2025 CVEs (page 313)
Page 313 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-33103 | High | 8.5 | 2025-05-17 | IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 product IBM TCP/IP Connectivity Utilities for i contains a privilege escalation vulnerability. A malicious actor with command… |
CVE-2025-4829 | High | 8.8 | 2025-05-17 | A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. Affected by this vulnerability is the function sub… |
CVE-2025-4827 | High | 8.8 | 2025-05-17 | A vulnerability, which was classified as critical, was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. Affected is an unknown function of the… |
CVE-2025-4101 | Medium | 4.3 | 2025-05-17 | The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capabil… |
CVE-2025-48187 | Critical | 9.1 | 2025-05-17 | RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arb… |
CVE-2025-4669 | Medium | 6.4 | 2025-05-17 | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including… |
CVE-2025-3888 | Medium | 6.4 | 2025-05-17 | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and including, 4.8.12 due to… |
CVE-2025-3527 | Medium | 6.4 | 2025-05-17 | The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib/settings/settings… |
CVE-2025-4826 | High | 8.8 | 2025-05-17 | A vulnerability, which was classified as critical, has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This issue affects some unknown p… |
CVE-2025-4825 | High | 8.8 | 2025-05-17 | A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the fil… |
CVE-2025-4824 | High | 8.8 | 2025-05-17 | A vulnerability classified as critical has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boa… |
CVE-2025-4823 | High | 8.8 | 2025-05-17 | A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue is the function sub… |
CVE-2025-4610 | Medium | 6.4 | 2025-05-17 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_user_memberships shortcode in all ver… |
CVE-2025-4819 | Low | 3.1 | 2025-05-17 | A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout… |
CVE-2025-4391 | Critical | 9.8 | 2025-05-17 | The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the echo_generate_featured… |
CVE-2025-4389 | Critical | 9.8 | 2025-05-17 | The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlo… |
CVE-2025-4190 | High | 7.2 | 2025-05-17 | The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary f… |
CVE-2025-3812 | High | 8.1 | 2025-05-17 | The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the qcld_openai_delet… |
CVE-2025-4818 | High | 7.3 | 2025-05-17 | A vulnerability was found in SourceCodester Doctor's Appointment System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2025-4817 | High | 7.3 | 2025-05-17 | A vulnerability was found in Sourcecodester Doctor's Appointment System 1.0. It has been declared as critical. This vulnerability affects unknown code of the f… |
CVE-2025-4816 | High | 7.3 | 2025-05-17 | A vulnerability was found in SourceCodester Doctor's Appointment System 1.0. It has been classified as critical. This affects an unknown part of the file /admi… |
CVE-2025-4194 | Medium | 6.1 | 2025-05-17 | The AlT Monitoring plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or inco… |
CVE-2025-4189 | Medium | 6.1 | 2025-05-17 | The Audio Comments Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing… |
CVE-2025-4815 | High | 7.3 | 2025-05-17 | A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-4814 | High | 7.3 | 2025-05-17 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-1706 | High | 7.5 | 2025-05-17 | Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions. |
CVE-2025-4813 | High | 7.3 | 2025-05-16 | A vulnerability, which was classified as critical, was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected is an unknown function… |
CVE-2025-4812 | High | 7.3 | 2025-05-16 | A vulnerability, which was classified as critical, has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This issue affects some un… |
CVE-2025-4811 | High | 7.3 | 2025-05-16 | A vulnerability was found in CodeAstro Pharmacy Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2025-4810 | High | 8.8 | 2025-05-16 | A vulnerability was found in Tenda AC7 15.03.06.44. It has been declared as critical. Affected by this vulnerability is the function formSetRebootTimer of the… |
CVE-2025-4805 | | 2025-05-16 | A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Access Portal configuration. An a… | |
CVE-2025-4804 | | 2025-05-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the s… | |
CVE-2025-48188 | Low | 2.9 | 2025-05-16 | libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib rijndaelDecrypt function, leading to a… |
CVE-2025-32407 | Medium | 5.9 | 2025-05-16 | Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, allowing for an attack… |
CVE-2025-4809 | High | 8.8 | 2025-05-16 | A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. Affected is the function fromSafeSetMacFilter of the file /goform/setMa… |
CVE-2025-4808 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2025-4807 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Student Clearance System 1.0. This affects an unknown part. The manipu… |
CVE-2025-4802 | High | 7.8 | 2025-05-16 | Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared… |
CVE-2025-22233 | Low | 3.1 | 2025-05-16 | CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, the… |
CVE-2025-4806 | Medium | 6.3 | 2025-05-16 | A vulnerability, which was classified as critical, has been found in SourceCodester/oretnom23 Stock Management System 1.0. Affected by this issue is some unkno… |
CVE-2025-4795 | Medium | 4.7 | 2025-05-16 | A vulnerability classified as critical has been found in gongfuxiang schoolcms 2.3.1. This affects the function SaveInfo of the file /index.php?m=Admin&c=artic… |
CVE-2025-4794 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Online Course Registration 3.1. It has been declared as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-4793 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Online Course Registration 3.1. It has been classified as critical. Affected is an unknown function of the file /edit-s… |
CVE-2025-4792 | High | 7.3 | 2025-05-16 | A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the component MDELETE Command H… |
CVE-2025-4476 | Medium | 4.3 | 2025-05-16 | A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unau… |
CVE-2025-4791 | High | 7.3 | 2025-05-16 | A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the component HASH Command Ha… |
CVE-2025-4790 | High | 7.3 | 2025-05-16 | A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component GLOB Command Handler. T… |
CVE-2025-4789 | High | 7.3 | 2025-05-16 | A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the comp… |
CVE-2025-4788 | High | 7.3 | 2025-05-16 | A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component DELET… |
CVE-2025-4787 | Medium | 6.3 | 2025-05-16 | A vulnerability classified as critical has been found in SourceCodester/oretnom23 Stock Management System 1.0. Affected is an unknown function of the file /adm… |
CVE-2025-4786 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2025-48146 | High | 7.1 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Lups SEO Flow by LupsOnline lupsonline-link-netwerk allows Stored XSS.This issue affects SEO Flow by… |
CVE-2025-48144 | High | 7.1 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Impo… |
CVE-2025-48138 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-48137 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in proxymis Interview interview allows SQL Injection.This is… |
CVE-2025-48136 | High | 7.5 | 2025-05-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Mortgage Calculator Estatik es… |
CVE-2025-48135 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aptivadadev Aptivada for WP aptivada-for-wp allows DOM-Ba… |
CVE-2025-48134 | High | 7.2 | 2025-05-16 | Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects WP Tabs: from n/a th… |
CVE-2025-48132 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows… |
CVE-2025-48131 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-eleme… |
CVE-2025-48128 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in Sharespine Sharespine Woocommerce Connector sharespine-woocommerce-connector allows Exploiting Incorrectly Configured Ac… |
CVE-2025-48127 | Medium | 6.5 | 2025-05-16 | Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Co… |
CVE-2025-48121 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Puddick WP Notes Widget wp-notes-widget allows DOM-… |
CVE-2025-48120 | Medium | 5.3 | 2025-05-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issu… |
CVE-2025-48119 | Medium | 5.3 | 2025-05-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in RS WP THEMES RS WP Book Showcase rs-wp-books-showcase allows Code Injection.This iss… |
CVE-2025-48117 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-48116 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in Ashan Perera EventON eventon-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Eve… |
CVE-2025-48115 | Medium | 4.3 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue a… |
CVE-2025-48114 | High | 7.1 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in Shayan Farhang Pazhooh ShayanWeb Admin FontChanger shayanweb-admin-fontchanger allows Stored XSS.This issue… |
CVE-2025-48113 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS… |
CVE-2025-48112 | High | 7.1 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc… |
CVE-2025-48080 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learnda… |
CVE-2025-48079 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access… |
CVE-2025-47693 | High | 7.5 | 2025-05-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Services Booking fat-servi… |
CVE-2025-47567 | High | 7.6 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Video Player & FullScreen Video Background u… |
CVE-2025-47564 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: fro… |
CVE-2025-47563 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in villatheme CURCY woocommerce-multi-currency allows Accessing Functionality Not Properly Constrained by ACLs.This issue a… |
CVE-2025-47562 | Medium | 5.3 | 2025-05-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg allows Code Injection.This issue affects MapSVG: from n/a th… |
CVE-2025-47560 | Medium | 5.0 | 2025-05-16 | Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSV… |
CVE-2025-47557 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg allows Stored XSS.This issue affe… |
CVE-2025-47556 | Medium | 5.4 | 2025-05-16 | Missing Authorization vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Exploiting Incorrectly Confi… |
CVE-2025-47534 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-46464 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Stored XSS.Thi… |
CVE-2025-40906 | Critical | 9.8 | 2025-05-16 | BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790… |
CVE-2025-39537 | High | 7.1 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blaze Concepts Better Customer List for WooCommerce woo-b… |
CVE-2025-39511 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-39509 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode TNC FlipBook pdf-viewer-for-wordpress allows S… |
CVE-2025-39507 | High | 7.5 | 2025-05-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core nasa-core allows P… |
CVE-2025-39493 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in ValvePress Rankie valvepress-rankie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-39492 | High | 7.5 | 2025-05-16 | Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision. |
CVE-2025-39491 | High | 8.1 | 2025-05-16 | Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision. |
CVE-2025-39482 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eve… |
CVE-2025-39481 | Critical | 9.3 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in imithemes Eventer eventer allows Blind SQL Injection.This… |
CVE-2025-32643 | Critical | 9.3 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPGYM allows Blind SQL Injection. This issue aff… |
CVE-2025-32310 | High | 8.8 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeMove QuickCal - Appointment Booking Calendar for WordPress quickcal allows Privilege Escalation.This is… |
CVE-2025-32307 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Chameleon HTML5 Audio Player With/Without Pl… |
CVE-2025-32306 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Radio Player Shoutcast & Icecast WordPress P… |
CVE-2025-32301 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup CountDown Pro WP Plugin circular_countdown a… |
CVE-2025-32299 | Medium | 4.3 | 2025-05-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress q… |
CVE-2025-32296 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Exploiting Incorrectly Configured Access Control Secu… |