2025 CVEs (page 293)
Page 293 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5872 | Medium | 5.3 | 2025-06-09 | A vulnerability was found in eGauge EG3000 Energy Monitor 3.6.3. It has been classified as problematic. This affects an unknown part of the component Setting H… |
CVE-2025-5871 | Medium | 5.3 | 2025-06-09 | A vulnerability was found in Papendorf SOL Connect Center 3.3.0.0 and classified as problematic. Affected by this issue is some unknown functionality of the co… |
CVE-2025-40675 | Medium | 6.1 | 2025-06-09 | A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the… |
CVE-2025-5870 | High | 7.3 | 2025-06-09 | A vulnerability has been found in TRENDnet TV-IP121W 1.1.1 Build 36 and classified as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-5869 | High | 8.0 | 2025-06-09 | A vulnerability, which was classified as critical, was found in RT-Thread 5.1.0. Affected is the function sys_recvfrom of the file rt-thread/components/lwp/lwp… |
CVE-2025-5894 | High | 8.8 | 2025-06-09 | Smart Parking Management System from Honding Technology has a Missing Authorization vulnerability, allowing remote attackers with regular privileges to access… |
CVE-2025-5868 | High | 8.0 | 2025-06-09 | A vulnerability, which was classified as critical, has been found in RT-Thread 5.1.0. This issue affects the function sys_thread_sigprocmask of the file rt-thr… |
CVE-2025-5867 | High | 8.0 | 2025-06-09 | A vulnerability classified as critical was found in RT-Thread 5.1.0. This vulnerability affects the function csys_sendto of the file rt-thread/components/lwp/l… |
CVE-2025-5893 | Critical | 9.8 | 2025-06-09 | Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to ac… |
CVE-2025-5866 | High | 8.0 | 2025-06-09 | A vulnerability classified as critical has been found in RT-Thread 5.1.0. This affects the function sys_sigprocmask of the file rt-thread/components/lwp/lwp_sy… |
CVE-2025-5865 | High | 8.0 | 2025-06-09 | A vulnerability was found in RT-Thread 5.1.0. It has been rated as critical. Affected by this issue is the function sys_select of the file rt-thread/components… |
CVE-2025-5864 | Low | 3.7 | 2025-06-09 | A vulnerability was found in Tenda TDSEE App up to 1.7.12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-5863 | High | 8.8 | 2025-06-09 | A vulnerability was found in Tenda AC5 15.03.06.47. It has been classified as critical. Affected is the function formSetRebootTimer of the file /goform/SetRebo… |
CVE-2025-4652 | Medium | 6.1 | 2025-06-09 | The Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Sit… |
CVE-2025-47712 | Medium | 6.5 | 2025-06-09 | A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for… |
CVE-2025-47711 | Medium | 6.5 | 2025-06-09 | There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a ve… |
CVE-2025-3582 | Medium | 4.8 | 2025-06-09 | The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to pe… |
CVE-2025-3581 | Medium | 4.8 | 2025-06-09 | The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/post where the bloc… |
CVE-2025-25209 | Medium | 5.7 | 2025-06-09 | The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes those secretes are already in the kuadrant-sy… |
CVE-2025-25208 | Medium | 5.7 | 2025-06-09 | A Developer persona can bring down the Authorino service, preventing the evaluation of all AuthPolicies on the cluster |
CVE-2025-25207 | Medium | 5.7 | 2025-06-09 | The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer pers… |
CVE-2025-5862 | High | 8.8 | 2025-06-09 | A vulnerability was found in Tenda AC7 15.03.06.44 and classified as critical. This issue affects the function formSetPPTPUserList of the file /goform/setPptpU… |
CVE-2025-5861 | High | 8.8 | 2025-06-09 | A vulnerability has been found in Tenda AC7 15.03.06.44 and classified as critical. This vulnerability affects the function fromadvsetlanip of the file /goform… |
CVE-2025-5860 | High | 7.3 | 2025-06-09 | A vulnerability, which was classified as critical, was found in PHPGurukul Maid Hiring Management System 1.0. This affects an unknown part of the file /admin/s… |
CVE-2025-5859 | Medium | 6.3 | 2025-06-09 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2025-5858 | Medium | 6.3 | 2025-06-09 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the f… |
CVE-2025-5857 | Medium | 6.3 | 2025-06-09 | A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. This issue affects some unknown processing of the f… |
CVE-2025-5856 | High | 7.3 | 2025-06-09 | A vulnerability has been found in PHPGurukul BP Monitoring Management System 1.0 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2025-5855 | High | 8.8 | 2025-06-09 | A vulnerability, which was classified as critical, was found in Tenda AC6 15.03.05.16. This affects the function formSetRebootTimer of the file /goform/SetRebo… |
CVE-2025-5854 | High | 8.8 | 2025-06-09 | A vulnerability, which was classified as critical, has been found in Tenda AC6 15.03.05.16. Affected by this issue is the function fromadvsetlanip of the file… |
CVE-2025-5853 | High | 8.8 | 2025-06-09 | A vulnerability classified as critical was found in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formSetSafeWanWebMan of the file /gof… |
CVE-2025-5852 | High | 8.8 | 2025-06-09 | A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function formSetPPTPUserList of the file /goform/setPptpUserLis… |
CVE-2025-5851 | High | 8.8 | 2025-06-09 | A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been rated as critical. This issue affects the function fromadvsetlanip of the file /goform/A… |
CVE-2025-5850 | High | 8.8 | 2025-06-08 | A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been declared as critical. This vulnerability affects the function formsetschedled of the fil… |
CVE-2025-5849 | High | 8.8 | 2025-06-08 | A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been classified as critical. This affects the function formSetSafeWanWebMan of the file /gofo… |
CVE-2025-5848 | High | 8.8 | 2025-06-08 | A vulnerability was found in Tenda AC15 15.03.05.19_multi and classified as critical. Affected by this issue is the function formSetPPTPUserList of the file /g… |
CVE-2025-3461 | Critical | 9.1 | 2025-06-08 | The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Functi… |
CVE-2025-3460 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Ne… |
CVE-2025-3459 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, "Improper… |
CVE-2025-35010 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM comman… |
CVE-2025-35009 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command… |
CVE-2025-35008 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command… |
CVE-2025-35007 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command… |
CVE-2025-35006 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD comma… |
CVE-2025-35005 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command t… |
CVE-2025-35004 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command th… |
CVE-2025-32459 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the sync_time argument), that is vulnerable to command injection. This is… |
CVE-2025-32458 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection… |
CVE-2025-32457 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_file_from_qtn argument), that is vulnerable to command injection… |
CVE-2025-32456 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. Th… |
CVE-2025-32455 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the run_cmd argument), that is vulnerable to command injection. This is an… |
CVE-2025-5847 | High | 8.8 | 2025-06-08 | A vulnerability has been found in Tenda AC9 15.03.02.13 and classified as critical. Affected by this vulnerability is the function formSetSafeWanWebMan of the… |
CVE-2025-27563 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. |
CVE-2025-27247 | Medium | 5.5 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. |
CVE-2025-27242 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2025-27131 | Medium | 6.1 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2025-26693 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. |
CVE-2025-26691 | Medium | 5.5 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. |
CVE-2025-25217 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. |
CVE-2025-24493 | Medium | 5.5 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through race condition. |
CVE-2025-23235 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-21082 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2025-20063 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2025-38004 | High | 7.3 | 2025-06-08 | In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can… |
CVE-2025-38003 | High | 7.8 | 2025-06-08 | In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content When the procfs content is g… |
CVE-2025-5840 | High | 7.3 | 2025-06-07 | A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file… |
CVE-2025-5839 | High | 8.8 | 2025-06-07 | A vulnerability, which was classified as critical, has been found in Tenda AC9 15.03.02.13. Affected by this issue is the function fromadvsetlanip of the file… |
CVE-2025-5838 | Medium | 6.3 | 2025-06-07 | A vulnerability classified as critical was found in PHPGurukul Employee Record Management System 1.3. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-5837 | Medium | 6.3 | 2025-06-07 | A vulnerability classified as critical has been found in PHPGurukul Employee Record Management System 1.3. Affected is an unknown function of the file /admin/a… |
CVE-2025-5836 | Medium | 6.3 | 2025-06-07 | A vulnerability was found in Tenda AC9 15.03.02.13. It has been rated as critical. This issue affects the function formSetIptv of the file /goform/SetIPTVCfg o… |
CVE-2025-49619 | High | 8.5 | 2025-06-07 | Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper… |
CVE-2025-5568 | Medium | 6.4 | 2025-06-07 | The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 4.4.2 due to insu… |
CVE-2025-5528 | Medium | 6.1 | 2025-06-07 | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in… |
CVE-2025-5303 | High | 7.2 | 2025-06-07 | The LTL Freight Quotes – Freightview Edition, LTL Freight Quotes – Daylight Edition and LTL Freight Quotes – Day & Ross Edition plugins for WordPress are vulne… |
CVE-2025-5399 | High | 7.5 | 2025-06-07 | Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop… |
CVE-2025-5814 | Medium | 5.3 | 2025-06-07 | The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsd_… |
CVE-2025-47601 | High | 8.8 | 2025-06-07 | Missing Authorization vulnerability in Christiaan Pieterse MaxiBlocks maxi-blocks allows Privilege Escalation.This issue affects MaxiBlocks: from n/a through <… |
CVE-2025-49128 | Medium | 4.0 | 2025-06-06 | Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and… |
CVE-2025-49127 | | 2025-06-06 | Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any unauthenticated user… | |
CVE-2025-5799 | High | 8.8 | 2025-06-06 | A vulnerability was found in Tenda AC8 16.03.34.09. It has been declared as critical. Affected by this vulnerability is the function fromSetWirelessRepeat of t… |
CVE-2025-5798 | High | 8.8 | 2025-06-06 | A vulnerability was found in Tenda AC8 16.03.34.09. It has been classified as critical. Affected is the function fromSetSysTime of the file /goform/SetSysTimeC… |
CVE-2025-5797 | Low | 3.5 | 2025-06-06 | A vulnerability was found in code-projects Laundry System 1.0 and classified as problematic. This issue affects some unknown processing of the file /data/inser… |
CVE-2025-5796 | Low | 3.5 | 2025-06-06 | A vulnerability has been found in code-projects Laundry System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /data/edi… |
CVE-2025-5795 | High | 8.8 | 2025-06-06 | A vulnerability, which was classified as critical, was found in Tenda AC5 1.0/15.03.06.47. This affects the function fromadvsetlanip of the file /goform/AdvSet… |
CVE-2025-5794 | High | 8.8 | 2025-06-06 | A vulnerability, which was classified as critical, has been found in Tenda AC5 15.03.06.47. Affected by this issue is the function formSetPPTPUserList of the f… |
CVE-2025-5481 | High | 7.8 | 2025-06-06 | Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2025-5480 | High | 7.8 | 2025-06-06 | Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2025-5474 | High | 7.3 | 2025-06-06 | 2BrightSparks SyncBackFree Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affecte… |
CVE-2025-5473 | High | 8.8 | 2025-06-06 | GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2025-3485 | High | 8.8 | 2025-06-06 | Allegra extractFileFromZip Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2025-2766 | High | 8.8 | 2025-06-06 | 70mai A510 Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affect… |
CVE-2025-5793 | High | 8.8 | 2025-06-06 | A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/fo… |
CVE-2025-5792 | High | 8.8 | 2025-06-06 | A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the… |
CVE-2025-5790 | High | 8.8 | 2025-06-06 | A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105. This vulnerability affects unknown code of the file /boafrm/formIpQoS of… |
CVE-2025-5789 | High | 8.8 | 2025-06-06 | A vulnerability classified as critical has been found in TOTOLINK X15 1.0.0-B20230714.1105. This affects an unknown part of the file /boafrm/formPortFw of the… |
CVE-2025-49011 | Low | 3.7 | 2025-06-06 | SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats… |
CVE-2025-47950 | High | 7.5 | 2025-06-06 | CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) ser… |
CVE-2025-5788 | High | 8.8 | 2025-06-06 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-5787 | High | 8.8 | 2025-06-06 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-5786 | High | 8.8 | 2025-06-06 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. Affected is an unknown function of the file /boafrm/formDMZ… |