2025 CVEs (page 282)
Page 282 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49215 | High | 8.8 | 2025-06-17 | A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installa… |
CVE-2025-49214 | High | 8.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected… |
CVE-2025-49213 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected… |
CVE-2025-49212 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected… |
CVE-2025-49211 | High | 7.7 | 2025-06-17 | A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. … |
CVE-2025-48443 | Medium | 6.7 | 2025-06-17 | Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege Escalation Vulnerability that could allo… |
CVE-2025-41413 | High | 7.8 | 2025-06-17 | Fuji Electric Smart Editor is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code. |
CVE-2025-41388 | High | 7.8 | 2025-06-17 | Fuji Electric Smart Editor is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. |
CVE-2025-32412 | High | 7.8 | 2025-06-17 | Fuji Electric Smart Editor is vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code. |
CVE-2025-30642 | Medium | 5.5 | 2025-06-17 | A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to create a denial of service (DoS) situation on affected… |
CVE-2025-30641 | High | 7.8 | 2025-06-17 | A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privilege… |
CVE-2025-30640 | High | 7.8 | 2025-06-17 | A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Pleas… |
CVE-2025-5141 | Medium | 5.5 | 2025-06-17 | A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1… |
CVE-2025-49847 | High | 8.8 | 2025-06-17 | llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model vocabulary can trigger a buffer overflow in l… |
CVE-2025-45526 | Low | 2.9 | 2025-06-17 | A denial of service (DoS) vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, doe… |
CVE-2025-45525 | Low | 2.9 | 2025-06-17 | A NULL pointer dereference vulnerability has been identified in the JavaScript library microlight version 0.0.7, a lightweight syntax highlighting library. Whe… |
CVE-2025-30680 | High | 7.1 | 2025-06-17 | A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to infor… |
CVE-2025-30679 | Medium | 6.5 | 2025-06-17 | A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain par… |
CVE-2025-30678 | Medium | 6.5 | 2025-06-17 | A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain par… |
CVE-2025-49850 | | 2025-06-17 | A Heap-based Buffer Overflow vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data… | |
CVE-2025-49849 | | 2025-06-17 | An Out-of-bounds Read vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which c… | |
CVE-2025-49848 | High | 7.8 | 2025-06-17 | An out-of-bounds write vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which… |
CVE-2025-49487 | Medium | 6.8 | 2025-06-17 | An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical a… |
CVE-2025-49158 | Medium | 6.7 | 2025-06-17 | An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges on affected installa… |
CVE-2025-49157 | High | 7.8 | 2025-06-17 | A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on affected installation… |
CVE-2025-49156 | High | 7.0 | 2025-06-17 | A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected installations. Plea… |
CVE-2025-49155 | High | 8.8 | 2025-06-17 | An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to a… |
CVE-2025-49154 | High | 8.7 | 2025-06-17 | An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key mem… |
CVE-2025-34511 | High | 8.8 | 2025-06-17 | Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricte… |
CVE-2025-34510 | High | 8.8 | 2025-06-17 | Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip S… |
CVE-2025-34509 | High | 7.5 | 2025-06-17 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, an… |
CVE-2025-49220 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected i… |
CVE-2025-49219 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected… |
CVE-2025-47867 | High | 7.5 | 2025-06-17 | A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to exec… |
CVE-2025-47866 | Medium | 4.3 | 2025-06-17 | An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affe… |
CVE-2025-47865 | High | 7.5 | 2025-06-17 | A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affec… |
CVE-2025-33122 | High | 7.5 | 2025-06-17 | IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 could allow a user to gain elevated privileges due to an unqualified library call in IBM Advanced Job Scheduler for i. A mali… |
CVE-2025-45880 | Medium | 6.1 | 2025-06-17 | A cross-site scripting (XSS) vulnerability in the data resource management function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in t… |
CVE-2025-45878 | Medium | 6.1 | 2025-06-17 | A cross-site scripting (XSS) vulnerability in the report manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context… |
CVE-2025-45879 | Medium | 6.1 | 2025-06-17 | A cross-site scripting (XSS) vulnerability in the e-mail manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context… |
CVE-2025-6199 | Low | 3.3 | 2025-06-17 | A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output… |
CVE-2025-6196 | Medium | 5.5 | 2025-06-17 | A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, lead… |
CVE-2025-4754 | | 2025-06-17 | Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable after… | |
CVE-2025-49882 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Tauqeer CubeWP cubewp-framework allows DOM-Based XS… |
CVE-2025-49881 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-add… |
CVE-2025-49880 | Medium | 4.3 | 2025-06-17 | Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-49879 | High | 8.6 | 2025-06-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in themezaa Litho litho allows Path Traversal.This issue affects L… |
CVE-2025-49878 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.T… |
CVE-2025-49877 | Medium | 4.9 | 2025-06-17 | Server-Side Request Forgery (SSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Server Side Request Forgery… |
CVE-2025-49875 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalizati… |
CVE-2025-49874 | Medium | 4.3 | 2025-06-17 | Missing Authorization vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-49872 | Medium | 5.3 | 2025-06-17 | Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects myCred: from… |
CVE-2025-49871 | Medium | 5.9 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows… |
CVE-2025-49868 | Medium | 4.7 | 2025-06-17 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects Fun… |
CVE-2025-49865 | Medium | 4.3 | 2025-06-17 | Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanc… |
CVE-2025-49864 | Medium | 5.3 | 2025-06-17 | Missing Authorization vulnerability in AFS Analytics AFS Analytics addfreestats allows Accessing Functionality Not Properly Constrained by ACLs.This issue affe… |
CVE-2025-49863 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-sermons allows Stored… |
CVE-2025-49862 | Medium | 5.9 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store ebook-store allows Stored XSS.This… |
CVE-2025-49861 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timur Kamaev Kama Click Counter kama-clic-counter allows… |
CVE-2025-49859 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in etruel WP Views Counter wpecounter allows Stored XSS.This… |
CVE-2025-49858 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allo… |
CVE-2025-49857 | Medium | 4.3 | 2025-06-17 | Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCr… |
CVE-2025-49856 | Medium | 4.3 | 2025-06-17 | Cross-Site Request Forgery (CSRF) vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Cross Site Request Forgery.This issue affects Responsi… |
CVE-2025-49855 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Flexible Shortcodes meks-flexible-shortcodes al… |
CVE-2025-49854 | High | 7.6 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anh Tran Slim SEO slim-seo allows SQL Injection.This issu… |
CVE-2025-49508 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP… |
CVE-2025-49452 | Critical | 9.3 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Ladó PostaPanduri postapanduri allows SQL Injectio… |
CVE-2025-49451 | High | 7.5 | 2025-06-17 | Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery al… |
CVE-2025-49447 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu allows Using Malicious Files. This issue affects FW Food Menu : from… |
CVE-2025-49444 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web Shell to a Web Server… |
CVE-2025-49415 | High | 8.6 | 2025-06-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Path Traversal.This is… |
CVE-2025-49331 | High | 7.2 | 2025-06-17 | Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCo… |
CVE-2025-49330 | Critical | 9.8 | 2025-06-17 | Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue aff… |
CVE-2025-49316 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflect… |
CVE-2025-49312 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution Echo RSS Feed Post Generator Plugin for Wo… |
CVE-2025-49266 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Refle… |
CVE-2025-49261 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local Fil… |
CVE-2025-49260 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local Fil… |
CVE-2025-49259 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local Fil… |
CVE-2025-49258 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Maia maia allows PHP Local Fil… |
CVE-2025-49257 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local Fil… |
CVE-2025-49256 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Sapa sapa allows PHP Local Fil… |
CVE-2025-49255 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Ruza ruza allows PHP Local Fil… |
CVE-2025-49254 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local Fil… |
CVE-2025-49253 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Lasa lasa allows PHP Local Fil… |
CVE-2025-49252 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local Fil… |
CVE-2025-49251 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local Fil… |
CVE-2025-49234 | Medium | 6.5 | 2025-06-17 | Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-49180 | High | 7.8 | 2025-06-17 | A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow… |
CVE-2025-49179 | High | 7.3 | 2025-06-17 | A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length… |
CVE-2025-49178 | Medium | 5.5 | 2025-06-17 | A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's… |
CVE-2025-49177 | Medium | 6.1 | 2025-06-17 | A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended… |
CVE-2025-49176 | High | 7.3 | 2025-06-17 | A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an… |
CVE-2025-49175 | Medium | 6.1 | 2025-06-17 | A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, lead… |
CVE-2025-49071 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in NasaTheme Flozen flozen-theme allows Upload a Web Shell to a Web Server.This issue affects Flo… |
CVE-2025-48333 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPQuark eForm - WordPress Form Builder wp-fsqm-pro allows… |
CVE-2025-48274 | Critical | 9.3 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Blind SQL… |
CVE-2025-48145 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-ta… |
CVE-2025-48118 | High | 8.5 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpExperts Hub Woocommerce Partial Shipment wc-partial-shi… |
CVE-2025-48111 | Medium | 4.3 | 2025-06-17 | Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects… |