2025 CVEs (page 307)
Page 307 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4280 | | 2025-05-22 | MacOS version of Poedit bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main app… | |
CVE-2025-4123 | High | 7.6 | 2025-05-22 | A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect u… |
CVE-2025-4133 | Medium | 5.4 | 2025-05-22 | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which… |
CVE-2025-5062 | Medium | 6.1 | 2025-05-22 | The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and includin… |
CVE-2025-3887 | High | 8.8 | 2025-05-22 | GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2025-3885 | Medium | 6.5 | 2025-05-22 | Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denia… |
CVE-2025-3884 | High | 7.5 | 2025-05-22 | Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information… |
CVE-2025-3883 | High | 8.8 | 2025-05-22 | eCharge Hardy Barth cPH2 index.php Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbit… |
CVE-2025-3882 | High | 8.8 | 2025-05-22 | eCharge Hardy Barth cPH2 nwcheckexec.php dest Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to ex… |
CVE-2025-3881 | High | 8.8 | 2025-05-22 | eCharge Hardy Barth cPH2 check_req.php ntp Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execu… |
CVE-2025-3486 | High | 8.8 | 2025-05-22 | Allegra isZipEntryValide Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec… |
CVE-2025-3484 | Critical | 9.8 | 2025-05-22 | MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-3483 | High | 7.8 | 2025-05-22 | MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-3482 | High | 7.8 | 2025-05-22 | MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-3481 | High | 7.8 | 2025-05-22 | MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-3480 | Medium | 6.5 | 2025-05-22 | MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to d… |
CVE-2025-2759 | High | 7.8 | 2025-05-22 | GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affecte… |
CVE-2025-5059 | Medium | 4.7 | 2025-05-21 | A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. This affects an unknown part of the file /admin/edit-subcategory… |
CVE-2025-34025 | | 2025-05-21 | The Versa Concerto SD-WAN orchestration platform is vulnerable to an privileges escalation and container escape vulnerability caused by unsafe default mounting… | |
CVE-2025-5057 | High | 7.3 | 2025-05-21 | A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-5056 | High | 7.3 | 2025-05-21 | A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-48070 | Low | 3.5 | 2025-05-21 | Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that ar… |
CVE-2025-47947 | High | 7.5 | 2025-05-21 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerabl… |
CVE-2025-47942 | Medium | 5.3 | 2025-05-21 | The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against do… |
CVE-2025-34027 | | 2025-05-21 | The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to… | |
CVE-2025-34026 | High | 7.5 | 2025-05-21 | The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to… |
CVE-2025-5053 | High | 7.3 | 2025-05-21 | A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the comp… |
CVE-2025-5052 | High | 7.3 | 2025-05-21 | A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component LS Co… |
CVE-2025-45753 | High | 7.2 | 2025-05-21 | A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import fu… |
CVE-2025-44040 | High | 7.2 | 2025-05-21 | An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be mad… |
CVE-2025-5051 | High | 7.3 | 2025-05-21 | A vulnerability classified as critical has been found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component BINARY Command Handler. The… |
CVE-2025-46412 | Critical | 9.8 | 2025-05-21 | Affected Vertiv products do not properly protect webserver functions that could allow an attacker to bypass authentication. |
CVE-2025-45755 | Medium | 6.1 | 2025-05-21 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can… |
CVE-2025-41426 | Critical | 9.8 | 2025-05-21 | Affected Vertiv products contain a stack based buffer overflow vulnerability. An attacker could exploit this vulnerability to gain code execution on the device. |
CVE-2025-36535 | Critical | 10.0 | 2025-05-21 | The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational di… |
CVE-2025-5050 | High | 7.3 | 2025-05-21 | A vulnerability was found in FreeFloat FTP Server 1.0. It has been rated as critical. This issue affects some unknown processing of the component BELL Command… |
CVE-2025-5049 | High | 7.3 | 2025-05-21 | A vulnerability was found in FreeFloat FTP Server 1.0. It has been declared as critical. This vulnerability affects unknown code of the component APPEND Comman… |
CVE-2025-45752 | High | 7.2 | 2025-05-21 | A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functionality in the Exte… |
CVE-2025-44083 | Critical | 9.8 | 2025-05-21 | An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication |
CVE-2025-3751 | | 2025-05-21 | The component listed above contains a vulnerability that can be exploited by an attacker to perform a SQL Injection attack. This could lead to unauthorised acc… | |
CVE-2025-2261 | | 2025-05-21 | Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of… | |
CVE-2025-27558 | Critical | 9.1 | 2025-05-21 | IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equi… |
CVE-2025-5033 | Medium | 4.3 | 2025-05-21 | A vulnerability classified as problematic was found in XiaoBingby TeaCMS 2.0.2. Affected by this vulnerability is an unknown functionality of the file src/main… |
CVE-2025-5020 | Medium | 4.3 | 2025-05-21 | Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTT… |
CVE-2025-48069 | Medium | 6.6 | 2025-05-21 | ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a vulnerability rela… |
CVE-2025-48064 | Low | 3.3 | 2025-05-21 | GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view… |
CVE-2025-48063 | High | 8.8 | 2025-05-21 | XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security mo… |
CVE-2025-48060 | High | 7.5 | 2025-05-21 | jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execu… |
CVE-2025-47291 | High | 7.5 | 2025-05-21 | containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to… |
CVE-2025-46822 | | 2025-05-21 | OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77… | |
CVE-2025-2102 | | 2025-05-21 | Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.This issue affects HYP… | |
CVE-2025-5032 | High | 7.3 | 2025-05-21 | A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. Affected is an unknown function of the file /admin/edit-category… |
CVE-2025-5031 | Low | 3.1 | 2025-05-21 | A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the component wxap… |
CVE-2025-5030 | Medium | 5.0 | 2025-05-21 | A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file… |
CVE-2025-4416 | High | 7.5 | 2025-05-21 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track… |
CVE-2025-4415 | Medium | 4.8 | 2025-05-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This i… |
CVE-2025-48012 | Medium | 4.8 | 2025-05-21 | Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Pa… |
CVE-2025-48011 | Medium | 4.8 | 2025-05-21 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Pass… |
CVE-2025-48010 | Medium | 4.8 | 2025-05-21 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Pass… |
CVE-2025-48009 | Low | 3.1 | 2025-05-21 | Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12. |
CVE-2025-45754 | Medium | 5.4 | 2025-05-21 | A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inject malicious JavaScript payloads by cr… |
CVE-2025-25539 | Medium | 6.5 | 2025-05-21 | Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information via help menu. |
CVE-2025-20267 | Medium | 4.8 | 2025-05-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-si… |
CVE-2025-20258 | Medium | 5.4 | 2025-05-21 | A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitrary commands into emails that are sent… |
CVE-2025-20257 | Medium | 6.5 | 2025-05-21 | A vulnerability in an API subsystem of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow an authenticated… |
CVE-2025-20256 | Medium | 6.5 | 2025-05-21 | A vulnerability in the web-based management interface of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow… |
CVE-2025-20255 | Medium | 4.3 | 2025-05-21 | A vulnerability in client join services of Cisco Webex Meetings could allow an unauthenticated, remote attacker to manipulate cached HTTP responses within the… |
CVE-2025-20250 | Medium | 6.1 | 2025-05-21 | A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. A vulnerability is due to imp… |
CVE-2025-20247 | Medium | 6.1 | 2025-05-21 | A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. A vulnerability is due to imp… |
CVE-2025-20246 | Medium | 6.1 | 2025-05-21 | A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. A vulnerability is due to imp… |
CVE-2025-20242 | Medium | 6.5 | 2025-05-21 | A vulnerability in the Cloud Connect component of Cisco Unified Contact Center Enterprise (CCE) could allow an unauthenticated, remote attacker to read and mod… |
CVE-2025-20152 | High | 8.6 | 2025-05-21 | A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a den… |
CVE-2025-20114 | Medium | 4.3 | 2025-05-21 | A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation atta… |
CVE-2025-20113 | High | 7.1 | 2025-05-21 | A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of… |
CVE-2025-20112 | Medium | 5.1 | 2025-05-21 | A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privileg… |
CVE-2025-0372 | | 2025-05-21 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in HYPR Passwordless on Windows allows Privilege Esca… | |
CVE-2025-4008 | High | 8.8 | 2025-05-21 | The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web… |
CVE-2025-48207 | High | 8.6 | 2025-05-21 | The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference. |
CVE-2025-48206 | Medium | 6.1 | 2025-05-21 | The ns_backup extension through 13.0.0 for TYPO3 allows XSS. |
CVE-2025-48205 | High | 8.6 | 2025-05-21 | The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference. |
CVE-2025-48204 | Medium | 6.8 | 2025-05-21 | The ns_backup extension through 13.0.0 for TYPO3 allows command injection. |
CVE-2025-48203 | Medium | 6.4 | 2025-05-21 | The cs_seo extension through 9.2.0 for TYPO3 allows XSS. |
CVE-2025-48202 | Medium | 5.3 | 2025-05-21 | The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference. |
CVE-2025-48201 | High | 8.6 | 2025-05-21 | The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location. |
CVE-2025-48200 | Critical | 10.0 | 2025-05-21 | The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. |
CVE-2025-27998 | High | 8.4 | 2025-05-21 | An issue in Valvesoftware Steam Client Steam Client 1738026274 allows attackers to escalate privileges via a crafted executable or DLL. |
CVE-2025-27997 | High | 8.4 | 2025-05-21 | An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell script or executable into the C:\ProgramData… |
CVE-2025-5029 | Medium | 5.4 | 2025-05-21 | A vulnerability has been found in Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0 Patch April 2025 and classified as critical. Affected by this vulnera… |
CVE-2025-44895 | Medium | 6.5 | 2025-05-21 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4BasedAceAdd function. |
CVE-2025-44892 | Medium | 6.5 | 2025-05-21 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter in the web_rmon_alarm_post_rmon_alarm function. |
CVE-2025-48417 | Medium | 6.5 | 2025-05-21 | The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-coded in the firmware a… |
CVE-2025-48416 | High | 8.1 | 2025-05-21 | An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the defa… |
CVE-2025-48415 | Medium | 6.2 | 2025-05-21 | A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands… |
CVE-2025-40775 | High | 7.5 | 2025-05-21 | When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm f… |
CVE-2025-1421 | | 2025-05-21 | Data provided in a request performed to the server while activating a new device are put in a database. Other high privileged users might download this data as… | |
CVE-2025-1420 | | 2025-05-21 | Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cros… | |
CVE-2025-1419 | | 2025-05-21 | Input provided in comment section of Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack… | |
CVE-2025-1418 | | 2025-05-21 | A low-privileged user can access information about profiles created in Proget MDM (Mobile Device Management), which contain details about allowed/prohibited fu… | |
CVE-2025-1417 | | 2025-05-21 | In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management). Th… | |
CVE-2025-1416 | | 2025-05-21 | In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Manag… |