2025 CVEs (page 31)
Page 31 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59487 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-59482 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-58455 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-58077 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-52633 | Low | 3.1 | 2026-02-03 | HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies m… |
CVE-2025-52631 | Low | 3.7 | 2026-02-03 | HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially expo… |
CVE-2025-52628 | Medium | 4.6 | 2026-02-03 | HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potenti… |
CVE-2025-52623 | Low | 3.7 | 2026-02-03 | HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead… |
CVE-2025-71179 | Medium | 6.1 | 2026-02-03 | Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the str… |
CVE-2025-70849 | Medium | 6.1 | 2026-02-03 | Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The app… |
CVE-2025-70841 | Critical | 10.0 | 2026-02-03 | Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct… |
CVE-2025-70758 | High | 7.5 | 2026-02-03 | chetans9 core-php-admin-panel through commit a94a780d6 contains an authentication bypass vulnerability in includes/auth_validate.php. The application sends an… |
CVE-2025-70560 | High | 8.4 | 2026-02-03 | Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecul… |
CVE-2025-70559 | Medium | 6.5 | 2026-02-03 | pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CM… |
CVE-2025-70311 | Medium | 6.5 | 2026-02-03 | JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 parameters in the /systemControl.do interface… |
CVE-2025-69983 | Critical | 9.8 | 2026-02-03 | FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied script… |
CVE-2025-69981 | Critical | 9.8 | 2026-02-03 | FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauth… |
CVE-2025-69971 | Critical | 9.8 | 2026-02-03 | FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tok… |
CVE-2025-69970 | Critical | 9.3 | 2026-02-03 | FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causi… |
CVE-2025-69875 | High | 7.8 | 2026-02-03 | A vulnerability exists in Quick Heal Total Security 23.0.0 in the quarantine management component where insufficient validation of restore paths and improper p… |
CVE-2025-69848 | Medium | 5.4 | 2026-02-03 | NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in ve… |
CVE-2025-69431 | Medium | 6.1 | 2026-02-03 | The ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following. Attackers can format a USB drive to ext4, create a symbolic link to i… |
CVE-2025-69430 | Medium | 6.1 | 2026-02-03 | An Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including DM2 (version equal to or prior to V1.9.12), DM3 (version equal… |
CVE-2025-69429 | Medium | 6.1 | 2026-02-03 | The ORICO NAS CD3510 (version V1.9.12 and below) contains an Incorrect Symlink Follow vulnerability that could be exploited by attackers to leak or tamper with… |
CVE-2025-67189 | Medium | 6.5 | 2026-02-03 | A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B20210112. The urlKeyword parameter is not properly v… |
CVE-2025-67188 | Critical | 9.8 | 2026-02-03 | A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The issue resides in the setRadvdCfg interface of the /lib/cste_modules/ipv6… |
CVE-2025-67187 | Critical | 9.8 | 2026-02-03 | A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The flaw exists in the setIpQosRules interface of /lib/c… |
CVE-2025-67186 | Critical | 9.8 | 2026-02-03 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /lib/cste_modules/firewall.so. The vulne… |
CVE-2025-66374 | High | 7.8 | 2026-02-03 | CyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve privilege escalation through policy elevation of an Administration tas… |
CVE-2025-65924 | Medium | 4.1 | 2026-02-03 | ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScrip… |
CVE-2025-65923 | Medium | 5.4 | 2026-02-03 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Records… |
CVE-2025-65875 | High | 8.8 | 2026-02-03 | An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via uploading a crafted P… |
CVE-2025-63624 | Critical | 9.8 | 2026-02-03 | SQL Injection vulnerability in Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v.1.0 allows a remote attacker to execute arbitrary… |
CVE-2025-63372 | Medium | 4.3 | 2026-02-03 | Articentgroup Zip Rar Extractor Tool 1.345.93.0 is vulnerable to Directory Traversal. The vulnerability resides in the ZIP file processing component, specifica… |
CVE-2025-62599 | High | 8.6 | 2026-02-03 | eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to 2.6.11, 2.14.6, 3.2.4… |
CVE-2025-61506 | Critical | 9.8 | 2026-02-03 | An issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of any size to the /upload endpoint. |
CVE-2025-60865 | High | 7.8 | 2026-02-03 | Insecure Permissions vulnerability in avanquest Driver Updater v.9.1.57803.1174 allows a local attacker to escalate privileges via the Driver Updater Service w… |
CVE-2025-59439 | High | 7.5 | 2026-02-03 | An issue was discovered in Samsung Mobile Processor, Wearable Processor and Modem Exynos 980, 990, 850, 1080, 9110, W920, W930, W1000 and Modem 5123. Incorrect… |
CVE-2025-58348 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58347 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58346 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58345 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58344 | Medium | 6.2 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58343 | Medium | 5.5 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58342 | Medium | 6.2 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58341 | Medium | 6.2 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-58340 | Medium | 6.2 | 2026-02-03 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-57529 | Critical | 9.8 | 2026-02-03 | YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation. This al… |
CVE-2025-52629 | Low | 3.7 | 2026-02-03 | HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content in… |
CVE-2025-52627 | Medium | 5.5 | 2026-02-03 | Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing… |
CVE-2025-52626 | Medium | 4.5 | 2026-02-03 | A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the… |
CVE-2025-46651 | Medium | 4.3 | 2026-02-03 | Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature. Due to insufficient validation of user-sup… |
CVE-2025-65017 | Medium | 6.5 | 2026-02-03 | Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lea… |
CVE-2025-5319 | Critical | 9.8 | 2026-02-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Informatics and Communication Technologies Industry… |
CVE-2025-14550 | High | 7.5 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-se… |
CVE-2025-13473 | Medium | 5.3 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for… |
CVE-2025-7760 | High | 7.6 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ofisimo Web-Based Software Technologies Associatio… |
CVE-2025-6397 | High | 8.6 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ankara Hosting Website Design Website Software all… |
CVE-2025-11598 | | 2026-02-03 | In mObywatel iOS application an unauthorized user can use the App Switcher to view the account owner's personal information in the minimized app window, even a… | |
CVE-2025-67857 | Medium | 4.3 | 2026-02-03 | A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorize… |
CVE-2025-67856 | Medium | 5.4 | 2026-02-03 | A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be gra… |
CVE-2025-67855 | Medium | 5.4 | 2026-02-03 | A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return URL. This vulnerabi… |
CVE-2025-67853 | High | 7.5 | 2026-02-03 | A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attacke… |
CVE-2025-67852 | Low | 3.5 | 2026-02-03 | A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages afte… |
CVE-2025-67851 | Medium | 6.1 | 2026-02-03 | A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit… |
CVE-2025-67850 | High | 7.3 | 2026-02-03 | A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula edi… |
CVE-2025-67849 | High | 7.3 | 2026-02-03 | A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject m… |
CVE-2025-67848 | High | 8.1 | 2026-02-03 | A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) P… |
CVE-2025-59902 | | 2026-02-03 | HTML injection vulnerability in NICE Chat. This vulnerability allows an attacker to inject and render arbitrary HTML content in email transcripts by modifying… | |
CVE-2025-41065 | | 2026-02-03 | Stored Cross-Site Scripting (XSS) vulnerability type in LUNA software v7.5.5.6. This vulnerability allows an attacker to execute JavaScript code in the victim'… | |
CVE-2025-8461 | High | 7.6 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This i… |
CVE-2025-8456 | High | 7.6 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kod8 Software Technologies Trade Ltd. Co. Kod8 Ind… |
CVE-2025-8590 | High | 7.5 | 2026-02-03 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Directory Indexi… |
CVE-2025-8589 | High | 7.6 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AKCE Software Technology R&D Industry and Trade In… |
CVE-2025-9711 | High | 7.8 | 2026-02-03 | A vulnerability in Brocade Fabric OS before 9.2.1c3 could allow elevating the privileges of the local authenticated user to “root” using the export option of s… |
CVE-2025-58381 | Low | 2.3 | 2026-02-03 | A vulnerability in Brocade Fabric OS before 9.2.1c2 could allow an authenticated attacker with admin privileges using the shell commands “source, ping6, sle… |
CVE-2025-14274 | Medium | 5.4 | 2026-02-03 | The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Border Hero widget's Button Link field in versio… |
CVE-2025-58380 | Low | 2.3 | 2026-02-03 | A vulnerability in Brocade Fabric OS before 9.2.1 could allow an authenticated attacker with admin privileges using the shell command “grep” to modify the path… |
CVE-2025-67484 | Critical | 9.8 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWi… |
CVE-2025-67483 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-67482 | | 2026-02-03 | Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox. This vulnerability is associated with program files includes/Engines/LuaCommo… | |
CVE-2025-67481 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-67480 | Medium | 6.5 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affect… |
CVE-2025-67479 | | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunct… | |
CVE-2025-67478 | High | 8.8 | 2026-02-03 | Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUse… |
CVE-2025-67477 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-67476 | Medium | 4.3 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This i… |
CVE-2025-67475 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61658 | Medium | 4.3 | 2026-02-03 | Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/GlobalContributions/GlobalContributionsPager.Php. Thi… |
CVE-2025-61657 | | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is… | |
CVE-2025-61656 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerabil… |
CVE-2025-61655 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerabil… |
CVE-2025-61654 | | 2026-02-03 | Vulnerability in Wikimedia Foundation Thanks. This vulnerability is associated with program files includes/ThanksQueryHelper.Php. This issue affects Thanks: f… | |
CVE-2025-61653 | | 2026-02-03 | Vulnerability in Wikimedia Foundation TextExtracts. This vulnerability is associated with program files includes/ApiQueryExtracts.Php. This issue affects Text… | |
CVE-2025-61652 | | 2026-02-03 | Vulnerability in Wikimedia Foundation DiscussionTools.This issue affects DiscussionTools: from * before 1.43.4, 1.44.1. | |
CVE-2025-61651 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability… |
CVE-2025-58383 | High | 7.2 | 2026-02-03 | A vulnerability in Brocade Fabric OS versions before 9.2.1c2 could allow an administrator-level user to execute the bind command, to escalate privileges and by… |
CVE-2025-58382 | High | 7.2 | 2026-02-03 | A vulnerability in the secure configuration of authentication and management services in Brocade Fabric OS before Fabric OS 9.2.1c2 could allow an authentica… |
CVE-2025-58379 | Medium | 5.5 | 2026-02-03 | Brocade Fabric OS before 9.2.1 has a vulnerability that could allow a local authenticated attacker to reveal command line passwords using commands that may exp… |
CVE-2025-12774 | High | 7.5 | 2026-02-03 | A vulnerability in the migration script for Brocade SANnav before 3.0 could allow the collection of database sql queries in the SANnav support save file. An at… |