2025 CVEs (page 299)
Page 299 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-20994 | Medium | 4.5 | 2025-06-04 | Improper handling of insufficient permission in SyncClientProvider in Samsung Internet installed on non-Samsung Device prior to version 28.0.0.59 allows local… |
CVE-2025-20993 | Medium | 4.0 | 2025-06-04 | Out-of-bounds write in libsecimaging.camera.samsung.so prior to SMR Jun-2025 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2025-20992 | Medium | 4.0 | 2025-06-04 | Out-of-bound read in libsecimaging.camera.samsung.so prior to SMR Feb-2025 Release 1 allows local attackers to read out-of-bounds memory. |
CVE-2025-20991 | Medium | 4.0 | 2025-06-04 | Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allows local attackers to make devices discoverable. |
CVE-2025-20989 | Medium | 5.2 | 2025-06-04 | Improper logging in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a hmac_key. |
CVE-2025-20988 | Medium | 5.5 | 2025-06-04 | Out-of-bounds read in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to read out-of-bounds memory. |
CVE-2025-20987 | Medium | 5.2 | 2025-06-04 | Improper access control in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a auth_token. |
CVE-2025-20986 | Medium | 5.5 | 2025-06-04 | Improper access control in ScreenCapture for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to take screenshots. |
CVE-2025-20985 | Medium | 5.5 | 2025-06-04 | Improper privilege management in ThemeManager prior to SMR Jun-2025 Release 1 allows local privileged attackers to reuse trial items. |
CVE-2025-20984 | Medium | 6.8 | 2025-06-04 | Incorrect default permission in Samsung Cloud for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to access data in Samsung Cloud for Galax… |
CVE-2025-20981 | Medium | 6.2 | 2025-06-04 | Improper access control in AudioService prior to SMR Jun-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-5560 | High | 7.3 | 2025-06-04 | A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /i… |
CVE-2025-5558 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as critical. This issue affects some unknown processing… |
CVE-2025-5557 | Medium | 6.3 | 2025-06-04 | A vulnerability has been found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as critical. This vulnerability affects unknown co… |
CVE-2025-5556 | Medium | 6.3 | 2025-06-04 | A vulnerability, which was classified as critical, was found in PHPGurukul Teacher Subject Allocation Management System 1.0. This affects an unknown part of th… |
CVE-2025-5532 | Medium | 6.4 | 2025-06-04 | The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin… |
CVE-2025-5531 | Medium | 6.4 | 2025-06-04 | The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2025-5554 | Medium | 6.3 | 2025-06-04 | A vulnerability, which was classified as critical, has been found in PHPGurukul Rail Pass Management System 1.0. Affected by this issue is some unknown functio… |
CVE-2025-5553 | High | 7.3 | 2025-06-04 | A vulnerability classified as critical was found in PHPGurukul Rail Pass Management System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-5552 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in ChestnutCMS up to 15.1. It has been declared as critical. This vulnerability affects unknown code of the file /dev-api/groovy/exec… |
CVE-2025-49223 | Critical | 9.8 | 2025-06-04 | billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or… |
CVE-2025-5551 | High | 7.3 | 2025-06-04 | A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. This affects an unknown part of the component SYSTEM Command Handler… |
CVE-2025-5550 | High | 7.3 | 2025-06-04 | A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component PBSZ Co… |
CVE-2025-5549 | High | 7.3 | 2025-06-04 | A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the compon… |
CVE-2025-5548 | High | 7.3 | 2025-06-04 | A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component NOOP Command Handler… |
CVE-2025-5547 | High | 7.3 | 2025-06-04 | A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. This issue affects some unknown processing of the component CDUP… |
CVE-2025-5546 | Medium | 6.3 | 2025-06-04 | A vulnerability classified as critical was found in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /expense-r… |
CVE-2025-5545 | Medium | 4.3 | 2025-06-04 | A vulnerability classified as problematic has been found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. This affects the function imag… |
CVE-2025-5544 | Medium | 4.3 | 2025-06-03 | A vulnerability was found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. It has been rated as problematic. Affected by this issue is t… |
CVE-2025-5543 | Low | 2.4 | 2025-06-03 | A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726.1108. It has been declared as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2025-24015 | Medium | 5.3 | 2025-06-03 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in Deno in whic… |
CVE-2025-5542 | Low | 2.4 | 2025-06-03 | A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726.1108. It has been classified as problematic. Affected is an unknown function of the file /boafrm/f… |
CVE-2025-5527 | High | 8.8 | 2025-06-03 | A vulnerability was found in Tenda RX3 16.03.13.11_multi_TDE01. It has been rated as critical. This issue affects the function save_staticroute_data of the fil… |
CVE-2025-49002 | Critical | 9.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 tha… |
CVE-2025-49001 | Critical | 9.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully… |
CVE-2025-49000 | Low | 3.5 | 2025-06-03 | InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so… |
CVE-2025-48999 | High | 8.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a mali… |
CVE-2025-48951 | | 2025-06-03 | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserializatio… | |
CVE-2025-5525 | Medium | 5.6 | 2025-06-03 | A vulnerability was found in Jrohy trojan up to 2.15.3. It has been declared as critical. This vulnerability affects the function LogChan of the file trojan/ut… |
CVE-2025-5523 | Low | 3.5 | 2025-06-03 | A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file src/main/java/cn/enil… |
CVE-2025-35036 | High | 7.3 | 2025-06-03 | Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with… |
CVE-2025-23100 | High | 7.5 | 2025-06-03 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. The absence of a NULL check leads to a Denial of Service. |
CVE-2025-23098 | High | 7.8 | 2025-06-03 | An issue was discovered in Samsung Mobile Processor Exynos 980, 990, 1080, 2100, 1280, 2200, 1380. A Use-After-Free in the mobile processor leads to privilege… |
CVE-2025-23097 | Critical | 9.1 | 2025-06-03 | An issue was discovered in Samsung Mobile Processor Exynos 1380. The lack of a length check leads to out-of-bounds writes. |
CVE-2025-5522 | High | 7.3 | 2025-06-03 | A vulnerability was found in jack0240 魏 bskms 蓝天幼儿园管理系统 up to dffe6640b5b54d8e29da6f060e0493fea74b3fad. It has been rated as critical. Affected by this issue i… |
CVE-2025-5521 | Medium | 4.3 | 2025-06-03 | A vulnerability was found in WuKongOpenSource WukongCRM 9.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-48998 | High | 8.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27103 allows authenti… |
CVE-2025-48997 | | 2025-06-03 | Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 a… | |
CVE-2025-48953 | Medium | 5.5 | 2025-06-03 | Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that… |
CVE-2025-48950 | High | 8.8 | 2025-06-03 | MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common di… |
CVE-2025-23102 | High | 8.8 | 2025-06-03 | An issue was discovered in Samsung Mobile Processor Exynos 980, 990, 1080, 2100, 1280, 2200, 1380, 1480 and 2400. A Double Free in the mobile processor leads t… |
CVE-2025-5520 | Medium | 5.3 | 2025-06-03 | A vulnerability was found in Open5GS up to 2.7.3. It has been classified as problematic. Affected is the function gmm_state_authentication/emm_state_authentica… |
CVE-2025-5516 | Low | 2.4 | 2025-06-03 | A vulnerability, which was classified as problematic, was found in TOTOLINK X2000R 1.0.0-B20230726.1108. This affects an unknown part of the file /boafrm/formF… |
CVE-2025-5515 | Medium | 6.3 | 2025-06-03 | A vulnerability, which was classified as critical, has been found in TOTOLINK X2000R 1.0.0-B20230726.1108. Affected by this issue is some unknown functionality… |
CVE-2025-5513 | Low | 3.5 | 2025-06-03 | A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-30360 | Medium | 6.5 | 2025-06-03 | webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source… |
CVE-2025-30359 | Medium | 5.3 | 2025-06-03 | webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source… |
CVE-2025-5512 | High | 7.3 | 2025-06-03 | A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/ve… |
CVE-2025-5511 | Medium | 5.3 | 2025-06-03 | A vulnerability, which was classified as critical, has been found in quequnlong shiyi-blog up to 1.2.1. This issue affects some unknown processing of the file… |
CVE-2025-5510 | Medium | 6.3 | 2025-06-03 | A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknown code of the file /app/sys/article/opt… |
CVE-2025-32106 | Critical | 9.8 | 2025-06-03 | In Audiocodes Mediapack MP-11x through 6.60A.369.002, a crafted POST request request may result in an unauthenticated remote user's ability to execute unauthor… |
CVE-2025-32105 | Critical | 9.8 | 2025-06-03 | A buffer overflow in the the Sangoma IMG2020 HTTP server through 2.3.9.6 allows an unauthenticated user to achieve remote code execution. |
CVE-2025-30167 | High | 7.3 | 2025-06-03 | Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRA… |
CVE-2025-23107 | High | 8.6 | 2025-06-03 | An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The lack of a length check leads to out-of-bounds writes. |
CVE-2025-5509 | Medium | 6.3 | 2025-06-03 | A vulnerability classified as critical has been found in quequnlong shiyi-blog up to 1.2.1. This affects an unknown part of the file /api/file/upload. The mani… |
CVE-2025-5508 | Low | 2.4 | 2025-06-03 | A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been rated as problematic. Affected by this issue is some unknown functionality of t… |
CVE-2025-5507 | Low | 2.4 | 2025-06-03 | A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been declared as problematic. Affected by this vulnerability is an unknown functiona… |
CVE-2025-45854 | Critical | 10.0 | 2025-06-03 | /server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams. |
CVE-2025-44148 | Critical | 9.8 | 2025-06-03 | Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component |
CVE-2025-25022 | Critical | 9.6 | 2025-06-03 | IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticated user in the envir… |
CVE-2025-25021 | High | 7.2 | 2025-06-03 | IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a privileged execute code in case ma… |
CVE-2025-25020 | Medium | 6.5 | 2025-06-03 | IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated user to cause a den… |
CVE-2025-25019 | Medium | 4.8 | 2025-06-03 | IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which… |
CVE-2025-23103 | High | 8.6 | 2025-06-03 | An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The lack of a length check leads to out-of-bounds writes. |
CVE-2025-1334 | Medium | 4.0 | 2025-06-03 | IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 allows web pages to be stored locally which can… |
CVE-2025-5506 | Low | 2.4 | 2025-06-03 | A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been classified as problematic. Affected is an unknown function of the component NAT… |
CVE-2025-5505 | Low | 2.4 | 2025-06-03 | A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011 and classified as problematic. This issue affects some unknown processing of the file /boafr… |
CVE-2025-5504 | Medium | 6.3 | 2025-06-03 | A vulnerability has been found in TOTOLINK X2000R 1.0.0-B20230726.1108 and classified as critical. This vulnerability affects unknown code of the file /boafrm/… |
CVE-2025-5503 | High | 8.8 | 2025-06-03 | A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105. This affects the function formMapReboot of the file /boafrm/… |
CVE-2025-46548 | Medium | 6.5 | 2025-06-03 | If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied. Users that rely on authentication i… |
CVE-2025-43925 | Medium | 4.6 | 2025-06-03 | An issue was discovered in Unicom Focal Point 7.6.1. The database is encrypted with a hardcoded key, making it easier to recover the cleartext data. |
CVE-2025-43924 | Medium | 6.1 | 2025-06-03 | Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController (for /fp/admin/settings/loginpage) and th… |
CVE-2025-43923 | Medium | 6.5 | 2025-06-03 | An issue was discovered in ReportController in Unicom Focal Point 7.6.1. A user who has administrative privilege in Focal Point can perform SQL injection via t… |
CVE-2025-36564 | High | 7.8 | 2025-06-03 | Dell Encryption Admin Utilities versions prior to 11.10.2 contain an Improper Link Resolution vulnerability. A local malicious user could potentially exploit t… |
CVE-2025-5502 | Medium | 6.3 | 2025-06-03 | A vulnerability, which was classified as critical, has been found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this issue is the function formMapReboot of… |
CVE-2025-5501 | Medium | 5.3 | 2025-06-03 | A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_handle_path_switch_request_tran… |
CVE-2025-5499 | High | 7.3 | 2025-06-03 | A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_… |
CVE-2025-5498 | Medium | 5.5 | 2025-06-03 | A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of… |
CVE-2025-46154 | High | 8.4 | 2025-06-03 | Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php. |
CVE-2025-45855 | Medium | 5.4 | 2025-06-03 | An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading… |
CVE-2025-5497 | Medium | 6.3 | 2025-06-03 | A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport… |
CVE-2025-5495 | High | 7.3 | 2025-06-03 | A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. Th… |
CVE-2025-4517 | Critical | 9.4 | 2025-06-03 | Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the… |
CVE-2025-4435 | High | 7.5 | 2025-06-03 | When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. Howev… |
CVE-2025-4330 | High | 7.5 | 2025-06-03 | Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. … |
CVE-2025-4138 | High | 7.5 | 2025-06-03 | Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. … |
CVE-2025-5340 | Medium | 6.4 | 2025-06-03 | The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘album_buy_url’ parameter in all versions up to, and i… |
CVE-2025-4671 | Medium | 6.4 | 2025-06-03 | The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's user_meta and compare shortcodes in all versions up to… |
CVE-2025-4205 | Medium | 6.4 | 2025-06-03 | The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popupID' parameter in all versions up to, and including, 1.20.4 due… |
CVE-2025-5493 | Medium | 6.3 | 2025-06-03 | A vulnerability was found in Baison Channel Middleware Product 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the fi… |