2025 CVEs (page 294)
Page 294 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49599 | Medium | 4.1 | 2025-06-06 | Huawei EG8141A5 devices through V5R019C00S100, EG8145V5 devices through V5R019C00S100, and EG8145V5-V2 devices through V5R021C00S184 allow the Epuser account t… |
CVE-2025-5785 | High | 8.8 | 2025-06-06 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical. This issue affects some unknown processing of the file /boafrm/formW… |
CVE-2025-5784 | Medium | 6.3 | 2025-06-06 | A vulnerability has been found in PHPGurukul Employee Record Management System 1.3 and classified as critical. This vulnerability affects unknown code of the f… |
CVE-2025-5783 | Medium | 6.3 | 2025-06-06 | A vulnerability, which was classified as critical, was found in PHPGurukul Employee Record Management System 1.3. This affects an unknown part of the file /edi… |
CVE-2025-5751 | Medium | 6.8 | 2025-06-06 | WOLFBOX Level 2 EV Charger Management Card Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows physically present attackers t… |
CVE-2025-5750 | High | 8.8 | 2025-06-06 | WOLFBOX Level 2 EV Charger tuya_svc_devos_activate_result_parse Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows netwo… |
CVE-2025-5749 | High | 8.8 | 2025-06-06 | WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers… |
CVE-2025-5748 | High | 8.0 | 2025-06-06 | WOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execut… |
CVE-2025-5747 | High | 8.0 | 2025-06-06 | WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attac… |
CVE-2025-33035 | Medium | 6.5 | 2025-06-06 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability… |
CVE-2025-33031 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit t… |
CVE-2025-30279 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-29892 | High | 8.8 | 2025-06-06 | An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user acc… |
CVE-2025-29885 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-29884 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-29883 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-29877 | High | 7.5 | 2025-06-06 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-29876 | High | 7.5 | 2025-06-06 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-29873 | High | 7.5 | 2025-06-06 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-29872 | High | 7.5 | 2025-06-06 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, t… |
CVE-2025-29871 | Medium | 5.5 | 2025-06-06 | An out-of-bounds read vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the… |
CVE-2025-22490 | High | 7.5 | 2025-06-06 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-22486 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-22484 | | 2025-06-06 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, t… | |
CVE-2025-22482 | High | 8.1 | 2025-06-06 | A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attack… |
CVE-2025-22481 | High | 8.8 | 2025-06-06 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2025-5782 | Medium | 6.3 | 2025-06-06 | A vulnerability, which was classified as critical, has been found in PHPGurukul Employee Record Management System 1.3. Affected by this issue is some unknown f… |
CVE-2025-5780 | Medium | 6.3 | 2025-06-06 | A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-5779 | Medium | 6.3 | 2025-06-06 | A vulnerability has been found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown f… |
CVE-2025-41646 | Critical | 9.8 | 2025-06-06 | An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full com… |
CVE-2025-27531 | Critical | 9.8 | 2025-06-06 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an aut… |
CVE-2025-5806 | High | 8.0 | 2025-06-06 | Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641… |
CVE-2025-5791 | High | 7.1 | 2025-06-06 | A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than… |
CVE-2025-5778 | High | 7.3 | 2025-06-06 | A vulnerability, which was classified as critical, was found in 1000 Projects ABC Courier Management System 1.0. Affected is an unknown function of the file /a… |
CVE-2025-38002 | High | 7.8 | 2025-06-06 | In the Linux kernel, the following vulnerability has been resolved: io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo() Not everything requir… |
CVE-2025-38001 | High | 7.8 | 2025-06-06 | In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: … |
CVE-2025-0620 | Medium | 4.9 | 2025-06-06 | A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expo… |
CVE-2025-5766 | Medium | 4.3 | 2025-06-06 | A vulnerability was found in code-projects Laundry System 1.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation l… |
CVE-2025-5765 | Low | 3.5 | 2025-06-06 | A vulnerability was found in code-projects Laundry System 1.0. It has been classified as problematic. This affects an unknown part of the file /data/edit_laund… |
CVE-2025-5764 | Low | 3.5 | 2025-06-06 | A vulnerability was found in code-projects Laundry System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-49453 | High | 7.1 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Jatinder Pal Singh BP Profile as Homepage bp-profile-as-homepage allows Stored XSS.This issue affects BP Pro… |
CVE-2025-49450 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mhallmann SEPA Girocode sepa-girocode allows Stored XSS.T… |
CVE-2025-49449 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive Regional Map of Africa interactive-map-of-africa allows Cross Site Request Forger… |
CVE-2025-49446 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in minhlaobao Admin Notes admin-note allows Cross Site Request Forgery.This issue affects Admin Notes: from n/a… |
CVE-2025-49445 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive UK Regional Map interactive-uk-regional-map allows Cross Site Request Forgery.Thi… |
CVE-2025-49443 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris McCoy Bacon Ipsum bacon-ipsum allows Stored XSS.Thi… |
CVE-2025-49442 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mostafa Shahiri Simple Nested Menu simple-nested-menu all… |
CVE-2025-49441 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in WP Map Plugins Interactive Regional Map of Florida interactive-map-of-florida allows Exploiting Incorrectly Configured A… |
CVE-2025-49440 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Vuong Nguyen WP Security Master wp-security-master allows Cross Site Request Forgery.This issue affects WP S… |
CVE-2025-49439 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in mariusz88atelierweb Atelier Create CV atelier-create-cv allows Cross Site Request Forgery.This issue affects… |
CVE-2025-49435 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Hasina77 Wp Easy Allopass wordpress-easy-allopass allows Cross Site Request Forgery.This issue affects Wp Ea… |
CVE-2025-49429 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Burnette Video Embeds video-embeds allows Stored XSS… |
CVE-2025-49427 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Burnette Abbie Expander abbie-expander allows Stored… |
CVE-2025-49425 | High | 7.1 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Adrian Hanft Konami Easter Egg konami-easter-egg allows Stored XSS.This issue affects Konami Easter Egg: fro… |
CVE-2025-49421 | High | 7.6 | 2025-06-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Andrei Filonov WP Text Expander wp-text-expander allows S… |
CVE-2025-49419 | Medium | 5.5 | 2025-06-06 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in esigngenie Foxit eSign for WordPress esign-genie-for-wp allows Retr… |
CVE-2025-49333 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership simple-membership allows Sto… |
CVE-2025-49332 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issu… |
CVE-2025-49329 | Medium | 6.6 | 2025-06-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Upload a Web Shell to a Web Ser… |
CVE-2025-49328 | High | 7.6 | 2025-06-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agile Logix Store Locator WordPress agile-store-locator a… |
CVE-2025-49327 | High | 7.6 | 2025-06-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia ShortLinks Pro shortlinkspro allows SQL Inje… |
CVE-2025-49326 | High | 7.6 | 2025-06-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows SQL Injection.Thi… |
CVE-2025-49325 | Medium | 4.7 | 2025-06-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Phishing.This issue affects Ne… |
CVE-2025-49324 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-49323 | High | 8.5 | 2025-06-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection… |
CVE-2025-49322 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd 404 Page by SeedProd allows Stored XSS. This iss… |
CVE-2025-49320 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in fraudlabspro FraudLabs Pro for WooCommerce fraudlabs-pro-for-woocommerce allows Exploiting Incorrectly Configured Access… |
CVE-2025-49318 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPtouch WPtouch wptouch allows Stored XSS.This issue affe… |
CVE-2025-49317 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in NTC WP Page Loading wp-page-loading allows Cross Site Request Forgery.This issue affects WP Page Loading: fr… |
CVE-2025-49315 | High | 7.6 | 2025-06-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce… |
CVE-2025-49314 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ovatheme BRW ova-brw allows Stored XSS.This issue affects… |
CVE-2025-49313 | High | 7.5 | 2025-06-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme BRW ova-brw allows PHP Local… |
CVE-2025-49311 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-f… |
CVE-2025-49310 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard al… |
CVE-2025-49309 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Team Member ht-team-member allows Stored XS… |
CVE-2025-49308 | High | 7.5 | 2025-06-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-t… |
CVE-2025-49307 | High | 7.5 | 2025-06-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magazine3 WP Multilang wp-multilang al… |
CVE-2025-49306 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stor… |
CVE-2025-49305 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple post-type-x allows Store… |
CVE-2025-49304 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeManas Search with Typesense search-with-typesense all… |
CVE-2025-49301 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-b… |
CVE-2025-49299 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPlugged.com WebHotelier webhotelier allows Stored XSS.Th… |
CVE-2025-49298 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This i… |
CVE-2025-49294 | Medium | 5.3 | 2025-06-06 | Insertion of Sensitive Information Into Sent Data vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-po… |
CVE-2025-49293 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Exploiti… |
CVE-2025-49292 | Medium | 4.3 | 2025-06-06 | Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder profile-builder allows Phishing.This issue affects Profile Build… |
CVE-2025-49291 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affect… |
CVE-2025-49289 | Medium | 5.0 | 2025-06-06 | Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-49288 | High | 8.8 | 2025-06-06 | Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a… |
CVE-2025-49287 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-49286 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP T… |
CVE-2025-49285 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Cross Site Requ… |
CVE-2025-49284 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cros… |
CVE-2025-49283 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant gdpr-compliant-recap… |
CVE-2025-49273 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in sminozzi WP Tools wptools allows Cross Site Request Forgery.This issue affects WP Tools: from n/a through <=… |
CVE-2025-49272 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-49270 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affe… |
CVE-2025-49269 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Anton Vanyukov Market Exporter market-exporter allows Cross Site Request Forgery.This issue affects Market E… |
CVE-2025-49268 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in Soft8Soft LLC Verge3D verge3d allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-49263 | High | 7.6 | 2025-06-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WCVendors WC Vendors Marketplace wc-vendors allows Blind… |