2025 CVEs (page 283)
Page 283 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47573 | Critical | 9.3 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla School Management allows Blind SQL Injection. Th… |
CVE-2025-47572 | High | 7.5 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla School Management allows PHP… |
CVE-2025-47559 | Critical | 9.9 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg allows Upload a Web Shell to a Web Server.This issue affects MapSVG: f… |
CVE-2025-47452 | Critical | 9.9 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR wpvr allows Upload a Web Shell to a Web Server.This issue affects WP VR: from n… |
CVE-2025-39508 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Reflected XSS.This i… |
CVE-2025-39486 | High | 8.5 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Rankie valvepress-rankie allows SQL Injection… |
CVE-2025-39479 | Critical | 9.3 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartiolabs Smart Notification allows Blind SQL Injection… |
CVE-2025-34508 | Medium | 6.3 | 2025-06-17 | A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker… |
CVE-2025-32549 | High | 7.5 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPGYM allows PHP Local File I… |
CVE-2025-32510 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in ovatheme Ovatheme Events Manager ova-events-manager allows Using Malicious Files.This issue af… |
CVE-2025-31919 | Critical | 9.8 | 2025-06-17 | Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection. This issue affects Spare: from n/a through 1.7. |
CVE-2025-30988 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player all… |
CVE-2025-30618 | Critical | 9.8 | 2025-06-17 | Deserialization of Untrusted Data vulnerability in yuliaz Rapyd Payment Extension for WooCommerce rapyd-payments allows Object Injection.This issue affects Rap… |
CVE-2025-30562 | High | 8.5 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdistillery Navigation Tree Elementor navigation-tree-el… |
CVE-2025-29002 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Simen snssimen allows PHP Loc… |
CVE-2025-28991 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Evon snsevon allows PHP Local… |
CVE-2025-28972 | High | 7.6 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Suhas Surse WP Employee Attendance System wp-employee-att… |
CVE-2025-24773 | Critical | 9.3 | 2025-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce w… |
CVE-2025-24761 | High | 8.1 | 2025-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme DSK dsk allows PHP Local File… |
CVE-2025-6069 | Medium | 4.3 | 2025-06-17 | The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-o… |
CVE-2025-4879 | High | 7.8 | 2025-06-17 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
CVE-2025-4404 | Critical | 9.1 | 2025-06-17 | A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCano… |
CVE-2025-49842 | | 2025-06-17 | conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the conda_forge_webservice Docker co… | |
CVE-2025-0320 | High | 7.8 | 2025-06-17 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Secure Access Client for Windows |
CVE-2025-6020 | High | 7.8 | 2025-06-17 | A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their p… |
CVE-2025-5777 | High | 7.5 | 2025-06-17 | Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA… |
CVE-2025-5349 | High | 8.8 | 2025-06-17 | Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway |
CVE-2025-4365 | High | 7.5 | 2025-06-17 | Arbitrary file read in NetScaler Console and NetScaler SDX (SVM) |
CVE-2025-5700 | Medium | 6.4 | 2025-06-17 | The Simple Logo Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.9.3 d… |
CVE-2025-5291 | Medium | 6.4 | 2025-06-17 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_pb and ms_slide sho… |
CVE-2025-3880 | Medium | 4.3 | 2025-06-17 | The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability… |
CVE-2025-6050 | Medium | 4.8 | 2025-06-17 | Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "… |
CVE-2025-3515 | High | 8.1 | 2025-06-17 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation… |
CVE-2025-40674 | | 2025-06-17 | Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the… | |
CVE-2025-6173 | Medium | 4.7 | 2025-06-17 | A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_pr… |
CVE-2025-6167 | Medium | 5.5 | 2025-06-17 | A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/… |
CVE-2025-6166 | Low | 3.5 | 2025-06-17 | A vulnerability was found in frdel Agent-Zero up to 0.8.4. It has been rated as problematic. This issue affects the function image_get of the file /python/api/… |
CVE-2025-6165 | High | 8.8 | 2025-06-17 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/f… |
CVE-2025-6164 | High | 8.8 | 2025-06-17 | A vulnerability was found in TOTOLINK A3002R 4.0.0-B20230531.1404. It has been classified as critical. This affects an unknown part of the file /boafrm/formMul… |
CVE-2025-5209 | Medium | 4.8 | 2025-06-17 | The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2025-6163 | High | 8.8 | 2025-06-17 | A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-6162 | High | 8.8 | 2025-06-17 | A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-6161 | High | 7.3 | 2025-06-17 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown function of the file /ed… |
CVE-2025-6160 | High | 7.3 | 2025-06-17 | A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown proc… |
CVE-2025-6159 | High | 7.3 | 2025-06-17 | A vulnerability classified as critical was found in code-projects Hostel Management System 1.0. This vulnerability affects unknown code of the file /allocate_r… |
CVE-2025-6158 | High | 8.8 | 2025-06-17 | A vulnerability classified as critical has been found in D-Link DIR-665 1.00. This affects the function sub_AC78 of the component HTTP POST Request Handler. Th… |
CVE-2025-6157 | High | 7.3 | 2025-06-17 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functi… |
CVE-2025-6156 | Medium | 6.3 | 2025-06-17 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2025-6155 | High | 7.3 | 2025-06-17 | A vulnerability was found in PHPGurukul Hostel Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /includes… |
CVE-2025-6154 | High | 7.3 | 2025-06-17 | A vulnerability was found in PHPGurukul Hostel Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /includ… |
CVE-2025-6153 | High | 7.3 | 2025-06-17 | A vulnerability has been found in PHPGurukul Hostel Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admi… |
CVE-2025-49823 | Unrated | | 2025-06-17 | (conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts proce… |
CVE-2025-6152 | Medium | 6.3 | 2025-06-17 | A vulnerability, which was classified as critical, was found in Steel Browser up to 0.1.3. This affects the function handleFileUpload of the file api/src/modul… |
CVE-2025-5673 | Medium | 6.5 | 2025-06-17 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the ‘prgSortPostType’ parameter in all versions up… |
CVE-2025-4775 | Medium | 6.4 | 2025-06-17 | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in al… |
CVE-2025-3774 | High | 7.2 | 2025-06-17 | The Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.3.4 due… |
CVE-2025-6151 | | 2025-06-17 | A vulnerability has been found in TP-Link TL-WR940N V4 and TL-WR841N V11. Affected by this issue is some unknown functionality of the file /userRpm/WanSlaacC… | |
CVE-2025-6150 | High | 8.8 | 2025-06-17 | A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2025-6149 | High | 8.8 | 2025-06-17 | A vulnerability classified as critical has been found in TOTOLINK A3002R 4.0.0-B20230531.1404. Affected is an unknown function of the file /boafrm/formSysLog o… |
CVE-2025-6148 | High | 8.8 | 2025-06-17 | A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615. It has been rated as critical. This issue affects some unknown processing of the file /boaf… |
CVE-2025-6147 | High | 8.8 | 2025-06-17 | A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm… |
CVE-2025-48993 | Medium | 6.1 | 2025-06-17 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be… |
CVE-2025-6146 | High | 8.8 | 2025-06-17 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. This affects an unknown part of the file /boafrm/formSysLog… |
CVE-2025-6145 | High | 8.8 | 2025-06-16 | A vulnerability was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2025-6144 | High | 8.8 | 2025-06-16 | A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-6143 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/fo… |
CVE-2025-48992 | Medium | 4.8 | 2025-06-16 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripti… |
CVE-2025-6142 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in Intera InHire up to 20250530. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The ma… |
CVE-2025-6141 | Low | 3.3 | 2025-06-16 | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of… |
CVE-2025-6140 | Low | 3.3 | 2025-06-16 | A vulnerability, which was classified as problematic, was found in spdlog up to 1.15.1. This affects the function scoped_padder in the library include/spdlog/p… |
CVE-2025-43200 | Medium | 4.2 | 2025-06-16 | This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3… |
CVE-2025-27587 | Medium | 5.3 | 2025-06-16 | OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages usin… |
CVE-2025-6139 | Low | 3.9 | 2025-06-16 | A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown functionality of the… |
CVE-2025-6138 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical was found in TOTOLINK T10 4.1.8cu.5207. Affected by this vulnerability is the function setWizardCfg of the file /cgi-bin… |
CVE-2025-49134 | Medium | 5.3 | 2025-06-16 | Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obt… |
CVE-2025-47951 | Medium | 4.9 | 2025-06-16 | Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate li… |
CVE-2025-32800 | Critical | 9.8 | 2025-06-16 | Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This pac… |
CVE-2025-32799 | Critical | 9.8 | 2025-06-16 | Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build processing logic is vulnerable to path traversal (Tar… |
CVE-2025-6137 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207. Affected is the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cg… |
CVE-2025-6136 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-32798 | Critical | 9.8 | 2025-06-16 | Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build recipe processing logic has been found to be vulnerab… |
CVE-2025-6135 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2025-6134 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in Projectworlds Life Insurance Management System 1.0. It has been classified as critical. This affects an unknown part of the file /… |
CVE-2025-6087 | Critical | 9.1 | 2025-06-16 | A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature… |
CVE-2025-32797 | High | 7.0 | 2025-06-16 | Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the write_build_scripts function in conda-build creates the temporary… |
CVE-2025-6133 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in Projectworlds Life Insurance Management System 1.0 and classified as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-6132 | High | 7.3 | 2025-06-16 | A vulnerability has been found in Chanjet CRM 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysconfig… |
CVE-2025-6179 | Critical | 9.8 | 2025-06-16 | Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and ac… |
CVE-2025-6177 | High | 7.4 | 2025-06-16 | Privilege Escalation in MiniOS in Google ChromeOS (16063.45.2 and potentially others) on enrolled devices allows a local attacker to gain root code execution v… |
CVE-2025-6131 | Low | 2.4 | 2025-06-16 | A vulnerability, which was classified as problematic, was found in CodeAstro Food Ordering System 1.0. Affected is an unknown function of the file /admin/store… |
CVE-2025-6130 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the… |
CVE-2025-5309 | Critical | 9.8 | 2025-06-16 | The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead t… |
CVE-2025-2327 | | 2025-06-16 | A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured. | |
CVE-2025-6170 | Low | 2.5 | 2025-06-16 | A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program… |
CVE-2025-6129 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This vulnerability affects unknown code of the file /boafrm/formSa… |
CVE-2025-6128 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This affects an unknown part of the file /boafrm/formWireless… |
CVE-2025-49796 | Critical | 9.1 | 2025-06-16 | A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an a… |
CVE-2025-49795 | High | 7.5 | 2025-06-16 | A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML inpu… |
CVE-2025-49794 | Critical | 9.1 | 2025-06-16 | A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the… |
CVE-2025-6127 | Low | 3.5 | 2025-06-16 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown fun… |