2025 CVEs (page 276)
Page 276 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-52918 | Medium | 5.0 | 2025-06-21 | Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces. |
CVE-2025-52917 | Medium | 4.3 | 2025-06-21 | The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests. |
CVE-2025-52916 | Low | 2.2 | 2025-06-21 | Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits). |
CVE-2025-6421 | High | 7.3 | 2025-06-21 | A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been rated as critical. This issue affects some unknown processin… |
CVE-2025-6420 | High | 7.3 | 2025-06-21 | A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown cod… |
CVE-2025-1987 | Medium | 6.1 | 2025-06-21 | A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bi… |
CVE-2025-6419 | High | 7.3 | 2025-06-21 | A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2025-6418 | High | 7.3 | 2025-06-21 | A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functi… |
CVE-2025-6417 | Medium | 6.3 | 2025-06-21 | A vulnerability has been found in PHPGurukul Art Gallery Management System 1.1 and classified as critical. Affected by this vulnerability is an unknown functio… |
CVE-2025-6416 | Medium | 6.3 | 2025-06-21 | A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.1. Affected is an unknown function of the file /admi… |
CVE-2025-6415 | Medium | 6.3 | 2025-06-21 | A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.1. This issue affects some unknown processing o… |
CVE-2025-6414 | Medium | 6.3 | 2025-06-21 | A vulnerability classified as critical was found in PHPGurukul Art Gallery Management System 1.1. This vulnerability affects unknown code of the file /admin/ch… |
CVE-2025-6413 | Medium | 6.3 | 2025-06-21 | A vulnerability classified as critical has been found in PHPGurukul Art Gallery Management System 1.1. This affects an unknown part of the file /admin/changeim… |
CVE-2025-6412 | Medium | 6.3 | 2025-06-21 | A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2025-6411 | Medium | 6.3 | 2025-06-21 | A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been declared as critical. Affected by this vulnerability is an unknown funct… |
CVE-2025-6410 | Medium | 6.3 | 2025-06-21 | A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been classified as critical. Affected is an unknown function of the file /adm… |
CVE-2025-6409 | High | 7.3 | 2025-06-21 | A vulnerability was found in PHPGurukul Art Gallery Management System 1.1 and classified as critical. This issue affects some unknown processing of the file /a… |
CVE-2025-6408 | High | 7.3 | 2025-06-21 | A vulnerability has been found in Campcodes Online Hospital Management System 1.0 and classified as critical. This vulnerability affects unknown code of the fi… |
CVE-2025-6407 | High | 7.3 | 2025-06-21 | A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. This affects an unknown part of the file /user… |
CVE-2025-6406 | High | 7.3 | 2025-06-21 | A vulnerability, which was classified as critical, has been found in Campcodes Online Hospital Management System 1.0. Affected by this issue is some unknown fu… |
CVE-2025-6405 | High | 7.3 | 2025-06-21 | A vulnerability classified as critical was found in Campcodes Online Teacher Record Management System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2025-3629 | Medium | 4.3 | 2025-06-21 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an authenticated user to delete another user's comments due to improper ownership man… |
CVE-2025-3221 | High | 7.5 | 2025-06-21 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a remote attacker to cause a denial of service due to insufficient validation of incomi… |
CVE-2025-36016 | Medium | 6.8 | 2025-06-21 | IBM Process Mining 2.0.1 IF001 and 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to vi… |
CVE-2025-6404 | High | 7.3 | 2025-06-21 | A vulnerability classified as critical has been found in Campcodes Online Teacher Record Management System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-5289 | Medium | 6.4 | 2025-06-21 | The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ a… |
CVE-2025-6403 | High | 7.3 | 2025-06-21 | A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the fil… |
CVE-2025-6402 | High | 8.8 | 2025-06-21 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/f… |
CVE-2025-6401 | Low | 3.5 | 2025-06-21 | A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been classified as problematic. This affects an unknown part of the file /boafrm/formF… |
CVE-2025-5143 | Medium | 6.4 | 2025-06-21 | The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_popup_iframe_button s… |
CVE-2025-6400 | High | 8.8 | 2025-06-21 | A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101 and classified as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-5034 | High | 7.1 | 2025-06-21 | The wp-file-download WordPress plugin before 6.2.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2025-6399 | High | 8.8 | 2025-06-21 | A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105. Affected is an unknown function of the file /boafrm/formIPv6… |
CVE-2025-52552 | Medium | 6.1 | 2025-06-21 | FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable to open redirect and DOM-based XSS. Impr… |
CVE-2025-52488 | High | 8.6 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-52487 | High | 7.5 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 7.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-52486 | Medium | 6.1 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-52485 | Medium | 5.4 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-6394 | High | 7.3 | 2025-06-21 | A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an u… |
CVE-2025-52557 | | 2025-06-21 | Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hija… | |
CVE-2025-52556 | | 2025-06-21 | rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161. Prior to version 1.0.3, there is a flaw in the timestamp r… | |
CVE-2025-6393 | High | 8.8 | 2025-06-21 | A vulnerability was found in TOTOLINK A702R, A3002R, A3002RU and EX1200T 3.0.0-B20230809.1615/4.0.0-B20230531.1404/4.0.0-B20230721.1521/4.1.2cu.5232_B20210713… |
CVE-2025-6375 | Low | 3.3 | 2025-06-21 | A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/s… |
CVE-2025-6374 | High | 8.8 | 2025-06-21 | A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formSetACLFilter of the file /goform/formSetAC… |
CVE-2025-6218 | High | 7.8 | 2025-06-21 | RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected install… |
CVE-2025-6217 | Low | 2.5 | 2025-06-21 | PEAK-System Driver PCANFD_ADD_FILTERS Time-Of-Check Time-Of-Use Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sen… |
CVE-2025-6216 | Critical | 9.8 | 2025-06-21 | Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on aff… |
CVE-2025-5820 | High | 8.8 | 2025-06-21 | Sony XAV-AX8500 Bluetooth ERTM Channel Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on af… |
CVE-2025-5479 | High | 7.5 | 2025-06-21 | Sony XAV-AX8500 Bluetooth AVCTP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers t… |
CVE-2025-5478 | High | 8.8 | 2025-06-21 | Sony XAV-AX8500 Bluetooth SDP Protocol Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute ar… |
CVE-2025-5477 | High | 7.5 | 2025-06-21 | Sony XAV-AX8500 Bluetooth L2CAP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers t… |
CVE-2025-5476 | High | 8.8 | 2025-06-21 | Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication… |
CVE-2025-5475 | High | 7.5 | 2025-06-21 | Sony XAV-AX8500 Bluetooth Packet Handling Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute… |
CVE-2025-6373 | High | 8.8 | 2025-06-21 | A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWizard1 of the file /gofor… |
CVE-2025-6372 | High | 8.8 | 2025-06-20 | A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formSetWizard1 of the file /goform/formSetWi… |
CVE-2025-6371 | High | 8.8 | 2025-06-20 | A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetEnableWizard of the… |
CVE-2025-6370 | High | 8.8 | 2025-06-20 | A vulnerability classified as critical was found in D-Link DIR-619L 2.06B01. Affected by this vulnerability is the function formWlanGuestSetup of the file /gof… |
CVE-2025-6369 | High | 8.8 | 2025-06-20 | A vulnerability classified as critical has been found in D-Link DIR-619L 2.06B01. Affected is the function formdumpeasysetup of the file /goform/formdumpeasyse… |
CVE-2025-6368 | High | 8.8 | 2025-06-20 | A vulnerability was found in D-Link DIR-619L 2.06B01. It has been rated as critical. This issue affects the function formSetEmail of the file /goform/formSetEm… |
CVE-2025-6367 | High | 8.8 | 2025-06-20 | A vulnerability was found in D-Link DIR-619L 2.06B01. It has been declared as critical. This vulnerability affects unknown code of the file /goform/formSetDoma… |
CVE-2025-6365 | Medium | 5.7 | 2025-06-20 | A vulnerability was found in HobbesOSR Kitten up to c4f8b7c3158983d1020af432be1b417b28686736 and classified as critical. Affected by this issue is the function… |
CVE-2025-6364 | High | 7.3 | 2025-06-20 | A vulnerability has been found in code-projects Simple Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown funct… |
CVE-2025-6363 | High | 7.3 | 2025-06-20 | A vulnerability, which was classified as critical, was found in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-6362 | High | 7.3 | 2025-06-20 | A vulnerability, which was classified as critical, has been found in code-projects Simple Pizza Ordering System 1.0. This issue affects some unknown processing… |
CVE-2025-6361 | High | 7.3 | 2025-06-20 | A vulnerability classified as critical was found in code-projects Simple Pizza Ordering System 1.0. This vulnerability affects unknown code of the file /adds.p… |
CVE-2025-48945 | | 2025-06-20 | pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asynchronously. Prior t… | |
CVE-2025-6360 | High | 7.3 | 2025-06-20 | A vulnerability classified as critical has been found in code-projects Simple Pizza Ordering System 1.0. This affects an unknown part of the file /portal.php… |
CVE-2025-6359 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-34030 | | 2025-06-20 | An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-su… | |
CVE-2025-34029 | High | 8.8 | 2025-06-20 | An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSys… |
CVE-2025-34024 | High | 8.8 | 2025-06-20 | An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint impr… |
CVE-2025-34023 | | 2025-06-20 | A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user… | |
CVE-2025-34022 | | 2025-06-20 | A path traversal vulnerability exists in multiple models of Selea Targa IP OCR-ANPR cameras, including iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 T… | |
CVE-2025-34021 | | 2025-06-20 | A server-side request forgery (SSRF) vulnerability exists in multiple Selea Targa IP OCR-ANPR camera models, including iZero, Targa 512, Targa 504, Targa Sempl… | |
CVE-2025-25038 | Critical | 9.8 | 2025-06-20 | An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize us… |
CVE-2025-25037 | | 2025-06-20 | An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpo… | |
CVE-2025-25034 | | 2025-06-20 | A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP seria… | |
CVE-2025-6358 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-6357 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /p… |
CVE-2025-6356 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Simple Pizza Ordering System 1.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2025-5121 | High | 8.5 | 2025-06-20 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have al… |
CVE-2025-52484 | | 2025-06-20 | RISC Zero is a general computing platform based on zk-STARKs and the RISC-V microarchitecture. Due to a missing constraint in the rv32im circuit, any 3-registe… | |
CVE-2025-46158 | Medium | 6.2 | 2025-06-20 | An issue in redoxOS kernel before commit 5d41cd7c allows a local attacker to cause a denial of service via the `setitimer` syscall |
CVE-2025-2443 | High | 8.7 | 2025-06-20 | An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific con… |
CVE-2025-6355 | High | 7.3 | 2025-06-20 | A vulnerability has been found in SourceCodester Online Hotel Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2025-6354 | High | 7.3 | 2025-06-20 | A vulnerability, which was classified as critical, has been found in code-projects Online Shoe Store 1.0. Affected by this issue is some unknown functionality… |
CVE-2025-6353 | Low | 3.5 | 2025-06-20 | A vulnerability classified as problematic was found in code-projects Responsive Blog 1.0. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-49132 | Critical | 10.0 | 2025-06-20 | Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query p… |
CVE-2025-48059 | | 2025-06-20 | PowSyBl (Power System Blocks) is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criteria versions 6.3.0 to before 6.7.2 and c… | |
CVE-2025-44635 | Critical | 9.8 | 2025-06-20 | There are multiple unauthorized remote command execution vulnerabilities in the H3C ER2200G2, ERG2-450W, ERG2-1200W, ERG2-1350W, NR1200W series routers before… |
CVE-2025-6352 | Medium | 5.3 | 2025-06-20 | A vulnerability classified as problematic has been found in code-projects Automated Voting System 1.0. Affected is an unknown function of the file /vote.php of… |
CVE-2025-6351 | Medium | 6.3 | 2025-06-20 | A vulnerability was found in itsourcecode Employee Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-6347 | Low | 2.4 | 2025-06-20 | A vulnerability was found in code-projects Responsive Blog 1.0/1.12.4/3.3.4. It has been declared as problematic. This vulnerability affects unknown code of th… |
CVE-2025-6193 | Medium | 5.9 | 2025-06-20 | A command injection vulnerability was discovered in the TrustyAI Explainability toolkit. Arbitrary commands placed in certain fields of a LMEValJob custom reso… |
CVE-2025-5416 | Low | 2.7 | 2025-06-20 | A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /a… |
CVE-2025-45890 | Critical | 9.8 | 2025-06-20 | Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter |
CVE-2025-45331 | High | 7.5 | 2025-06-20 | brplot v420.69.1 contains a Null Pointer Dereference (NPD) vulnerability in the br_dagens_handle_once function of its data processing module, leading to unpred… |
CVE-2025-44203 | High | 7.5 | 2025-06-20 | In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation w… |
CVE-2025-6346 | Medium | 6.3 | 2025-06-20 | A vulnerability was found in SourceCodester Advance Charity Management System 1.0. It has been classified as critical. This affects an unknown part of the file… |
CVE-2025-6345 | Low | 3.5 | 2025-06-20 | A vulnerability was found in SourceCodester My Food Recipe 1.0 and classified as problematic. Affected by this issue is the function addRecipeModal of the file… |