2025 CVEs (page 308)
Page 308 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2410 | Critical | 9.1 | 2025-05-22 | Port manipulation vulnerabilities in ASPECT provide attackers with the ability to con-trol TCP/IP port access if session administrator credentials become compr… |
CVE-2025-2409 | Critical | 9.1 | 2025-05-22 | File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issu… |
CVE-2025-48061 | Medium | 5.6 | 2025-05-22 | wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidate… |
CVE-2025-47780 | High | 7.8 | 2025-05-22 | Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-… |
CVE-2025-47779 | High | 7.7 | 2025-05-22 | Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-… |
CVE-2025-46716 | Medium | 5.5 | 2025-05-22 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to version 1.15.1… |
CVE-2025-46715 | High | 7.8 | 2025-05-22 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to version 1.15.1… |
CVE-2025-45472 | High | 8.8 | 2025-05-22 | Insecure permissions in autodeploy-layer v1.2.0 allows attackers to escalate privileges and compromise the customer cloud account. |
CVE-2025-43596 | High | 7.8 | 2025-05-22 | An insecure file system permissions vulnerability in MSP360 Backup 8.0 allows a low privileged user to execute commands with SYSTEM level privileges using a sp… |
CVE-2025-33138 | Medium | 5.4 | 2025-05-22 | IBM Aspera Faspex 5.0.0 through 5.0.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be execute… |
CVE-2025-33137 | High | 7.1 | 2025-05-22 | IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another u… |
CVE-2025-33136 | High | 7.1 | 2025-05-22 | IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another u… |
CVE-2025-5081 | High | 7.3 | 2025-05-22 | A vulnerability classified as critical was found in Campcodes Cybercafe Management System 1.0. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-4366 | Medium | 6.1 | 2025-05-22 | A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated… |
CVE-2025-45468 | High | 8.8 | 2025-05-22 | Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account. |
CVE-2025-2506 | Medium | 5.3 | 2025-05-22 | When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database config… |
CVE-2025-23183 | Medium | 6.1 | 2025-05-22 | CWE-601: URL Redirection to Untrusted Site ('Open Redirect') |
CVE-2025-23182 | Medium | 4.3 | 2025-05-22 | CWE-203: Observable Discrepancy |
CVE-2025-5080 | High | 8.8 | 2025-05-22 | A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function webExcptypemanFilter of the file /goform/webExcptypemanF… |
CVE-2025-5079 | High | 7.3 | 2025-05-22 | A flaw has been found in PHPGurukul/Campcodes Online Shopping Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/updateo… |
CVE-2025-5024 | High | 7.4 | 2025-05-22 | A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and r… |
CVE-2025-45471 | High | 8.8 | 2025-05-22 | Insecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account. |
CVE-2025-32915 | Medium | 5.5 | 2025-05-22 | Packages downloaded by Checkmk's automatic agent updates on Linux and Solaris have incorrect permissions in Checkmk < 2.4.0p1, < 2.3.0p32, < 2.2.0p42 and <= 2… |
CVE-2025-32815 | Medium | 6.5 | 2025-05-22 | An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur. |
CVE-2025-32814 | Critical | 9.8 | 2025-05-22 | An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur. |
CVE-2025-32813 | High | 7.2 | 2025-05-22 | An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur. |
CVE-2025-0993 | High | 7.5 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. This could allow an authentic… |
CVE-2025-0679 | Medium | 4.3 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Under certain condi… |
CVE-2025-0605 | Medium | 4.6 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access contro… |
CVE-2025-5078 | High | 7.3 | 2025-05-22 | A vulnerability was detected in PHPGurukul/Campcodes Online Shopping Portal 1.0. Affected is an unknown function of the file /admin/subcategory.php. Performing… |
CVE-2025-5077 | High | 7.3 | 2025-05-22 | A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been classified as critical. This affects an unknown part of the file /admin/edit-sub… |
CVE-2025-5076 | High | 7.3 | 2025-05-22 | A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component SEND Co… |
CVE-2025-4979 | Medium | 4.9 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to re… |
CVE-2025-4575 | Medium | 6.5 | 2025-05-22 | Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a… |
CVE-2025-3111 | Medium | 6.5 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input val… |
CVE-2025-2853 | Medium | 6.5 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of proper validation i… |
CVE-2025-1110 | Low | 2.7 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could ac… |
CVE-2025-5075 | High | 7.3 | 2025-05-22 | A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the compon… |
CVE-2025-46714 | High | 7.8 | 2025-05-22 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to 1.15.12, API_G… |
CVE-2025-46713 | High | 7.8 | 2025-05-22 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 0.0.1 and prior to 1.15.12, API_S… |
CVE-2025-3945 | High | 7.2 | 2025-05-22 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterpris… |
CVE-2025-3944 | High | 7.2 | 2025-05-22 | Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File… |
CVE-2025-3943 | Medium | 4.1 | 2025-05-22 | Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security o… |
CVE-2025-3942 | Medium | 4.3 | 2025-05-22 | Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linu… |
CVE-2025-3941 | Medium | 5.4 | 2025-05-22 | Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows… |
CVE-2025-3940 | Medium | 5.3 | 2025-05-22 | Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux… |
CVE-2025-3939 | Medium | 5.3 | 2025-05-22 | Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX a… |
CVE-2025-3938 | Medium | 6.8 | 2025-05-22 | Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows… |
CVE-2025-3937 | High | 7.7 | 2025-05-22 | Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Secur… |
CVE-2025-3936 | Medium | 6.5 | 2025-05-22 | Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows all… |
CVE-2025-2272 | High | 7.0 | 2025-05-22 | Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issu… |
CVE-2025-5074 | High | 7.3 | 2025-05-22 | A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component PROMPT Command Handl… |
CVE-2025-5073 | High | 7.3 | 2025-05-22 | A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. This issue affects some unknown processing of the component MKDI… |
CVE-2025-41403 | High | 8.3 | 2025-05-22 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data. |
CVE-2025-3836 | High | 8.3 | 2025-05-22 | Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report. |
CVE-2025-3444 | Medium | 6.5 | 2025-05-22 | Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin… |
CVE-2025-4419 | Medium | 4.3 | 2025-05-22 | The Hot Random Image plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.9.2 via the 'path' parameter. This makes it p… |
CVE-2025-4405 | Medium | 4.9 | 2025-05-22 | The Hot Random Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 1.9.2 due… |
CVE-2025-4280 | | 2025-05-22 | MacOS version of Poedit bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main app… | |
CVE-2025-4123 | High | 7.6 | 2025-05-22 | A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect u… |
CVE-2025-4133 | Medium | 5.4 | 2025-05-22 | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which… |
CVE-2025-5062 | Medium | 6.1 | 2025-05-22 | The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and includin… |
CVE-2025-3887 | High | 8.8 | 2025-05-22 | GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2025-3885 | Medium | 6.5 | 2025-05-22 | Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denia… |
CVE-2025-3884 | High | 7.5 | 2025-05-22 | Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information… |
CVE-2025-3883 | High | 8.8 | 2025-05-22 | eCharge Hardy Barth cPH2 index.php Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbit… |
CVE-2025-3882 | High | 8.8 | 2025-05-22 | eCharge Hardy Barth cPH2 nwcheckexec.php dest Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to ex… |
CVE-2025-3881 | High | 8.8 | 2025-05-22 | eCharge Hardy Barth cPH2 check_req.php ntp Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execu… |
CVE-2025-3486 | High | 8.8 | 2025-05-22 | Allegra isZipEntryValide Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec… |
CVE-2025-3484 | Critical | 9.8 | 2025-05-22 | MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-3483 | High | 7.8 | 2025-05-22 | MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-3482 | High | 7.8 | 2025-05-22 | MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-3481 | High | 7.8 | 2025-05-22 | MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-3480 | Medium | 6.5 | 2025-05-22 | MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to d… |
CVE-2025-2759 | High | 7.8 | 2025-05-22 | GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affecte… |
CVE-2025-5059 | Medium | 4.7 | 2025-05-21 | A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. This affects an unknown part of the file /admin/edit-subcategory… |
CVE-2025-34025 | High | 8.8 | 2025-05-21 | The Versa Concerto SD-WAN orchestration platform is vulnerable to an privileges escalation and container escape vulnerability caused by unsafe default mounting… |
CVE-2025-5057 | High | 7.3 | 2025-05-21 | A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-5056 | High | 7.3 | 2025-05-21 | A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-48070 | Low | 3.5 | 2025-05-21 | Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that ar… |
CVE-2025-47947 | High | 7.5 | 2025-05-21 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerabl… |
CVE-2025-47942 | Medium | 5.3 | 2025-05-21 | The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against do… |
CVE-2025-34027 | Critical | 9.0 | 2025-05-21 | The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to… |
CVE-2025-34026 | High | 7.5 | 2025-05-21 | The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to… |
CVE-2025-5053 | High | 7.3 | 2025-05-21 | A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the comp… |
CVE-2025-5052 | High | 7.3 | 2025-05-21 | A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component LS Co… |
CVE-2025-45753 | High | 7.2 | 2025-05-21 | A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import fu… |
CVE-2025-44040 | High | 7.2 | 2025-05-21 | An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be mad… |
CVE-2025-5051 | High | 7.3 | 2025-05-21 | A vulnerability classified as critical has been found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component BINARY Command Handler. The… |
CVE-2025-46412 | Critical | 9.8 | 2025-05-21 | Affected Vertiv products do not properly protect webserver functions that could allow an attacker to bypass authentication. |
CVE-2025-45755 | Medium | 6.1 | 2025-05-21 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can… |
CVE-2025-41426 | Critical | 9.8 | 2025-05-21 | Affected Vertiv products contain a stack based buffer overflow vulnerability. An attacker could exploit this vulnerability to gain code execution on the device. |
CVE-2025-36535 | Critical | 10.0 | 2025-05-21 | The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational di… |
CVE-2025-5050 | High | 7.3 | 2025-05-21 | A vulnerability was found in FreeFloat FTP Server 1.0. It has been rated as critical. This issue affects some unknown processing of the component BELL Command… |
CVE-2025-5049 | High | 7.3 | 2025-05-21 | A vulnerability was found in FreeFloat FTP Server 1.0. It has been declared as critical. This vulnerability affects unknown code of the component APPEND Comman… |
CVE-2025-45752 | High | 7.2 | 2025-05-21 | A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functionality in the Exte… |
CVE-2025-44083 | Critical | 9.8 | 2025-05-21 | An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication |
CVE-2025-3751 | | 2025-05-21 | The component listed above contains a vulnerability that can be exploited by an attacker to perform a SQL Injection attack. This could lead to unauthorised acc… | |
CVE-2025-2261 | | 2025-05-21 | Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of… | |
CVE-2025-27558 | Critical | 9.1 | 2025-05-21 | IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equi… |