2025 CVEs (page 296)
Page 296 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24763 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in Pascal Casier bbPress API bbp-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-24762 | Medium | 5.4 | 2025-06-06 | Missing Authorization vulnerability in facturaone TicketBAI Facturas para WooCommerce wp-ticketbai allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-23971 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-23969 | Medium | 5.3 | 2025-06-06 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows… |
CVE-2025-5763 | Medium | 4.7 | 2025-06-06 | A vulnerability has been found in Tenda CP3 11.10.00.2311090948 and classified as critical. Affected by this vulnerability is the function sub_F3C8C of the fil… |
CVE-2025-5762 | Medium | 6.3 | 2025-06-06 | A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. Affected is an unknown function of the file… |
CVE-2025-5761 | Medium | 6.3 | 2025-06-06 | A vulnerability, which was classified as critical, has been found in PHPGurukul BP Monitoring Management System 1.0. This issue affects some unknown processing… |
CVE-2025-5760 | Medium | 4.9 | 2025-06-06 | The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_t… |
CVE-2025-5239 | Medium | 6.4 | 2025-06-06 | The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 3.0… |
CVE-2025-49077 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeHigh Dynamic Pricing and Discount Rules discount-and-dynamic-pricing allows Cross Site Request Forgery… |
CVE-2025-49076 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite… |
CVE-2025-49075 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist wishlist allows Stored XSS.This issu… |
CVE-2025-49074 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abu Huraira Bin Aman WidgetKit widgetkit-for-elementor al… |
CVE-2025-49068 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oceanwp Ocean Extra ocean-extra allows Stored XSS.This is… |
CVE-2025-49067 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Stored XSS.This issu… |
CVE-2025-48337 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in QuickcabWP QuickCab.This issue affects QuickCab: from n/a through 1.3.3. |
CVE-2025-48335 | Medium | 5.4 | 2025-06-06 | Missing Authorization vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-48329 | High | 7.1 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-ti… |
CVE-2025-48328 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Cross Site R… |
CVE-2025-47586 | Critical | 9.0 | 2025-06-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors - Events stm-mot… |
CVE-2025-47584 | High | 8.5 | 2025-06-06 | Deserialization of Untrusted Data vulnerability in ThemeGoods Photography.This issue affects Photography: from n/a through 7.5.2. |
CVE-2025-41367 | | 2025-06-06 | Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaSc… | |
CVE-2025-41366 | | 2025-06-06 | In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability… | |
CVE-2025-41365 | | 2025-06-06 | Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that… | |
CVE-2025-41364 | | 2025-06-06 | Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaSc… | |
CVE-2025-41363 | | 2025-06-06 | In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability… | |
CVE-2025-41362 | | 2025-06-06 | Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that… | |
CVE-2025-41361 | | 2025-06-06 | Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROC… | |
CVE-2025-41360 | | 2025-06-06 | Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The device is vulnerable to a packet flooding denial of service… | |
CVE-2025-39358 | High | 8.8 | 2025-06-06 | Deserialization of Untrusted Data vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Object Injection.This issue affects WP Posts Carouse… |
CVE-2025-5759 | High | 7.3 | 2025-06-06 | A vulnerability classified as critical was found in PHPGurukul Local Services Search Engine Management System 2.1. This vulnerability affects unknown code of t… |
CVE-2025-5758 | High | 7.3 | 2025-06-06 | A vulnerability classified as critical has been found in SourceCodester Open Source Clinic Management System 1.0. This affects an unknown part of the file /doc… |
CVE-2025-5757 | Low | 3.5 | 2025-06-06 | A vulnerability was found in code-projects Traffic Offense Reporting System 1.0. It has been rated as problematic. Affected by this issue is some unknown funct… |
CVE-2025-5756 | High | 7.3 | 2025-06-06 | A vulnerability was found in code-projects Real Estate Property Management System 1.0. It has been declared as critical. Affected by this vulnerability is an u… |
CVE-2025-5755 | High | 7.3 | 2025-06-06 | A vulnerability was found in SourceCodester Open Source Clinic Management System 1.0. It has been classified as critical. Affected is an unknown function of th… |
CVE-2025-5192 | High | 7.5 | 2025-06-06 | A missing authentication for critical function vulnerability in the client application of Soar Cloud HRD Human Resource Management System through version 7.3.2… |
CVE-2025-48784 | High | 7.5 | 2025-06-06 | A missing authorization vulnerability in Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to modify system… |
CVE-2025-48783 | High | 7.5 | 2025-06-06 | An external control of file name or path vulnerability in the delete file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025… |
CVE-2025-48782 | Critical | 9.8 | 2025-06-06 | An unrestricted upload of file with dangerous type vulnerability in the upload file function of Soar Cloud HRD Human Resource Management System through version… |
CVE-2025-48781 | High | 7.5 | 2025-06-06 | An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.202… |
CVE-2025-48780 | Critical | 9.8 | 2025-06-06 | A deserialization of untrusted data vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.040… |
CVE-2025-5739 | High | 8.8 | 2025-06-06 | A vulnerability classified as critical has been found in TOTOLINK X15 1.0.0-B20230714.1105. This affects an unknown part of the file /boafrm/formSaveConfig of… |
CVE-2025-5738 | High | 8.8 | 2025-06-06 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-5737 | High | 8.8 | 2025-06-06 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-3365 | Critical | 9.8 | 2025-06-06 | A missing protection against path traversal allows to access any file on the server. |
CVE-2025-3322 | | 2025-06-06 | An improper neutralization of inputs used in expression language allows remote code execution with the highest privileges on the server. | |
CVE-2025-5736 | High | 8.8 | 2025-06-06 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. Affected is an unknown function of the file /boafrm/formNtp… |
CVE-2025-5735 | High | 8.8 | 2025-06-06 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical. This issue affects some unknown processing of the file /boafrm/formS… |
CVE-2025-5734 | High | 8.8 | 2025-06-06 | A vulnerability has been found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical. This vulnerability affects unknown code of the file /boafrm/for… |
CVE-2025-5732 | Medium | 4.3 | 2025-06-06 | A vulnerability, which was classified as problematic, was found in code-projects Traffic Offense Reporting System 1.0. This affects an unknown part. The manipu… |
CVE-2025-3321 | | 2025-06-06 | A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the se… | |
CVE-2025-5729 | Medium | 6.3 | 2025-06-06 | A vulnerability, which was classified as critical, was found in code-projects Health Center Patient Record Management System 1.0. Affected is an unknown functi… |
CVE-2025-5728 | Medium | 6.3 | 2025-06-06 | A vulnerability classified as critical was found in SourceCodester Open Source Clinic Management System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2025-5727 | Low | 2.4 | 2025-06-06 | A vulnerability classified as problematic has been found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /scri… |
CVE-2025-5703 | Medium | 6.4 | 2025-06-06 | The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and including, 10.0.3 due to… |
CVE-2025-5699 | Medium | 5.5 | 2025-06-06 | The Developer Formatter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2015.0.2.1 d… |
CVE-2025-5686 | Medium | 6.4 | 2025-06-06 | The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including… |
CVE-2025-5586 | Medium | 6.4 | 2025-06-06 | The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to… |
CVE-2025-5565 | Medium | 6.4 | 2025-06-06 | The Hide It plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hideit' shortcode in all versions up to, and including, 1.0.1 d… |
CVE-2025-5563 | Medium | 6.5 | 2025-06-06 | The WP-Addpub plugin for WordPress is vulnerable to SQL Injection via the 'wp-addpub' shortcode in all versions up to, and including, 1.2.8 due to insufficient… |
CVE-2025-5541 | Medium | 6.4 | 2025-06-06 | The Runners Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'runnerslog' shortcode in all versions up to, and including… |
CVE-2025-5538 | Medium | 6.4 | 2025-06-06 | The BNS Featured Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bnsfc' shortcode in all versions up to, and inclu… |
CVE-2025-5536 | Medium | 6.4 | 2025-06-06 | The Freemind Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'freemind' shortcode in all versions up to, and includin… |
CVE-2025-5534 | Medium | 6.4 | 2025-06-06 | The ESV Bible Shortcode for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'esv' shortcode in all versions up to… |
CVE-2025-5533 | Medium | 6.4 | 2025-06-06 | The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kbalert' shortcode in all versions up to, and including… |
CVE-2025-5486 | Critical | 9.8 | 2025-06-06 | The WP Email Debug plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the WPMDBUG_handle_settings() function in ve… |
CVE-2025-5019 | Medium | 5.4 | 2025-06-06 | The Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all v… |
CVE-2025-5018 | High | 7.1 | 2025-06-06 | The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hs_update_ai_chat_… |
CVE-2025-4966 | Medium | 6.1 | 2025-06-06 | The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing… |
CVE-2025-4964 | Medium | 4.9 | 2025-06-06 | The WP Online Users Stats plugin for WordPress is vulnerable to time-based SQL Injection via the ‘table_name’ parameter in all versions up to, and including, 1… |
CVE-2025-48911 | High | 8.2 | 2025-06-06 | Vulnerability of improper permission assignment in the note sharing module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-48910 | Medium | 5.5 | 2025-06-06 | Buffer overflow vulnerability in the DFile module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-48909 | High | 7.1 | 2025-06-06 | Bypass vulnerability in the device management channel Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-48908 | Medium | 6.7 | 2025-06-06 | Ability Auto Startup service vulnerability in the foundation process Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-48907 | Medium | 6.2 | 2025-06-06 | Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-48906 | High | 8.8 | 2025-06-06 | Authentication bypass vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-48905 | High | 8.1 | 2025-06-06 | Wasm exception capture vulnerability in the arkweb v8 module Impact: Successful exploitation of this vulnerability may cause the failure to capture specific Wa… |
CVE-2025-48904 | Medium | 4.4 | 2025-06-06 | Vulnerability that cards can call unauthorized APIs in the FRS process Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-48903 | High | 7.8 | 2025-06-06 | Permission bypass vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-48902 | Medium | 6.6 | 2025-06-06 | Vulnerability of uncontrolled system resource applications in the setting module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-2935 | Medium | 5.4 | 2025-06-06 | The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and… |
CVE-2025-5726 | Low | 2.4 | 2025-06-06 | A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown func… |
CVE-2025-5725 | Low | 2.4 | 2025-06-06 | A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unk… |
CVE-2025-5724 | Low | 2.4 | 2025-06-06 | A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been classified as problematic. Affected is an unknown function of the… |
CVE-2025-1778 | Medium | 4.3 | 2025-06-06 | The Art Theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'arttheme_theme_option_restore' AJAX function in all… |
CVE-2025-1777 | Medium | 6.4 | 2025-06-06 | The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' f… |
CVE-2025-5723 | Low | 2.4 | 2025-06-06 | A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unknown processing of t… |
CVE-2025-5722 | Low | 2.4 | 2025-06-06 | A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as problematic. This vulnerability affects unknown code of… |
CVE-2025-36513 | Medium | 4.3 | 2025-06-06 | Cross-site request forgery vulnerability exists in surveillance cameras provided by i-PRO Co., Ltd.. If a user views a crafted page while logged in to the affe… |
CVE-2025-5733 | Medium | 5.3 | 2025-06-06 | The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper o… |
CVE-2025-5721 | Low | 2.4 | 2025-06-06 | A vulnerability, which was classified as problematic, was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the fil… |
CVE-2025-5719 | | 2025-06-06 | The wallet has an authentication bypass vulnerability that allows access to specific pages. | |
CVE-2025-5716 | High | 7.3 | 2025-06-06 | A vulnerability classified as critical has been found in SourceCodester Open Source Clinic Management System 1.0. Affected is an unknown function of the file /… |
CVE-2025-5715 | Low | 3.8 | 2025-06-06 | A vulnerability was found in Signal App 7.41.4 on Android. It has been declared as problematic. This vulnerability affects unknown code of the component Biomet… |
CVE-2025-5714 | Medium | 4.3 | 2025-06-06 | A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250516. It has been classified as problematic. This affects an unknown part of the file /sys/up… |
CVE-2025-5713 | Low | 3.5 | 2025-06-06 | A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250519 and classified as problematic. Affected by this issue is some unknown functionality of th… |
CVE-2025-5712 | High | 7.3 | 2025-06-06 | A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulnerability is an unkn… |
CVE-2025-5711 | High | 7.3 | 2025-06-06 | A vulnerability, which was classified as critical, was found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of th… |
CVE-2025-5710 | High | 7.3 | 2025-06-06 | A vulnerability, which was classified as critical, has been found in code-projects Real Estate Property Management System 1.0. This issue affects some unknown… |
CVE-2025-5709 | High | 7.3 | 2025-06-06 | A vulnerability classified as critical was found in code-projects Real Estate Property Management System 1.0. This vulnerability affects unknown code of the fi… |