2025 CVEs (page 302)
Page 302 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5359 | High | 7.3 | 2025-05-30 | A vulnerability classified as critical has been found in Campcodes Online Hospital Management System 1.0. This affects an unknown part of the file /appointment… |
CVE-2025-48944 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/c… |
CVE-2025-48943 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes… |
CVE-2025-48942 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a… |
CVE-2025-48938 | Critical | 9.8 | 2025-05-30 | go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 wh… |
CVE-2025-48885 | | 2025-05-30 | application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary… | |
CVE-2025-48883 | | 2025-05-30 | Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly enc… | |
CVE-2025-5358 | High | 7.3 | 2025-05-30 | A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. It has been rated as critical. Affected by this issue is some unknown funct… |
CVE-2025-5357 | High | 7.3 | 2025-05-30 | A vulnerability was found in FreeFloat FTP Server 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the comp… |
CVE-2025-5054 | Medium | 4.7 | 2025-05-30 | Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. … |
CVE-2025-48887 | Medium | 6.5 | 2025-05-30 | vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability in the file `vllm/entr… |
CVE-2025-5356 | High | 7.3 | 2025-05-30 | A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component BYE Command Handler… |
CVE-2025-4992 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Relea… |
CVE-2025-4991 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEX… |
CVE-2025-4990 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Change Governance in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE… |
CVE-2025-4989 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025… |
CVE-2025-4988 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Results Analytics in Multidisciplinary Optimization Engineer from Release 3DEXPERIENCE R2022x throu… |
CVE-2025-4986 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Model Definition in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R… |
CVE-2025-4985 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXP… |
CVE-2025-4984 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025x allows an attacker to exec… |
CVE-2025-4983 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting City Referential in City Referential Manager on Release 3DEXPERIENCE R2025x allows an attacker to… |
CVE-2025-3611 | Low | 3.1 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allow… |
CVE-2025-3230 | Medium | 5.4 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deact… |
CVE-2025-2571 | Medium | 4.2 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user account… |
CVE-2025-1792 | Low | 3.1 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member inf… |
CVE-2025-0602 | High | 8.7 | 2025-05-30 | A stored Cross-site Scripting (XSS) vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPE… |
CVE-2025-4598 | Medium | 4.7 | 2025-05-30 | A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access th… |
CVE-2025-48331 | High | 7.5 | 2025-05-30 | Insertion of Sensitive Information Into Sent Data vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-customers-exporter allow… |
CVE-2025-4433 | High | 8.8 | 2025-05-30 | Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and… |
CVE-2025-40909 | Medium | 5.9 | 2025-05-30 | Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the… |
CVE-2025-2500 | High | 7.4 | 2025-05-30 | A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gain unauthorized acce… |
CVE-2025-1484 | Medium | 6.5 | 2025-05-30 | A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker could impact the confide… |
CVE-2025-5190 | High | 8.8 | 2025-05-30 | The Browse As plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2. This is due to incorrect authentication checki… |
CVE-2025-4944 | Medium | 6.4 | 2025-05-30 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Compare and Google Maps widget… |
CVE-2025-4597 | Medium | 6.5 | 2025-05-30 | The Woo Slider Pro – Drag Drop Slider Builder For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili… |
CVE-2025-1763 | High | 8.7 | 2025-05-30 | An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific con… |
CVE-2025-5235 | Medium | 6.4 | 2025-05-30 | The OpenSheetMusicDisplay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including… |
CVE-2025-5142 | Medium | 6.5 | 2025-05-30 | The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due t… |
CVE-2025-4636 | High | 7.8 | 2025-05-30 | Due to excessive privileges granted to the web user running the airpointer web platform, a malicious actor that gains control of the this user would be able to… |
CVE-2025-4635 | Medium | 6.6 | 2025-05-30 | A malicious user with administrative privileges in the web portal would be able to manipulate the Diagnostics module to obtain remote code execution on the loc… |
CVE-2025-4634 | Medium | 4.1 | 2025-05-30 | The web portal on airpointer 2.4.107-2 was vulnerable local file inclusion. A malicious user with administrative privileges in the web portal would be able to… |
CVE-2025-4633 | Medium | 6.5 | 2025-05-30 | Default credentials were present in the web portal for Airpointer 2.4.107-2, allowing an unauthenticated malicious actor to log in via the web portal |
CVE-2025-48912 | Medium | 6.5 | 2025-05-30 | An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. T… |
CVE-2025-48334 | Medium | 6.5 | 2025-05-30 | Missing Authorization vulnerability in BinaryCarpenter Woo Slider Pro woo-slider-pro-drag-drop-slider-builder-for-woocommerce allows Exploiting Incorrectly Con… |
CVE-2025-5236 | Medium | 6.4 | 2025-05-30 | The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and inclu… |
CVE-2025-4431 | Medium | 4.3 | 2025-05-30 | The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c… |
CVE-2025-4943 | Medium | 6.4 | 2025-05-30 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-lakit-element-link’ parameter in all ve… |
CVE-2025-48936 | High | 8.1 | 2025-05-30 | Zitadel is open-source identity infrastructure software. Prior to versions 2.70.12, 2.71.10, and 3.2.2, a potential vulnerability exists in the password reset… |
CVE-2025-48880 | Medium | 6.6 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, when an administrative account is a deleting a user, there is the the p… |
CVE-2025-48875 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, the system's incorrect validation of last_name and first_name during pr… |
CVE-2025-48865 | Critical | 9.1 | 2025-05-30 | Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (ex… |
CVE-2025-48492 | High | 8.8 | 2025-05-30 | GetSimple CMS is a content management system. In versions starting from 3.3.16 to 3.3.21, an authenticated user with access to the Edit component can inject ar… |
CVE-2025-48489 | Medium | 4.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due… |
CVE-2025-48488 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, deleting the file .htaccess allows an attacker to upload an HTML file c… |
CVE-2025-48487 | Medium | 4.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when creating a translation of a phrase that appears in a flash-message… |
CVE-2025-48486 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the cross-site scripiting (XSS) vulnerability is caused by the lack of… |
CVE-2025-48485 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due… |
CVE-2025-47697 | High | 7.5 | 2025-05-30 | Client-side enforcement of server-side security issue exists in wivia 5 all versions. If exploited, an unauthenticated attacker may bypass authentication and o… |
CVE-2025-41406 | Medium | 6.1 | 2025-05-30 | Cross-site scripting vulnerability exists in wivia 5 all versions. If exploited, when a user connects to the affected device with a specific operation, an arbi… |
CVE-2025-41385 | High | 7.2 | 2025-05-30 | An OS Command Injection issue exists in wivia 5 all versions. If this vulnerability is exploited, an arbitrary OS command may be executed by a logged-in admini… |
CVE-2025-5259 | Medium | 6.4 | 2025-05-30 | The Minimal Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.7… |
CVE-2025-4659 | Medium | 5.3 | 2025-05-30 | The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in al… |
CVE-2025-4429 | Medium | 6.1 | 2025-05-30 | The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the page, leading to a R… |
CVE-2025-48889 | Medium | 5.3 | 2025-05-30 | Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python funct… |
CVE-2025-48881 | High | 8.3 | 2025-05-30 | Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all ob… |
CVE-2025-48490 | | 2025-05-30 | Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations defined for the same… | |
CVE-2025-41235 | High | 8.6 | 2025-05-30 | Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies. |
CVE-2025-48484 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application is vulnerable to Cross-Site Scripting (XSS) attacks due… |
CVE-2025-48483 | Medium | 5.4 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due… |
CVE-2025-48482 | Medium | 4.3 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, there is a mass assignment vulnerability. The Customer object is update… |
CVE-2025-48481 | Critical | 9.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invite_hash… |
CVE-2025-48480 | Low | 2.7 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an authorized user with the administrator role or with the privilege Us… |
CVE-2025-48479 | Low | 2.7 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the laravel-translation-manager package does not correctly validate use… |
CVE-2025-48478 | Medium | 4.9 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, insufficient input validation during user creation has resulted in a ma… |
CVE-2025-48477 | High | 8.1 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application's logic requires the user to perform a correct sequence… |
CVE-2025-48476 | High | 8.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user records using the fill() method, there is… |
CVE-2025-48491 | | 2025-05-30 | Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in the source code. This issue has been p… | |
CVE-2025-48381 | Medium | 4.3 | 2025-05-30 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0… |
CVE-2025-48068 | Medium | 4.3 | 2025-05-30 | Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js ma… |
CVE-2025-47952 | Critical | 9.1 | 2025-05-30 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik man… |
CVE-2025-44906 | High | 7.8 | 2025-05-30 | jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c. |
CVE-2025-44905 | High | 8.8 | 2025-05-30 | hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. |
CVE-2025-44904 | High | 8.8 | 2025-05-30 | hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. |
CVE-2025-48757 | Critical | 9.3 | 2025-05-30 | An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database… |
CVE-2025-44619 | Critical | 9.1 | 2025-05-30 | Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the network without authentic… |
CVE-2025-44614 | High | 7.5 | 2025-05-30 | Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext. |
CVE-2025-44612 | Medium | 5.9 | 2025-05-30 | Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device credentials, allowing… |
CVE-2025-46352 | Critical | 9.8 | 2025-05-30 | The CS5000 Fire Panel is vulnerable due to a hard-coded password that runs on a VNC server and is visible as a string in the binary responsible for running V… |
CVE-2025-41438 | Critical | 9.8 | 2025-05-30 | The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, i… |
CVE-2025-1907 | Critical | 9.8 | 2025-05-30 | Instantel Micromate lacks authentication on a configuration port which could allow an attacker to execute commands if connected. |
CVE-2025-5332 | High | 7.3 | 2025-05-29 | A vulnerability was found in 1000 Projects Online Notice Board 1.0 and classified as critical. This issue affects some unknown processing of the file /index.ph… |
CVE-2025-5331 | High | 7.3 | 2025-05-29 | A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. This vulnerability affects unknown code of the component NLST Command Hand… |
CVE-2025-5330 | High | 7.3 | 2025-05-29 | A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component RETR Command Handler. T… |
CVE-2025-5307 | High | 7.8 | 2025-05-29 | Santesoft Sante DICOM Viewer Pro contains a memory corruption vulnerability. A local attacker could exploit this issue to potentially disclose information and… |
CVE-2025-31264 | Medium | 4.6 | 2025-05-29 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An… |
CVE-2025-31263 | Critical | 9.1 | 2025-05-29 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to corrupt coprocessor memory. |
CVE-2025-31261 | Medium | 5.5 | 2025-05-29 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A… |
CVE-2025-31231 | Medium | 5.5 | 2025-05-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to read sensitive location inform… |
CVE-2025-31199 | Medium | 5.5 | 2025-05-29 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.8.2, visionOS… |
CVE-2025-31198 | Medium | 5.5 | 2025-05-29 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A path han… |