2025 CVEs (page 290)
Page 290 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5902 | High | 8.8 | 2025-06-09 | A vulnerability was found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This issue affects the function setUpgradeFW of the file /cgi-bin/cstecgi.cg… |
CVE-2025-5901 | High | 8.8 | 2025-06-09 | A vulnerability has been found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This vulnerability affects the function UploadCustomModule of the file… |
CVE-2025-30515 | Critical | 9.8 | 2025-06-09 | CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system. |
CVE-2025-30507 | Medium | 5.3 | 2025-06-09 | CyberData 011209 Intercom could allow an unauthenticated user to gather sensitive information through blind SQL injections. |
CVE-2025-30183 | High | 7.5 | 2025-06-09 | CyberData 011209 Intercom does not properly store or protect web server admin credentials. |
CVE-2025-26468 | High | 7.5 | 2025-06-09 | CyberData 011209 Intercom exposes features that could allow an unauthenticated to gain access and cause a denial-of-service condition or system disruption. |
CVE-2025-5900 | Medium | 4.3 | 2025-06-09 | A vulnerability, which was classified as problematic, was found in Tenda AC9 15.03.02.13. This affects an unknown part. The manipulation leads to cross-site re… |
CVE-2025-5899 | Medium | 5.3 | 2025-06-09 | A vulnerability classified as critical was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected by this vulnerability is the function parse_var… |
CVE-2025-5898 | Medium | 5.3 | 2025-06-09 | A vulnerability classified as critical has been found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected is the function parse_variables_option of… |
CVE-2025-49140 | High | 7.5 | 2025-06-09 | Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can b… |
CVE-2025-30184 | Critical | 9.8 | 2025-06-09 | CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path. |
CVE-2025-5897 | Medium | 4.3 | 2025-06-09 | A vulnerability was found in vuejs vue-cli up to 5.0.8. It has been rated as problematic. This issue affects the function HtmlPwaPlugin of the file packages/@v… |
CVE-2025-5896 | Medium | 4.3 | 2025-06-09 | A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/cs… |
CVE-2025-49141 | High | 8.5 | 2025-06-09 | HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `gitImportSite` functionality obtains a URL string… |
CVE-2025-49139 | Medium | 5.3 | 2025-06-09 | HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can create a website blo… |
CVE-2025-49138 | Medium | 6.5 | 2025-06-09 | HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, an authenticated Local File Inclusion (LFI) vulnerabil… |
CVE-2025-49137 | High | 8.5 | 2025-06-09 | HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user in… |
CVE-2025-49004 | High | 7.5 | 2025-06-09 | Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on an attacker-controll… |
CVE-2025-5918 | Low | 3.9 | 2025-06-09 | A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for rea… |
CVE-2025-5917 | Low | 2.8 | 2025-06-09 | A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file n… |
CVE-2025-5916 | Low | 3.9 | 2025-06-09 | A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC… |
CVE-2025-5915 | Medium | 6.6 | 2025-06-09 | A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exce… |
CVE-2025-5914 | High | 7.8 | 2025-06-09 | A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an inte… |
CVE-2025-5895 | Medium | 4.3 | 2025-06-09 | A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/li… |
CVE-2025-5892 | Medium | 4.3 | 2025-06-09 | A vulnerability, which was classified as problematic, has been found in RocketChat up to 7.6.1. This issue affects the function parseMessage of the file /apps/… |
CVE-2025-5891 | Medium | 4.3 | 2025-06-09 | A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The m… |
CVE-2025-5890 | Medium | 4.3 | 2025-06-09 | A vulnerability classified as problematic has been found in actions toolkit 0.5.0. This affects the function globEscape of the file toolkit/packages/glob/src/i… |
CVE-2025-5889 | Low | 3.1 | 2025-06-09 | A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the funct… |
CVE-2025-5888 | Medium | 4.3 | 2025-06-09 | A vulnerability was found in jsnjfz WebStack-Guns 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The man… |
CVE-2025-49653 | High | 8.0 | 2025-06-09 | Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform. |
CVE-2025-49652 | Critical | 9.8 | 2025-06-09 | Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when… |
CVE-2025-49651 | High | 8.1 | 2025-06-09 | Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the sessi… |
CVE-2025-5887 | Low | 3.5 | 2025-06-09 | A vulnerability was found in jsnjfz WebStack-Guns 1.0. It has been classified as problematic. Affected is an unknown function of the file UserMgrController.jav… |
CVE-2025-49136 | Critical | 9.0 | 2025-06-09 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` tem… |
CVE-2025-46041 | Medium | 5.4 | 2025-06-09 | A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the p… |
CVE-2025-45002 | Medium | 5.4 | 2025-06-09 | Vigybag v1.0 and before is vulnerable to Cross Site Scripting (XSS) via the upload profile picture function under my profile. |
CVE-2025-45001 | High | 7.5 | 2025-06-09 | react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compi… |
CVE-2025-29627 | Medium | 6.8 | 2025-06-09 | An issue in KeeperChat IOS Application v.5.8.8 allows a physically proximate attacker to escalate privileges via the Biometric Authentication Module |
CVE-2025-5886 | Low | 3.5 | 2025-06-09 | A vulnerability was found in Emlog up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin/article.php. The ma… |
CVE-2025-49297 | High | 8.1 | 2025-06-09 | Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from… |
CVE-2025-49296 | High | 8.1 | 2025-06-09 | Path Traversal: '.../...//' vulnerability in Mikado-Themes GrandPrix grandprix allows PHP Local File Inclusion.This issue affects GrandPrix: from n/a through <… |
CVE-2025-49295 | High | 8.1 | 2025-06-09 | Path Traversal: '.../...//' vulnerability in Mikado-Themes MediClinic mediclinic allows PHP Local File Inclusion.This issue affects MediClinic: from n/a throug… |
CVE-2025-49282 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magze magze allows PHP Local… |
CVE-2025-49281 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magways magways allows PHP Lo… |
CVE-2025-49280 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magty magty allows PHP Local… |
CVE-2025-49279 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogvy blogvy allows PHP Loca… |
CVE-2025-49278 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogty blogty allows PHP Loca… |
CVE-2025-49277 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogprise blogprise allows PH… |
CVE-2025-49276 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogmine blogmine allows PHP… |
CVE-2025-49275 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogbyte blogbyte allows PHP… |
CVE-2025-49265 | High | 7.5 | 2025-06-09 | Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained… |
CVE-2025-48281 | Critical | 9.3 | 2025-06-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer mystyle-c… |
CVE-2025-48279 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS… |
CVE-2025-48267 | High | 8.6 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal. This issue affects WP… |
CVE-2025-48261 | High | 7.5 | 2025-06-09 | Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Retrieve Embedded Sensitive Dat… |
CVE-2025-48147 | Medium | 6.5 | 2025-06-09 | Missing Authorization vulnerability in Crypto Cloud CryptoCloud - Crypto Payment Gateway cryptocloud-crypto-payment-gateway allows Exploiting Incorrectly Confi… |
CVE-2025-48143 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salesup2019 Formulario de contacto SalesUp! formularios-d… |
CVE-2025-48141 | Critical | 9.3 | 2025-06-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Zaytseff Multi CryptoCurrency Payments multi-crypto-… |
CVE-2025-48140 | Critical | 9.9 | 2025-06-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects M… |
CVE-2025-48139 | Medium | 6.5 | 2025-06-09 | Missing Authorization vulnerability in relentlo StyleAI relentlosoftware allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sty… |
CVE-2025-48130 | High | 7.5 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.Thi… |
CVE-2025-48129 | Critical | 9.8 | 2025-06-09 | Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-… |
CVE-2025-48126 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essentia… |
CVE-2025-48125 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Event Manager WP Event Manager wp-e… |
CVE-2025-48124 | High | 7.5 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce an… |
CVE-2025-48123 | Critical | 10.0 | 2025-06-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Lig… |
CVE-2025-48122 | Critical | 9.3 | 2025-06-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooComme… |
CVE-2025-47651 | High | 8.5 | 2025-06-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injec… |
CVE-2025-47608 | Critical | 9.3 | 2025-06-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recov… |
CVE-2025-47598 | Medium | 6.5 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in click5 History Log by click5 history-log-by-click5 allows… |
CVE-2025-47561 | High | 8.8 | 2025-06-09 | Incorrect Privilege Assignment vulnerability in RomanCode MapSVG mapsvg allows Privilege Escalation.This issue affects MapSVG: from n/a through < 8.6.13. |
CVE-2025-47527 | High | 7.1 | 2025-06-09 | Missing Authorization vulnerability in Icegram Icegram Collect icegram-rainmaker allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-47511 | Medium | 6.8 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversa… |
CVE-2025-47487 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-f… |
CVE-2025-47477 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-cap… |
CVE-2025-47463 | High | 7.1 | 2025-06-09 | Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured A… |
CVE-2025-46178 | Medium | 6.1 | 2025-06-09 | Cross-Site Scripting (XSS) vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. This allows remote attackers to inject… |
CVE-2025-45055 | Medium | 5.4 | 2025-06-09 | Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An authenticated user can upload a malicious SVG fi… |
CVE-2025-39539 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brewlabs WP Email Delivery wp-email-delivery allows Refle… |
CVE-2025-39476 | High | 7.5 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Revo revo allows PHP Local F… |
CVE-2025-39475 | High | 8.1 | 2025-06-09 | Path Traversal: '.../...//' vulnerability in Frenify Arlo arlo allows PHP Local File Inclusion.This issue affects Arlo: from n/a through <= 6.0.3. |
CVE-2025-39473 | High | 8.1 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebGeniusLab Seofy Core seofy-core allows PHP Local File Inclus… |
CVE-2025-32595 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Krowd krowd allows PHP Local Fi… |
CVE-2025-32308 | High | 7.6 | 2025-06-09 | Missing Authorization vulnerability in looks_awesome Team Builder a-team-showcase allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-32305 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sneeit WordPress FlatNews Theme flatnews allows Reflected… |
CVE-2025-32291 | Critical | 10.0 | 2025-06-09 | Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using Malicious Files.This issue affects SUMO… |
CVE-2025-31925 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup SHOUT lbg-audio8-html5-radio_ads allows Refl… |
CVE-2025-31920 | High | 8.5 | 2025-06-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech WP Guppy wp-guppy allows SQL Injection.This is… |
CVE-2025-31917 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal_video_playe… |
CVE-2025-31638 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Spare allows Reflected XSS. This issue affects S… |
CVE-2025-31635 | High | 7.5 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup CLEVER lbg-audio11-html5-shoutcast_history allows… |
CVE-2025-31429 | Critical | 9.8 | 2025-06-09 | Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection. This issue affect… |
CVE-2025-31426 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutca… |
CVE-2025-31424 | Critical | 9.3 | 2025-06-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows B… |
CVE-2025-31398 | Critical | 9.8 | 2025-06-09 | Deserialization of Untrusted Data vulnerability in themeton PIMP - Creative MultiPurpose allows Object Injection. This issue affects PIMP - Creative MultiPurpo… |
CVE-2025-31396 | Critical | 9.8 | 2025-06-09 | Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection. This issue affects FLAP - Business WordPre… |
CVE-2025-31061 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Wishlist wishlist allows Reflected XSS.This issu… |
CVE-2025-31059 | Critical | 9.3 | 2025-06-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in woobewoo WBW Product Table PRO woo-producttables-pro allo… |
CVE-2025-31058 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Revolution Video Player revolution_video_pla… |
CVE-2025-31057 | High | 7.1 | 2025-06-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player elementor_widget_univ… |