2025 CVEs (page 310)
Page 310 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-39402 | Critical | 9.9 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2025-39401 | Critical | 10.0 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2025-39395 | Critical | 9.3 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection… |
CVE-2025-39393 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla Hospital Management System hospital-management a… |
CVE-2025-39392 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPAMS apartment-management allows Reflected XSS… |
CVE-2025-39389 | Critical | 9.3 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solid Plugins AnalyticsWP allows SQL Injection.This issue… |
CVE-2025-39386 | Critical | 9.3 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla Hospital Management System hospital-management a… |
CVE-2025-39380 | Critical | 10.0 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System hospital-management allows Upload a Web Shell to a Web Ser… |
CVE-2025-39372 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elbisnero WordPress Events Calendar Registration & Ticket… |
CVE-2025-39366 | High | 8.8 | 2025-05-19 | Incorrect Privilege Assignment vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0. |
CVE-2025-39365 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rocket Apps wProject allows Reflected XSS.This issue affe… |
CVE-2025-39357 | High | 8.5 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla Hospital Management System hospital-management a… |
CVE-2025-39356 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart foodbakery-sticky-cart allows Object Injection.This issue affects Foodbak… |
CVE-2025-39355 | High | 8.5 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking fat-services-booking allows… |
CVE-2025-39354 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object Injection.This issue affects Grand Conference: fro… |
CVE-2025-39352 | High | 8.2 | 2025-05-19 | Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-39350 | High | 8.2 | 2025-05-19 | Missing Authorization vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0. |
CVE-2025-39349 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in Potenzaglobalsolutions CiyaShop ciyashop allows Object Injection.This issue affects CiyaShop: from n/a throu… |
CVE-2025-39348 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: fro… |
CVE-2025-32928 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue affects Altair: from n/a through <= 5.2.2. |
CVE-2025-32927 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery wp-foodbakery allows Object Injection.This issue affects FoodBakery: from n/a through… |
CVE-2025-32926 | Critical | 9.8 | 2025-05-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Travers… |
CVE-2025-32925 | High | 8.3 | 2025-05-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FantasticPlugins SUMO Reward Points re… |
CVE-2025-32924 | High | 8.5 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy revy allows SQL Injection.This issue affects… |
CVE-2025-31027 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jocoxdesign Tiger tiger allows Reflected XSS.This issue a… |
CVE-2025-47934 | | 2025-05-19 | OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Startinf in version 5.0.1 and prior to versions 5.11.3 and 6.1.1, a maliciously modified mes… | |
CVE-2025-47581 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Object Injection.This issue af… |
CVE-2025-47577 | Critical | 10.0 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to… |
CVE-2025-47284 | Critical | 9.9 | 2025-05-19 | Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the `gardenlet` comp… |
CVE-2025-47283 | Critical | 9.9 | 2025-05-19 | Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to ve… |
CVE-2025-43839 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Messages Tool bp-messages-tool allows Reflecte… |
CVE-2025-43838 | Medium | 6.5 | 2025-05-19 | Missing Authorization vulnerability in ChoPlugins.com Custom PC Builder Lite for WooCommerce custom-pc-builder-lite-for-woocommerce allows Exploiting Incorrect… |
CVE-2025-43837 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in binti76 Total Donations total-donations allows Reflected… |
CVE-2025-43836 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in confuzzledduck Syndicate Out syndicate-out allows Reflect… |
CVE-2025-43832 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andreyk Remote Images Grabber remote-images-grabber allow… |
CVE-2025-39459 | High | 7.3 | 2025-05-19 | Incorrect Privilege Assignment vulnerability in contempoinc Real Estate 7 realestate-7 allows Privilege Escalation.This issue affects Real Estate 7: from n/a t… |
CVE-2025-39458 | High | 8.1 | 2025-05-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Foton foton allows PHP L… |
CVE-2025-39451 | High | 7.5 | 2025-05-19 | Missing Authorization vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Accessing Functionality Not Properly Constrained by ACLs.This issue… |
CVE-2025-39449 | High | 7.5 | 2025-05-19 | Missing Authorization vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affe… |
CVE-2025-39447 | High | 7.5 | 2025-05-19 | Missing Authorization vulnerability in Crocoblock JetElements For Elementor jet-elements allows Accessing Functionality Not Properly Constrained by ACLs.This i… |
CVE-2025-39446 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl LLC Booster Plus for WooCommerce allows Reflecte… |
CVE-2025-39445 | Critical | 9.3 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows… |
CVE-2025-39411 | High | 7.5 | 2025-05-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Indie_Plugins WhatsApp Click to Chat P… |
CVE-2025-39410 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon.This issue affects Smart Sections Them… |
CVE-2025-39409 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressaholic WordPress Video Robot - The Ultimate Video Im… |
CVE-2025-39407 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caseproof, LLC Memberpress allows Reflected XSS.This issu… |
CVE-2025-39406 | Critical | 9.8 | 2025-05-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPAMS apartment-management al… |
CVE-2025-39405 | High | 8.8 | 2025-05-19 | Incorrect Privilege Assignment vulnerability in mojoomla WPAMS apartment-management allows Privilege Escalation.This issue affects WPAMS: from n/a through <= 4… |
CVE-2025-39403 | High | 8.5 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection… |
CVE-2025-47582 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in QuantumCloud WPBot Pro Wordpress Chatbot allows Object Injection.This issue affects WPBot Pro Wordpress Chat… |
CVE-2025-47282 | Critical | 9.9 | 2025-05-19 | Gardener External DNS Management is an environment to manage external DNS entries for a kubernetes cluster. A security vulnerability was discovered in Gardener… |
CVE-2025-43841 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jamesdbruner WP Vegas vegas-fullscreen-background-slider… |
CVE-2025-43840 | High | 7.1 | 2025-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in ref CheckBot checkbot allows Stored XSS.This issue affects CheckBot: from n/a through <= 1.05. |
CVE-2025-43835 | Medium | 4.3 | 2025-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in ktsvetkov wp-cyr-cho wp-cyr-cho allows Cross Site Request Forgery.This issue affects wp-cyr-cho: from n/a th… |
CVE-2025-43834 | Medium | 5.9 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tox82 cookieBAR cookiebar allows Stored XSS.This issue af… |
CVE-2025-43833 | High | 7.6 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amir Helzer Absolute Links absolute-links allows Blind SQ… |
CVE-2025-39460 | Medium | 5.3 | 2025-05-19 | Missing Authorization vulnerability in ThimPress Eduma eduma allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eduma… |
CVE-2025-39454 | Medium | 4.3 | 2025-05-19 | Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.30.0. |
CVE-2025-39450 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This iss… |
CVE-2025-39448 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows… |
CVE-2025-39412 | Medium | 4.3 | 2025-05-19 | Missing Authorization vulnerability in averta Master Slider master-slider.This issue affects Master Slider: from n/a through <= 3.11.0. |
CVE-2025-39398 | Medium | 4.3 | 2025-05-19 | Missing Authorization vulnerability in Themovation Bellevue bellevuex.This issue affects Bellevue: from n/a through <= 4.2.2. |
CVE-2025-39396 | High | 7.5 | 2025-05-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allo… |
CVE-2025-27010 | High | 8.1 | 2025-05-19 | Path Traversal: '.../...//' vulnerability in bslthemes Tastyc tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a through < 2.5.2. |
CVE-2025-26997 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in validas Wireless Butler wireless-butler allows Reflected… |
CVE-2025-26892 | Critical | 9.9 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Celestial Aura allows Using Malicious Files.This issue affects Celestial Aura: from n/… |
CVE-2025-26872 | Critical | 9.9 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Eximius allows Using Malicious Files.This issue affects Eximius: from n/a through 2.2. |
CVE-2025-26735 | High | 7.5 | 2025-05-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Candid themes Grip.This issue affects… |
CVE-2025-22287 | Medium | 5.4 | 2025-05-19 | Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Edition ltl-freight-quotes-freightquote-edition allows Exploiting In… |
CVE-2025-4945 | Low | 3.7 | 2025-05-19 | A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processi… |
CVE-2025-4941 | High | 7.3 | 2025-05-19 | A vulnerability, which was classified as critical, was found in PHPGurukul Credit Card Application Management System 1.0. Affected is an unknown function of th… |
CVE-2025-4940 | High | 7.3 | 2025-05-19 | A vulnerability, which was classified as critical, has been found in 1000 Projects Daily College Class Work Report Book 1.0. This issue affects some unknown pr… |
CVE-2025-47583 | Medium | 5.4 | 2025-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Cross Site Request Forgery.This issue affect… |
CVE-2025-47576 | High | 8.8 | 2025-05-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bringthepixel Bimber - Viral Magazine… |
CVE-2025-46543 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CharlyLeetham Enhanced Paypal Shortcodes enhanced-paypal-… |
CVE-2025-46263 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lloyd Saunders Author Box After Posts author-box-after-po… |
CVE-2025-46262 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Mad Mimi for WordPress mad-mimi allows Stored X… |
CVE-2025-39394 | Medium | 5.3 | 2025-05-19 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Solid Plugins AnalyticsWP allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-39388 | Medium | 5.3 | 2025-05-19 | Missing Authorization vulnerability in Solid Plugins AnalyticsWP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP… |
CVE-2025-39376 | Medium | 4.3 | 2025-05-19 | Missing Authorization vulnerability in QuanticaLabs Car Park Booking System for WordPress car-park-booking-system-for-wordpress.This issue affects Car Park Boo… |
CVE-2025-39375 | Medium | 4.3 | 2025-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in Ashok G Easy Child Theme Creator easy-child-theme-creator allows Cross Site Request Forgery.This issue affec… |
CVE-2025-39374 | High | 7.1 | 2025-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in aseem1234 Best Posts Summary best-posts-summary allows Stored XSS.This issue affects Best Posts Summary: fro… |
CVE-2025-39373 | Medium | 5.3 | 2025-05-19 | Missing Authorization vulnerability in jegtheme JNews jnews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JNews: f… |
CVE-2025-39371 | Medium | 4.3 | 2025-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in Sanjeev Mohindra Author Box Plugin With Different Description author-box-with-different-description allows C… |
CVE-2025-39370 | High | 7.6 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cnilsson iCafe Library icafe-library allows SQL Injection… |
CVE-2025-39369 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sihibbs Posts for Page posts-for-page allows DOM-Based XS… |
CVE-2025-39368 | Medium | 5.3 | 2025-05-19 | Missing Authorization vulnerability in ed4becky Rootspersona rootspersona allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-39364 | High | 7.5 | 2025-05-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginEver Product Category Slider for… |
CVE-2025-39353 | Medium | 5.3 | 2025-05-19 | Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-39351 | Medium | 4.3 | 2025-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Cross Site Request Forgery.This issue affects Grand Resta… |
CVE-2025-26920 | Medium | 5.4 | 2025-05-19 | Missing Authorization vulnerability in pressmaximum Customify customify-theme allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-26867 | Medium | 5.3 | 2025-05-19 | Missing Authorization vulnerability in Themes4WP Bulk allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk: from n/a through… |
CVE-2025-4948 | High | 7.5 | 2025-05-19 | A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handl… |
CVE-2025-4939 | Medium | 4.3 | 2025-05-19 | A vulnerability classified as problematic was found in PHPGurukul Credit Card Application Management System 1.0. This vulnerability affects unknown code of the… |
CVE-2025-4938 | Medium | 6.3 | 2025-05-19 | A vulnerability was found in PHPGurukul Employee Record Management System 1.3. It has been rated as critical. Affected by this issue is some unknown functional… |
CVE-2025-4876 | Medium | 6.0 | 2025-05-19 | ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering… |
CVE-2025-32920 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-w… |
CVE-2025-31262 | Medium | 5.5 | 2025-05-19 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, w… |
CVE-2025-31185 | Low | 3.3 | 2025-05-19 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3. Photos in the Hidden Photos Album may be viewed without auth… |
CVE-2025-26621 | High | 7.6 | 2025-05-19 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manag… |