2025 CVEs (page 303)
Page 303 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5268 | High | 8.1 | 2025-05-27 | Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption… |
CVE-2025-5267 | Medium | 5.4 | 2025-05-27 | A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in… |
CVE-2025-5266 | Medium | 4.3 | 2025-05-27 | Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability was fixed… |
CVE-2025-5265 | Medium | 4.8 | 2025-05-27 | Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially lead… |
CVE-2025-5264 | Medium | 4.8 | 2025-05-27 | Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leadin… |
CVE-2025-5263 | Medium | 4.3 | 2025-05-27 | Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed… |
CVE-2025-5262 | High | 7.5 | 2025-05-27 | A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memo… |
CVE-2025-5244 | Medium | 5.3 | 2025-05-27 | A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflin… |
CVE-2025-5117 | High | 8.8 | 2025-05-27 | The Property plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the use of the property_package_user_role metadata… |
CVE-2025-4412 | | 2025-05-27 | On macOS systems, by utilizing a Launch Agent and loading the viscosity_openvpn process from the application bundle, it is possible to load a dynamic library w… | |
CVE-2025-41653 | High | 7.5 | 2025-05-27 | An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a specially crafted HTTP r… |
CVE-2025-41652 | Critical | 9.8 | 2025-05-27 | The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakn… |
CVE-2025-41651 | Critical | 9.8 | 2025-05-27 | Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling una… |
CVE-2025-41650 | High | 7.5 | 2025-05-27 | An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially caus… |
CVE-2025-41649 | High | 7.5 | 2025-05-27 | An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leading to a denial-of-se… |
CVE-2025-2407 | | 2025-05-27 | Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability… | |
CVE-2025-23393 | Medium | 5.2 | 2025-05-27 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code… |
CVE-2025-5232 | Medium | 4.7 | 2025-05-27 | A vulnerability, which was classified as critical, has been found in PHPGurukul Student Study Center Management System 1.0. This issue affects some unknown pro… |
CVE-2025-5231 | High | 7.3 | 2025-05-27 | A vulnerability classified as critical was found in PHPGurukul Company Visitor Management System 1.0. This vulnerability affects unknown code of the file /forg… |
CVE-2025-48382 | Medium | 5.5 | 2025-05-27 | Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary… |
CVE-2025-48054 | | 2025-05-27 | Radashi is a TypeScript utility toolkit. Prior to version 12.5.1, the set function within the Radashi library is vulnerable to prototype pollution. If an attac… | |
CVE-2025-5230 | High | 7.3 | 2025-05-27 | A vulnerability classified as critical has been found in PHPGurukul Online Nurse Hiring System 1.0. This affects an unknown part of the file /admin/bwdates-rep… |
CVE-2025-5229 | High | 7.3 | 2025-05-27 | A vulnerability was found in Campcodes Online Hospital Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionali… |
CVE-2025-5228 | High | 8.8 | 2025-05-27 | A vulnerability was found in D-Link DI-8100 up to 20250523. It has been classified as critical. Affected is the function httpd_get_parm of the file /login.cgi… |
CVE-2025-5227 | High | 7.3 | 2025-05-27 | A vulnerability was found in PHPGurukul Small CRM 3.0 and classified as critical. This issue affects some unknown processing of the file /admin/manage-tickets… |
CVE-2025-48828 | Critical | 9.0 | 2025-05-27 | Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template co… |
CVE-2025-48827 | Critical | 10.0 | 2025-05-27 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or late… |
CVE-2025-48742 | Medium | 5.4 | 2025-05-27 | The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution. |
CVE-2025-26211 | Low | 3.7 | 2025-05-27 | Gibbon before 29.0.00 allows CSRF. |
CVE-2025-5226 | High | 7.3 | 2025-05-27 | A vulnerability has been found in PHPGurukul Small CRM 3.0 and classified as critical. This vulnerability affects unknown code of the file /admin/change-passwo… |
CVE-2025-5225 | High | 7.3 | 2025-05-27 | A vulnerability, which was classified as critical, was found in Campcodes Advanced Online Voting System 1.0. This affects an unknown part of the file /index.ph… |
CVE-2025-5224 | High | 7.3 | 2025-05-27 | A vulnerability classified as critical has been found in Campcodes Online Hospital Management System 1.0. Affected is an unknown function of the file /admin/ad… |
CVE-2025-5221 | High | 7.3 | 2025-05-27 | A vulnerability was found in FreeFloat FTP Server 1.0.0. It has been classified as critical. This affects an unknown part of the component QUOTE Command Handle… |
CVE-2025-4683 | Medium | 4.3 | 2025-05-27 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil… |
CVE-2025-4682 | Medium | 6.4 | 2025-05-27 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML attribute… |
CVE-2025-48744 | Medium | 6.4 | 2025-05-27 | In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution. |
CVE-2025-48743 | Medium | 5.3 | 2025-05-27 | SIGB PMB before 8.0.1.2 allows SQL injection. |
CVE-2025-5220 | High | 7.3 | 2025-05-27 | A vulnerability was found in FreeFloat FTP Server 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the component GET C… |
CVE-2025-33079 | Medium | 6.5 | 2025-05-27 | IBM Controller 11.0.0, 11.0.1, and 11.1.0 application could allow an authenticated user to obtain sensitive credentials that may be inadvertently included with… |
CVE-2025-5219 | High | 7.3 | 2025-05-27 | A vulnerability has been found in FreeFloat FTP Server 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the comp… |
CVE-2025-5218 | High | 7.3 | 2025-05-27 | A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0.0. Affected is an unknown function of the component LITERAL Command Ha… |
CVE-2025-5217 | High | 7.3 | 2025-05-27 | A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.0. This issue affects some unknown processing of the component RM… |
CVE-2025-5216 | High | 7.3 | 2025-05-27 | A vulnerability classified as critical was found in PHPGurukul Student Record System 3.20. This vulnerability affects unknown code of the file /login.php. The… |
CVE-2025-5215 | High | 8.8 | 2025-05-27 | A vulnerability classified as critical has been found in D-Link DCS-5020L 1.01_B2. This affects the function websReadEvent of the file /rame/ptdc.cgi. The mani… |
CVE-2025-5214 | High | 7.3 | 2025-05-27 | A vulnerability was found in Kashipara Responsive Online Learing Platform 1.0. It has been rated as critical. Affected by this issue is some unknown functional… |
CVE-2025-5213 | High | 7.3 | 2025-05-27 | A vulnerability was found in projectworlds Responsive E-Learning System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-4783 | Medium | 6.4 | 2025-05-27 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of the Countdown Timer Widget in a… |
CVE-2025-5212 | High | 7.3 | 2025-05-26 | A vulnerability was found in PHPGurukul Employee Record Management System 1.3. It has been classified as critical. Affected is an unknown function of the file… |
CVE-2025-5211 | High | 7.3 | 2025-05-26 | A vulnerability was found in PHPGurukul Employee Record Management System 1.3 and classified as critical. This issue affects some unknown processing of the fil… |
CVE-2025-5210 | High | 7.3 | 2025-05-26 | A vulnerability has been found in PHPGurukul Employee Record Management System 1.3 and classified as critical. This vulnerability affects unknown code of the f… |
CVE-2025-5208 | High | 7.3 | 2025-05-26 | A vulnerability, which was classified as critical, was found in SourceCodester Online Hospital Management System 1.0. This affects an unknown part of the file… |
CVE-2025-5207 | Medium | 4.7 | 2025-05-26 | A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. Affected by this issue is some unkno… |
CVE-2025-5206 | Medium | 4.7 | 2025-05-26 | A vulnerability classified as critical was found in Pixelimity 1.0. Affected by this vulnerability is an unknown functionality of the file /install/index.php o… |
CVE-2025-5205 | High | 7.3 | 2025-05-26 | A vulnerability classified as critical has been found in 1000 Projects Daily College Class Work Report Book 1.0. Affected is an unknown function of the file /d… |
CVE-2025-5204 | Low | 3.3 | 2025-05-26 | A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::ParseSkinLump_3DGS_M… |
CVE-2025-5203 | Low | 3.3 | 2025-05-26 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function SkipSpaces in the… |
CVE-2025-5202 | Low | 3.3 | 2025-05-26 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function HL1MDL… |
CVE-2025-5201 | Low | 3.3 | 2025-05-26 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function LWOImporter::CountVertsAnd… |
CVE-2025-5200 | Low | 3.3 | 2025-05-26 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDLImporter::InternReadFile_… |
CVE-2025-46802 | Medium | 6.0 | 2025-05-26 | For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session. |
CVE-2025-23395 | High | 7.8 | 2025-05-26 | Screen 5.0.0 when it runs with setuid-root privileges does not drop privileges while operating on a user supplied path. This allows unprivileged users to creat… |
CVE-2025-23394 | Critical | 9.8 | 2025-05-26 | A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumb… |
CVE-2025-23392 | Medium | 5.2 | 2025-05-26 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code o… |
CVE-2025-46803 | Medium | 5.0 | 2025-05-26 | The default mode of pseudo terminals (PTYs) allocated by Screen was changed from 0620 to 0622, thereby allowing anyone to write to any Screen PTYs in the syste… |
CVE-2025-37992 | Medium | 5.5 | 2025-05-26 | In the Linux kernel, the following vulnerability has been resolved: net_sched: Flush gso_skb list too during ->change() Previously, when reducing a qdisc's l… |
CVE-2025-5196 | Medium | 6.6 | 2025-05-26 | A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the com… |
CVE-2025-46805 | Medium | 5.5 | 2025-05-26 | Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setui… |
CVE-2025-46804 | Low | 3.3 | 2025-05-26 | A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not… |
CVE-2025-39498 | Medium | 5.3 | 2025-05-26 | Insertion of Sensitive Information Into Sent Data vulnerability in Spotlight Spotlight - Social Media Feeds (Premium) allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-5186 | Medium | 6.3 | 2025-05-26 | A vulnerability was found in thinkgem JeeSite up to 5.11.1. It has been rated as critical. Affected by this issue is the function ResourceLoader.getResource of… |
CVE-2025-5185 | Medium | 4.3 | 2025-05-26 | A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. It has been declared as problematic. Affected by this vulnerab… |
CVE-2025-40667 | Medium | 6.5 | 2025-05-26 | Missing authorization vulnerability in TCMAN's GIM v11. This allows an authenticated attacker to access any functionality of the application even when they are… |
CVE-2025-40666 | Critical | 9.8 | 2025-05-26 | Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID par… |
CVE-2025-40665 | Critical | 9.8 | 2025-05-26 | Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID par… |
CVE-2025-40664 | Critical | 9.1 | 2025-05-26 | Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestio… |
CVE-2025-40663 | | 2025-05-26 | Stored Cross-Site Scripting (XSS) vulnerability in i2A-Cronos version 23.02.01.17, from i2A. It allows an authenticated attacker to upload a malicious SVG imag… | |
CVE-2025-40653 | | 2025-05-26 | User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an att… | |
CVE-2025-40652 | | 2025-05-26 | Stored Cross-Site Scripting (XSS) vulnerability in the CoverManager booking software. This allows an attacker to inject malicious scripts into the application… | |
CVE-2025-40650 | | 2025-05-26 | Insecure Direct Object Reference (IDOR) vulnerability in Clickedu. This vulnerability could allow an attacker to retrieve information about student report card… | |
CVE-2025-5184 | Medium | 4.3 | 2025-05-26 | A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. It has been classified as problematic. Affected is an unknown… |
CVE-2025-5183 | Low | 3.5 | 2025-05-26 | A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as problematic. This issue affects some unknown… |
CVE-2025-5182 | Medium | 4.3 | 2025-05-26 | A vulnerability has been found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as critical. This vulnerability affects unk… |
CVE-2025-5181 | Low | 3.5 | 2025-05-26 | A vulnerability, which was classified as problematic, was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. This affects an unknown… |
CVE-2025-5180 | High | 7.0 | 2025-05-26 | A vulnerability, which was classified as critical, has been found in Wondershare Filmora 14.5.16. Affected by this issue is some unknown functionality in the l… |
CVE-2025-5179 | Low | 2.4 | 2025-05-26 | A vulnerability classified as problematic was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. Affected by this vulnerability is an unknown functi… |
CVE-2025-5178 | Medium | 6.3 | 2025-05-26 | A vulnerability classified as critical has been found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. Affected is an unknown function of the file /adm/… |
CVE-2025-5177 | Medium | 4.3 | 2025-05-26 | A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2025-4057 | Medium | 5.5 | 2025-05-26 | A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies. |
CVE-2025-4053 | | 2025-05-26 | The data stored in Be-Tech Mifare Classic card is stored in cleartext. An attacker having access to a Be-Tech hotel guest Mifare Classic card can create a mast… | |
CVE-2025-40672 | | 2025-05-26 | A Privilege Escalation vulnerability has been found in Panloader component v3.24.0.0 by Espiral MS Group. This vulnerability allows any user to override the fi… | |
CVE-2025-40671 | | 2025-05-26 | SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘… | |
CVE-2025-35003 | Critical | 9.8 | 2025-05-26 | Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bl… |
CVE-2025-41655 | High | 7.5 | 2025-05-26 | An unauthenticated remote attacker can access a URL which causes the device to reboot. |
CVE-2025-41654 | High | 8.2 | 2025-05-26 | An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by th… |
CVE-2025-1985 | Medium | 6.1 | 2025-05-26 | Due to improper neutralization of input during web page generation (XSS) an unauthenticated remote attacker can inject HTML code into the Web-UI in the affecte… |
CVE-2025-5176 | High | 7.3 | 2025-05-26 | A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2025-5175 | Medium | 5.3 | 2025-05-26 | A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py… |
CVE-2025-5174 | Medium | 5.3 | 2025-05-26 | A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypi… |
CVE-2025-5173 | Medium | 5.3 | 2025-05-26 | A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by… |
CVE-2025-41441 | Medium | 5.3 | 2025-05-26 | Mailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attacker to obtain coupon c… |