2025 CVEs (page 307)
Page 307 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-46487 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sftranna EC Authorize.net ec-authorizenet allows Reflecte… |
CVE-2025-46486 | Medium | 4.9 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocess… |
CVE-2025-46474 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SEUR OFICIAL SEUR Oficial seur allows… |
CVE-2025-46468 | Critical | 9.8 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPFable Fable Extra fable-extra allows… |
CVE-2025-46463 | High | 8.5 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group all… |
CVE-2025-46460 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Detheme Easy Guide wp-easy-guide allows SQL Injection.Thi… |
CVE-2025-46458 | High | 8.2 | 2025-05-23 | Cross-Site Request Forgery (CSRF) vulnerability in x000x occupancyplan occupancyplan allows SQL Injection.This issue affects occupancyplan: from n/a through <=… |
CVE-2025-46456 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Theme Blvd Sliders theme-blvd-sliders allows Reflec… |
CVE-2025-46455 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IndigoThemes WP HRM LITE wp-hrm-lite-human-resource-manag… |
CVE-2025-46454 | High | 7.5 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in svil4ok Meta Keywords & Description wp… |
CVE-2025-46448 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reifsnyderb Document Management System dms allows Reflect… |
CVE-2025-46446 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivanrojas Libro de Reclamaciones libro-de-reclamaciones a… |
CVE-2025-46444 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in scripteo Ads Pro ap-plugin-scripteo al… |
CVE-2025-46440 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark kStats Reloaded kstats-reloaded allows Reflected XSS… |
CVE-2025-46437 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tayoricom Tayori Form tayori allows Reflected XSS.This is… |
CVE-2025-41380 | | 2025-05-23 | Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a local user to retrieve the SSH hash string. | |
CVE-2025-41379 | | 2025-05-23 | The Intellian C700 web panel allows you to add firewall rules. Each of these rules has an associated ID, but there is a problem when adding a new rule, the ID… | |
CVE-2025-41378 | | 2025-05-23 | The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file. This can be exploited by an attacker to extend his knowle… | |
CVE-2025-41377 | | 2025-05-23 | A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated… | |
CVE-2025-39536 | High | 8.2 | 2025-05-23 | Missing Authorization vulnerability in Chimpstudio JobHunt Job Alerts allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affec… |
CVE-2025-39506 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core nasa-core allows P… |
CVE-2025-39505 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Reflected X… |
CVE-2025-39504 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Blind SQL I… |
CVE-2025-39503 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Object Injection.This issue affects Goodlayers Hotel: from n/a… |
CVE-2025-39502 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Reflected… |
CVE-2025-39501 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Blind SQL… |
CVE-2025-39500 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Object Injection.This issue affects Goodlayers Hostel: from… |
CVE-2025-39499 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in BoldThemes Medicare medicare allows Object Injection.This issue affects Medicare: from n/a through <= 2.1.0. |
CVE-2025-39495 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in BoldThemes Avantage avantage allows Object Injection.This issue affects Avantage: from n/a through <= 2.4.9. |
CVE-2025-39494 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wilmër wilmer allows PHP… |
CVE-2025-39490 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Backpack Traveler backpa… |
CVE-2025-39489 | Critical | 9.8 | 2025-05-23 | Incorrect Privilege Assignment vulnerability in pebas CouponXL couponxl allows Privilege Escalation.This issue affects CouponXL: from n/a through <= 4.5.0. |
CVE-2025-39485 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5… |
CVE-2025-39480 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer cardealer allows Object Injection.This issue affects Car Dealer: from n/a through < 1… |
CVE-2025-32309 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Healsoul healsoul allows PHP… |
CVE-2025-32302 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Winnex winnex allows PHP Local… |
CVE-2025-32294 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Oxpitan oxpitan allows PHP Loca… |
CVE-2025-32293 | High | 8.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in designthemes Finance Consultant finance allows Object Injection.This issue affects Finance Consultant: from… |
CVE-2025-32292 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in AncoraThemes Jarvis – Night Club, Concert, Festival WordPress jarvis allows Object Injection.This issue affe… |
CVE-2025-32289 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Yozi yozi allows PHP Local F… |
CVE-2025-32286 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Butcher butcher allows PHP L… |
CVE-2025-32285 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApusTheme Butcher butcher allows Reflected XSS.This issue… |
CVE-2025-32284 | High | 8.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in designthemes Pet World petsworld allows Object Injection.This issue affects Pet World: from n/a through <= 2… |
CVE-2025-31927 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in themeton Acerola allows Object Injection. This issue affects Acerola: from n/a through 1.6.5. |
CVE-2025-31924 | High | 8.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in designthemes Crafts & Arts crafts-and-arts allows Object Injection.This issue affects Crafts & Arts: from n/… |
CVE-2025-31918 | Critical | 9.8 | 2025-05-23 | Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue… |
CVE-2025-31916 | Critical | 9.0 | 2025-05-23 | Unrestricted Upload of File with Dangerous Type vulnerability in joy2012bd JP Students Result Management System Premium allows Upload a Web Shell to a Web Serv… |
CVE-2025-31914 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autores… |
CVE-2025-31913 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Ogami ogami allows PHP Local… |
CVE-2025-31912 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Enzio - Responsive Business Wor… |
CVE-2025-31636 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SaurabhSharma WP Post Modules for Elementor wp-post-modul… |
CVE-2025-31633 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kiamo - Responsive Business Ser… |
CVE-2025-31632 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SpyroPress La Boom allows PHP Local Fi… |
CVE-2025-31631 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in AncoraThemes Fish House fish-house allows Object Injection.This issue affects Fish House: from n/a through <… |
CVE-2025-31430 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in themeton The Business allows Object Injection. This issue affects The Business: from n/a through 1.6.1. |
CVE-2025-31423 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in AncoraThemes Umberto umberto allows Object Injection.This issue affects Umberto: from n/a through <= 1.2.8. |
CVE-2025-31397 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartcms Bus Ticket Booking with Seat Reservation for Woo… |
CVE-2025-31069 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Object Injection. This issue affects HotStar – Multi-… |
CVE-2025-31064 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Vizeon - Business Consulting vi… |
CVE-2025-31060 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Capie capie allows PHP Local… |
CVE-2025-31056 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn WhatsCart - Whatsapp Abandoned Cart Recovery, O… |
CVE-2025-31053 | High | 7.7 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows… |
CVE-2025-31049 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection. This issue affects Dash: from n/a through 1.3. |
CVE-2025-1123 | High | 7.2 | 2025-05-23 | The Solid Mail – SMTP email and logging made by SolidWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email Name, Subject, and Body in… |
CVE-2025-5106 | High | 7.3 | 2025-05-23 | A vulnerability was found in Fujian Kelixun 1.0. It has been classified as critical. This affects an unknown part of the file /app/fax/fax_view.php of the comp… |
CVE-2025-5105 | High | 7.3 | 2025-05-23 | A vulnerability was found in TOZED ZLT W51 up to 1.4.2 and classified as critical. Affected by this issue is some unknown functionality of the component Servic… |
CVE-2025-41407 | High | 8.3 | 2025-05-23 | Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report. |
CVE-2025-3895 | | 2025-05-23 | Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. It allows an unauth… | |
CVE-2025-3894 | | 2025-05-23 | Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privilege… | |
CVE-2025-3893 | | 2025-05-23 | While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action. Input provided by the the user i… | |
CVE-2025-36527 | High | 8.3 | 2025-05-23 | Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports. |
CVE-2025-4379 | | 2025-05-23 | DobryCMS in versions 2.* and lower is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in szukaj parameter allows arbitrary JavaSc… | |
CVE-2025-5096 | Medium | 6.4 | 2025-05-23 | The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data-s-content-padding', 'data-s-title', an… |
CVE-2025-47149 | Medium | 5.3 | 2025-05-23 | The optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper pattern file validation. If exploited, the product may treat an unautho… |
CVE-2025-48695 | Medium | 6.4 | 2025-05-23 | An issue was discovered in CyberDAVA before 1.1.20. A privilege escalation vulnerability allows a low-privileged user to escalate their privilege by abusing th… |
CVE-2025-4594 | Medium | 6.4 | 2025-05-23 | The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions u… |
CVE-2025-48708 | Medium | 4.0 | 2025-05-23 | gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document incl… |
CVE-2025-48701 | Medium | 5.4 | 2025-05-23 | openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used. |
CVE-2025-5100 | High | 8.0 | 2025-05-23 | A double-free condition occurs during the cleanup of temporary image files, which can be exploited to achieve memory corruption and potentially arbitrary code… |
CVE-2025-5099 | Critical | 9.8 | 2025-05-23 | An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary cod… |
CVE-2025-5098 | Critical | 9.1 | 2025-05-23 | PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authoriza… |
CVE-2025-2394 | | 2025-05-23 | Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leadi… | |
CVE-2025-4692 | Medium | 6.8 | 2025-05-23 | Actors can use a maliciously crafted JavaScript object notation (JSON) web token (JWT) to perform privilege escalation by submitting the malicious JWT to a vul… |
CVE-2025-4338 | Medium | 6.8 | 2025-05-22 | Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain cre… |
CVE-2025-48371 | High | 8.8 | 2025-05-22 | OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and doc… |
CVE-2025-4975 | | 2025-05-22 | When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power s… | |
CVE-2025-47181 | High | 8.8 | 2025-05-22 | Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. |
CVE-2025-48374 | | 2025-05-22 | zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudove… | |
CVE-2025-48373 | Critical | 9.1 | 2025-05-22 | Schule is open-source school management system software. The application relies on client-side JavaScript (index.js) to redirect users to different panels base… |
CVE-2025-48372 | High | 7.3 | 2025-05-22 | Schule is open-source school management system software. The generateOTP() function generates a 4-digit numeric One-Time Password (OTP). Prior to version 1.0.1… |
CVE-2025-48369 | Medium | 5.4 | 2025-05-22 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a persistent Cross-Site Scripting (XS… |
CVE-2025-48368 | Medium | 5.4 | 2025-05-22 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a DOM-based Cross-Site Scripting (XSS… |
CVE-2025-48366 | Medium | 5.4 | 2025-05-22 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability… |
CVE-2025-48075 | High | 7.5 | 2025-05-22 | Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to n… |
CVE-2025-48066 | Medium | 6.0 | 2025-05-22 | wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function to delete local dat… |
CVE-2025-30173 | Medium | 6.7 | 2025-05-22 | File upload vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03… |
CVE-2025-30172 | High | 8.0 | 2025-05-22 | Remote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: throu… |
CVE-2025-30171 | Critical | 9.0 | 2025-05-22 | System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This is… |
CVE-2025-30170 | Medium | 5.5 | 2025-05-22 | Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers access to file system information if session administrator crede… |
CVE-2025-30169 | Medium | 6.7 | 2025-05-22 | File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised. This issue affects ASPECT… |