2025 CVEs (page 304)
Page 304 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5172 | High | 7.3 | 2025-05-26 | A vulnerability, which was classified as critical, was found in Econtrata up to 20250516. Affected is an unknown function of the file /valida. The manipulation… |
CVE-2025-5171 | Medium | 6.3 | 2025-05-26 | A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5. This issue affects the function this.fileService.do… |
CVE-2025-5170 | Medium | 6.3 | 2025-05-26 | A vulnerability classified as critical was found in llisoft MTA Maita Training System 4.5. This vulnerability affects the function AdminShitiListRequestVo of t… |
CVE-2025-5169 | Low | 3.3 | 2025-05-26 | A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_… |
CVE-2025-5168 | Low | 3.3 | 2025-05-26 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::Impo… |
CVE-2025-5167 | Low | 3.3 | 2025-05-26 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImp… |
CVE-2025-5166 | Low | 3.3 | 2025-05-26 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFil… |
CVE-2025-5165 | Low | 3.3 | 2025-05-26 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurface… |
CVE-2025-5164 | Low | 3.7 | 2025-05-26 | A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handle… |
CVE-2025-5163 | Medium | 5.3 | 2025-05-26 | A vulnerability, which was classified as problematic, was found in yangshare 技术杨工 warehouseManager 仓库管理系统 1.0. This affects an unknown part. The manipulation l… |
CVE-2025-5162 | Medium | 6.3 | 2025-05-26 | A vulnerability, which was classified as critical, has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this issue is some unknown function… |
CVE-2025-5161 | Medium | 4.3 | 2025-05-26 | A vulnerability classified as problematic was found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this vulnerability is the function operationDaily… |
CVE-2025-5160 | Medium | 4.3 | 2025-05-26 | A vulnerability classified as problematic has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected is the function Download of the file /packetCap… |
CVE-2025-5159 | Medium | 4.3 | 2025-05-26 | A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been rated as problematic. This issue affects the function Download of the file… |
CVE-2025-2146 | Critical | 9.8 | 2025-05-26 | Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network… |
CVE-2025-5158 | Medium | 4.3 | 2025-05-25 | A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been declared as problematic. This vulnerability affects the function downloadSo… |
CVE-2025-5157 | Medium | 4.3 | 2025-05-25 | A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been classified as critical. This affects the function fileContent of the file /… |
CVE-2025-5156 | High | 8.8 | 2025-05-25 | A vulnerability was found in H3C GR-5400AX up to 100R008 and classified as critical. Affected by this issue is the function EditWlanMacList of the file /routin… |
CVE-2025-5155 | Medium | 6.3 | 2025-05-25 | A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical. Affected by this vulnerability is the function batchCope of the file app/adm… |
CVE-2025-5154 | Low | 2.3 | 2025-05-25 | A vulnerability, which was classified as problematic, was found in PhonePe App 25.03.21.0 on Android. Affected is an unknown function of the file /data/data/co… |
CVE-2025-5153 | Low | 3.5 | 2025-05-25 | A vulnerability, which was classified as problematic, has been found in CMS Made Simple 2.2.21. This issue affects some unknown processing of the component Des… |
CVE-2025-5152 | Medium | 6.3 | 2025-05-25 | A vulnerability classified as critical was found in Chanjet CRM up to 20250510. This vulnerability affects unknown code of the file /activity/newActivityedit.p… |
CVE-2025-5151 | Medium | 5.3 | 2025-05-25 | A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function execute_analysis_code_safely of the file in… |
CVE-2025-5150 | Medium | 6.3 | 2025-05-25 | A vulnerability was found in docarray up to 0.40.1. It has been rated as critical. Affected by this issue is the function __getitem__ of the file /docarray/dat… |
CVE-2025-5149 | Medium | 5.6 | 2025-05-25 | A vulnerability was found in WCMS up to 8.3.11. It has been declared as critical. Affected by this vulnerability is the function getMemberByUid of the file /in… |
CVE-2025-5148 | Medium | 5.3 | 2025-05-25 | A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the funct… |
CVE-2025-5147 | Medium | 6.3 | 2025-05-25 | A vulnerability was found in Netcore NBR1005GPEV2, NBR200V2 and B6V2 up to 20250508 and classified as critical. This issue affects the function tools_ping of t… |
CVE-2025-5146 | Medium | 6.3 | 2025-05-25 | A vulnerability has been found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2 and NBR200V2 up to 20250508 and classified as critical. This vul… |
CVE-2025-5145 | Medium | 6.3 | 2025-05-25 | A vulnerability, which was classified as critical, was found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2, NBR200V2 and POWER13 up to 202505… |
CVE-2025-5140 | Medium | 6.3 | 2025-05-25 | A vulnerability classified as critical has been found in Seeyon Zhiyuan OA Web Application System up to 8.1 SP2. This affects the function this.oursNetService… |
CVE-2025-5139 | Medium | 5.6 | 2025-05-25 | A vulnerability was found in Qualitor 8.20/8.24. It has been rated as critical. Affected by this issue is some unknown functionality of the file /html/ad/adcon… |
CVE-2025-5138 | Low | 3.5 | 2025-05-25 | A vulnerability was found in Bitwarden up to 2.25.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the com… |
CVE-2025-5137 | Medium | 4.7 | 2025-05-25 | A vulnerability was found in DedeCMS 5.7.117. It has been classified as critical. Affected is an unknown function of the file dede/sys_verifies.php?action=getf… |
CVE-2025-5136 | Low | 3.7 | 2025-05-25 | A vulnerability, which was classified as problematic, was found in Tmall Demo up to 20250505. This affects an unknown part of the file /tmall/order/pay/ of the… |
CVE-2025-5135 | Low | 2.4 | 2025-05-24 | A vulnerability, which was classified as problematic, has been found in Tmall Demo up to 20250505. Affected by this issue is some unknown functionality of the… |
CVE-2025-5134 | Low | 3.5 | 2025-05-24 | A vulnerability classified as problematic was found in Tmall Demo up to 20250505. Affected by this vulnerability is an unknown functionality of the component B… |
CVE-2025-5133 | Medium | 4.3 | 2025-05-24 | A vulnerability classified as problematic has been found in Tmall Demo up to 20250505. Affected is an unknown function of the component Search Box. The manipul… |
CVE-2025-5132 | Medium | 4.3 | 2025-05-24 | A vulnerability was found in Tmall Demo up to 20250505. It has been rated as problematic. This issue affects some unknown processing of the file tmall/admin/ac… |
CVE-2025-5131 | Medium | 4.7 | 2025-05-24 | A vulnerability was found in Tmall Demo up to 20250505. It has been declared as critical. This vulnerability affects the function uploadCategoryImage of the fi… |
CVE-2025-5130 | Medium | 4.7 | 2025-05-24 | A vulnerability was found in Tmall Demo up to 20250505. It has been classified as critical. This affects the function uploadProductImage of the file tmall/admi… |
CVE-2025-5129 | High | 7.0 | 2025-05-24 | A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical. Affected by this vulnerability is an unknown functionality in… |
CVE-2025-5128 | High | 7.3 | 2025-05-24 | A vulnerability, which was classified as critical, was found in ScriptAndTools Real-Estate-website-in-PHP 1.0. Affected is an unknown function of the file /adm… |
CVE-2025-5127 | Low | 3.5 | 2025-05-24 | A vulnerability was determined in Teledyne FLIR AX8 up to 1.46.16. This issue affects some unknown processing of the file /prod.php. Executing manipulation of… |
CVE-2025-5126 | High | 8.8 | 2025-05-24 | A vulnerability was found in Teledyne FLIR AX8 up to 1.46.16. This vulnerability affects the function setDataTime of the file \usr\www\application\models\setti… |
CVE-2025-5124 | High | 8.1 | 2025-05-24 | A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30. This affects… |
CVE-2025-4223 | Medium | 4.7 | 2025-05-24 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘login_url’ parameter… |
CVE-2025-5058 | Critical | 9.8 | 2025-05-24 | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_image()… |
CVE-2025-4603 | Critical | 9.1 | 2025-05-24 | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delet… |
CVE-2025-4602 | Medium | 5.9 | 2025-05-24 | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Reads in all versions up to, and including, 1.2.5 via the get_… |
CVE-2025-4336 | High | 8.1 | 2025-05-24 | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_file()… |
CVE-2025-5055 | Medium | 4.4 | 2025-05-24 | The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versi… |
CVE-2025-48756 | Low | 2.9 | 2025-05-24 | In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.g., 5 bits) for grou… |
CVE-2025-48755 | Low | 2.9 | 2025-05-24 | In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type). |
CVE-2025-48754 | Low | 2.9 | 2025-05-24 | In the memory_pages crate 0.1.0 for Rust, division by zero can occur. |
CVE-2025-48753 | Low | 2.9 | 2025-05-24 | In the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock. |
CVE-2025-48752 | Low | 2.9 | 2025-05-24 | In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked. |
CVE-2025-48751 | Low | 2.9 | 2025-05-24 | The process_lock crate 0.1.0 for Rust allows data races in unlock. |
CVE-2025-3869 | Medium | 6.1 | 2025-05-24 | The 4stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect no… |
CVE-2025-5119 | High | 7.3 | 2025-05-23 | A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical. This vulnerability affects unknown code of the file /include/controller/api_cont… |
CVE-2025-48741 | | 2025-05-23 | A Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, and 5.4.0 before 5.4.10 allows remote, authenticated, and… | |
CVE-2025-48740 | | 2025-05-23 | A Cross-Site Request Forgery (CSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 a… | |
CVE-2025-48739 | | 2025-05-23 | A Server-Side Request Forgery (SSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1… | |
CVE-2025-48738 | | 2025-05-23 | An e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows unauthentic… | |
CVE-2025-48735 | Medium | 4.3 | 2025-05-23 | A SQL Injection issue in the request body processing in BOS IPCs with firmware 21.45.8.2.2_220219 before 21.45.8.2.3_230220 allows remote attackers to obtain s… |
CVE-2025-46176 | Medium | 6.5 | 2025-05-23 | Hardcoded credentials in the Telnet service in D-Link DIR-605L v2.13B01 and DIR-816L v2.06B01 allow attackers to remotely execute arbitrary commands via firmwa… |
CVE-2025-44998 | Medium | 6.1 | 2025-05-23 | A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execute arbitrary JavaScr… |
CVE-2025-48378 | Medium | 5.4 | 2025-05-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could… |
CVE-2025-48377 | Medium | 5.4 | 2025-05-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL… |
CVE-2025-48376 | Low | 3.5 | 2025-05-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a malicious SuperUser (H… |
CVE-2025-48375 | Medium | 5.3 | 2025-05-23 | Schule is open-source school management system software. Prior to version 1.0.1, the file forgot_password.php (or equivalent endpoint responsible for email-bas… |
CVE-2025-43860 | High | 7.6 | 2025-05-23 | OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in v… |
CVE-2025-32967 | Medium | 5.4 | 2025-05-23 | OpenEMR is a free and open source electronic health records and medical practice management application. A logging oversight in versions prior to 7.0.3.4 allow… |
CVE-2025-32794 | High | 7.6 | 2025-05-23 | OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in v… |
CVE-2025-24917 | High | 7.8 | 2025-05-23 | In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run… |
CVE-2025-24916 | High | 7.0 | 2025-05-23 | When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did not enforce secure per… |
CVE-2025-5114 | Medium | 6.3 | 2025-05-23 | A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index… |
CVE-2025-5112 | High | 7.3 | 2025-05-23 | A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component MGET Command Handler. T… |
CVE-2025-5111 | High | 7.3 | 2025-05-23 | A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the comp… |
CVE-2025-5110 | High | 7.3 | 2025-05-23 | A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component VERBO… |
CVE-2025-3580 | Medium | 5.5 | 2025-05-23 | An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. Th… |
CVE-2025-5109 | High | 7.3 | 2025-05-23 | A vulnerability classified as critical has been found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component STATUS Command Handler. The… |
CVE-2025-5108 | Medium | 6.3 | 2025-05-23 | A vulnerability was found in zongzhige ShopXO 6.5.0. It has been rated as critical. This issue affects the function Upload of the file app/admin/controller/Pay… |
CVE-2025-5107 | Medium | 6.3 | 2025-05-23 | A vulnerability was found in Fujian Kelixun 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /app/xml_cdr/xml_cdr_det… |
CVE-2025-48292 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GoodLayers Tourmaster tourmaster allow… |
CVE-2025-48289 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet kidsplanet allows Object Injection.This issue affects Kids Planet: from n/a through… |
CVE-2025-48287 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Injection.This issue affects Pix 4x sem juros… |
CVE-2025-48286 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catkin ReDi Restaurant Reservation redi-restaurant-reserv… |
CVE-2025-48283 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Majestic Support Majestic Support majestic-support allows… |
CVE-2025-48275 | Medium | 6.5 | 2025-05-23 | Missing Authorization vulnerability in dastan800 Visual Header visual-header allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-48273 | High | 7.5 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Path Traversal.T… |
CVE-2025-48271 | Medium | 6.5 | 2025-05-23 | Missing Authorization vulnerability in Leadinfo Leadinfo leadinfo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Le… |
CVE-2025-48245 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal Quick Contact Form quick-contact-form allows R… |
CVE-2025-48241 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This i… |
CVE-2025-47690 | High | 8.8 | 2025-05-23 | Missing Authorization vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Privilege Escalation.This issue affec… |
CVE-2025-47687 | Critical | 10.0 | 2025-05-23 | Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Upload a Web S… |
CVE-2025-47680 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-tidy-tags xili-tidy-tags allo… |
CVE-2025-47678 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelCockpit FunnelCockpit funnelcockpit allows Reflecte… |
CVE-2025-47673 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allo… |
CVE-2025-47672 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange miniOrange Discord Integrat… |
CVE-2025-47671 | High | 7.6 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LETSCMS MLM Software Binary MLM Plan binary-mlm-plan allo… |