2025 CVEs (page 291)
Page 291 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31052 | Critical | 9.8 | 2025-06-09 | Deserialization of Untrusted Data vulnerability in themeton The Fashion - Model Agency One Page Beauty Theme nrgfashion allows Object Injection.This issue affe… |
CVE-2025-31050 | High | 7.5 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in appthaplugins Apptha Slider Gallery apptha-slider-gallery allow… |
CVE-2025-31045 | High | 7.5 | 2025-06-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in elfsight elfsight Contact Form widget elfsight-contact-form allows… |
CVE-2025-31039 | Critical | 9.1 | 2025-06-09 | Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Cate… |
CVE-2025-31022 | Critical | 9.8 | 2025-06-09 | Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU… |
CVE-2025-31019 | High | 8.8 | 2025-06-09 | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abus… |
CVE-2025-28992 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme SNS Anton snsanton allows PHP… |
CVE-2025-28945 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Valen - Sport, Fashion WooCom… |
CVE-2025-28944 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Avaz snsavaz allows PHP Local… |
CVE-2025-28888 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme GiftXtore bw-giftxtore allows… |
CVE-2025-27362 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Petito bw-petito allows PHP L… |
CVE-2025-26592 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Lab lab allows PHP Local F… |
CVE-2025-24770 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme CraftXtore bw-craftxtore allo… |
CVE-2025-24768 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Nitan snsnitan allows PHP Loc… |
CVE-2025-24767 | Critical | 9.3 | 2025-06-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in facturaone TicketBAI Facturas para WooCommerce wp-ticketb… |
CVE-2025-23974 | High | 8.1 | 2025-06-09 | Incorrect Privilege Assignment vulnerability in ifkooo One-Login one-login allows Privilege Escalation.This issue affects One-Login: from n/a through <= 1.4. |
CVE-2025-5885 | Medium | 4.3 | 2025-06-09 | A vulnerability has been found in Konica Minolta bizhub up to 20250202 and classified as problematic. This vulnerability affects unknown code. The manipulation… |
CVE-2025-5884 | Low | 3.5 | 2025-06-09 | A vulnerability, which was classified as problematic, was found in Konica Minolta bizhub up to 20250202. This affects an unknown part of the component Display… |
CVE-2025-5881 | Medium | 6.3 | 2025-06-09 | A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confi… |
CVE-2025-5880 | Medium | 4.3 | 2025-06-09 | A vulnerability has been found in Whistle 2.9.98 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/sessions/get-temp-… |
CVE-2025-5879 | Low | 3.5 | 2025-06-09 | A vulnerability, which was classified as problematic, was found in WuKongOpenSource WukongCRM 9.0. This affects an unknown part of the file AdminSysConfigContr… |
CVE-2025-5877 | Medium | 6.3 | 2025-06-09 | A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of… |
CVE-2025-49131 | Medium | 6.3 | 2025-06-09 | FastGPT is an open-source project that provides a platform for building, deploying, and operating AI-driven workflows and conversational agents. The Sandbox co… |
CVE-2025-49130 | | 2025-06-09 | Laravel Translation Manager is a package to manage Laravel translation files. Prior to version 0.6.8, the application is vulnerable to Cross-Site Scripting (XS… | |
CVE-2025-49013 | Critical | 9.9 | 2025-06-09 | WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue a… |
CVE-2025-49006 | | 2025-06-09 | Wasp (Web Application Specification) is a Rails-like framework for React, Node.js, and Prisma. Prior to version 0.16.6, Wasp authentication has a vulnerability… | |
CVE-2025-48877 | Critical | 9.8 | 2025-06-09 | Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.bet… |
CVE-2025-48062 | High | 7.1 | 2025-06-09 | Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.bet… |
CVE-2025-48053 | High | 7.5 | 2025-06-09 | Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.bet… |
CVE-2025-40670 | High | 8.8 | 2025-06-09 | Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by… |
CVE-2025-40669 | Medium | 6.5 | 2025-06-09 | Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the appl… |
CVE-2025-40668 | Medium | 6.5 | 2025-06-09 | Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other user… |
CVE-2025-5876 | Medium | 5.3 | 2025-06-09 | A vulnerability classified as problematic was found in Lucky LM-520-SC, LM-520-FSC and LM-520-FSC-SAM up to 20250321. Affected by this vulnerability is an unkn… |
CVE-2025-5875 | High | 8.8 | 2025-06-09 | A vulnerability classified as critical has been found in TP-LINK Technologies TL-IPC544EP-W4 1.0.9 Build 240428 Rel 69493n. Affected is the function sub_69064… |
CVE-2025-41444 | High | 8.3 | 2025-06-09 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module. |
CVE-2025-5874 | Medium | 4.6 | 2025-06-09 | A vulnerability was found in Redash up to 10.1.0/25.1.0. It has been rated as problematic. This issue affects the function run_query of the file /query_runner/… |
CVE-2025-5873 | Medium | 6.3 | 2025-06-09 | A vulnerability was detected in eCharge Hardy Barth Salia PLCC up to 2.3.81. Affected by this issue is some unknown functionality of the file /firmware.php of… |
CVE-2025-41437 | Medium | 4.3 | 2025-06-09 | Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer and OpUtils versions 128565 and below are vulnerable to Ref… |
CVE-2025-3835 | Critical | 9.6 | 2025-06-09 | Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module. |
CVE-2025-36528 | High | 8.3 | 2025-06-09 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports. |
CVE-2025-27709 | High | 8.3 | 2025-06-09 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports. |
CVE-2025-5872 | Medium | 5.3 | 2025-06-09 | A vulnerability was found in eGauge EG3000 Energy Monitor 3.6.3. It has been classified as problematic. This affects an unknown part of the component Setting H… |
CVE-2025-5871 | Medium | 5.3 | 2025-06-09 | A vulnerability was found in Papendorf SOL Connect Center 3.3.0.0 and classified as problematic. Affected by this issue is some unknown functionality of the co… |
CVE-2025-40675 | Medium | 6.1 | 2025-06-09 | A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the… |
CVE-2025-5870 | High | 7.3 | 2025-06-09 | A vulnerability has been found in TRENDnet TV-IP121W 1.1.1 Build 36 and classified as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-5869 | High | 8.0 | 2025-06-09 | A vulnerability, which was classified as critical, was found in RT-Thread 5.1.0. Affected is the function sys_recvfrom of the file rt-thread/components/lwp/lwp… |
CVE-2025-5894 | High | 8.8 | 2025-06-09 | Smart Parking Management System from Honding Technology has a Missing Authorization vulnerability, allowing remote attackers with regular privileges to access… |
CVE-2025-5868 | High | 8.0 | 2025-06-09 | A vulnerability, which was classified as critical, has been found in RT-Thread 5.1.0. This issue affects the function sys_thread_sigprocmask of the file rt-thr… |
CVE-2025-5867 | High | 8.0 | 2025-06-09 | A vulnerability classified as critical was found in RT-Thread 5.1.0. This vulnerability affects the function csys_sendto of the file rt-thread/components/lwp/l… |
CVE-2025-5893 | Critical | 9.8 | 2025-06-09 | Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to ac… |
CVE-2025-5866 | High | 8.0 | 2025-06-09 | A vulnerability classified as critical has been found in RT-Thread 5.1.0. This affects the function sys_sigprocmask of the file rt-thread/components/lwp/lwp_sy… |
CVE-2025-5865 | High | 8.0 | 2025-06-09 | A vulnerability was found in RT-Thread 5.1.0. It has been rated as critical. Affected by this issue is the function sys_select of the file rt-thread/components… |
CVE-2025-5864 | Low | 3.7 | 2025-06-09 | A vulnerability was found in Tenda TDSEE App up to 1.7.12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-5863 | High | 8.8 | 2025-06-09 | A vulnerability was found in Tenda AC5 15.03.06.47. It has been classified as critical. Affected is the function formSetRebootTimer of the file /goform/SetRebo… |
CVE-2025-4652 | Medium | 6.1 | 2025-06-09 | The Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Sit… |
CVE-2025-47712 | Medium | 6.5 | 2025-06-09 | A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for… |
CVE-2025-47711 | Medium | 6.5 | 2025-06-09 | There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a ve… |
CVE-2025-3582 | Medium | 4.8 | 2025-06-09 | The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to pe… |
CVE-2025-3581 | Medium | 4.8 | 2025-06-09 | The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/post where the bloc… |
CVE-2025-25209 | Medium | 5.7 | 2025-06-09 | The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes those secretes are already in the kuadrant-sy… |
CVE-2025-25208 | Medium | 5.7 | 2025-06-09 | A Developer persona can bring down the Authorino service, preventing the evaluation of all AuthPolicies on the cluster |
CVE-2025-25207 | Medium | 5.7 | 2025-06-09 | The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer pers… |
CVE-2025-5862 | High | 8.8 | 2025-06-09 | A vulnerability was found in Tenda AC7 15.03.06.44 and classified as critical. This issue affects the function formSetPPTPUserList of the file /goform/setPptpU… |
CVE-2025-5861 | High | 8.8 | 2025-06-09 | A vulnerability has been found in Tenda AC7 15.03.06.44 and classified as critical. This vulnerability affects the function fromadvsetlanip of the file /goform… |
CVE-2025-5860 | High | 7.3 | 2025-06-09 | A vulnerability, which was classified as critical, was found in PHPGurukul Maid Hiring Management System 1.0. This affects an unknown part of the file /admin/s… |
CVE-2025-5859 | Medium | 6.3 | 2025-06-09 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2025-5858 | Medium | 6.3 | 2025-06-09 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the f… |
CVE-2025-5857 | Medium | 6.3 | 2025-06-09 | A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. This issue affects some unknown processing of the f… |
CVE-2025-5856 | High | 7.3 | 2025-06-09 | A vulnerability has been found in PHPGurukul BP Monitoring Management System 1.0 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2025-5855 | High | 8.8 | 2025-06-09 | A vulnerability, which was classified as critical, was found in Tenda AC6 15.03.05.16. This affects the function formSetRebootTimer of the file /goform/SetRebo… |
CVE-2025-5854 | High | 8.8 | 2025-06-09 | A vulnerability, which was classified as critical, has been found in Tenda AC6 15.03.05.16. Affected by this issue is the function fromadvsetlanip of the file… |
CVE-2025-5853 | High | 8.8 | 2025-06-09 | A vulnerability classified as critical was found in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formSetSafeWanWebMan of the file /gof… |
CVE-2025-5852 | High | 8.8 | 2025-06-09 | A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function formSetPPTPUserList of the file /goform/setPptpUserLis… |
CVE-2025-5851 | High | 8.8 | 2025-06-09 | A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been rated as critical. This issue affects the function fromadvsetlanip of the file /goform/A… |
CVE-2025-5850 | High | 8.8 | 2025-06-08 | A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been declared as critical. This vulnerability affects the function formsetschedled of the fil… |
CVE-2025-5849 | High | 8.8 | 2025-06-08 | A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been classified as critical. This affects the function formSetSafeWanWebMan of the file /gofo… |
CVE-2025-5848 | High | 8.8 | 2025-06-08 | A vulnerability was found in Tenda AC15 15.03.05.19_multi and classified as critical. Affected by this issue is the function formSetPPTPUserList of the file /g… |
CVE-2025-3461 | Critical | 9.1 | 2025-06-08 | The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Functi… |
CVE-2025-3460 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Ne… |
CVE-2025-3459 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, "Improper… |
CVE-2025-35010 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM comman… |
CVE-2025-35009 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command… |
CVE-2025-35008 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command… |
CVE-2025-35007 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command… |
CVE-2025-35006 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD comma… |
CVE-2025-35005 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command t… |
CVE-2025-35004 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command th… |
CVE-2025-32459 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the sync_time argument), that is vulnerable to command injection. This is… |
CVE-2025-32458 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection… |
CVE-2025-32457 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_file_from_qtn argument), that is vulnerable to command injection… |
CVE-2025-32456 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. Th… |
CVE-2025-32455 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the run_cmd argument), that is vulnerable to command injection. This is an… |
CVE-2025-5847 | High | 8.8 | 2025-06-08 | A vulnerability has been found in Tenda AC9 15.03.02.13 and classified as critical. Affected by this vulnerability is the function formSetSafeWanWebMan of the… |
CVE-2025-27563 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. |
CVE-2025-27247 | Medium | 5.5 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. |
CVE-2025-27242 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2025-27131 | Medium | 6.1 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2025-26693 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. |
CVE-2025-26691 | Medium | 5.5 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. |
CVE-2025-25217 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. |