2025 CVEs (page 301)
Page 301 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0358 | High | 8.8 | 2025-06-02 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed… |
CVE-2025-0325 | Medium | 4.3 | 2025-06-02 | A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour conf… |
CVE-2025-0324 | Critical | 9.4 | 2025-06-02 | The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges. |
CVE-2025-5434 | High | 7.3 | 2025-06-02 | A vulnerability was found in Aem Solutions CMS up to 1.0. It has been classified as critical. This affects an unknown part of the file /page.php. The manipulat… |
CVE-2025-5433 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical. Affected by this issue is some unknown functionality of the file /index… |
CVE-2025-4010 | | 2025-06-02 | The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple endpoints of the web interface are vulnerable… | |
CVE-2025-1235 | Medium | 4.3 | 2025-06-02 | A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the sw… |
CVE-2025-5432 | Medium | 6.3 | 2025-06-02 | A vulnerability has been found in AssamLook CMS 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /view_te… |
CVE-2025-5431 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, was found in AssamLook CMS 1.0. Affected is an unknown function of the file /department-profile.php. The man… |
CVE-2025-3951 | Medium | 4.1 | 2025-06-02 | The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the a… |
CVE-2025-1485 | Medium | 4.8 | 2025-06-02 | The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise an… |
CVE-2025-5430 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, has been found in AssamLook CMS 1.0. This issue affects some unknown processing of the file /product.php. Th… |
CVE-2025-5429 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical was found in juzaweb CMS up to 3.4.2. This vulnerability affects unknown code of the file /admin-cp/plugin/install of th… |
CVE-2025-49113 | Critical | 9.9 | 2025-06-02 | Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validat… |
CVE-2025-49112 | Low | 3.1 | 2025-06-02 | setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev->size - prev->used. |
CVE-2025-25179 | High | 7.8 | 2025-06-02 | Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. |
CVE-2025-5428 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical has been found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/log-viewer of the componen… |
CVE-2025-5427 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin-cp… |
CVE-2025-5426 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-5425 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/de… |
CVE-2025-5424 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2 and classified as critical. This issue affects some unknown processing of the file /admin-cp/media of the… |
CVE-2025-20678 | Medium | 6.5 | 2025-06-02 | In ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue… |
CVE-2025-20677 | Medium | 5.5 | 2025-06-02 | In Bluetooth driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges n… |
CVE-2025-20676 | Medium | 5.5 | 2025-06-02 | In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges ne… |
CVE-2025-20675 | Medium | 5.5 | 2025-06-02 | In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges ne… |
CVE-2025-20674 | Critical | 9.8 | 2025-06-02 | In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check. This could lead to remote escalation of privilege with… |
CVE-2025-20673 | Medium | 5.5 | 2025-06-02 | In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges ne… |
CVE-2025-20672 | Critical | 9.8 | 2025-06-02 | In Bluetooth driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execu… |
CVE-2025-5423 | Medium | 6.3 | 2025-06-02 | A vulnerability has been found in juzaweb CMS up to 3.4.2 and classified as critical. This vulnerability affects unknown code of the file /admin-cp/setting/sys… |
CVE-2025-5422 | Medium | 4.3 | 2025-06-02 | A vulnerability, which was classified as problematic, was found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/logs/email of th… |
CVE-2025-5421 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, has been found in juzaweb CMS up to 3.4.2. Affected by this issue is some unknown functionality of the file… |
CVE-2025-5420 | Low | 3.5 | 2025-06-02 | A vulnerability classified as problematic was found in juzaweb CMS up to 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-c… |
CVE-2025-5412 | Low | 3.5 | 2025-06-02 | A vulnerability classified as problematic has been found in Mist Community Edition up to 4.7.1. Affected is the function Login of the file src/mist/api/views.p… |
CVE-2025-5411 | Low | 3.5 | 2025-06-01 | A vulnerability was found in Mist Community Edition up to 4.7.1. It has been rated as problematic. This issue affects the function tag_resources of the file sr… |
CVE-2025-5410 | Medium | 4.3 | 2025-06-01 | A vulnerability was found in Mist Community Edition up to 4.7.1. It has been declared as problematic. This vulnerability affects the function session_start_res… |
CVE-2025-5409 | High | 7.3 | 2025-06-01 | A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function create_token of the file src/mis… |
CVE-2025-5408 | Critical | 9.8 | 2025-06-01 | A vulnerability was found in WAVLINK QUANTUM D2G, QUANTUM D3G, WL-WN530G3A, WL-WN530HG3, WL-WN532A3 and WL-WN576K1 up to V1410_240222 and classified as critica… |
CVE-2025-5407 | Low | 2.4 | 2025-06-01 | A vulnerability has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513 and classified as problematic. Affected by this vulnera… |
CVE-2025-5406 | Medium | 6.3 | 2025-06-01 | A vulnerability, which was classified as critical, was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. Affected is an unknown f… |
CVE-2025-5405 | Low | 3.5 | 2025-06-01 | A vulnerability, which was classified as problematic, has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This issue affec… |
CVE-2025-5404 | Medium | 4.3 | 2025-06-01 | A vulnerability classified as problematic was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This vulnerability affects unknow… |
CVE-2025-5403 | Medium | 6.3 | 2025-06-01 | A vulnerability classified as critical has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This affects an unknown part of… |
CVE-2025-5402 | High | 7.3 | 2025-06-01 | A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been rated as critical. Affected by this issue is so… |
CVE-2025-40908 | Critical | 9.1 | 2025-06-01 | YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified |
CVE-2025-5401 | High | 7.3 | 2025-06-01 | A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been declared as critical. Affected by this vulnerab… |
CVE-2025-33005 | Medium | 6.3 | 2025-06-01 | IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the… |
CVE-2025-33004 | Medium | 6.5 | 2025-06-01 | IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction. |
CVE-2025-2896 | Medium | 4.8 | 2025-06-01 | IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript c… |
CVE-2025-25044 | Medium | 5.4 | 2025-06-01 | IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript c… |
CVE-2025-1499 | Medium | 6.5 | 2025-06-01 | IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext parameter file that could be viewed by an authe… |
CVE-2025-5400 | High | 7.3 | 2025-06-01 | A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been classified as critical. Affected is an unknown… |
CVE-2025-5390 | Medium | 6.3 | 2025-05-31 | A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /systemController/filedea… |
CVE-2025-5389 | Medium | 6.3 | 2025-05-31 | A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogenerateOne2Many of the fi… |
CVE-2025-5388 | Medium | 6.3 | 2025-05-31 | A vulnerability classified as critical was found in JeeWMS up to 20250504. Affected by this vulnerability is the function dogenerate of the file /generateContr… |
CVE-2025-5387 | Medium | 6.3 | 2025-05-31 | A vulnerability classified as critical has been found in JeeWMS up to 20250504. Affected is the function dogenerate of the file /generateController.do?dogenera… |
CVE-2025-5386 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in JeeWMS up to 20250504. It has been rated as critical. This issue affects the function transEditor of the file /cgformTransControll… |
CVE-2025-5385 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in JeeWMS up to 20250504. It has been declared as critical. This vulnerability affects the function doAdd of the file /cgformTemplate… |
CVE-2025-5384 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in JeeWMS up to 20250504. It has been classified as critical. This affects the function CgAutoListController of the file /cgAutoListC… |
CVE-2025-5383 | Low | 2.4 | 2025-05-31 | A vulnerability was found in Yifang CMS up to 2.0.2 and classified as problematic. Affected by this issue is some unknown functionality of the component Articl… |
CVE-2025-5381 | Low | 2.7 | 2025-05-31 | A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2. Affected is the function downloadFile of the file /api/File/download… |
CVE-2025-5380 | Medium | 6.3 | 2025-05-31 | A vulnerability, which was classified as critical, has been found in ashinigit 天青一白 XueShengZhuSu 学生住宿管理系统 up to 4d3f0ada0e71482c1e51fd5f5615e5a3d8bcbfbb. This… |
CVE-2025-5379 | Medium | 4.3 | 2025-05-31 | A vulnerability classified as critical was found in NuCom NC-WR744G 8.5.5 Build 20200530.307. This vulnerability affects unknown code of the component Console… |
CVE-2025-5378 | Medium | 4.3 | 2025-05-31 | A vulnerability classified as problematic has been found in Astun Technology iShare Maps 5.4.0. This affects an unknown part of the file mycouncil2.aspx. The m… |
CVE-2025-5377 | Medium | 4.3 | 2025-05-31 | A vulnerability was found in Astun Technology iShare Maps 5.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2025-5376 | High | 7.3 | 2025-05-31 | A vulnerability was found in SourceCodester Health Center Patient Record Management System 1.0. It has been declared as critical. Affected by this vulnerabilit… |
CVE-2025-4857 | High | 7.2 | 2025-05-31 | The Newsletters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.9.9 via the 'file' parameter. This makes i… |
CVE-2025-4691 | Medium | 5.3 | 2025-05-31 | The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all… |
CVE-2025-5375 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in PHPGurukul HPGurukul Online Birth Certificate System 2.0. It has been classified as critical. Affected is an unknown function of t… |
CVE-2025-5374 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in PHPGurukul Online Birth Certificate System 2.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2025-5373 | Medium | 6.3 | 2025-05-31 | A vulnerability has been found in PHPGurukul Online Birth Certificate System 2.0 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2025-5371 | High | 7.3 | 2025-05-31 | A vulnerability, which was classified as critical, has been found in SourceCodester Health Center Patient Record Management System 1.0. Affected by this issue… |
CVE-2025-5290 | Medium | 6.4 | 2025-05-31 | The Borderless – Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up… |
CVE-2025-3813 | Medium | 6.4 | 2025-05-31 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_elementor_data’ parameter in all versions… |
CVE-2025-5292 | Medium | 6.4 | 2025-05-31 | The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder plugin for WordPress is vulnerable… |
CVE-2025-5285 | Medium | 6.4 | 2025-05-31 | The Product Subtitle for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmlTag’ parameter in all versions up to, and i… |
CVE-2025-4672 | High | 8.8 | 2025-05-31 | The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permission_callback() functio… |
CVE-2025-4631 | Critical | 9.8 | 2025-05-31 | The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktend_object endpoint in versions 2.0.6.0… |
CVE-2025-4607 | Critical | 9.8 | 2025-05-31 | The PSW Front-end Login & Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12 via the customer_r… |
CVE-2025-4595 | Medium | 6.4 | 2025-05-31 | The FastSpring plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fastspring/block-fastspringblocks-complete-product-catalog'… |
CVE-2025-4590 | Medium | 6.4 | 2025-05-31 | The Daisycon prijsvergelijkers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'daisycon_uitvaart' shortcode in all versions… |
CVE-2025-4103 | High | 8.8 | 2025-05-31 | The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wp_ajax_wpgm_start_geojson_import() function… |
CVE-2025-5370 | High | 7.3 | 2025-05-31 | A vulnerability classified as critical was found in PHPGurukul News Portal 4.1. Affected by this vulnerability is an unknown functionality of the file /admin/f… |
CVE-2025-5369 | High | 7.3 | 2025-05-31 | A vulnerability classified as critical has been found in SourceCodester PHP Display Username After Login 1.0. Affected is an unknown function of the file /logi… |
CVE-2025-5368 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-5016 | Medium | 4.7 | 2025-05-31 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and includ… |
CVE-2025-5367 | High | 7.3 | 2025-05-31 | A vulnerability was found in PHPGurukul Online Shopping Portal Project 1.0. It has been declared as critical. This vulnerability affects unknown code of the fi… |
CVE-2025-5365 | High | 7.3 | 2025-05-31 | A vulnerability was found in Campcodes Online Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file /adm… |
CVE-2025-5364 | High | 7.3 | 2025-05-30 | A vulnerability was found in Campcodes Online Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality o… |
CVE-2025-5363 | High | 7.3 | 2025-05-30 | A vulnerability has been found in Campcodes Online Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2025-5362 | High | 7.3 | 2025-05-30 | A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. Affected is an unknown function of the file /a… |
CVE-2025-5361 | High | 7.3 | 2025-05-30 | A vulnerability, which was classified as critical, has been found in Campcodes Online Hospital Management System 1.0. This issue affects some unknown processin… |
CVE-2025-5360 | High | 7.3 | 2025-05-30 | A vulnerability classified as critical was found in Campcodes Online Hospital Management System 1.0. This vulnerability affects unknown code of the file /book-… |
CVE-2025-48949 | Critical | 9.8 | 2025-05-30 | Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validatio… |
CVE-2025-48948 | Medium | 6.5 | 2025-05-30 | Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated… |
CVE-2025-48946 | Low | 3.7 | 2025-05-30 | liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version 0.13.0 supports the… |
CVE-2025-48882 | | 2025-05-30 | PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the sta… | |
CVE-2025-2503 | High | 7.1 | 2025-05-30 | An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file deletions as an ele… |
CVE-2025-2502 | High | 7.8 | 2025-05-30 | An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges. |
CVE-2025-2501 | High | 7.8 | 2025-05-30 | An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges. |
CVE-2025-1479 | Medium | 5.3 | 2025-05-30 | An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to execute arbitrary cod… |