2025 CVEs (page 284)
Page 284 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5938 | Medium | 5.3 | 2025-06-13 | The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc… |
CVE-2025-5930 | Medium | 4.3 | 2025-06-13 | The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect n… |
CVE-2025-5928 | Medium | 4.3 | 2025-06-13 | The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due… |
CVE-2025-5926 | Medium | 6.1 | 2025-06-13 | The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due to missing or incorre… |
CVE-2025-5841 | Medium | 6.4 | 2025-06-13 | The ACF Onyx Poll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1.9 due t… |
CVE-2025-5491 | High | 8.8 | 2025-06-13 | Acer ControlCenter contains Remote Code Execution vulnerability. The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functi… |
CVE-2025-5288 | Critical | 9.8 | 2025-06-13 | The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capa… |
CVE-2025-5233 | Medium | 6.4 | 2025-06-13 | The Color Palette plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hex’ parameter in all versions up to, and including, 4.3.2 due to… |
CVE-2025-5123 | Medium | 6.4 | 2025-06-13 | The Contact Us Page – Contact People plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and inc… |
CVE-2025-4586 | Medium | 6.4 | 2025-06-13 | The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmcalendarview' shortcode in all versions up to, and incl… |
CVE-2025-4585 | Medium | 6.4 | 2025-06-13 | The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmflat' shortcode in all versions up to, and including, 1… |
CVE-2025-4584 | Medium | 6.4 | 2025-06-13 | The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode in all versions up to, and includi… |
CVE-2025-47959 | High | 7.1 | 2025-06-13 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a netwo… |
CVE-2025-30399 | High | 7.5 | 2025-06-13 | Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2025-4232 | High | 8.8 | 2025-06-13 | An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrati… |
CVE-2025-4231 | High | 7.2 | 2025-06-13 | A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker… |
CVE-2025-4230 | | 2025-06-13 | A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary… | |
CVE-2025-4228 | | 2025-06-13 | An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain file… | |
CVE-2025-4233 | | 2025-06-12 | An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control policies. | |
CVE-2025-41234 | Medium | 6.5 | 2025-06-12 | Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack… |
CVE-2025-41233 | Medium | 6.8 | 2025-06-12 | Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of the issue to be in the… |
CVE-2025-49589 | | 2025-06-12 | PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. A stack-based buffer overflow exists in the Kprintf_HLE function of PCSX2 versions up to 2.3.414… | |
CVE-2025-44091 | Medium | 5.4 | 2025-06-12 | yangyouwang crud v1.0.0 is vulnerable to Cross Site Scripting (XSS) via the role management function. |
CVE-2025-27689 | High | 7.8 | 2025-06-12 | Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. A low privileged attacker with local access could potentia… |
CVE-2025-6031 | High | 7.5 | 2025-06-12 | Amazon Cloud Cam is a home security camera that was deprecated on December 2, 2022, is end of life, and is no longer actively supported. When a user powers o… |
CVE-2025-5485 | High | 8.6 | 2025-06-12 | User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malici… |
CVE-2025-5484 | High | 8.3 | 2025-06-12 | A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier prin… |
CVE-2025-4418 | Medium | 4.4 | 2025-06-12 | An improper validation of integrity check value vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could al… |
CVE-2025-4417 | Medium | 5.5 | 2025-06-12 | A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator misc… |
CVE-2025-44019 | High | 7.1 | 2025-06-12 | AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary P… |
CVE-2025-36539 | Medium | 6.5 | 2025-06-12 | AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary P… |
CVE-2025-2745 | Medium | 6.5 | 2025-06-12 | A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with pr… |
CVE-2025-49579 | Medium | 6.5 | 2025-06-12 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are in… |
CVE-2025-49578 | Medium | 6.5 | 2025-06-12 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw… |
CVE-2025-49577 | Medium | 6.5 | 2025-06-12 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody wh… |
CVE-2025-49576 | Medium | 6.5 | 2025-06-12 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system… |
CVE-2025-49575 | Medium | 6.5 | 2025-06-12 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw H… |
CVE-2025-49081 | Medium | 4.9 | 2025-06-12 | There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with syst… |
CVE-2025-43866 | High | 7.5 | 2025-06-12 | vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the us… |
CVE-2025-43863 | Critical | 9.8 | 2025-06-12 | vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If… |
CVE-2025-5982 | Low | 3.7 | 2025-06-12 | An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditio… |
CVE-2025-49080 | High | 7.5 | 2025-06-12 | There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Deni… |
CVE-2025-49467 | | 2025-06-12 | A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publi… | |
CVE-2025-46035 | High | 7.5 | 2025-06-12 | Buffer Overflow vulnerability in Tenda AC6 v.15.03.05.16 allows a remote attacker to cause a denial of service via the oversized schedStartTime and schedEndTim… |
CVE-2025-36573 | High | 7.1 | 2025-06-12 | Dell Smart Dock Firmware, versions prior to 01.00.08.01, contain an Insertion of Sensitive Information into Log File vulnerability. A user with local access co… |
CVE-2025-29744 | Medium | 5.4 | 2025-06-12 | pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers. |
CVE-2025-49200 | Medium | 6.5 | 2025-06-12 | The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup fil… |
CVE-2025-49199 | High | 8.8 | 2025-06-12 | The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows… |
CVE-2025-49198 | Low | 3.1 | 2025-06-12 | The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible… |
CVE-2025-49197 | Medium | 6.5 | 2025-06-12 | The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account. |
CVE-2025-49196 | Medium | 6.5 | 2025-06-12 | A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in unexpected ways or s… |
CVE-2025-49195 | Medium | 5.3 | 2025-06-12 | The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the… |
CVE-2025-49194 | High | 7.5 | 2025-06-12 | The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic betwe… |
CVE-2025-49193 | Medium | 4.2 | 2025-06-12 | The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing… |
CVE-2025-49192 | Medium | 4.3 | 2025-06-12 | The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on s… |
CVE-2025-49191 | Medium | 4.8 | 2025-06-12 | Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible… |
CVE-2025-49190 | Medium | 4.3 | 2025-06-12 | The application is vulnerable to Server-Side Request Forgery (SSRF). An endpoint can be used to send server internal requests to other ports. |
CVE-2025-49189 | Medium | 5.3 | 2025-06-12 | The HttpOnlyflag of the session cookie \"@@\" is set to false. Since this flag helps preventing access to cookies via client-side scripts, setting the flag to… |
CVE-2025-49188 | Medium | 5.3 | 2025-06-12 | The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering. |
CVE-2025-49187 | Medium | 5.3 | 2025-06-12 | For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existin… |
CVE-2025-49186 | Medium | 5.3 | 2025-06-12 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute… |
CVE-2025-49185 | Medium | 5.5 | 2025-06-12 | The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into… |
CVE-2025-49184 | High | 7.5 | 2025-06-12 | A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product. |
CVE-2025-49183 | High | 7.5 | 2025-06-12 | All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the poss… |
CVE-2025-49182 | High | 7.5 | 2025-06-12 | Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the a… |
CVE-2025-49181 | High | 8.6 | 2025-06-12 | Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET requests to gather sensitive information. An attacker could also send HTT… |
CVE-2025-6021 | High | 7.5 | 2025-06-12 | A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue… |
CVE-2025-5195 | Medium | 4.3 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. It was possible for… |
CVE-2025-0673 | High | 7.5 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2, allow an attacker t… |
CVE-2025-5996 | Medium | 6.5 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input va… |
CVE-2025-4278 | High | 8.7 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search pag… |
CVE-2025-2254 | High | 8.7 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper output enc… |
CVE-2025-1516 | Medium | 6.5 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper input valid… |
CVE-2025-1478 | Medium | 6.5 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input val… |
CVE-2025-6003 | Medium | 5.3 | 2025-06-12 | The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versi… |
CVE-2025-4613 | High | 8.8 | 2025-06-12 | Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking… |
CVE-2025-5301 | Medium | 6.1 | 2025-06-12 | ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI… |
CVE-2025-40592 | Medium | 6.1 | 2025-06-12 | A vulnerability has been identified in Mendix Studio Pro 10 (All versions < V10.23.0), Mendix Studio Pro 10.12 (All versions < V10.12.17), Mendix Studio Pro 10… |
CVE-2025-5012 | High | 8.8 | 2025-06-12 | The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file ty… |
CVE-2025-4973 | Critical | 9.8 | 2025-06-12 | The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to… |
CVE-2025-35978 | High | 7.1 | 2025-06-12 | Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to… |
CVE-2025-6009 | Medium | 4.7 | 2025-06-12 | A vulnerability was found in kiCode111 like-girl 5.2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ipAd… |
CVE-2025-6008 | Medium | 4.7 | 2025-06-12 | A vulnerability has been found in kiCode111 like-girl 5.2.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-6007 | Medium | 4.7 | 2025-06-12 | A vulnerability, which was classified as critical, was found in kiCode111 like-girl 5.2.0. Affected is an unknown function of the file /admin/CopyadminPost.php… |
CVE-2025-6006 | Medium | 4.7 | 2025-06-12 | A vulnerability, which was classified as critical, has been found in kiCode111 like-girl 5.2.0. This issue affects some unknown processing of the file /admin/I… |
CVE-2025-6005 | Medium | 4.7 | 2025-06-12 | A vulnerability classified as critical was found in kiCode111 like-girl 5.2.0. This vulnerability affects unknown code of the file /admin/aboutPost.php. The ma… |
CVE-2025-32466 | | 2025-06-11 | A SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for Joomla was discovered. The issue occurs within the dashboard component, where use… | |
CVE-2025-32465 | | 2025-06-11 | A stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for Joomla was discovered. It allows attackers to perform cross-site scripting (XSS) attacks… | |
CVE-2025-30085 | | 2025-06-11 | Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomla was discovered. The issue occurs within the submission export feature and… | |
CVE-2025-49150 | Medium | 5.9 | 2025-06-11 | Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by… |
CVE-2025-40912 | Critical | 9.8 | 2025-06-11 | CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode. CryptX embeds the tomcrypt library. The versions of t… |
CVE-2025-25032 | High | 7.5 | 2025-06-11 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of… |
CVE-2025-0923 | Medium | 5.3 | 2025-06-11 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 stores source code on the web server that could aid in… |
CVE-2025-0917 | Medium | 5.5 | 2025-06-11 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to stored cross-site scripting. This vuln… |
CVE-2025-0913 | Medium | 5.5 | 2025-06-11 | os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile wi… |
CVE-2025-6002 | High | 7.2 | 2025-06-11 | An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload files with arbitrar… |
CVE-2025-6001 | High | 8.3 | 2025-06-11 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the product image upload function of VirtueMart that bypasses the CSRF protection token. An attacke… |
CVE-2025-4673 | Medium | 6.8 | 2025-06-11 | Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. |
CVE-2025-40915 | High | 7.0 | 2025-06-11 | Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens. That version of the module generates tokens as an MD5 of… |
CVE-2025-22874 | High | 7.5 | 2025-06-11 | Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains whi… |