2025 CVEs (page 281)
Page 281 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49862 | Medium | 5.9 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store ebook-store allows Stored XSS.This… |
CVE-2025-49861 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timur Kamaev Kama Click Counter kama-clic-counter allows… |
CVE-2025-49859 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in etruel WP Views Counter wpecounter allows Stored XSS.This… |
CVE-2025-49858 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allo… |
CVE-2025-49857 | Medium | 4.3 | 2025-06-17 | Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCr… |
CVE-2025-49856 | Medium | 4.3 | 2025-06-17 | Cross-Site Request Forgery (CSRF) vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Cross Site Request Forgery.This issue affects Responsi… |
CVE-2025-49855 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Flexible Shortcodes meks-flexible-shortcodes al… |
CVE-2025-49854 | High | 7.6 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anh Tran Slim SEO slim-seo allows SQL Injection.This issu… |
CVE-2025-49508 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP… |
CVE-2025-49452 | Critical | 9.3 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Ladó PostaPanduri postapanduri allows SQL Injectio… |
CVE-2025-49451 | High | 7.5 | 2025-06-17 | Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery al… |
CVE-2025-49447 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu allows Using Malicious Files. This issue affects FW Food Menu : from… |
CVE-2025-49444 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web Shell to a Web Server… |
CVE-2025-49415 | High | 8.6 | 2025-06-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Path Traversal.This is… |
CVE-2025-49331 | High | 7.2 | 2025-06-17 | Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCo… |
CVE-2025-49330 | Critical | 9.8 | 2025-06-17 | Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue aff… |
CVE-2025-49316 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflect… |
CVE-2025-49312 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution Echo RSS Feed Post Generator Plugin for Wo… |
CVE-2025-49266 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Refle… |
CVE-2025-49261 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local Fil… |
CVE-2025-49260 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local Fil… |
CVE-2025-49259 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local Fil… |
CVE-2025-49258 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Maia maia allows PHP Local Fil… |
CVE-2025-49257 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local Fil… |
CVE-2025-49256 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Sapa sapa allows PHP Local Fil… |
CVE-2025-49255 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Ruza ruza allows PHP Local Fil… |
CVE-2025-49254 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local Fil… |
CVE-2025-49253 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Lasa lasa allows PHP Local Fil… |
CVE-2025-49252 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local Fil… |
CVE-2025-49251 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local Fil… |
CVE-2025-49234 | Medium | 6.5 | 2025-06-17 | Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-49180 | High | 7.8 | 2025-06-17 | A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow… |
CVE-2025-49179 | High | 7.3 | 2025-06-17 | A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length… |
CVE-2025-49178 | Medium | 5.5 | 2025-06-17 | A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's… |
CVE-2025-49177 | Medium | 6.1 | 2025-06-17 | A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended… |
CVE-2025-49176 | High | 7.3 | 2025-06-17 | A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an… |
CVE-2025-49175 | Medium | 6.1 | 2025-06-17 | A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, lead… |
CVE-2025-49071 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in NasaTheme Flozen flozen-theme allows Upload a Web Shell to a Web Server.This issue affects Flo… |
CVE-2025-48333 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPQuark eForm - WordPress Form Builder wp-fsqm-pro allows… |
CVE-2025-48274 | Critical | 9.3 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Blind SQL… |
CVE-2025-48145 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-ta… |
CVE-2025-48118 | High | 8.5 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpExperts Hub Woocommerce Partial Shipment wc-partial-shi… |
CVE-2025-48111 | Medium | 4.3 | 2025-06-17 | Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects… |
CVE-2025-47573 | Critical | 9.3 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla School Management allows Blind SQL Injection. Th… |
CVE-2025-47572 | High | 7.5 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla School Management allows PHP… |
CVE-2025-47559 | Critical | 9.9 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg allows Upload a Web Shell to a Web Server.This issue affects MapSVG: f… |
CVE-2025-47452 | Critical | 9.9 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR wpvr allows Upload a Web Shell to a Web Server.This issue affects WP VR: from n… |
CVE-2025-39508 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Reflected XSS.This i… |
CVE-2025-39486 | High | 8.5 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Rankie valvepress-rankie allows SQL Injection… |
CVE-2025-39479 | Critical | 9.3 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartiolabs Smart Notification allows Blind SQL Injection… |
CVE-2025-34508 | Medium | 6.3 | 2025-06-17 | A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker… |
CVE-2025-32549 | High | 7.5 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPGYM allows PHP Local File I… |
CVE-2025-32510 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in ovatheme Ovatheme Events Manager ova-events-manager allows Using Malicious Files.This issue af… |
CVE-2025-31919 | Critical | 9.8 | 2025-06-17 | Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection. This issue affects Spare: from n/a through 1.7. |
CVE-2025-30988 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player all… |
CVE-2025-30618 | Critical | 9.8 | 2025-06-17 | Deserialization of Untrusted Data vulnerability in yuliaz Rapyd Payment Extension for WooCommerce rapyd-payments allows Object Injection.This issue affects Rap… |
CVE-2025-30562 | High | 8.5 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdistillery Navigation Tree Elementor navigation-tree-el… |
CVE-2025-29002 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Simen snssimen allows PHP Loc… |
CVE-2025-28991 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Evon snsevon allows PHP Local… |
CVE-2025-28972 | High | 7.6 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Suhas Surse WP Employee Attendance System wp-employee-att… |
CVE-2025-24773 | Critical | 9.3 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce w… |
CVE-2025-24761 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme DSK dsk allows PHP Local File… |
CVE-2025-6069 | Medium | 4.3 | 2025-06-17 | The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-o… |
CVE-2025-4879 | High | 7.8 | 2025-06-17 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
CVE-2025-4404 | Critical | 9.1 | 2025-06-17 | A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCano… |
CVE-2025-49842 | | 2025-06-17 | conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the conda_forge_webservice Docker co… | |
CVE-2025-0320 | High | 7.8 | 2025-06-17 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Secure Access Client for Windows |
CVE-2025-6020 | High | 7.8 | 2025-06-17 | A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their p… |
CVE-2025-5777 | High | 7.5 | 2025-06-17 | Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA… |
CVE-2025-5349 | High | 8.8 | 2025-06-17 | Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway |
CVE-2025-4365 | High | 7.5 | 2025-06-17 | Arbitrary file read in NetScaler Console and NetScaler SDX (SVM) |
CVE-2025-5700 | Medium | 6.4 | 2025-06-17 | The Simple Logo Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.9.3 d… |
CVE-2025-5291 | Medium | 6.4 | 2025-06-17 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_pb and ms_slide sho… |
CVE-2025-3880 | Medium | 4.3 | 2025-06-17 | The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability… |
CVE-2025-6050 | Medium | 4.8 | 2025-06-17 | Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "… |
CVE-2025-3515 | High | 8.1 | 2025-06-17 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation… |
CVE-2025-40674 | | 2025-06-17 | Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the… | |
CVE-2025-6173 | Medium | 4.7 | 2025-06-17 | A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_pr… |
CVE-2025-6167 | Medium | 5.5 | 2025-06-17 | A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/… |
CVE-2025-6166 | Low | 3.5 | 2025-06-17 | A vulnerability was found in frdel Agent-Zero up to 0.8.4. It has been rated as problematic. This issue affects the function image_get of the file /python/api/… |
CVE-2025-6165 | High | 8.8 | 2025-06-17 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/f… |
CVE-2025-6164 | High | 8.8 | 2025-06-17 | A vulnerability was found in TOTOLINK A3002R 4.0.0-B20230531.1404. It has been classified as critical. This affects an unknown part of the file /boafrm/formMul… |
CVE-2025-5209 | Medium | 4.8 | 2025-06-17 | The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2025-6163 | High | 8.8 | 2025-06-17 | A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-6162 | High | 8.8 | 2025-06-17 | A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-6161 | High | 7.3 | 2025-06-17 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown function of the file /ed… |
CVE-2025-6160 | High | 7.3 | 2025-06-17 | A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown proc… |
CVE-2025-6159 | High | 7.3 | 2025-06-17 | A vulnerability classified as critical was found in code-projects Hostel Management System 1.0. This vulnerability affects unknown code of the file /allocate_r… |
CVE-2025-6158 | High | 8.8 | 2025-06-17 | A vulnerability classified as critical has been found in D-Link DIR-665 1.00. This affects the function sub_AC78 of the component HTTP POST Request Handler. Th… |
CVE-2025-6157 | High | 7.3 | 2025-06-17 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functi… |
CVE-2025-6156 | Medium | 6.3 | 2025-06-17 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2025-6155 | High | 7.3 | 2025-06-17 | A vulnerability was found in PHPGurukul Hostel Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /includes… |
CVE-2025-6154 | High | 7.3 | 2025-06-17 | A vulnerability was found in PHPGurukul Hostel Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /includ… |
CVE-2025-6153 | High | 7.3 | 2025-06-17 | A vulnerability has been found in PHPGurukul Hostel Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admi… |
CVE-2025-49823 | Unrated | | 2025-06-17 | (conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts proce… |
CVE-2025-6152 | Medium | 6.3 | 2025-06-17 | A vulnerability, which was classified as critical, was found in Steel Browser up to 0.1.3. This affects the function handleFileUpload of the file api/src/modul… |
CVE-2025-5673 | Medium | 6.5 | 2025-06-17 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the ‘prgSortPostType’ parameter in all versions up… |
CVE-2025-4775 | Medium | 6.4 | 2025-06-17 | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in al… |
CVE-2025-3774 | High | 7.2 | 2025-06-17 | The Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.3.4 due… |
CVE-2025-6151 | | 2025-06-17 | A vulnerability has been found in TP-Link TL-WR940N V4 and TL-WR841N V11. Affected by this issue is some unknown functionality of the file /userRpm/WanSlaacC… |