2025 CVEs (page 274)
Page 274 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6546 | Medium | 6.4 | 2025-06-26 | The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and includ… |
CVE-2025-6540 | Medium | 6.4 | 2025-06-26 | The web-cam plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 3.0 due to insuffi… |
CVE-2025-6537 | Medium | 6.4 | 2025-06-26 | The Namasha By Mdesign plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘playicon_title’ parameter in all versions up to, and includin… |
CVE-2025-5932 | Medium | 4.3 | 2025-06-26 | The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.30. This is due to missing or incorre… |
CVE-2025-5929 | Medium | 6.4 | 2025-06-26 | The The Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘clientId’ parameter in all versions up to, and including, 2.0.1 du… |
CVE-2025-5813 | Medium | 5.3 | 2025-06-26 | The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcta2w_get_… |
CVE-2025-5275 | Medium | 4.4 | 2025-06-26 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-6538 | Medium | 6.4 | 2025-06-26 | The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1… |
CVE-2025-6383 | Medium | 6.4 | 2025-06-26 | The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, and including, 1.2… |
CVE-2025-6378 | Medium | 6.4 | 2025-06-26 | The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shortcode in all versio… |
CVE-2025-6290 | Medium | 6.4 | 2025-06-26 | The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to… |
CVE-2025-6258 | Medium | 6.4 | 2025-06-26 | The WP SoundSystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode in all versions up to, and includi… |
CVE-2025-5812 | Medium | 4.3 | 2025-06-26 | The VG WORT METIS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gutenberg_save_post() functi… |
CVE-2025-5590 | High | 8.8 | 2025-06-26 | The Owl carousel responsive plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.9 due… |
CVE-2025-5588 | Medium | 6.4 | 2025-06-26 | The Image Editor by Pixo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘download’ parameter in all versions up to, and including, 2… |
CVE-2025-5564 | Medium | 6.4 | 2025-06-26 | The GC Social Wall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gc_social_wall' shortcode in all versions up to, and inc… |
CVE-2025-5559 | Medium | 6.4 | 2025-06-26 | The TimeZoneCalculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'timezonecalculator_output' shortcode in all versions… |
CVE-2025-5540 | Medium | 6.4 | 2025-06-26 | The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in… |
CVE-2025-5535 | Medium | 6.4 | 2025-06-26 | The e.nigma buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including… |
CVE-2025-5488 | Medium | 6.4 | 2025-06-26 | The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all versions up to, and… |
CVE-2025-4334 | Critical | 9.8 | 2025-06-26 | The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient… |
CVE-2025-3863 | Medium | 4.3 | 2025-06-26 | The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_pro… |
CVE-2025-6669 | Low | 3.7 | 2025-06-25 | A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file middlewar… |
CVE-2025-6668 | High | 7.3 | 2025-06-25 | A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /php_a… |
CVE-2025-6667 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in code-projects Car Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-6662 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6661 | High | 7.8 | 2025-06-25 | PDF-XChange Editor App Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec… |
CVE-2025-6660 | High | 7.8 | 2025-06-25 | PDF-XChange Editor GIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit… |
CVE-2025-6659 | High | 7.8 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-6658 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6657 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6656 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6655 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6654 | High | 7.8 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-6653 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6652 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6651 | High | 7.8 | 2025-06-25 | PDF-XChange Editor JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-6650 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6649 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6648 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6647 | High | 7.8 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-6646 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive infor… |
CVE-2025-6645 | High | 7.8 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2025-6644 | High | 7.8 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2025-6643 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6642 | High | 7.8 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2025-6641 | Low | 3.3 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-6640 | High | 7.8 | 2025-06-25 | PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2025-6443 | High | 7.2 | 2025-06-25 | Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected i… |
CVE-2025-6665 | High | 7.3 | 2025-06-25 | A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2025-6664 | Medium | 4.3 | 2025-06-25 | A vulnerability, which was classified as problematic, was found in CodeAstro Patient Record Management System 1.0. Affected is an unknown function. The manipul… |
CVE-2025-36038 | Critical | 9.0 | 2025-06-25 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of seriali… |
CVE-2025-45333 | High | 7.5 | 2025-06-25 | berkeley-abc abc 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the Abc_NtkCecFraigPart function of its data processing module, leading to unpr… |
CVE-2025-6627 | High | 8.8 | 2025-06-25 | A vulnerability has been found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. This vulnerability affects unknown code of the file /boafrm/f… |
CVE-2025-6678 | High | 7.5 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose… |
CVE-2025-6621 | Medium | 6.3 | 2025-06-25 | A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c.884. This affects the function QuickSetting of the file ap.so. The manipulatio… |
CVE-2025-6620 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been rated as critical. Affected by this issue is the function setUpgradeUboot of the file upg… |
CVE-2025-6619 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. Affected by this vulnerability is the function setUpgradeFW of the… |
CVE-2025-6618 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been classified as critical. Affected is the function SetWLanApcliSettings of the file wps.so… |
CVE-2025-6445 | High | 8.1 | 2025-06-25 | ServiceStack FindType Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2025-6444 | Medium | 5.9 | 2025-06-25 | ServiceStack GetErrorResponse Improper Input Validation NTLM Relay Vulnerability. This vulnerability allows remote attackers to relay NTLM credentials on affec… |
CVE-2025-5834 | High | 7.8 | 2025-06-25 | Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to bypass… |
CVE-2025-5833 | Medium | 6.8 | 2025-06-25 | Pioneer DMH-WT7600NEX Root Filesystem Insufficient Verification of Data Authenticity Vulnerability. This vulnerability allows physically present attackers to b… |
CVE-2025-5832 | Medium | 6.8 | 2025-06-25 | Pioneer DMH-WT7600NEX Software Update Signing Insufficient Verification of Data Authenticity Vulnerability. This vulnerability allows physically present attack… |
CVE-2025-5830 | High | 8.8 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adj… |
CVE-2025-5829 | Medium | 6.8 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically presen… |
CVE-2025-5828 | Medium | 6.8 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to… |
CVE-2025-5827 | High | 8.8 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows networ… |
CVE-2025-5826 | Medium | 6.3 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2025-5825 | High | 7.5 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute… |
CVE-2025-5824 | High | 7.5 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to by… |
CVE-2025-5823 | Medium | 6.5 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers… |
CVE-2025-5822 | High | 8.8 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers t… |
CVE-2025-49550 | Medium | 4.3 | 2025-06-25 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result… |
CVE-2025-49549 | Low | 2.7 | 2025-06-25 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result… |
CVE-2025-45332 | High | 7.5 | 2025-06-25 | vkoskiv c-ray 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the parse_mtllib function of its data processing module, leading to unpredictable… |
CVE-2025-6617 | High | 8.8 | 2025-06-25 | A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formAdvanceSetup of the file /goform/formAdvan… |
CVE-2025-6616 | High | 8.8 | 2025-06-25 | A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWAN_Wizard51 of the file /… |
CVE-2025-6442 | Medium | 5.9 | 2025-06-25 | Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected instal… |
CVE-2025-5015 | High | 8.8 | 2025-06-25 | A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a mal… |
CVE-2025-52999 | | 2025-06-25 | jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, i… | |
CVE-2025-52894 | High | 7.5 | 2025-06-25 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0… |
CVE-2025-52893 | Medium | 4.5 | 2025-06-25 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0… |
CVE-2025-52890 | High | 8.1 | 2025-06-25 | Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables ru… |
CVE-2025-52889 | Low | 3.4 | 2025-06-25 | Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables ru… |
CVE-2025-52576 | Medium | 5.3 | 2025-06-25 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP… |
CVE-2025-52569 | | 2025-06-25 | GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided value… | |
CVE-2025-52483 | Critical | 9.8 | 2025-06-25 | Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the cl… |
CVE-2025-52480 | Critical | 9.8 | 2025-06-25 | Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the cl… |
CVE-2025-4656 | Low | 3.1 | 2025-06-25 | Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. Th… |
CVE-2025-49153 | | 2025-06-25 | The affected products could allow an unauthenticated attacker to overwrite files and execute arbitrary code. | |
CVE-2025-49152 | | 2025-06-25 | The affected products contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system. | |
CVE-2025-49151 | | 2025-06-25 | The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens (JWT) to bypass authentication. | |
CVE-2025-20282 | Critical | 10.0 | 2025-06-25 | A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected devi… |
CVE-2025-6615 | High | 8.8 | 2025-06-25 | A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formAutoDetecWAN_wizard4 of the file /goform… |
CVE-2025-6614 | High | 8.8 | 2025-06-25 | A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetWANType_Wizard5 of… |
CVE-2025-6612 | High | 7.3 | 2025-06-25 | A vulnerability was found in code-projects Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fi… |
CVE-2025-6611 | High | 7.3 | 2025-06-25 | A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fi… |
CVE-2025-52479 | | 2025-06-25 | HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers (URIs). URIs.jl prior to versio… | |
CVE-2025-50179 | Medium | 4.6 | 2025-06-25 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerabili… |