2025 CVEs (page 3)
Page 3 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31938 | | 2026-08-11 | Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX may allow an information disclos… | |
CVE-2025-31936 | Medium | 5.7 | 2026-08-11 | Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within SMM may allow an escalation… |
CVE-2025-31356 | | 2026-08-11 | Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow an information disc… | |
CVE-2025-0041 | | 2026-08-11 | Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrar… | |
CVE-2025-31114 | | 2026-08-11 | Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval w… | |
CVE-2025-30241 | | 2026-08-10 | Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level… | |
CVE-2025-30240 | | 2026-08-10 | The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supp… | |
CVE-2025-30239 | | 2026-08-10 | In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker… | |
CVE-2025-30238 | | 2026-08-10 | In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. … | |
CVE-2025-30237 | | 2026-08-10 | The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoin… | |
CVE-2025-32736 | | 2026-08-10 | Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actio… | |
CVE-2025-15683 | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can inv… | |
CVE-2025-15682 | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT… | |
CVE-2025-15681 | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated… | |
CVE-2025-15680 | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate attacker can connect… | |
CVE-2025-13294 | | 2026-08-10 | An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controll… | |
CVE-2025-13293 | | 2026-08-10 | A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the d… | |
CVE-2025-71413 | Medium | 5.3 | 2026-08-07 | Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload a… |
CVE-2025-71412 | High | 7.1 | 2026-08-07 | Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flig… |
CVE-2025-71411 | Medium | 5.3 | 2026-08-07 | Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack… |
CVE-2025-71410 | Medium | 5.3 | 2026-08-07 | Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requ… |
CVE-2025-71409 | High | 7.1 | 2026-08-07 | Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading cle… |
CVE-2025-63235 | High | 7.5 | 2026-08-07 | In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid… |
CVE-2025-6508 | Medium | 4.3 | 2026-08-06 | The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API d… |
CVE-2025-15674 | Low | 2.7 | 2026-08-06 | The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected con… |
CVE-2025-14561 | Critical | 9.0 | 2026-08-06 | In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privil… |
CVE-2025-12317 | Medium | 5.0 | 2026-08-06 | When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with… |
CVE-2025-49506 | High | 7.5 | 2026-08-06 | APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaki… |
CVE-2025-9266 | Medium | 4.3 | 2026-08-06 | The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in al… |
CVE-2025-15028 | High | 7.2 | 2026-08-06 | The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2025-15039 | Critical | 9.4 | 2026-08-06 | The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific… |
CVE-2025-14779 | Low | 3.8 | 2026-08-06 | The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails… |
CVE-2025-13909 | Medium | 4.3 | 2026-08-06 | The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-fact… |
CVE-2025-13736 | Low | 3.7 | 2026-08-06 | When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and… |
CVE-2025-13394 | Medium | 5.4 | 2026-08-06 | The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically… |
CVE-2025-12627 | Low | 2.4 | 2026-08-06 | The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who… |
CVE-2025-11850 | Medium | 4.3 | 2026-08-06 | When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user… |
CVE-2025-15678 | Medium | 6.1 | 2026-08-06 | The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by defau… |
CVE-2025-63823 | Critical | 9.8 | 2026-08-05 | My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and… |
CVE-2025-63822 | High | 8.1 | 2026-08-05 | SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass a… |
CVE-2025-70962 | High | 7.5 | 2026-08-05 | Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. A… |
CVE-2025-15677 | Low | 3.5 | 2026-08-05 | The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing hi… |
CVE-2025-29296 | Critical | 9.8 | 2026-08-04 | H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C… |
CVE-2025-15631 | Medium | 5.9 | 2026-08-03 | A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficien… |
CVE-2025-15630 | Medium | 5.9 | 2026-08-03 | A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimat… |
CVE-2025-15629 | High | 7.5 | 2026-08-03 | A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed dev… |
CVE-2025-15628 | High | 7.5 | 2026-08-03 | Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An… |
CVE-2025-15627 | High | 7.5 | 2026-08-03 | A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentica… |
CVE-2025-15544 | Medium | 5.9 | 2026-08-03 | A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmit… |
CVE-2025-9291 | Medium | 6.5 | 2026-08-03 | A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not ad… |
CVE-2025-15673 | Medium | 4.9 | 2026-08-03 | The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowin… |
CVE-2025-15672 | High | 8.1 | 2026-08-03 | The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated… |
CVE-2025-71401 | Medium | 5.9 | 2026-08-02 | better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker a… |
CVE-2025-71400 | High | 7.1 | 2026-08-02 | better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated… |
CVE-2025-71399 | High | 8.6 | 2026-08-02 | Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path… |
CVE-2025-15675 | Medium | 4.8 | 2026-08-02 | The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, a… |
CVE-2025-71404 | | 2026-08-01 | better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value o… | |
CVE-2025-71403 | High | 7.1 | 2026-08-01 | better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers ca… |
CVE-2025-71402 | | 2026-08-01 | better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-se… | |
CVE-2025-14073 | Medium | 5.3 | 2026-08-01 | The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versio… |
CVE-2025-14469 | Medium | 4.3 | 2026-08-01 | The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce valid… |
CVE-2025-15669 | Medium | 4.8 | 2026-08-01 | The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, al… |
CVE-2025-69948 | Critical | 9.8 | 2026-07-31 | SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1. |
CVE-2025-69946 | Critical | 9.8 | 2026-07-31 | SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and wa… |
CVE-2025-62347 | Medium | 4.3 | 2026-07-31 | HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was… |
CVE-2025-67651 | | 2026-07-31 | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attribut… | |
CVE-2025-67650 | | 2026-07-31 | An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated… | |
CVE-2025-67649 | | 2026-07-31 | A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters respon… | |
CVE-2025-69947 | Critical | 9.8 | 2026-07-30 | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1. |
CVE-2025-69941 | Critical | 9.8 | 2026-07-30 | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1. |
CVE-2025-69938 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType. |
CVE-2025-69937 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id. |
CVE-2025-69936 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1. |
CVE-2025-69935 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter. |
CVE-2025-69934 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1. |
CVE-2025-69933 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1. |
CVE-2025-69931 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1. |
CVE-2025-69930 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1. |
CVE-2025-65342 | Medium | 6.1 | 2026-07-30 | code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field. |
CVE-2025-65341 | Medium | 6.1 | 2026-07-30 | Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php. |
CVE-2025-65336 | Critical | 9.8 | 2026-07-30 | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php. |
CVE-2025-51684 | Medium | 6.1 | 2026-07-30 | CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before… |
CVE-2025-36374 | Medium | 5.5 | 2026-07-30 | IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerabili… |
CVE-2025-0152 | Medium | 6.1 | 2026-07-30 | IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting… |
CVE-2025-36431 | Medium | 5.4 | 2026-07-30 | IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scripting. This vulne… |
CVE-2025-36298 | Medium | 5.4 | 2026-07-30 | IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling Fil… |
CVE-2025-69949 | High | 7.3 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email. |
CVE-2025-69945 | High | 7.3 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1. |
CVE-2025-69944 | High | 7.3 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter. |
CVE-2025-69943 | Critical | 9.8 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid. |
CVE-2025-69942 | Critical | 9.8 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1. |
CVE-2025-67408 | High | 7.3 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status. |
CVE-2025-67407 | High | 7.3 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class. |
CVE-2025-67406 | High | 7.3 | 2026-07-29 | https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code (remote). The compone… |
CVE-2025-67405 | High | 7.3 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password. |
CVE-2025-67404 | Critical | 9.8 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class. |
CVE-2025-67403 | Critical | 9.8 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name. |
CVE-2025-65340 | Critical | 9.8 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php. |
CVE-2025-65337 | Medium | 6.1 | 2026-07-29 | Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field. |
CVE-2025-14562 | Low | 3.1 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |