2025 CVEs (page 296)
Page 296 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5650 | High | 7.3 | 2025-06-05 | A vulnerability classified as critical was found in 1000projects Online Notice Board 1.0. This vulnerability affects unknown code of the file /register.php. Th… |
CVE-2025-4568 | | 2025-06-05 | Improper neutralization of input provided by an unauthorized user into changes__reference_id parameter in URL allows for boolean-based Blind SQL Injection atta… | |
CVE-2025-5649 | Medium | 5.3 | 2025-06-05 | A vulnerability classified as critical has been found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /admin/c… |
CVE-2025-5648 | Low | 2.5 | 2025-06-05 | A vulnerability was found in Radare2 5.9.9. It has been classified as problematic. Affected is the function r_cons_pal_init in the library /libr/cons/pal.c of… |
CVE-2025-5647 | Low | 2.5 | 2025-06-05 | A vulnerability was found in Radare2 5.9.9 and classified as problematic. This issue affects the function r_cons_context_break_pop in the library /libr/cons/co… |
CVE-2025-5646 | Low | 2.5 | 2025-06-05 | A vulnerability has been found in Radare2 5.9.9 and classified as problematic. This vulnerability affects the function r_cons_rainbow_free in the library /libr… |
CVE-2025-5645 | Low | 2.5 | 2025-06-05 | A vulnerability, which was classified as problematic, was found in Radare2 5.9.9. This affects the function r_cons_pal_init in the library /libr/cons/pal.c of… |
CVE-2025-5644 | Low | 2.5 | 2025-06-05 | A vulnerability, which was classified as problematic, has been found in Radare2 5.9.9. Affected by this issue is the function r_cons_flush in the library /libr… |
CVE-2025-5643 | Low | 2.5 | 2025-06-05 | A vulnerability classified as problematic was found in Radare2 5.9.9. Affected by this vulnerability is the function cons_stack_load in the library /libr/cons/… |
CVE-2025-5642 | Low | 2.5 | 2025-06-05 | A vulnerability classified as problematic has been found in Radare2 5.9.9. Affected is the function r_cons_pal_init in the library /libr/cons/pal.c of the comp… |
CVE-2025-5641 | Low | 2.5 | 2025-06-05 | A vulnerability was found in Radare2 5.9.9. It has been rated as problematic. This issue affects the function r_cons_is_breaked in the library /libr/cons/cons… |
CVE-2025-5683 | Medium | 5.5 | 2025-06-05 | When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, f… |
CVE-2025-5640 | Low | 3.3 | 2025-06-05 | A vulnerability was found in PX4-Autopilot 1.12.3. It has been classified as problematic. This affects the function MavlinkReceiver::handle_message_trajectory_… |
CVE-2025-5639 | High | 7.3 | 2025-06-05 | A vulnerability was found in PHPGurukul Notice Board System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /f… |
CVE-2025-3055 | High | 8.1 | 2025-06-05 | The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_avatar_ajax() fun… |
CVE-2025-3054 | High | 8.8 | 2025-06-05 | The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all… |
CVE-2025-5638 | Medium | 6.3 | 2025-06-05 | A vulnerability has been found in PHPGurukul Notice Board System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-5637 | High | 7.3 | 2025-06-05 | A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component SYSTEM Command Handler… |
CVE-2025-5636 | High | 7.3 | 2025-06-05 | A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SET Co… |
CVE-2025-1793 | Critical | 9.8 | 2025-06-05 | Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to rea… |
CVE-2025-5635 | High | 7.3 | 2025-06-05 | A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component PLS Command Handler. The m… |
CVE-2025-5634 | High | 7.3 | 2025-06-05 | A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component NOOP Command Handler. The manipu… |
CVE-2025-5633 | Medium | 6.3 | 2025-06-05 | A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been rated as critical. Affected by this issue is… |
CVE-2025-5632 | Medium | 6.3 | 2025-06-05 | A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been declared as critical. Affected by this vulner… |
CVE-2025-5631 | High | 7.3 | 2025-06-05 | A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been classified as critical. Affected is an unknow… |
CVE-2025-5630 | Critical | 9.8 | 2025-06-05 | A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. This vulnerability affects unknown code of the file /goform/form2lansetu… |
CVE-2025-5629 | High | 8.8 | 2025-06-05 | A vulnerability, which was classified as critical, was found in Tenda AC10 up to 15.03.06.47. This affects the function formSetPPTPServer of the file /goform/S… |
CVE-2025-49466 | Medium | 5.8 | 2025-06-05 | aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachment part, |
CVE-2025-48432 | Medium | 4.0 | 2025-06-05 | An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, whic… |
CVE-2025-5628 | Low | 3.5 | 2025-06-05 | A vulnerability, which was classified as problematic, has been found in SourceCodester Food Menu Manager 1.0. Affected by this issue is some unknown functional… |
CVE-2025-5627 | Medium | 6.3 | 2025-06-05 | A vulnerability classified as critical was found in code-projects Patient Record Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-5626 | High | 7.3 | 2025-06-05 | A vulnerability classified as critical has been found in Campcodes Online Teacher Record Management System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-5625 | High | 7.3 | 2025-06-05 | A vulnerability was found in Campcodes Online Teacher Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing o… |
CVE-2025-5624 | Critical | 9.8 | 2025-06-05 | A vulnerability was found in D-Link DIR-816 1.10CNB05. It has been declared as critical. This vulnerability affects the function QoSPortSetup of the file /gofo… |
CVE-2025-49008 | | 2025-06-05 | Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of `escapeshellcmd()` in `/components/code… | |
CVE-2025-5623 | Critical | 9.8 | 2025-06-05 | A vulnerability was found in D-Link DIR-816 1.10CNB05. It has been classified as critical. This affects the function qosClassifier of the file /goform/qosClass… |
CVE-2025-5622 | Critical | 9.8 | 2025-06-05 | A vulnerability was found in D-Link DIR-816 1.10CNB05 and classified as critical. Affected by this issue is the function wirelessApcli_5g of the file /goform/w… |
CVE-2025-5621 | High | 7.3 | 2025-06-05 | A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. Affected by this vulnerability is the function qosClassifier of the file… |
CVE-2025-5620 | High | 7.3 | 2025-06-05 | A vulnerability, which was classified as critical, was found in D-Link DIR-816 1.10CNB05. Affected is the function setipsec_config of the file /goform/setipsec… |
CVE-2025-5619 | High | 8.8 | 2025-06-04 | A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.1. This issue affects the function formaddUserName of the file /goform/ad… |
CVE-2025-5618 | Medium | 6.3 | 2025-06-04 | A vulnerability classified as critical was found in PHPGurukul Online Fire Reporting System 1.2. This vulnerability affects unknown code of the file /admin/edi… |
CVE-2025-5617 | Medium | 6.3 | 2025-06-04 | A vulnerability classified as critical has been found in PHPGurukul Online Fire Reporting System 1.2. This affects an unknown part of the file /admin/manage-te… |
CVE-2025-5616 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been rated as critical. Affected by this issue is some unknown functionality o… |
CVE-2025-49007 | Medium | 5.3 | 2025-06-04 | Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-D… |
CVE-2025-5690 | Medium | 6.5 | 2025-06-04 | PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data… |
CVE-2025-5615 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been declared as critical. Affected by this vulnerability is an unknown functi… |
CVE-2025-5614 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been classified as critical. Affected is an unknown function of the file /sear… |
CVE-2025-5613 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This issue affects some unknown processing of the file /re… |
CVE-2025-5612 | Medium | 6.3 | 2025-06-04 | A vulnerability has been found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This vulnerability affects unknown code of the file /… |
CVE-2025-5611 | Medium | 6.3 | 2025-06-04 | A vulnerability, which was classified as critical, was found in CodeAstro Real Estate Management System 1.0. This affects an unknown part of the file /submitpr… |
CVE-2025-5610 | Medium | 6.3 | 2025-06-04 | A vulnerability, which was classified as critical, has been found in CodeAstro Real Estate Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2025-48947 | | 2025-06-04 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session`… | |
CVE-2025-46341 | High | 7.1 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any… |
CVE-2025-5609 | High | 8.8 | 2025-06-04 | A vulnerability classified as critical was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/… |
CVE-2025-5608 | High | 8.8 | 2025-06-04 | A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formsetreboottimer of the file /goform/SetSysAutoRebb… |
CVE-2025-5607 | High | 8.8 | 2025-06-04 | A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formSetPPTPUserList of the file /goform/set… |
CVE-2025-48935 | Critical | 9.1 | 2025-06-04 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission re… |
CVE-2025-48934 | Medium | 5.3 | 2025-06-04 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the `Deno.env.toObject` method ignores any variables listed in… |
CVE-2025-48888 | Medium | 5.3 | 2025-06-04 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read -… |
CVE-2025-46339 | Medium | 4.3 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy se… |
CVE-2025-46204 | Medium | 6.5 | 2025-06-04 | An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint. |
CVE-2025-46203 | Medium | 6.5 | 2025-06-04 | An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint. |
CVE-2025-46011 | Medium | 6.5 | 2025-06-04 | Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileges. |
CVE-2025-32015 | Medium | 6.7 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the `<iframe srcdoc>` attribute, which leads to cro… |
CVE-2025-31482 | Medium | 4.3 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. A vulnerability in versions prior to 1.26.2 causes a user to be repeatedly logged out after fetching a malicious… |
CVE-2025-31136 | Medium | 6.7 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a… |
CVE-2025-31134 | High | 7.5 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain dir… |
CVE-2025-22245 | Medium | 5.9 | 2025-06-04 | VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation. |
CVE-2025-22244 | Medium | 6.9 | 2025-06-04 | VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation. |
CVE-2025-22243 | High | 7.5 | 2025-06-04 | VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation. |
CVE-2025-5606 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in Tenda AC18 15.03.05.05. It has been declared as critical. This vulnerability affects the function formSetIptv of the file /goform/… |
CVE-2025-5604 | High | 7.3 | 2025-06-04 | A vulnerability was found in Campcodes Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-5603 | High | 7.3 | 2025-06-04 | A vulnerability has been found in Campcodes Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-5602 | High | 7.3 | 2025-06-04 | A vulnerability, which was classified as critical, was found in Campcodes Hospital Management System 1.0. Affected is an unknown function of the file /admin/re… |
CVE-2025-5600 | Critical | 9.8 | 2025-06-04 | A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This issue affects the function setLanguageCfg of… |
CVE-2025-5599 | High | 7.3 | 2025-06-04 | A vulnerability classified as critical was found in PHPGurukul Student Result Management System 1.3. This vulnerability affects unknown code of the file /editm… |
CVE-2025-5688 | | 2025-06-04 | We have identified a buffer overflow issue allowing out-of-bounds write when processing LLMNR or mDNS queries with very long DNS names. This issue only affects… | |
CVE-2025-5596 | High | 7.3 | 2025-06-04 | A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component REGET Command Handl… |
CVE-2025-5595 | High | 7.3 | 2025-06-04 | A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the component PROGRESS Command… |
CVE-2025-2336 | Medium | 4.8 | 2025-06-04 | Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to b… |
CVE-2025-20286 | Critical | 9.9 | 2025-06-04 | A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE)… |
CVE-2025-20279 | Medium | 4.8 | 2025-06-04 | A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to conduct a stored XSS attack on an a… |
CVE-2025-20278 | Medium | 6.0 | 2025-06-04 | A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the… |
CVE-2025-20277 | Low | 3.4 | 2025-06-04 | A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, local attacker to execute arbitrary code on an affecte… |
CVE-2025-20276 | Low | 3.8 | 2025-06-04 | A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to execute arbitrary code on an affect… |
CVE-2025-20275 | Medium | 5.3 | 2025-06-04 | A vulnerability in the file opening process of Cisco Unified Contact Center Express (Unified CCX) Editor could allow an unauthenticated attacker to execute arb… |
CVE-2025-20273 | Medium | 6.1 | 2025-06-04 | A vulnerability in the web-based management interface of Cisco Unified Intelligent Contact Management Enterprise could allow an unauthenticated, remote attacke… |
CVE-2025-20261 | High | 8.8 | 2025-06-04 | A vulnerability in the SSH connection handling of Cisco Integrated Management Controller (IMC) for Cisco UCS B-Series, UCS C-Series, UCS S-Series, and UCS X-Se… |
CVE-2025-20259 | Medium | 5.3 | 2025-06-04 | Multiple vulnerabilities in the update process of Cisco ThousandEyes Endpoint Agent for Windows could allow an authenticated, local attacker to delete arbitrar… |
CVE-2025-20163 | High | 8.7 | 2025-06-04 | A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisc… |
CVE-2025-20130 | Medium | 4.9 | 2025-06-04 | A vulnerability in the API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote atta… |
CVE-2025-20129 | Medium | 4.3 | 2025-06-04 | A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform (CCP), formerly Cisco SocialMiner, could allow an unauthenticated, rem… |
CVE-2025-5594 | High | 7.3 | 2025-06-04 | A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the component SET Command Han… |
CVE-2025-5593 | High | 7.3 | 2025-06-04 | A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component HOST Command Handler. T… |
CVE-2025-29094 | Medium | 6.1 | 2025-06-04 | Cross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Marketing/Forms, Mar… |
CVE-2025-29093 | High | 8.2 | 2025-06-04 | File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Gallery/Images compon… |
CVE-2025-23106 | Medium | 6.5 | 2025-06-04 | An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation. |
CVE-2025-23101 | Medium | 6.5 | 2025-06-04 | An issue was discovered in Samsung Mobile Processor Exynos 1380. A Use-After-Free in the mobile processor leads to privilege escalation. |
CVE-2025-23096 | Medium | 6.5 | 2025-06-04 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. A Double Free in the mobile processor leads to privilege escalation. |
CVE-2025-23095 | Medium | 6.5 | 2025-06-04 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. A Double Free in the mobile processor leads to privilege escalation. |