2025 CVEs (page 279)
Page 279 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-50017 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt WP Voting Contest wp-voting-contest allows Stored XS… |
CVE-2025-50016 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XS… |
CVE-2025-50015 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rodrigo Bastos Hand Talk handtalk allows Stored XSS.This… |
CVE-2025-50014 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iamapinan PDPA Consent for Thailand pdpa-consent allows S… |
CVE-2025-50013 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Judge CSV Importer Improved csv-importer-improved a… |
CVE-2025-50012 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fridaysystems Inventory Presser inventory-presser allows… |
CVE-2025-50011 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Félix Martínez Recipes manager - WPH allows Stored XSS. T… |
CVE-2025-50010 | Medium | 5.4 | 2025-06-20 | Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-50009 | Medium | 5.4 | 2025-06-20 | Missing Authorization vulnerability in Climax Themes Kata Plus kata-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-50008 | Medium | 5.4 | 2025-06-20 | Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-mana… |
CVE-2025-49998 | Medium | 5.4 | 2025-06-20 | Missing Authorization vulnerability in Wetail WooCommerce Fortnox Integration woocommerce-fortnox-integration allows Exploiting Incorrectly Configured Access C… |
CVE-2025-49997 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by… |
CVE-2025-49996 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Accessing Functionality Not Properly Constra… |
CVE-2025-49995 | Medium | 5.3 | 2025-06-20 | Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured A… |
CVE-2025-49993 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in csarturas Cookie-Script.com cookie-script-com allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-49991 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in tggfref WP-Recall allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-Recall: from n/… |
CVE-2025-49990 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2025-49989 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in App Cheap App Builder app-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-49988 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configur… |
CVE-2025-49987 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in WPFactory CRM ERP Business Solution crm-erp-business-solution allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-49986 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in thanhtungtnt Video List Manager video-list-manager allows Accessing Functionality Not Properly Constrained by ACLs.This… |
CVE-2025-49985 | Medium | 4.9 | 2025-06-20 | Server-Side Request Forgery (SSRF) vulnerability in Ali Irani Auto Upload Images auto-upload-images allows Server Side Request Forgery.This issue affects Auto… |
CVE-2025-49984 | Medium | 4.9 | 2025-06-20 | Server-Side Request Forgery (SSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress P… |
CVE-2025-49983 | Medium | 4.9 | 2025-06-20 | Server-Side Request Forgery (SSRF) vulnerability in Joe Hoyle WPThumb wp-thumb allows Server Side Request Forgery.This issue affects WPThumb: from n/a through… |
CVE-2025-49982 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-49981 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-49980 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-49979 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-49978 | Medium | 4.3 | 2025-06-20 | Authorization Bypass Through User-Controlled Key vulnerability in eyecix JobSearch wp-jobsearch allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-49977 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects… |
CVE-2025-49976 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-49975 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2… |
CVE-2025-49974 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Acc… |
CVE-2025-49973 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploi… |
CVE-2025-49972 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in David Wood TM Replace Howdy tm-replace-howdy allows Cross Site Request Forgery.This issue affects TM Replace… |
CVE-2025-49971 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-49970 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog hello-fse-blog allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-49969 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in Zara 4 Zara 4 Image Compression zara-4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-49968 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Oganro XML Travel Portal Widget oganro-reservation-widget allows Cross Site Request Forgery.This issue affec… |
CVE-2025-49967 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in marcusjansen Live Sports Streamthunder live-sports-streamthunder allows Cross Site Request Forgery.This issu… |
CVE-2025-49966 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-h… |
CVE-2025-49965 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Oganro PixelBeds Channel Manager and Hotel Booking Engine pixelbeds-channel-manager-booking-engine allows Cr… |
CVE-2025-49964 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in indgeek ClipLink cliplink allows Cross Site Request Forgery.This issue affects ClipLink: from n/a through <=… |
CVE-2025-49873 | High | 7.1 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Elessi elessi-theme allows Reflected XSS.This i… |
CVE-2025-46179 | Critical | 9.8 | 2025-06-20 | A SQL Injection vulnerability was discovered in the askquery.php file of CloudClassroom-PHP Project v1.0. The squeryx parameter accepts unsanitized input, whic… |
CVE-2025-3319 | High | 8.1 | 2025-06-20 | IBM Spectrum Protect Server 8.1 through 8.1.26 could allow attacker to bypass authentication due to improper session authentication which can result in access… |
CVE-2025-3228 | Medium | 4.3 | 2025-06-20 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from play… |
CVE-2025-3227 | Medium | 4.3 | 2025-06-20 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member managemen… |
CVE-2025-6344 | High | 7.3 | 2025-06-20 | A vulnerability has been found in code-projects Online Shoe Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-6343 | High | 7.3 | 2025-06-20 | A vulnerability, which was classified as critical, was found in code-projects Online Shoe Store 1.0. Affected is an unknown function of the file /admin/admin_p… |
CVE-2025-6342 | High | 7.3 | 2025-06-20 | A vulnerability, which was classified as critical, has been found in code-projects Online Shoe Store 1.0. This issue affects some unknown processing of the fil… |
CVE-2025-48706 | Critical | 9.1 | 2025-06-20 | An issue was discovered in COROS PACE 3 through 3.0808.0. Due to an out-of-bounds read vulnerability, sending a crafted BLE message forces the device to reboot. |
CVE-2025-48705 | High | 7.5 | 2025-06-20 | An issue was discovered in COROS PACE 3 through 3.0808.0. Due to a NULL pointer dereference vulnerability, sending a crafted BLE message forces the device to r… |
CVE-2025-32880 | Critical | 9.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 d… |
CVE-2025-32879 | High | 8.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to con… |
CVE-2025-32878 | Critical | 9.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. This function is mainly for download… |
CVE-2025-32877 | Critical | 9.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, which results in the u… |
CVE-2025-32876 | Medium | 6.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. The BLE implementation of the COROS smartwatch does not support LE Secure Connections and ins… |
CVE-2025-32875 | Medium | 5.7 | 2025-06-20 | An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application… |
CVE-2025-32753 | Medium | 5.3 | 2025-06-20 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.1, contains an improper neutralization of special elements used in an SQL command ('SQL injection') vuln… |
CVE-2025-6341 | Medium | 4.3 | 2025-06-20 | A vulnerability classified as problematic was found in code-projects School Fees Payment System 1.0. This vulnerability affects unknown code. The manipulation… |
CVE-2025-6340 | Low | 3.5 | 2025-06-20 | A vulnerability classified as problematic has been found in code-projects School Fees Payment System 1.0. This affects an unknown part of the file /branch.php… |
CVE-2025-6339 | High | 7.3 | 2025-06-20 | A vulnerability was found in ponaravindb Hospital Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-6337 | High | 8.8 | 2025-06-20 | A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615/4.0.0-B20230531.1404. It has been declared as critical. Affected by this vulnerab… |
CVE-2025-6336 | High | 8.8 | 2025-06-20 | A vulnerability was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. It has been classified as critical. Affected is an unknown function of the file /boafrm/f… |
CVE-2025-4102 | High | 7.2 | 2025-06-20 | The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabl… |
CVE-2025-38083 | High | 7.8 | 2025-06-20 | In the Linux kernel, the following vulnerability has been resolved: net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race condition in PRIO… |
CVE-2025-6335 | Medium | 4.7 | 2025-06-20 | A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical. This issue affects some unknown processing of the file /include/dedetag.class.php… |
CVE-2025-6334 | High | 8.8 | 2025-06-20 | A vulnerability has been found in D-Link DIR-867 1.0 and classified as critical. This vulnerability affects the function strncpy of the component Query String… |
CVE-2025-6333 | Medium | 6.3 | 2025-06-20 | A vulnerability, which was classified as critical, was found in PHPGurukul Directory Management System 2.0. This affects an unknown part of the file /admin/adm… |
CVE-2025-6332 | Medium | 6.3 | 2025-06-20 | A vulnerability, which was classified as critical, has been found in PHPGurukul Directory Management System 2.0. Affected by this issue is some unknown functio… |
CVE-2025-4981 | Critical | 9.9 | 2025-06-20 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extract… |
CVE-2025-6331 | Medium | 6.3 | 2025-06-20 | A vulnerability classified as critical was found in PHPGurukul Directory Management System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-6330 | High | 7.3 | 2025-06-20 | A vulnerability classified as critical has been found in PHPGurukul Directory Management System 1.0. Affected is an unknown function of the file /searchdata.ph… |
CVE-2025-6329 | Medium | 5.4 | 2025-06-20 | A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2025-6328 | High | 8.8 | 2025-06-20 | A vulnerability was found in D-Link DIR-815 1.01. It has been declared as critical. This vulnerability affects the function sub_403794 of the file hedwig.cgi… |
CVE-2025-5963 | | 2025-06-20 | The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.securi… | |
CVE-2025-5255 | | 2025-06-20 | The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.s… | |
CVE-2025-6323 | High | 7.3 | 2025-06-20 | A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0. It has been classified as critical. This affects an unknown part of the file /enrollm… |
CVE-2025-6322 | High | 7.3 | 2025-06-20 | A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-6321 | Medium | 6.3 | 2025-06-20 | A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-6320 | Medium | 6.3 | 2025-06-20 | A vulnerability, which was classified as critical, was found in PHPGurukul Pre-School Enrollment System 1.0. Affected is an unknown function of the file /admin… |
CVE-2025-6257 | Medium | 6.4 | 2025-06-20 | The Euro FxRef Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currency shortcode in all versions up to… |
CVE-2025-6319 | Medium | 6.3 | 2025-06-20 | A vulnerability, which was classified as critical, has been found in PHPGurukul Pre-School Enrollment System 1.0. This issue affects some unknown processing of… |
CVE-2025-6318 | High | 7.3 | 2025-06-20 | A vulnerability classified as critical was found in PHPGurukul Pre-School Enrollment System 1.0. This vulnerability affects unknown code of the file /admin/che… |
CVE-2025-6317 | High | 7.3 | 2025-06-20 | A vulnerability classified as critical has been found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/confirm.php. The… |
CVE-2025-6316 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Online Shoe Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2025-6315 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Online Shoe Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-6314 | High | 7.3 | 2025-06-20 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/c… |
CVE-2025-6313 | High | 7.3 | 2025-06-20 | A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages… |
CVE-2025-50054 | Medium | 5.5 | 2025-06-20 | Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message… |
CVE-2025-6312 | High | 7.3 | 2025-06-20 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pag… |
CVE-2025-6311 | High | 7.3 | 2025-06-20 | A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. This affects an unknown part of the file /pages/accou… |
CVE-2025-5125 | Medium | 4.8 | 2025-06-20 | The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without saniti… |
CVE-2025-6310 | High | 7.3 | 2025-06-20 | A vulnerability, which was classified as critical, has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this issue is some unknown f… |
CVE-2025-6309 | Medium | 6.3 | 2025-06-20 | A vulnerability classified as critical was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-6308 | Medium | 6.3 | 2025-06-20 | A vulnerability classified as critical has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /admin/b… |
CVE-2025-6307 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Online Shoe Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /functi… |
CVE-2025-6306 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Online Shoe Store 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/… |
CVE-2025-6305 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Online Shoe Store 1.0. It has been classified as critical. This affects an unknown part of the file /admin/admin_fea… |