2025 CVEs (page 298)
Page 298 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5622 | Critical | 9.8 | 2025-06-05 | A vulnerability was found in D-Link DIR-816 1.10CNB05 and classified as critical. Affected by this issue is the function wirelessApcli_5g of the file /goform/w… |
CVE-2025-5621 | High | 7.3 | 2025-06-05 | A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. Affected by this vulnerability is the function qosClassifier of the file… |
CVE-2025-5620 | High | 7.3 | 2025-06-05 | A vulnerability, which was classified as critical, was found in D-Link DIR-816 1.10CNB05. Affected is the function setipsec_config of the file /goform/setipsec… |
CVE-2025-5619 | High | 8.8 | 2025-06-04 | A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.1. This issue affects the function formaddUserName of the file /goform/ad… |
CVE-2025-5618 | Medium | 6.3 | 2025-06-04 | A vulnerability classified as critical was found in PHPGurukul Online Fire Reporting System 1.2. This vulnerability affects unknown code of the file /admin/edi… |
CVE-2025-5617 | Medium | 6.3 | 2025-06-04 | A vulnerability classified as critical has been found in PHPGurukul Online Fire Reporting System 1.2. This affects an unknown part of the file /admin/manage-te… |
CVE-2025-5616 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been rated as critical. Affected by this issue is some unknown functionality o… |
CVE-2025-49007 | Medium | 5.3 | 2025-06-04 | Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-D… |
CVE-2025-5690 | Medium | 6.5 | 2025-06-04 | PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data… |
CVE-2025-5615 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been declared as critical. Affected by this vulnerability is an unknown functi… |
CVE-2025-5614 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been classified as critical. Affected is an unknown function of the file /sear… |
CVE-2025-5613 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This issue affects some unknown processing of the file /re… |
CVE-2025-5612 | Medium | 6.3 | 2025-06-04 | A vulnerability has been found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This vulnerability affects unknown code of the file /… |
CVE-2025-5611 | Medium | 6.3 | 2025-06-04 | A vulnerability, which was classified as critical, was found in CodeAstro Real Estate Management System 1.0. This affects an unknown part of the file /submitpr… |
CVE-2025-5610 | Medium | 6.3 | 2025-06-04 | A vulnerability, which was classified as critical, has been found in CodeAstro Real Estate Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2025-48947 | | 2025-06-04 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session`… | |
CVE-2025-46341 | High | 7.1 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any… |
CVE-2025-5609 | High | 8.8 | 2025-06-04 | A vulnerability classified as critical was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/… |
CVE-2025-5608 | High | 8.8 | 2025-06-04 | A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formsetreboottimer of the file /goform/SetSysAutoRebb… |
CVE-2025-5607 | High | 8.8 | 2025-06-04 | A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formSetPPTPUserList of the file /goform/set… |
CVE-2025-48935 | Critical | 9.1 | 2025-06-04 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission re… |
CVE-2025-48934 | Medium | 5.3 | 2025-06-04 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the `Deno.env.toObject` method ignores any variables listed in… |
CVE-2025-48888 | Medium | 5.3 | 2025-06-04 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read -… |
CVE-2025-46339 | Medium | 4.3 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy se… |
CVE-2025-46204 | Medium | 6.5 | 2025-06-04 | An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint. |
CVE-2025-46203 | Medium | 6.5 | 2025-06-04 | An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint. |
CVE-2025-46011 | Medium | 6.5 | 2025-06-04 | Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileges. |
CVE-2025-32015 | Medium | 6.7 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the `<iframe srcdoc>` attribute, which leads to cro… |
CVE-2025-31482 | Medium | 4.3 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. A vulnerability in versions prior to 1.26.2 causes a user to be repeatedly logged out after fetching a malicious… |
CVE-2025-31136 | Medium | 6.7 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a… |
CVE-2025-31134 | High | 7.5 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain dir… |
CVE-2025-22245 | Medium | 5.9 | 2025-06-04 | VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation. |
CVE-2025-22244 | Medium | 6.9 | 2025-06-04 | VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation. |
CVE-2025-22243 | High | 7.5 | 2025-06-04 | VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation. |
CVE-2025-5606 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in Tenda AC18 15.03.05.05. It has been declared as critical. This vulnerability affects the function formSetIptv of the file /goform/… |
CVE-2025-5604 | High | 7.3 | 2025-06-04 | A vulnerability was found in Campcodes Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-5603 | High | 7.3 | 2025-06-04 | A vulnerability has been found in Campcodes Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-5602 | High | 7.3 | 2025-06-04 | A vulnerability, which was classified as critical, was found in Campcodes Hospital Management System 1.0. Affected is an unknown function of the file /admin/re… |
CVE-2025-5600 | Critical | 9.8 | 2025-06-04 | A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This issue affects the function setLanguageCfg of… |
CVE-2025-5599 | High | 7.3 | 2025-06-04 | A vulnerability classified as critical was found in PHPGurukul Student Result Management System 1.3. This vulnerability affects unknown code of the file /editm… |
CVE-2025-5688 | | 2025-06-04 | We have identified a buffer overflow issue allowing out-of-bounds write when processing LLMNR or mDNS queries with very long DNS names. This issue only affects… | |
CVE-2025-5596 | High | 7.3 | 2025-06-04 | A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component REGET Command Handl… |
CVE-2025-5595 | High | 7.3 | 2025-06-04 | A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the component PROGRESS Command… |
CVE-2025-2336 | Medium | 4.8 | 2025-06-04 | Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to b… |
CVE-2025-20286 | Critical | 9.9 | 2025-06-04 | A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE)… |
CVE-2025-20279 | Medium | 4.8 | 2025-06-04 | A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to conduct a stored XSS attack on an a… |
CVE-2025-20278 | Medium | 6.0 | 2025-06-04 | A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the… |
CVE-2025-20277 | Low | 3.4 | 2025-06-04 | A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, local attacker to execute arbitrary code on an affecte… |
CVE-2025-20276 | Low | 3.8 | 2025-06-04 | A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to execute arbitrary code on an affect… |
CVE-2025-20275 | Medium | 5.3 | 2025-06-04 | A vulnerability in the file opening process of Cisco Unified Contact Center Express (Unified CCX) Editor could allow an unauthenticated attacker to execute arb… |
CVE-2025-20273 | Medium | 6.1 | 2025-06-04 | A vulnerability in the web-based management interface of Cisco Unified Intelligent Contact Management Enterprise could allow an unauthenticated, remote attacke… |
CVE-2025-20261 | High | 8.8 | 2025-06-04 | A vulnerability in the SSH connection handling of Cisco Integrated Management Controller (IMC) for Cisco UCS B-Series, UCS C-Series, UCS S-Series, and UCS X-Se… |
CVE-2025-20259 | Medium | 5.3 | 2025-06-04 | Multiple vulnerabilities in the update process of Cisco ThousandEyes Endpoint Agent for Windows could allow an authenticated, local attacker to delete arbitrar… |
CVE-2025-20163 | High | 8.7 | 2025-06-04 | A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisc… |
CVE-2025-20130 | Medium | 4.9 | 2025-06-04 | A vulnerability in the API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote atta… |
CVE-2025-20129 | Medium | 4.3 | 2025-06-04 | A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform (CCP), formerly Cisco SocialMiner, could allow an unauthenticated, rem… |
CVE-2025-5594 | High | 7.3 | 2025-06-04 | A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the component SET Command Han… |
CVE-2025-5593 | High | 7.3 | 2025-06-04 | A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component HOST Command Handler. T… |
CVE-2025-29094 | Medium | 6.1 | 2025-06-04 | Cross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Marketing/Forms, Mar… |
CVE-2025-29093 | High | 8.2 | 2025-06-04 | File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Gallery/Images compon… |
CVE-2025-23106 | Medium | 6.5 | 2025-06-04 | An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation. |
CVE-2025-23101 | Medium | 6.5 | 2025-06-04 | An issue was discovered in Samsung Mobile Processor Exynos 1380. A Use-After-Free in the mobile processor leads to privilege escalation. |
CVE-2025-23096 | Medium | 6.5 | 2025-06-04 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. A Double Free in the mobile processor leads to privilege escalation. |
CVE-2025-23095 | Medium | 6.5 | 2025-06-04 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. A Double Free in the mobile processor leads to privilege escalation. |
CVE-2025-5592 | High | 7.3 | 2025-06-04 | A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the comp… |
CVE-2025-48962 | Medium | 4.3 | 2025-06-04 | Sensitive information disclosure due to SSRF. The following products are affected: Acronis Cyber Protect 16 (Windows, Linux) before build 39938. |
CVE-2025-48961 | High | 7.3 | 2025-06-04 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39938. |
CVE-2025-48960 | Medium | 5.9 | 2025-06-04 | Weak server key used for TLS encryption. The following products are affected: Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938. |
CVE-2025-27811 | High | 7.8 | 2025-06-04 | A local privilege escalation in the razer_elevation_service.exe in Razer Synapse 4 through 4.0.86.2502180127 allows a local attacker to escalate their privileg… |
CVE-2025-1701 | | 2025-06-04 | CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially crafted request ov… | |
CVE-2025-5598 | | 2025-06-04 | Path Traversal vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Retrieve Embedded Sensitive Data.This issue affects airleader MASTER: 3.0046. | |
CVE-2025-5597 | | 2025-06-04 | Improper Authentication vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Authentication Bypass.This issue affects airleader MASTER: 3.00571. | |
CVE-2025-48959 | Medium | 6.7 | 2025-06-04 | Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 4007… |
CVE-2025-30415 | High | 7.5 | 2025-06-04 | Denial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) b… |
CVE-2025-5601 | High | 7.8 | 2025-06-04 | Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 allows denial of service via packet injection or crafted capture file |
CVE-2025-5584 | Low | 2.4 | 2025-06-04 | A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been classified as problematic. Affected is an unknown function of the file /doc… |
CVE-2025-5583 | High | 7.3 | 2025-06-04 | A vulnerability classified as critical has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /register.php… |
CVE-2025-5582 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-5581 | High | 7.3 | 2025-06-04 | A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2025-5580 | High | 7.3 | 2025-06-04 | A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been classified as critical. This affects an unknown part of the file /login.p… |
CVE-2025-5579 | High | 7.3 | 2025-06-04 | A vulnerability was found in PHPGurukul Dairy Farm Shop Management System 1.3 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2025-5578 | High | 7.3 | 2025-06-04 | A vulnerability has been found in PHPGurukul Dairy Farm Shop Management System 1.3 and classified as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-5577 | High | 7.3 | 2025-06-04 | A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System 1.3. Affected is an unknown function of the file /… |
CVE-2025-5576 | High | 7.3 | 2025-06-04 | A vulnerability, which was classified as critical, has been found in PHPGurukul Dairy Farm Shop Management System 1.3. This issue affects some unknown processi… |
CVE-2025-5482 | High | 8.8 | 2025-06-04 | The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all v… |
CVE-2025-47728 | High | 7.3 | 2025-06-04 | Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability t… |
CVE-2025-47727 | High | 7.3 | 2025-06-04 | Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to e… |
CVE-2025-47726 | High | 7.3 | 2025-06-04 | Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to e… |
CVE-2025-47725 | High | 7.3 | 2025-06-04 | Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to e… |
CVE-2025-47724 | High | 7.3 | 2025-06-04 | Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to e… |
CVE-2025-27444 | Medium | 4.8 | 2025-06-04 | A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filter[dateF… |
CVE-2025-5575 | High | 7.3 | 2025-06-04 | A vulnerability classified as critical was found in PHPGurukul Dairy Farm Shop Management System 1.3. This vulnerability affects unknown code of the file /add-… |
CVE-2025-5574 | High | 7.3 | 2025-06-04 | A vulnerability classified as critical has been found in PHPGurukul Dairy Farm Shop Management System 1.3. This affects an unknown part of the file /add-compan… |
CVE-2025-5573 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in D-Link DCS-932L 2.18.01. It has been rated as critical. Affected by this issue is the function setSystemWizard/setSystemControl of… |
CVE-2025-5572 | High | 8.8 | 2025-06-04 | A vulnerability was found in D-Link DCS-932L 2.18.01. It has been declared as critical. Affected by this vulnerability is the function setSystemEmail of the fi… |
CVE-2025-5571 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in D-Link DCS-932L 2.18.01. It has been classified as critical. Affected is the function setSystemAdmin of the file /setSystemAdmin… |
CVE-2025-5569 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in IdeaCMS up to 1.7 and classified as critical. This issue affects the function Article/Goods of the file /api/v1.index.article/getL… |
CVE-2025-4580 | Medium | 4.3 | 2025-06-04 | The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2025-4578 | Critical | 9.8 | 2025-06-04 | The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action availa… |
CVE-2025-48710 | Medium | 4.1 | 2025-06-04 | kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary co… |