2025 CVEs (page 280)
Page 280 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6304 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Online Shoe Store 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-6303 | High | 7.3 | 2025-06-20 | A vulnerability has been found in code-projects Online Shoe Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-6302 | High | 8.8 | 2025-06-20 | A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is the function setStaticDhcpConfig of the fi… |
CVE-2025-6301 | Low | 2.4 | 2025-06-20 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Notice Board System 1.0. This issue affects some unknown processing of the f… |
CVE-2025-6300 | High | 7.3 | 2025-06-20 | A vulnerability classified as critical was found in PHPGurukul Employee Record Management System 1.3. This vulnerability affects unknown code of the file /admi… |
CVE-2025-6299 | Medium | 4.7 | 2025-06-20 | A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boa/formWSC. The manipulati… |
CVE-2025-6264 | Medium | 5.5 | 2025-06-20 | Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated… |
CVE-2025-6296 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Hostel Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-6295 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Hostel Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functio… |
CVE-2025-6294 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Hostel Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /conta… |
CVE-2025-6293 | High | 7.3 | 2025-06-20 | A vulnerability was found in code-projects Hostel Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /con… |
CVE-2025-6292 | High | 8.8 | 2025-06-20 | A vulnerability has been found in D-Link DIR-825 2.03 and classified as critical. This vulnerability affects the function sub_4091AC of the component HTTP POST… |
CVE-2025-6291 | High | 8.8 | 2025-06-20 | A vulnerability, which was classified as critical, was found in D-Link DIR-825 2.03. This affects the function do_file of the component HTTP POST Request Handl… |
CVE-2025-6288 | Low | 2.4 | 2025-06-20 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Bus Pass Management System 1.0. Affected by this issue is some unknown funct… |
CVE-2025-49715 | High | 7.5 | 2025-06-20 | Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose i… |
CVE-2025-48058 | | 2025-06-20 | PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, there is a potential polynomial Regular Expressio… | |
CVE-2025-6287 | Low | 3.5 | 2025-06-20 | A vulnerability classified as problematic was found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2025-47771 | | 2025-06-20 | PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read… | |
CVE-2025-6286 | Low | 3.5 | 2025-06-19 | A vulnerability classified as problematic has been found in PHPGurukul COVID19 Testing Management System 2021. Affected is an unknown function of the file /sea… |
CVE-2025-6285 | Medium | 4.3 | 2025-06-19 | A vulnerability was found in PHPGurukul COVID19 Testing Management System 2021. It has been rated as problematic. This issue affects some unknown processing of… |
CVE-2025-6284 | Medium | 4.3 | 2025-06-19 | A vulnerability was found in PHPGurukul Car Rental Portal 3.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation l… |
CVE-2025-6283 | Low | 3.5 | 2025-06-19 | A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/a… |
CVE-2025-6282 | Medium | 5.5 | 2025-06-19 | A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the funct… |
CVE-2025-6281 | Medium | 5.5 | 2025-06-19 | A vulnerability has been found in OpenBMB XAgent up to 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-6280 | Medium | 5.5 | 2025-06-19 | A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function download_attachment of the f… |
CVE-2025-47293 | | 2025-06-19 | PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vu… | |
CVE-2025-6384 | Critical | 9.1 | 2025-06-19 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via… |
CVE-2025-6279 | Medium | 5.5 | 2025-06-19 | A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools… |
CVE-2025-6278 | Medium | 5.5 | 2025-06-19 | A vulnerability classified as critical was found in Upsonic up to 0.55.6. This vulnerability affects the function os.path.join of the file markdown/server.py… |
CVE-2025-6277 | Medium | 6.3 | 2025-06-19 | A vulnerability classified as critical has been found in Brilliance Golden Link Secondary System up to 20250609. This affects an unknown part of the file /stor… |
CVE-2025-6276 | Medium | 6.3 | 2025-06-19 | A vulnerability was found in Brilliance Golden Link Secondary System up to 20250609. It has been rated as critical. Affected by this issue is some unknown func… |
CVE-2025-6275 | Low | 3.3 | 2025-06-19 | A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset o… |
CVE-2025-6274 | Low | 3.3 | 2025-06-19 | A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic. Affected is the function OnDataCount of the file src/interp/… |
CVE-2025-6273 | Low | 3.3 | 2025-06-19 | A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the file src/binary-read… |
CVE-2025-6272 | Low | 3.3 | 2025-06-19 | A vulnerability has been found in wasm3 0.5.0 and classified as problematic. This vulnerability affects the function MarkSlotAllocated of the file source/m3_co… |
CVE-2025-6271 | Low | 3.3 | 2025-06-19 | A vulnerability, which was classified as problematic, was found in swftools up to 0.9.2. This affects the function wav_convert2mono in the library lib/wav.c of… |
CVE-2025-36050 | Medium | 6.2 | 2025-06-19 | IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2025-33121 | High | 7.1 | 2025-06-19 | IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2025-33117 | Critical | 9.1 | 2025-06-19 | IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 could allow a privileged user to modify configuration files that would allow the upload of a malicious aut… |
CVE-2025-6270 | Medium | 5.3 | 2025-06-19 | A vulnerability, which was classified as critical, has been found in HDF5 up to 1.14.6. Affected by this issue is the function H5FS__sect_find_node of the file… |
CVE-2025-50200 | Medium | 5.5 | 2025-06-19 | RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When quer… |
CVE-2025-6269 | Medium | 5.3 | 2025-06-19 | A vulnerability classified as critical was found in HDF5 up to 1.14.6. Affected by this vulnerability is the function H5C__reconstruct_cache_entry of the file… |
CVE-2025-52464 | High | 8.3 | 2025-06-19 | Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resultin… |
CVE-2025-6268 | Medium | 4.3 | 2025-06-19 | A vulnerability classified as problematic has been found in Luna Imaging up to 7.5.5.6. Affected is an unknown function of the file /luna/servlet/view/search… |
CVE-2025-49014 | | 2025-06-19 | jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This is… | |
CVE-2025-48886 | Medium | 4.8 | 2025-06-19 | Hydra is a layer-two scalability solution for Cardano. Prior to version 0.22.0, the process assumes L1 event finality and does not consider failed transactions… |
CVE-2025-6267 | Medium | 6.3 | 2025-06-19 | A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. It has been rated as critical. This issue affects some unk… |
CVE-2025-4738 | Critical | 9.8 | 2025-06-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yirmibes Software MY ERP allows SQL Injection. This issu… |
CVE-2025-6266 | Medium | 6.3 | 2025-06-19 | A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by this vulnerability is an unknown functionality of the file /upload.php. Performing ma… |
CVE-2025-6019 | High | 7.0 | 2025-06-19 | A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to… |
CVE-2025-32896 | Medium | 6.5 | 2025-06-19 | # Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can… |
CVE-2025-5234 | Medium | 6.4 | 2025-06-19 | The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4… |
CVE-2025-5071 | High | 8.8 | 2025-06-19 | The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs… |
CVE-2025-49763 | High | 7.5 | 2025-06-19 | ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can… |
CVE-2025-31698 | High | 7.5 | 2025-06-19 | ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl… |
CVE-2025-4965 | Medium | 6.4 | 2025-06-19 | The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feature in all versions… |
CVE-2025-4571 | Medium | 5.4 | 2025-06-19 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient c… |
CVE-2025-5490 | Medium | 5.5 | 2025-06-19 | The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.4 due to insu… |
CVE-2025-5524 | Medium | 4.9 | 2025-06-19 | The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insuffi… |
CVE-2025-52474 | Critical | 9.8 | 2025-06-19 | WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, a SQL Injection vulnerability was identified in the id parameter of the /WeGIA/cont… |
CVE-2025-50201 | Critical | 9.8 | 2025-06-19 | WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debu… |
CVE-2025-4479 | Medium | 6.4 | 2025-06-19 | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's befor… |
CVE-2025-4367 | Medium | 6.4 | 2025-06-19 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, an… |
CVE-2025-6201 | Medium | 6.4 | 2025-06-19 | The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2025-52467 | Critical | 9.1 | 2025-06-19 | pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was… |
CVE-2025-50183 | Medium | 6.5 | 2025-06-19 | OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application… |
CVE-2025-4661 | Low | 2.3 | 2025-06-19 | A path transversal vulnerability in Brocade Fabric OS 9.1.0 through 9.2.2 could allow a local admin user to gain access to files outside the intended directo… |
CVE-2025-50182 | Medium | 5.3 | 2025-06-19 | urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Nod… |
CVE-2025-50181 | Medium | 5.3 | 2025-06-19 | urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager… |
CVE-2025-24291 | Medium | 6.1 | 2025-06-19 | The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains… |
CVE-2025-24288 | Critical | 9.8 | 2025-06-19 | The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most… |
CVE-2025-24287 | Medium | 6.1 | 2025-06-19 | A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with elevated permissions. |
CVE-2025-24286 | High | 7.2 | 2025-06-19 | A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code. |
CVE-2025-23173 | High | 7.5 | 2025-06-19 | The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify… |
CVE-2025-23172 | High | 7.2 | 2025-06-19 | The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" an… |
CVE-2025-23171 | High | 7.2 | 2025-06-19 | The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload p… |
CVE-2025-23170 | Medium | 6.7 | 2025-06-19 | The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The… |
CVE-2025-23169 | Medium | 6.1 | 2025-06-19 | The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provide… |
CVE-2025-23168 | Medium | 6.3 | 2025-06-19 | The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Di… |
CVE-2025-23121 | High | 8.8 | 2025-06-19 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user |
CVE-2025-49591 | Critical | 9.1 | 2025-06-18 | CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak… |
CVE-2025-49590 | Medium | 6.1 | 2025-06-18 | CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripti… |
CVE-2025-26199 | Critical | 9.8 | 2025-06-18 | CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP dur… |
CVE-2025-6192 | High | 8.8 | 2025-06-18 | Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2025-6191 | High | 8.8 | 2025-06-18 | Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML… |
CVE-2025-29646 | High | 7.1 | 2025-06-18 | An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP SessionEstablishmentRequest packet with r… |
CVE-2025-26198 | Critical | 9.8 | 2025-06-18 | CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-sup… |
CVE-2025-20260 | Critical | 9.8 | 2025-06-18 | A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of… |
CVE-2025-20271 | High | 8.6 | 2025-06-18 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2025-20234 | Medium | 5.3 | 2025-06-18 | A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conditio… |
CVE-2025-1349 | Medium | 5.5 | 2025-06-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. T… |
CVE-2025-1348 | Medium | 4.0 | 2025-06-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 could allow a local user to obtain sensitive info… |
CVE-2025-4821 | High | 7.5 | 2025-06-18 | Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the pa… |
CVE-2025-4820 | Medium | 5.3 | 2025-06-18 | Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the pa… |
CVE-2025-44952 | High | 7.8 | 2025-06-18 | A missing length check in `ogs_pfcp_subnet_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to c… |
CVE-2025-44951 | High | 7.1 | 2025-06-18 | A missing length check in `ogs_pfcp_dev_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to caus… |
CVE-2025-36049 | High | 8.8 | 2025-06-18 | IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A rem… |
CVE-2025-36048 | High | 7.2 | 2025-06-18 | IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due t… |
CVE-2025-6240 | | 2025-06-18 | Improper Input Validation vulnerability in Profisee on Windows (filesystem modules) allows Path Traversal after authentication to the Profisee system.This issu… | |
CVE-2025-46109 | High | 8.8 | 2025-06-18 | SQL Injection vulnerability in pbootCMS v.3.2.5 and v.3.2.10 allows a remote attacker to obtain sensitive information via a crafted GET request |