2025 CVEs (page 313)
Page 313 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48255 | Medium | 4.3 | 2025-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Cross Site Request Forgery… |
CVE-2025-48254 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Change Add to Cart Button Text for WooCommerce… |
CVE-2025-48253 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shippin… |
CVE-2025-48252 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget back-button-widget allows St… |
CVE-2025-48251 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Emails & Recipients for WooCo… |
CVE-2025-48250 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Coupons & Add to Cart by URL Links for WooComme… |
CVE-2025-48249 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EAN for WooCommerce ean-for-woocommerce allows… |
CVE-2025-48248 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Sitewide Discount for WooCommerce: Apply Discou… |
CVE-2025-48247 | Medium | 4.3 | 2025-05-19 | Missing Authorization vulnerability in Blair Williams Shortlinks by Pretty Links pretty-link allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-48246 | Medium | 5.4 | 2025-05-19 | Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-48244 | Medium | 5.9 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor exclusive-addons-… |
CVE-2025-48243 | Medium | 4.3 | 2025-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in sminozzi reCAPTCHA for all recaptcha-for-all allows Cross Site Request Forgery.This issue affects reCAPTCHA… |
CVE-2025-48242 | Medium | 6.5 | 2025-05-19 | Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-48240 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Cost of Goods for WooCommerce cost-of-goods-for… |
CVE-2025-48239 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Notes Tab & Private Admin Notes for Woo… |
CVE-2025-48238 | High | 7.1 | 2025-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in awcode AWcode Toolkit awcode-toolkit allows Stored XSS.This issue affects AWcode Toolkit: from n/a through <… |
CVE-2025-48237 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocomme… |
CVE-2025-48236 | High | 8.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bunny.net bunny.net bunnycdn allows Stored XSS.This issue… |
CVE-2025-48235 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bogdan Bendziukov WP Image Mask wp-image-mask allows DOM-… |
CVE-2025-48234 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DO… |
CVE-2025-48233 | High | 7.1 | 2025-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in affmngr Affiliates Manager Google reCAPTCHA Integration affiliates-manager-google-recaptcha-integration allo… |
CVE-2025-48232 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Addons For Beaver Builder – Lite xpro-addons-be… |
CVE-2025-43714 | Medium | 6.5 | 2025-05-19 | The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a code block), which e… |
CVE-2025-3908 | Medium | 6.2 | 2025-05-19 | The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory wh… |
CVE-2025-30072 | High | 7.6 | 2025-05-19 | Tiiwee X1 Alarm System TWX1HAKV2 allows Authentication Bypass by Capture-replay, leading to physical Access to the protected facilities without triggering an a… |
CVE-2025-4935 | High | 7.3 | 2025-05-19 | A vulnerability was found in SourceCodester Stock Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /php… |
CVE-2025-4934 | High | 7.3 | 2025-05-19 | A vulnerability has been found in PHPGurukul User Registration & Login and User Management System 3.3 and classified as critical. This vulnerability affects un… |
CVE-2025-44108 | Medium | 4.8 | 2025-05-19 | A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacke… |
CVE-2025-28371 | Medium | 6.5 | 2025-05-19 | EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function. The device fails to validate the current pass… |
CVE-2025-4933 | Medium | 6.3 | 2025-05-19 | A vulnerability, which was classified as critical, was found in ponaravindb Hospital-Management-System 1.0. This affects an unknown part of the file /doctor-pa… |
CVE-2025-4932 | High | 7.3 | 2025-05-19 | A vulnerability, which was classified as critical, has been found in projectworlds Online Lawyer Management System 1.0. Affected by this issue is some unknown… |
CVE-2025-4931 | High | 7.3 | 2025-05-19 | A vulnerability classified as critical was found in projectworlds Online Lawyer Management System 1.0. Affected by this vulnerability is an unknown functionali… |
CVE-2025-4930 | High | 7.3 | 2025-05-19 | A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. Affected is an unknown function of the file /my-cart.php. The ma… |
CVE-2025-2099 | High | 7.5 | 2025-05-19 | A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regul… |
CVE-2025-4929 | High | 7.3 | 2025-05-19 | A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file /my-ac… |
CVE-2025-4928 | High | 7.3 | 2025-05-19 | A vulnerability was found in projectworlds Online Lawyer Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of th… |
CVE-2025-4927 | High | 7.3 | 2025-05-19 | A vulnerability was found in PHPGurukul Online Marriage Registration System 1.0. It has been classified as critical. This affects an unknown part of the file /… |
CVE-2025-4926 | Medium | 4.7 | 2025-05-19 | A vulnerability was found in PHPGurukul Car Rental Project 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /ad… |
CVE-2025-4925 | High | 7.3 | 2025-05-19 | A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1 and classified as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-4924 | High | 7.3 | 2025-05-19 | A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. Affected is an unknown function of the fi… |
CVE-2025-41429 | Medium | 4.8 | 2025-05-19 | a-blog cms multiple versions neutralize logs improperly. If this vulnerability is exploited with CVE-2025-36560, a remote unauthenticated attacker may hijack a… |
CVE-2025-36560 | High | 8.6 | 2025-05-19 | Server-side request forgery vulnerability exists in a-blog cms multiple versions. If this vulnerability is exploited, a remote unauthenticated attacker may gai… |
CVE-2025-32999 | Medium | 5.4 | 2025-05-19 | Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the en… |
CVE-2025-27566 | Low | 3.8 | 2025-05-19 | Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path vali… |
CVE-2025-4923 | High | 7.3 | 2025-05-19 | A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown proc… |
CVE-2025-4917 | High | 7.3 | 2025-05-19 | A vulnerability classified as critical has been found in PHPGurukul Auto Taxi Stand Management System 1.0. Affected is an unknown function of the file /admin/n… |
CVE-2025-47760 | High | 7.8 | 2025-05-19 | V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6MemInIF!set_temp_type_default function. Opening specially crafted V7 or V8… |
CVE-2025-47759 | High | 7.8 | 2025-05-19 | V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6ComFile!CV7BaseMap::WriteV7DataToRom function. Opening specially crafted V7… |
CVE-2025-47758 | High | 7.8 | 2025-05-19 | V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6File!CTxSubFile::get_ProgramFile_name function. Opening specially crafted V… |
CVE-2025-47757 | High | 7.8 | 2025-05-19 | V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6MemInIF.dll!set_plc_type_default function. Opening specially crafted V7 or V8 files… |
CVE-2025-47756 | High | 7.8 | 2025-05-19 | V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!CGamenDataRom::set_mr400_strc function. Opening specially crafted V7 or V8… |
CVE-2025-47755 | High | 7.8 | 2025-05-19 | V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!VS4_SaveEnvFile function. Opening specially crafted V7 or V8 files may lead… |
CVE-2025-47754 | High | 7.8 | 2025-05-19 | V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!Conv_Macro_Data function. Opening specially crafted V7 or V8 files may lead… |
CVE-2025-47753 | High | 7.8 | 2025-05-19 | V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!CDrawSLine::GetRectArea function. Opening specially crafted V7 or V8 files… |
CVE-2025-47752 | High | 7.8 | 2025-05-19 | V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6ComFile!MakeItemGlidZahyou function. Opening specially crafted V7 or V8 files may l… |
CVE-2025-47751 | High | 7.8 | 2025-05-19 | V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6EditData!CDataRomErrorCheck::MacroCommandCheck function. Opening specially crafted… |
CVE-2025-47750 | High | 7.8 | 2025-05-19 | V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6MemInIF!set_temp_type_default function. Opening specially crafted V7 or V8 files ma… |
CVE-2025-47749 | High | 7.8 | 2025-05-19 | V-SFT v6.2.5.0 and earlier contains an issue with free of pointer not at start of buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck function. Opening spec… |
CVE-2025-46801 | Critical | 9.8 | 2025-05-19 | Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, a… |
CVE-2025-37891 | High | 7.8 | 2025-05-19 | In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: Fix buffer overflow at UMP SysEx message conversion The conversion function fr… |
CVE-2025-4916 | High | 7.3 | 2025-05-19 | A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2025-4915 | High | 7.3 | 2025-05-19 | A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the… |
CVE-2025-4914 | High | 7.3 | 2025-05-19 | A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been classified as critical. This affects an unknown part of the file /ad… |
CVE-2025-4913 | High | 7.3 | 2025-05-19 | A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2025-4477 | High | 7.2 | 2025-05-19 | The ThreatSonar Anti-Ransomware from TeamT5 has a Privilege Escalation vulnerability, allowing remote attackers with intermediate privileges to escalate their… |
CVE-2025-2561 | Medium | 4.8 | 2025-05-19 | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2025-2560 | Medium | 4.8 | 2025-05-19 | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2025-2524 | Medium | 4.8 | 2025-05-19 | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2025-1627 | Medium | 5.4 | 2025-05-19 | The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is… |
CVE-2025-1626 | Medium | 5.4 | 2025-05-19 | The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the… |
CVE-2025-1625 | Medium | 5.4 | 2025-05-19 | The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a page/post where the b… |
CVE-2025-4912 | Medium | 5.4 | 2025-05-19 | A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2025-4911 | High | 7.3 | 2025-05-19 | A vulnerability, which was classified as critical, was found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/view-f… |
CVE-2025-2892 | Medium | 6.4 | 2025-05-19 | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pos… |
CVE-2025-4910 | High | 7.3 | 2025-05-19 | A vulnerability, which was classified as critical, has been found in PHPGurukul Zoo Management System 2.1. This issue affects some unknown processing of the fi… |
CVE-2025-4909 | High | 7.3 | 2025-05-19 | A vulnerability classified as critical was found in SourceCodester Client Database Management System 1.0. This vulnerability affects unknown code. The manipula… |
CVE-2025-4908 | High | 7.3 | 2025-05-19 | A vulnerability classified as critical has been found in PHPGurukul Daily Expense Tracker System 1.1. This affects an unknown part of the file /expense-datewis… |
CVE-2025-4907 | High | 7.3 | 2025-05-19 | A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality o… |
CVE-2025-4906 | High | 7.3 | 2025-05-19 | A vulnerability was found in PHPGurukul Notice Board System 1.0. It has been classified as critical. Affected is an unknown function of the file /login.php. Th… |
CVE-2025-4905 | Medium | 5.3 | 2025-05-19 | A vulnerability was found in iop-apl-uw basestation3 up to 3.0.4 and classified as problematic. This issue affects the function load_qc_pickl of the file bases… |
CVE-2025-23167 | Medium | 6.5 | 2025-05-19 | A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables… |
CVE-2025-23166 | High | 7.5 | 2025-05-19 | The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the… |
CVE-2025-23165 | Low | 3.7 | 2025-05-19 | In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently o… |
CVE-2025-23164 | Medium | 4.4 | 2025-05-19 | A misconfigured access token mechanism in the Unifi Protect Application (Version 5.3.41 and earlier) could permit the recipient of a "Share Livestream" link to… |
CVE-2025-23123 | Critical | 10.0 | 2025-05-19 | A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vulnerability in the U… |
CVE-2025-4904 | Medium | 5.3 | 2025-05-19 | A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. This vulnerability affects the function sub_41F0FC of th… |
CVE-2025-4903 | Medium | 5.3 | 2025-05-19 | A vulnerability, which was classified as critical, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). This affects the function sub_41F4F0 of the file /H5/web… |
CVE-2025-4902 | Medium | 5.3 | 2025-05-19 | A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this issue is the function sub_48F4F… |
CVE-2025-4901 | Medium | 4.3 | 2025-05-19 | A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this vulnerability is the function sub_41E304 of the… |
CVE-2025-4900 | High | 7.3 | 2025-05-18 | A vulnerability classified as critical has been found in Campcodes Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/payment.p… |
CVE-2025-4899 | High | 7.3 | 2025-05-18 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /p… |
CVE-2025-4898 | Medium | 5.4 | 2025-05-18 | A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affects the function unl… |
CVE-2025-4897 | High | 8.8 | 2025-05-18 | A vulnerability was found in Tenda A15 15.13.07.09/15.13.07.13. It has been classified as critical. This affects an unknown part of the file /goform/multimodal… |
CVE-2025-4896 | High | 8.8 | 2025-05-18 | A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. Affected by this issue is some unknown functionality of the file /goform/UserCo… |
CVE-2025-4895 | High | 7.3 | 2025-05-18 | A vulnerability, which was classified as critical, has been found in SourceCodester Doctors Appointment System 1.0. This issue affects some unknown processing… |
CVE-2025-4894 | Low | 3.7 | 2025-05-18 | A vulnerability classified as problematic was found in calmkart Django-sso-server up to 057247929a94ffc358788a37ab99e391379a4d15. This vulnerability affects th… |
CVE-2025-4893 | Medium | 6.3 | 2025-05-18 | A vulnerability classified as critical has been found in jammy928 CoinExchange_CryptoExchange_Java up to 8adf508b996020d3efbeeb2473d7235bd01436fa. This affects… |
CVE-2025-4892 | Medium | 5.3 | 2025-05-18 | A vulnerability was found in code-projects Police Station Management System 1.0. It has been declared as critical. Affected by this vulnerability is the functi… |
CVE-2025-4891 | Medium | 5.3 | 2025-05-18 | A vulnerability was found in code-projects Police Station Management System 1.0. It has been classified as critical. Affected is the function criminal::display… |
CVE-2025-4890 | Medium | 5.3 | 2025-05-18 | A vulnerability was found in code-projects Tourism Management System 1.0 and classified as critical. This issue affects the function LoginUser of the component… |