2025 CVEs (page 282)
Page 282 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6150 | High | 8.8 | 2025-06-17 | A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2025-6149 | High | 8.8 | 2025-06-17 | A vulnerability classified as critical has been found in TOTOLINK A3002R 4.0.0-B20230531.1404. Affected is an unknown function of the file /boafrm/formSysLog o… |
CVE-2025-6148 | High | 8.8 | 2025-06-17 | A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615. It has been rated as critical. This issue affects some unknown processing of the file /boaf… |
CVE-2025-6147 | High | 8.8 | 2025-06-17 | A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm… |
CVE-2025-48993 | Medium | 6.1 | 2025-06-17 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be… |
CVE-2025-6146 | High | 8.8 | 2025-06-17 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. This affects an unknown part of the file /boafrm/formSysLog… |
CVE-2025-6145 | High | 8.8 | 2025-06-16 | A vulnerability was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2025-6144 | High | 8.8 | 2025-06-16 | A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-6143 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/fo… |
CVE-2025-48992 | Medium | 4.8 | 2025-06-16 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripti… |
CVE-2025-6142 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in Intera InHire up to 20250530. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The ma… |
CVE-2025-6141 | Low | 3.3 | 2025-06-16 | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of… |
CVE-2025-6140 | Low | 3.3 | 2025-06-16 | A vulnerability, which was classified as problematic, was found in spdlog up to 1.15.1. This affects the function scoped_padder in the library include/spdlog/p… |
CVE-2025-43200 | Medium | 4.2 | 2025-06-16 | This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3… |
CVE-2025-27587 | Medium | 5.3 | 2025-06-16 | OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages usin… |
CVE-2025-6139 | Low | 3.9 | 2025-06-16 | A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown functionality of the… |
CVE-2025-6138 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical was found in TOTOLINK T10 4.1.8cu.5207. Affected by this vulnerability is the function setWizardCfg of the file /cgi-bin… |
CVE-2025-49134 | Medium | 5.3 | 2025-06-16 | Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obt… |
CVE-2025-47951 | Medium | 4.9 | 2025-06-16 | Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate li… |
CVE-2025-32800 | Critical | 9.8 | 2025-06-16 | Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This pac… |
CVE-2025-32799 | Critical | 9.8 | 2025-06-16 | Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build processing logic is vulnerable to path traversal (Tar… |
CVE-2025-6137 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207. Affected is the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cg… |
CVE-2025-6136 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-32798 | Critical | 9.8 | 2025-06-16 | Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build recipe processing logic has been found to be vulnerab… |
CVE-2025-6135 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2025-6134 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been classified as critical. This affects an unknown part of the file /… |
CVE-2025-6087 | Critical | 9.1 | 2025-06-16 | A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature… |
CVE-2025-32797 | High | 7.0 | 2025-06-16 | Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the write_build_scripts function in conda-build creates the temporary… |
CVE-2025-6133 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in Projectworlds Life Insurance Management System 1.0 and classified as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-6132 | High | 7.3 | 2025-06-16 | A vulnerability has been found in Chanjet CRM 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysconfig… |
CVE-2025-6179 | Critical | 9.8 | 2025-06-16 | Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and ac… |
CVE-2025-6177 | High | 7.4 | 2025-06-16 | Privilege Escalation in MiniOS in Google ChromeOS (16063.45.2 and potentially others) on enrolled devices allows a local attacker to gain root code execution v… |
CVE-2025-6131 | Low | 2.4 | 2025-06-16 | A vulnerability, which was classified as problematic, was found in CodeAstro Food Ordering System 1.0. Affected is an unknown function of the file /admin/store… |
CVE-2025-6130 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the… |
CVE-2025-5309 | Critical | 9.8 | 2025-06-16 | The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead t… |
CVE-2025-2327 | | 2025-06-16 | A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured. | |
CVE-2025-6170 | Low | 2.5 | 2025-06-16 | A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program… |
CVE-2025-6129 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This vulnerability affects unknown code of the file /boafrm/formSa… |
CVE-2025-6128 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This affects an unknown part of the file /boafrm/formWireless… |
CVE-2025-49796 | Critical | 9.1 | 2025-06-16 | A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an a… |
CVE-2025-49795 | High | 7.5 | 2025-06-16 | A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML inpu… |
CVE-2025-49794 | Critical | 9.1 | 2025-06-16 | A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the… |
CVE-2025-6127 | Low | 3.5 | 2025-06-16 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown fun… |
CVE-2025-6126 | Medium | 4.3 | 2025-06-16 | A vulnerability was found in PHPGurukul Rail Pass Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown func… |
CVE-2025-4565 | Medium | 5.3 | 2025-06-16 | Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messa… |
CVE-2025-49125 | High | 7.5 | 2025-06-16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the ro… |
CVE-2025-49124 | High | 8.4 | 2025-06-16 | Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without speci… |
CVE-2025-48988 | High | 7.5 | 2025-06-16 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10… |
CVE-2025-48976 | High | 7.5 | 2025-06-16 | Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Com… |
CVE-2025-3594 | Critical | 9.8 | 2025-06-16 | Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through u… |
CVE-2025-3526 | High | 7.5 | 2025-06-16 | SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does… |
CVE-2025-6125 | Low | 2.4 | 2025-06-16 | A vulnerability was found in PHPGurukul Rail Pass Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /ad… |
CVE-2025-6124 | High | 7.3 | 2025-06-16 | A vulnerability was found in code-projects Restaurant Order System 1.0 and classified as critical. This issue affects some unknown processing of the file /tabl… |
CVE-2025-3602 | High | 7.5 | 2025-06-16 | Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 thro… |
CVE-2025-36632 | High | 7.8 | 2025-06-16 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege. |
CVE-2025-6123 | High | 7.3 | 2025-06-16 | A vulnerability has been found in code-projects Restaurant Order System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pa… |
CVE-2025-6122 | Medium | 6.3 | 2025-06-16 | A vulnerability, which was classified as critical, was found in code-projects Restaurant Order System 1.0. This affects an unknown part of the file /table.php… |
CVE-2025-6121 | Critical | 9.8 | 2025-06-16 | A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08. Affected by this issue is the function get_pure_content of the co… |
CVE-2025-6120 | Medium | 5.3 | 2025-06-16 | A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function read_meshes in… |
CVE-2025-5689 | High | 8.5 | 2025-06-16 | A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part o… |
CVE-2025-46710 | Medium | 5.7 | 2025-06-16 | Possible kernel exceptions caused by reading and writing kernel heap data after free. |
CVE-2025-24388 | Low | 3.8 | 2025-06-16 | A vulnerability in the OTRS Admin Interface and Agent Interface (versions before OTRS 8) allow parameter injection due to for an autheniticated agent or admin… |
CVE-2025-6119 | Medium | 5.3 | 2025-06-16 | A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHLoader::ReadNodeChan… |
CVE-2025-6118 | High | 7.3 | 2025-06-16 | A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-4748 | | 2025-06-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, Fil… | |
CVE-2025-47869 | Critical | 9.8 | 2025-06-16 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability was discovered in Apache NuttX RTOS apps/exapmles/xmlrpc application. In… |
CVE-2025-47868 | Critical | 9.8 | 2025-06-16 | Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part o… |
CVE-2025-40916 | Critical | 9.1 | 2025-06-16 | Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() funct… |
CVE-2025-6117 | High | 7.3 | 2025-06-16 | A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2025-6116 | High | 7.3 | 2025-06-16 | A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been classified as critical. This affects an unknown part of the file /IntraFi… |
CVE-2025-25265 | Medium | 4.9 | 2025-06-16 | A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to rea… |
CVE-2025-25264 | Medium | 6.5 | 2025-06-16 | An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allow… |
CVE-2025-6172 | Critical | 9.8 | 2025-06-16 | Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation. |
CVE-2025-6115 | High | 8.8 | 2025-06-16 | A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this issue is the function form_macfilter. The manipulation of the… |
CVE-2025-6114 | High | 8.8 | 2025-06-16 | A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this vulnerability is the function form_portforwarding of the… |
CVE-2025-40729 | Medium | 6.1 | 2025-06-16 | Reflected Cross-Site Scripting (XSS) in /customer_support/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code vi… |
CVE-2025-40728 | High | 8.8 | 2025-06-16 | SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete databas… |
CVE-2025-40727 | | 2025-06-16 | A Reflected Cross Site Scripting (XSS) vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrar… | |
CVE-2025-40726 | | 2025-06-16 | Reflected Cross-Site Scripting (XSS) vulnerability in /pages/search-results-page in Nosto, which allows remote attackers to execute arbitrary code via the q GE… | |
CVE-2025-3464 | | 2025-06-16 | A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication… | |
CVE-2025-2091 | Medium | 5.4 | 2025-06-16 | An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF fi… |
CVE-2025-6113 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, was found in Tenda FH1203 2.0.1.6. Affected is the function fromadvsetlanip of the file /goform/AdvSetLanip… |
CVE-2025-6112 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, has been found in Tenda FH1205 2.0.0.7. This issue affects the function fromadvsetlanip of the file /goform/… |
CVE-2025-4987 | High | 8.7 | 2025-06-16 | A stored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2023x through Releas… |
CVE-2025-6169 | Critical | 9.8 | 2025-06-16 | The WIMP website co-construction management platform from HAMASTAR Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to i… |
CVE-2025-6111 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical was found in Tenda FH1205 2.0.0.7(775). This vulnerability affects the function fromVirtualSer of the file /goform/Virtu… |
CVE-2025-6110 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical has been found in Tenda FH1201 1.2.0.14(408). This affects an unknown part of the file /goform/SafeMacFilter. The manipu… |
CVE-2025-6109 | Medium | 4.3 | 2025-06-16 | A vulnerability was found in javahongxi whatsmars 2021.4.0. It has been rated as problematic. Affected by this issue is the function initialize of the file /wh… |
CVE-2025-6108 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in hansonwang99 Spring-Boot-In-Action up to 807fd37643aa774b94fd004cc3adbd29ca17e9aa. It has been declared as critical. Affected by t… |
CVE-2025-6107 | Low | 3.1 | 2025-06-16 | A vulnerability was found in comfyanonymous comfyui 0.3.40. It has been classified as problematic. Affected is the function set_attr of the file /comfy/utils.p… |
CVE-2025-6106 | Medium | 4.3 | 2025-06-16 | A vulnerability was found in WuKongOpenSource WukongCRM 9.0 and classified as problematic. This issue affects some unknown processing of the file AdminRoleCont… |
CVE-2025-6105 | Medium | 4.3 | 2025-06-16 | A vulnerability has been found in jflyfox jfinal_cms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The ma… |
CVE-2025-6104 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/p… |
CVE-2025-6103 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functio… |
CVE-2025-6102 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-6101 | Medium | 5.5 | 2025-06-16 | A vulnerability classified as critical has been found in letta-ai letta up to 0.4.1. Affected is the function function_message of the file letta/letta/interfac… |
CVE-2025-6100 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in realguoshuai open-video-cms 1.0. It has been rated as critical. This issue affects some unknown processing of the file /v1/video/l… |
CVE-2025-6099 | Medium | 5.3 | 2025-06-16 | A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects… |
CVE-2025-6098 | Critical | 9.8 | 2025-06-16 | A vulnerability was found in UTT 进取 750W up to 5.0. It has been classified as critical. This affects the function strcpy of the file /goform/setSysAdm of the c… |
CVE-2025-6097 | Medium | 5.3 | 2025-06-16 | A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/… |