8.8 | 2025-06-26 | A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been classified as critical. This affects the function strcpy of the file /goform/setSys… |
CVE-2025-6731 | Medium | 6.3 | 2025-06-26 | A vulnerability was found in yzcheng90 X-SpringBoot up to 5.0 and classified as critical. Affected by this issue is the function uploadApk of the file /sys/oss… |
CVE-2025-5731 | Medium | 5.5 | 2025-06-26 | A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command… |
CVE-2025-52555 | Medium | 6.5 | 2025-06-26 | Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can… |
CVE-2025-5995 | | 2025-06-26 | Canon EOS Webcam Utility Pro for MAC OS version 2.3d (2.3.29) and earlier contains an improper directory permissions vulnerability. Exploitation of this vulner… | |
CVE-2025-53122 | | 2025-06-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenNMS Horizon and Meridian applications allows SQL Inje… | |
CVE-2025-49592 | Medium | 4.6 | 2025-06-26 | n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to… |
CVE-2025-53121 | | 2025-06-26 | Multiple stored XSS were found on different nodes with unsanitized parameters in OpenMNS Horizon 33.0.8 and versions earlier than 33.1.6 on multiple platforms… | |
CVE-2025-52904 | High | 8.0 | 2025-06-26 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions… |
CVE-2025-52903 | High | 8.0 | 2025-06-26 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions… |
CVE-2025-53013 | Medium | 5.2 | 2025-06-26 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to aut… |
CVE-2025-49603 | Critical | 9.1 | 2025-06-26 | Northern.tech Mender Server before 3.7.11 and 4.x before 4.0.1 has Incorrect Access Control. |
CVE-2025-52477 | High | 8.6 | 2025-06-26 | Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SS… |
CVE-2025-30131 | Critical | 9.8 | 2025-06-26 | An issue was discovered on IROAD Dashcam FX2 devices. An unauthenticated file upload endpoint can be leveraged to execute arbitrary commands by uploading a CGI… |
CVE-2025-6702 | Medium | 4.3 | 2025-06-26 | A vulnerability, which was classified as problematic, was found in linlinjava litemall 1.8.0. Affected is an unknown function of the file /wx/comment/post. The… |
CVE-2025-6701 | Low | 3.5 | 2025-06-26 | A vulnerability, which was classified as problematic, has been found in Xuxueli xxl-sso 1.1.0. This issue affects some unknown processing of the file /xxl-sso-… |
CVE-2025-6700 | Medium | 4.3 | 2025-06-26 | A vulnerability classified as problematic was found in Xuxueli xxl-sso 1.1.0. This vulnerability affects unknown code of the file /xxl-sso-server/login. The ma… |
CVE-2025-6699 | Low | 3.5 | 2025-06-26 | A vulnerability classified as problematic has been found in LabRedesCefetRJ WeGIA 3.4.0. This affects an unknown part of the file /html/funcionario/cadastro_fu… |
CVE-2025-51671 | Medium | 5.4 | 2025-06-26 | A SQL injection vulnerability was discovered in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability allows remote attackers to execute arbi… |
CVE-2025-50350 | Medium | 5.4 | 2025-06-26 | PHPGurukul Pre-School Enrollment System Project v1.0 is vulnerable to Directory Traversal in manage-classes.php. |
CVE-2025-44141 | Medium | 6.1 | 2025-06-26 | A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30. |
CVE-2025-36034 | Medium | 5.3 | 2025-06-26 | IBM InfoSphere DataStage Flow Designer in IBM InfoSphere Information Server 11.7 discloses sensitive user information in API requests in clear text that could… |
CVE-2025-34049 | | 2025-06-26 | An OS command injection vulnerability exists in the OptiLink ONT1GEW GPON router firmware version V2.1.11_X101 Build 1127.190306 and earlier. The router’s web… | |
CVE-2025-34048 | | 2025-06-26 | A path traversal vulnerability exists in the web management interface of D-Link DSL-2730U, DSL-2750U, and DSL-2750E ADSL routers with firmware versions IN_1.02… | |
CVE-2025-34047 | | 2025-06-26 | A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the unde… | |
CVE-2025-34046 | | 2025-06-26 | An unauthenticated file upload vulnerability exists in the Fanwei E-Office <= v9.4 web management interface. The vulnerability affects the /general/index/Uploa… | |
CVE-2025-34045 | High | 7.5 | 2025-06-26 | A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform development framework by Shenzhen Yuanmengyun Technology Co… |
CVE-2025-34044 | | 2025-06-26 | A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET reques… | |
CVE-2025-34043 | | 2025-06-26 | A remote command injection vulnerability exists in Vacron Network Video Recorder (NVR) devices v1.4 due to improper input sanitization in the board.cgi script… | |
CVE-2025-34042 | | 2025-06-26 | An authenticated command injection vulnerability exists in the Beward N100 IP Camera firmware version M2.1.6.04C014 via the ServerName and TimeZone parameters… | |
CVE-2025-6698 | Low | 3.5 | 2025-06-26 | A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /h… |
CVE-2025-6697 | Low | 3.5 | 2025-06-26 | A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-6696 | Low | 3.5 | 2025-06-26 | A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been classified as problematic. Affected is an unknown function of the file /html/atendido/Cad… |
CVE-2025-53007 | | 2025-06-26 | arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response Splitting vulnerability. The `sendHeader` f… | |
CVE-2025-53002 | High | 8.3 | 2025-06-26 | LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including… |
CVE-2025-52902 | High | 7.6 | 2025-06-26 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown… |
CVE-2025-52900 | Medium | 5.5 | 2025-06-26 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file acc… |
CVE-2025-52887 | High | 7.5 | 2025-06-26 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http headers fields are passed in, the library d… |
CVE-2025-51672 | High | 8.0 | 2025-06-26 | A time-based blind SQL injection vulnerability was identified in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability exists in the manage-c… |
CVE-2025-29331 | Critical | 9.8 | 2025-06-26 | An issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute arbitrary code via the management script x-ui passes the no check cert… |
CVE-2025-6710 | High | 7.5 | 2025-06-26 | MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recu… |
CVE-2025-6709 | High | 7.5 | 2025-06-26 | The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentic… |
CVE-2025-6707 | Medium | 4.2 | 2025-06-26 | Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This… |
CVE-2025-6706 | Medium | 5.0 | 2025-06-26 | An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have author… |
CVE-2025-6695 | Low | 3.5 | 2025-06-26 | A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This issue affects some unknown processing of the file /html/matPat/adi… |
CVE-2025-6694 | Low | 3.5 | 2025-06-26 | A vulnerability has been found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This vulnerability affects unknown code of the file /html/matPat/a… |
CVE-2025-6677 | Medium | 5.4 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs table allows Cross-Site Scripting (XSS)… |
CVE-2025-6676 | Medium | 5.4 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting (XS… |
CVE-2025-6675 | Medium | 4.8 | 2025-06-26 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affect… |
CVE-2025-6674 | Medium | 6.1 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting (XSS… |
CVE-2025-5682 | Medium | 4.3 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Sit… |
CVE-2025-52573 | Medium | 6.0 | 2025-06-26 | iOS Simulator MCP Server (ios-simulator-mcp) is a Model Context Protocol (MCP) server for interacting with iOS simulators. Versions prior to 1.3.3 are written… |
CVE-2025-49003 | Critical | 9.8 | 2025-06-26 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java… |
CVE-2025-48923 | Medium | 6.1 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issu… |
CVE-2025-48922 | Medium | 6.1 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This i… |
CVE-2025-48921 | High | 8.8 | 2025-06-26 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3… |
CVE-2025-6693 | High | 7.8 | 2025-06-26 | A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sys_device_open/sys_device_read/sys_device_con… |
CVE-2025-6562 | High | 8.8 | 2025-06-26 | Certain hybrid DVR models (HBF-09KD and HBF-16NK) from Hunt Electronic have an OS Command Injection vulnerability, allowing remote attackers with regular privi… |
CVE-2025-5966 | High | 8.1 | 2025-06-26 | Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report. |
CVE-2025-5366 | High | 8.1 | 2025-06-26 | Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report. |
CVE-2025-6561 | Critical | 9.8 | 2025-06-26 | Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remo… |
CVE-2025-3773 | Medium | 5.5 | 2025-06-26 | A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin local user to extract se… |
CVE-2025-3771 | High | 7.1 | 2025-06-26 | A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with… |
CVE-2025-3722 | Medium | 4.4 | 2025-06-26 | A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post… |
CVE-2025-6703 | Medium | 6.5 | 2025-06-26 | Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo: from 0.4.24 through 0.13.2. |
CVE-2025-6212 | High | 7.2 | 2025-06-26 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due… |
CVE-2025-5842 | Medium | 6.4 | 2025-06-26 | The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1… |
CVE-2025-5338 | Medium | 6.4 | 2025-06-26 | The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.7.102… |
CVE-2025-5459 | High | 8.8 | 2025-06-26 | A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It a… |
CVE-2025-5846 | Low | 2.7 | 2025-06-26 | An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed… |
CVE-2025-5315 | Medium | 4.3 | 2025-06-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowe… |
CVE-2025-48497 | Medium | 4.3 | 2025-06-26 | Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL while being logged in… |
CVE-2025-41404 | Medium | 4.3 | 2025-06-26 | Direct request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. If this vulnerability is exploited, non-public contents may be vi… |
CVE-2025-3279 | Medium | 6.5 | 2025-06-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowe… |
CVE-2025-37101 | High | 8.7 | 2025-06-26 | A potential security vulnerability has been identified in HPE OneView for VMware vCenter (OV4VC). This vulnerability could be exploited allowing an attacker wi… |
CVE-2025-2938 | Low | 3.1 | 2025-06-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowe… |
CVE-2025-1754 | Medium | 5.3 | 2025-06-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowe… |
CVE-2025-6624 | High | 7.2 | 2025-06-26 | Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Re… |