2025 CVEs (page 309)
Page 309 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5033 | Medium | 4.3 | 2025-05-21 | A vulnerability classified as problematic was found in XiaoBingby TeaCMS 2.0.2. Affected by this vulnerability is an unknown functionality of the file src/main… |
CVE-2025-5020 | Medium | 4.3 | 2025-05-21 | Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTT… |
CVE-2025-48069 | Medium | 6.6 | 2025-05-21 | ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a vulnerability rela… |
CVE-2025-48064 | Low | 3.3 | 2025-05-21 | GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view… |
CVE-2025-48063 | High | 8.8 | 2025-05-21 | XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security mo… |
CVE-2025-48060 | High | 7.5 | 2025-05-21 | jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execu… |
CVE-2025-47291 | High | 7.5 | 2025-05-21 | containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to… |
CVE-2025-46822 | | 2025-05-21 | OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77… | |
CVE-2025-2102 | | 2025-05-21 | Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.This issue affects HYP… | |
CVE-2025-5032 | High | 7.3 | 2025-05-21 | A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. Affected is an unknown function of the file /admin/edit-category… |
CVE-2025-5031 | Low | 3.1 | 2025-05-21 | A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the component wxap… |
CVE-2025-5030 | Medium | 5.0 | 2025-05-21 | A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file… |
CVE-2025-4416 | High | 7.5 | 2025-05-21 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track… |
CVE-2025-4415 | Medium | 4.8 | 2025-05-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This i… |
CVE-2025-48012 | Medium | 4.8 | 2025-05-21 | Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Pa… |
CVE-2025-48011 | Medium | 4.8 | 2025-05-21 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Pass… |
CVE-2025-48010 | Medium | 4.8 | 2025-05-21 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Pass… |
CVE-2025-48009 | Low | 3.1 | 2025-05-21 | Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12. |
CVE-2025-45754 | Medium | 5.4 | 2025-05-21 | A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inject malicious JavaScript payloads by cr… |
CVE-2025-25539 | Medium | 6.5 | 2025-05-21 | Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information via help menu. |
CVE-2025-20267 | Medium | 4.8 | 2025-05-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-si… |
CVE-2025-20258 | Medium | 5.4 | 2025-05-21 | A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitrary commands into emails that are sent… |
CVE-2025-20257 | Medium | 6.5 | 2025-05-21 | A vulnerability in an API subsystem of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow an authenticated… |
CVE-2025-20256 | Medium | 6.5 | 2025-05-21 | A vulnerability in the web-based management interface of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow… |
CVE-2025-20255 | Medium | 4.3 | 2025-05-21 | A vulnerability in client join services of Cisco Webex Meetings could allow an unauthenticated, remote attacker to manipulate cached HTTP responses within the… |
CVE-2025-20250 | Medium | 6.1 | 2025-05-21 | A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. A vulnerability is due to imp… |
CVE-2025-20247 | Medium | 6.1 | 2025-05-21 | A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. A vulnerability is due to imp… |
CVE-2025-20246 | Medium | 6.1 | 2025-05-21 | A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. A vulnerability is due to imp… |
CVE-2025-20242 | Medium | 6.5 | 2025-05-21 | A vulnerability in the Cloud Connect component of Cisco Unified Contact Center Enterprise (CCE) could allow an unauthenticated, remote attacker to read and mod… |
CVE-2025-20152 | High | 8.6 | 2025-05-21 | A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a den… |
CVE-2025-20114 | Medium | 4.3 | 2025-05-21 | A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation atta… |
CVE-2025-20113 | High | 7.1 | 2025-05-21 | A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of… |
CVE-2025-20112 | Medium | 5.1 | 2025-05-21 | A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privileg… |
CVE-2025-0372 | | 2025-05-21 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in HYPR Passwordless on Windows allows Privilege Esca… | |
CVE-2025-4008 | High | 8.8 | 2025-05-21 | The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web… |
CVE-2025-48207 | High | 8.6 | 2025-05-21 | The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference. |
CVE-2025-48206 | Medium | 6.1 | 2025-05-21 | The ns_backup extension through 13.0.0 for TYPO3 allows XSS. |
CVE-2025-48205 | High | 8.6 | 2025-05-21 | The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference. |
CVE-2025-48204 | Medium | 6.8 | 2025-05-21 | The ns_backup extension through 13.0.0 for TYPO3 allows command injection. |
CVE-2025-48203 | Medium | 6.4 | 2025-05-21 | The cs_seo extension through 9.2.0 for TYPO3 allows XSS. |
CVE-2025-48202 | Medium | 5.3 | 2025-05-21 | The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference. |
CVE-2025-48201 | High | 8.6 | 2025-05-21 | The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location. |
CVE-2025-48200 | Critical | 10.0 | 2025-05-21 | The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. |
CVE-2025-27998 | High | 8.4 | 2025-05-21 | An issue in Valvesoftware Steam Client Steam Client 1738026274 allows attackers to escalate privileges via a crafted executable or DLL. |
CVE-2025-27997 | High | 8.4 | 2025-05-21 | An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell script or executable into the C:\ProgramData… |
CVE-2025-5029 | Medium | 5.4 | 2025-05-21 | A vulnerability has been found in Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0 Patch April 2025 and classified as critical. Affected by this vulnera… |
CVE-2025-44895 | Medium | 6.5 | 2025-05-21 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4BasedAceAdd function. |
CVE-2025-44892 | Medium | 6.5 | 2025-05-21 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter in the web_rmon_alarm_post_rmon_alarm function. |
CVE-2025-48417 | Medium | 6.5 | 2025-05-21 | The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-coded in the firmware a… |
CVE-2025-48416 | High | 8.1 | 2025-05-21 | An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the defa… |
CVE-2025-48415 | Medium | 6.2 | 2025-05-21 | A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands… |
CVE-2025-40775 | High | 7.5 | 2025-05-21 | When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm f… |
CVE-2025-1421 | | 2025-05-21 | Data provided in a request performed to the server while activating a new device are put in a database. Other high privileged users might download this data as… | |
CVE-2025-1420 | | 2025-05-21 | Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cros… | |
CVE-2025-1419 | | 2025-05-21 | Input provided in comment section of Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack… | |
CVE-2025-1418 | | 2025-05-21 | A low-privileged user can access information about profiles created in Proget MDM (Mobile Device Management), which contain details about allowed/prohibited fu… | |
CVE-2025-1417 | | 2025-05-21 | In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management). Th… | |
CVE-2025-1416 | | 2025-05-21 | In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Manag… | |
CVE-2025-4803 | High | 7.2 | 2025-05-21 | The Glossary by WPPedia – Best Glossary plugin for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1… |
CVE-2025-4611 | Medium | 6.4 | 2025-05-21 | The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slim_seo_breadcrumbs sh… |
CVE-2025-4221 | Medium | 6.4 | 2025-05-21 | The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader' shortcode in all versions up to, and… |
CVE-2025-4219 | Medium | 6.4 | 2025-05-21 | The DPEPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dpe' shortcode in all versions up to, and including, 0.3 due t… |
CVE-2025-4217 | Medium | 6.4 | 2025-05-21 | The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_youtube' shortcode in all versions up to… |
CVE-2025-4105 | Medium | 5.4 | 2025-05-21 | The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the 'splitIt-flexf… |
CVE-2025-48414 | Medium | 6.5 | 2025-05-21 | There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to additional administra… |
CVE-2025-48413 | High | 7.7 | 2025-05-21 | The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shipped with the update f… |
CVE-2025-41232 | Critical | 9.1 | 2025-05-21 | Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may… |
CVE-2025-3781 | Medium | 6.4 | 2025-05-21 | The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up… |
CVE-2025-3750 | Medium | 6.4 | 2025-05-21 | The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ parameter in all versions up to, and includi… |
CVE-2025-27804 | Medium | 6.5 | 2025-05-21 | Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a cer… |
CVE-2025-27803 | Medium | 6.5 | 2025-05-21 | The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets adm… |
CVE-2025-1415 | | 2025-05-21 | A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM (Mobile Device Management), as well as details of… | |
CVE-2025-1712 | High | 8.8 | 2025-05-21 | Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to write arbitrary files |
CVE-2025-4949 | Medium | 5.3 | 2025-05-21 | In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experim… |
CVE-2025-4524 | Critical | 9.8 | 2025-05-21 | The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and includi… |
CVE-2025-5013 | Medium | 4.3 | 2025-05-21 | A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.h… |
CVE-2025-4969 | Medium | 6.5 | 2025-05-21 | A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can all… |
CVE-2025-4094 | Critical | 9.8 | 2025-05-21 | The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for… |
CVE-2025-5011 | Low | 2.4 | 2025-05-21 | A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admin/home/index.html o… |
CVE-2025-5010 | Low | 2.4 | 2025-05-21 | A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the… |
CVE-2025-5008 | High | 7.3 | 2025-05-20 | A vulnerability was found in projectworlds Online Time Table Generator 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2025-5007 | Low | 3.5 | 2025-05-20 | A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file… |
CVE-2025-5006 | High | 7.3 | 2025-05-20 | A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/categ… |
CVE-2025-5004 | High | 7.3 | 2025-05-20 | A vulnerability was found in projectworlds Online Time Table Generator 1.0 and classified as critical. This issue affects some unknown processing of the file /… |
CVE-2025-5003 | High | 7.3 | 2025-05-20 | A vulnerability has been found in projectworlds Online Time Table Generator 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-5002 | High | 7.3 | 2025-05-20 | A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file… |
CVE-2025-5001 | Low | 3.3 | 2025-05-20 | A vulnerability was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. It has been declared as problematic. This vulnerability affects the function ca… |
CVE-2025-5000 | Medium | 6.3 | 2025-05-20 | A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000. It has been classified as critical. This affects the function control_panel… |
CVE-2025-4999 | Medium | 6.3 | 2025-05-20 | A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000 and classified as critical. Affected by this issue is the function sub_4153F… |
CVE-2025-4998 | Medium | 6.5 | 2025-05-20 | A vulnerability has been found in H3C Magic R200G up to 100R002 and classified as problematic. Affected by this vulnerability is the function Edit_BasicSSID/Ed… |
CVE-2025-44898 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the theauthName parameter in the web_aaa_loginAuthlistEdit function. |
CVE-2025-44897 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bytftp_srvip parameter in the web_tool_upgradeManager_post function. |
CVE-2025-44896 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bindEditMACName parameter in the web_acl_bindEdit_post function. |
CVE-2025-44894 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radDftParamKey parameter in the web_radiusSrv_dftParam_post function. |
CVE-2025-44891 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_v3host_add_post function. |
CVE-2025-44883 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the tacIp parameter in the web_tacplus_serverEdit_post function. |
CVE-2025-44882 | Critical | 9.8 | 2025-05-20 | A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafte… |
CVE-2025-44880 | Critical | 9.8 | 2025-05-20 | A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted inp… |
CVE-2025-4997 | Medium | 6.5 | 2025-05-20 | A vulnerability, which was classified as problematic, was found in H3C R2+ProG up to 200R004. Affected is the function UpdateWanParams/AddMacList/EditMacList/A… |
CVE-2025-48056 | Medium | 5.3 | 2025-05-20 | Hubble is a fully distributed networking and security observability platform for cloud native workloads. Prior to version 1.17.2, a network attacker could inje… |