2025 CVEs (page 284)
Page 284 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6126 | Medium | 4.3 | 2025-06-16 | A vulnerability was found in PHPGurukul Rail Pass Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown func… |
CVE-2025-4565 | Medium | 5.3 | 2025-06-16 | Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messa… |
CVE-2025-49125 | High | 7.5 | 2025-06-16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the ro… |
CVE-2025-49124 | High | 8.4 | 2025-06-16 | Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without speci… |
CVE-2025-48988 | High | 7.5 | 2025-06-16 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10… |
CVE-2025-48976 | High | 7.5 | 2025-06-16 | Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Com… |
CVE-2025-3594 | Critical | 9.8 | 2025-06-16 | Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through u… |
CVE-2025-3526 | High | 7.5 | 2025-06-16 | SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does… |
CVE-2025-6125 | Low | 2.4 | 2025-06-16 | A vulnerability was found in PHPGurukul Rail Pass Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /ad… |
CVE-2025-6124 | High | 7.3 | 2025-06-16 | A vulnerability was found in code-projects Restaurant Order System 1.0 and classified as critical. This issue affects some unknown processing of the file /tabl… |
CVE-2025-3602 | High | 7.5 | 2025-06-16 | Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 thro… |
CVE-2025-36632 | High | 7.8 | 2025-06-16 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege. |
CVE-2025-6123 | High | 7.3 | 2025-06-16 | A vulnerability has been found in code-projects Restaurant Order System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pa… |
CVE-2025-6122 | Medium | 6.3 | 2025-06-16 | A vulnerability, which was classified as critical, was found in code-projects Restaurant Order System 1.0. This affects an unknown part of the file /table.php… |
CVE-2025-6121 | Critical | 9.8 | 2025-06-16 | A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08. Affected by this issue is the function get_pure_content of the co… |
CVE-2025-6120 | Medium | 5.3 | 2025-06-16 | A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function read_meshes in… |
CVE-2025-5689 | High | 8.5 | 2025-06-16 | A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part o… |
CVE-2025-46710 | Medium | 5.7 | 2025-06-16 | Possible kernel exceptions caused by reading and writing kernel heap data after free. |
CVE-2025-24388 | Low | 3.8 | 2025-06-16 | A vulnerability in the OTRS Admin Interface and Agent Interface (versions before OTRS 8) allow parameter injection due to for an autheniticated agent or admin… |
CVE-2025-6119 | Medium | 5.3 | 2025-06-16 | A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHLoader::ReadNodeChan… |
CVE-2025-6118 | High | 7.3 | 2025-06-16 | A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-4748 | | 2025-06-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, Fil… | |
CVE-2025-47869 | Critical | 9.8 | 2025-06-16 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability was discovered in Apache NuttX RTOS apps/exapmles/xmlrpc application. In… |
CVE-2025-47868 | Critical | 9.8 | 2025-06-16 | Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part o… |
CVE-2025-40916 | Critical | 9.1 | 2025-06-16 | Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() funct… |
CVE-2025-6117 | High | 7.3 | 2025-06-16 | A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2025-6116 | High | 7.3 | 2025-06-16 | A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been classified as critical. This affects an unknown part of the file /IntraFi… |
CVE-2025-25265 | Medium | 4.9 | 2025-06-16 | A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to rea… |
CVE-2025-25264 | Medium | 6.5 | 2025-06-16 | An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allow… |
CVE-2025-6172 | Critical | 9.8 | 2025-06-16 | Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation. |
CVE-2025-6115 | High | 8.8 | 2025-06-16 | A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this issue is the function form_macfilter. The manipulation of the… |
CVE-2025-6114 | High | 8.8 | 2025-06-16 | A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this vulnerability is the function form_portforwarding of the… |
CVE-2025-40729 | Medium | 6.1 | 2025-06-16 | Reflected Cross-Site Scripting (XSS) in /customer_support/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code vi… |
CVE-2025-40728 | High | 8.8 | 2025-06-16 | SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete databas… |
CVE-2025-40727 | | 2025-06-16 | A Reflected Cross Site Scripting (XSS) vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrar… | |
CVE-2025-40726 | | 2025-06-16 | Reflected Cross-Site Scripting (XSS) vulnerability in /pages/search-results-page in Nosto, which allows remote attackers to execute arbitrary code via the q GE… | |
CVE-2025-3464 | | 2025-06-16 | A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication… | |
CVE-2025-2091 | Medium | 5.4 | 2025-06-16 | An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF fi… |
CVE-2025-6113 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, was found in Tenda FH1203 2.0.1.6. Affected is the function fromadvsetlanip of the file /goform/AdvSetLanip… |
CVE-2025-6112 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, has been found in Tenda FH1205 2.0.0.7. This issue affects the function fromadvsetlanip of the file /goform/… |
CVE-2025-4987 | High | 8.7 | 2025-06-16 | A stored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2023x through Releas… |
CVE-2025-6169 | Critical | 9.8 | 2025-06-16 | The WIMP website co-construction management platform from HAMASTAR Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to i… |
CVE-2025-6111 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical was found in Tenda FH1205 2.0.0.7(775). This vulnerability affects the function fromVirtualSer of the file /goform/Virtu… |
CVE-2025-6110 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical has been found in Tenda FH1201 1.2.0.14(408). This affects an unknown part of the file /goform/SafeMacFilter. The manipu… |
CVE-2025-6109 | Medium | 4.3 | 2025-06-16 | A vulnerability was found in javahongxi whatsmars 2021.4.0. It has been rated as problematic. Affected by this issue is the function initialize of the file /wh… |
CVE-2025-6108 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in hansonwang99 Spring-Boot-In-Action up to 807fd37643aa774b94fd004cc3adbd29ca17e9aa. It has been declared as critical. Affected by t… |
CVE-2025-6107 | Low | 3.1 | 2025-06-16 | A vulnerability was found in comfyanonymous comfyui 0.3.40. It has been classified as problematic. Affected is the function set_attr of the file /comfy/utils.p… |
CVE-2025-6106 | Medium | 4.3 | 2025-06-16 | A vulnerability was found in WuKongOpenSource WukongCRM 9.0 and classified as problematic. This issue affects some unknown processing of the file AdminRoleCont… |
CVE-2025-6105 | Medium | 4.3 | 2025-06-16 | A vulnerability has been found in jflyfox jfinal_cms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The ma… |
CVE-2025-6104 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/p… |
CVE-2025-6103 | High | 8.8 | 2025-06-16 | A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functio… |
CVE-2025-6102 | High | 8.8 | 2025-06-16 | A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-6101 | Medium | 5.5 | 2025-06-16 | A vulnerability classified as critical has been found in letta-ai letta up to 0.4.1. Affected is the function function_message of the file letta/letta/interfac… |
CVE-2025-6100 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in realguoshuai open-video-cms 1.0. It has been rated as critical. This issue affects some unknown processing of the file /v1/video/l… |
CVE-2025-6099 | Medium | 5.3 | 2025-06-16 | A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects… |
CVE-2025-6098 | Critical | 9.8 | 2025-06-16 | A vulnerability was found in UTT 进取 750W up to 5.0. It has been classified as critical. This affects the function strcpy of the file /goform/setSysAdm of the c… |
CVE-2025-6097 | Medium | 5.3 | 2025-06-16 | A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/… |
CVE-2025-6096 | Medium | 6.3 | 2025-06-16 | A vulnerability has been found in codesiddhant Jasmin Ransomware up to 1.0.1 and classified as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2025-6095 | High | 7.3 | 2025-06-15 | A vulnerability, which was classified as critical, was found in codesiddhant Jasmin Ransomware 1.0.1. Affected is an unknown function of the file /checklogin.p… |
CVE-2025-6094 | Medium | 6.3 | 2025-06-15 | A vulnerability, which was classified as critical, has been found in qianfox FoxCMS up to 1.2.5. This issue affects the function batchCope of the file app/admi… |
CVE-2025-6093 | Medium | 5.5 | 2025-06-15 | A vulnerability classified as critical was found in uYanki board-stm32f103rc-berial up to 84daed541609cb7b46854cc6672a275d1007e295. This vulnerability affects… |
CVE-2025-5964 | Medium | 6.5 | 2025-06-15 | A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the server. |
CVE-2025-6092 | Medium | 4.3 | 2025-06-15 | A vulnerability was found in comfyanonymous comfyui up to 0.3.39. It has been declared as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2025-5990 | High | 7.6 | 2025-06-15 | An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perfo… |
CVE-2025-6091 | High | 8.8 | 2025-06-15 | A vulnerability was found in H3C GR-3000AX V100R007L50. It has been classified as critical. Affected is the function UpdateWanParamsMulti/UpdateIpv6Params of t… |
CVE-2025-6090 | High | 8.8 | 2025-06-15 | A vulnerability was found in H3C GR-5400AX V100R009L50 and classified as critical. This issue affects the function UpdateWanparamsMulti/UpdateIpv6params of the… |
CVE-2025-22854 | | 2025-06-15 | Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions. | |
CVE-2025-21085 | | 2025-06-15 | PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization. | |
CVE-2025-6089 | Medium | 4.3 | 2025-06-15 | A vulnerability has been found in Astun Technology iShare Maps 5.4.0 and classified as problematic. This vulnerability affects unknown code of the file atCheck… |
CVE-2025-36041 | Medium | 4.7 | 2025-06-15 | IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC… |
CVE-2025-1411 | High | 7.8 | 2025-06-15 | IBM Security Verify Directory Container 10.0.0.0 through 10.0.3.1 could allow a local user to execute commands as root due to execution with unnecessary privil… |
CVE-2025-5337 | Medium | 6.4 | 2025-06-14 | The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ parameter in all version… |
CVE-2025-5238 | Medium | 6.4 | 2025-06-14 | The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4… |
CVE-2025-4667 | Medium | 6.4 | 2025-06-14 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin… |
CVE-2025-6070 | Medium | 6.5 | 2025-06-14 | The Restrict File Access plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.2 via the output() function. This… |
CVE-2025-6065 | Critical | 9.1 | 2025-06-14 | The Image Resizer On The Fly plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' task in all… |
CVE-2025-6064 | Medium | 6.1 | 2025-06-14 | The WP URL Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or inco… |
CVE-2025-6063 | Medium | 6.1 | 2025-06-14 | The XiSearch bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6. This is due to missing or incorrec… |
CVE-2025-6062 | Medium | 4.3 | 2025-06-14 | The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01. This is due to m… |
CVE-2025-6061 | Medium | 6.4 | 2025-06-14 | The kk Youtube Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kkytv' shortcode in all versions up to, and including… |
CVE-2025-6055 | Medium | 6.1 | 2025-06-14 | The Zen Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing or inc… |
CVE-2025-6040 | Medium | 6.1 | 2025-06-14 | The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incor… |
CVE-2025-5589 | Medium | 6.4 | 2025-06-14 | The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘status-classic-offline-text’ parameter in all ver… |
CVE-2025-5336 | Medium | 6.4 | 2025-06-14 | The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-no_number’ parameter in all versions up to, and including, 4… |
CVE-2025-4592 | Medium | 4.3 | 2025-06-14 | The AI Image Lab – Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This i… |
CVE-2025-4216 | Medium | 6.4 | 2025-06-14 | The DIOT SCADA with MQTT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'diot' shortcode in all versions up to, and includi… |
CVE-2025-4200 | High | 8.1 | 2025-06-14 | The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including… |
CVE-2025-4187 | Medium | 5.9 | 2025-06-14 | The UserPro - Community and User Profile WordPress Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.1.1… |
CVE-2025-5487 | High | 7.2 | 2025-06-14 | The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to time-based SQL In… |
CVE-2025-3234 | High | 7.2 | 2025-06-14 | The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and inc… |
CVE-2025-6059 | Medium | 4.3 | 2025-06-14 | The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to miss… |
CVE-2025-33108 | High | 8.5 | 2025-06-14 | IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges du… |
CVE-2025-25215 | High | 8.8 | 2025-06-13 | An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36… |
CVE-2025-24919 | High | 8.1 | 2025-06-13 | A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Pl… |
CVE-2025-6083 | Medium | 4.3 | 2025-06-13 | In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to sea… |
CVE-2025-49598 | | 2025-06-13 | conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to… | |
CVE-2025-25050 | High | 8.8 | 2025-06-13 | An out-of-bounds write vulnerability exists in the cv_upgrade_sensor_firmware functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault 3… |
CVE-2025-24922 | High | 8.8 | 2025-06-13 | A stack-based buffer overflow vulnerability exists in the securebio_identify functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Pl… |
CVE-2025-24311 | High | 8.4 | 2025-06-13 | An out-of-bounds read vulnerability exists in the cv_send_blockdata functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior… |
CVE-2025-49597 | Low | 3.9 | 2025-06-13 | handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could b… |