2025 CVEs (page 314)
Page 314 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32295 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-32290 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Sticky HTML5 Music Player lbg-audio3-html5 a… |
CVE-2025-32287 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playl… |
CVE-2025-32245 | Medium | 6.5 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in Chaser324 Featured Posts Scroll featured-posts-scroll allows Stored XSS.This issue affects Featured Posts Sc… |
CVE-2025-32180 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojofywp Product Carousel For WooCommerce – WoorouSell wo… |
CVE-2025-31928 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Multimedia Responsive Carousel with Image Vi… |
CVE-2025-31926 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutca… |
CVE-2025-31923 | Medium | 5.4 | 2025-05-16 | Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-31922 | High | 7.1 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Stored XSS.This issue affects CSS3 Accordi… |
CVE-2025-31921 | Medium | 4.3 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Ultimate Tours Builder WP_UltimateToursBuilder allows Cross Site Request Forgery.This issue affect… |
CVE-2025-31915 | Medium | 5.4 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Cross Site Request… |
CVE-2025-31641 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup UberSlider uber-classic allows SQL Injection… |
CVE-2025-31640 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPre… |
CVE-2025-31639 | Medium | 4.3 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in themeton Spare allows Cross Site Request Forgery. This issue affects Spare: from n/a through 1.7. |
CVE-2025-31637 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup SHOUT lbg-audio8-html5-radio_ads allows SQL… |
CVE-2025-31630 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in themeton The Business allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Bu… |
CVE-2025-31071 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-31068 | Medium | 4.3 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in themeton Seven Stars allows Cross Site Request Forgery. This issue affects Seven Stars: from n/a through 1.4… |
CVE-2025-31066 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in themeton Acerola acerola allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acer… |
CVE-2025-31065 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rozario: fr… |
CVE-2025-31063 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in redqteam Wishlist wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wi… |
CVE-2025-31062 | Medium | 4.3 | 2025-05-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in redqteam Wishlist wishlist allows Retrieve Embedded Sensitive Data… |
CVE-2025-4785 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality o… |
CVE-2025-4782 | Medium | 6.3 | 2025-05-16 | A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This vulnerability affects unknown code of t… |
CVE-2025-4781 | Medium | 6.3 | 2025-05-16 | A vulnerability classified as critical has been found in PHPGurukul Park Ticketing Management System 2.0. Affected is an unknown function of the file /forgot-p… |
CVE-2025-4478 | Medium | 6.5 | 2025-05-16 | A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the… |
CVE-2025-47916 | Critical | 10.0 | 2025-05-16 | Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor contr… |
CVE-2025-47794 | Low | 2.6 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0… |
CVE-2025-47793 | Medium | 4.3 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or… |
CVE-2025-47792 | Medium | 5.0 | 2025-05-16 | Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user m… |
CVE-2025-47791 | Medium | 4.3 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28… |
CVE-2025-4780 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2025-4778 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been declared as critical. This vulnerability affects unknown code of the… |
CVE-2025-4600 | High | 7.5 | 2025-05-16 | A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This… |
CVE-2025-4211 | | 2025-05-16 | Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows… | |
CVE-2025-47790 | Medium | 6.4 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13… |
CVE-2025-32962 | Medium | 4.3 | 2025-05-16 | Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to pe… |
CVE-2025-4777 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been classified as critical. This affects an unknown part of the file /vie… |
CVE-2025-4773 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Online Course Registration 3.1 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-40907 | Medium | 5.3 | 2025-05-16 | FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI library is affected by… |
CVE-2025-40629 | | 2025-05-16 | PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file… | |
CVE-2025-37890 | High | 7.8 | 2025-05-16 | In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described… |
CVE-2025-2306 | Medium | 5.9 | 2025-05-16 | An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sensitive documents wit… |
CVE-2025-2305 | High | 8.6 | 2025-05-16 | A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to download arbitrary files… |
CVE-2025-4772 | High | 7.3 | 2025-05-16 | A vulnerability has been found in PHPGurukul Online Course Registration 3.1 and classified as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-4771 | High | 7.3 | 2025-05-16 | A vulnerability, which was classified as critical, was found in PHPGurukul Online Course Registration 3.1. Affected is an unknown function of the file /admin/c… |
CVE-2025-4770 | Medium | 6.3 | 2025-05-16 | A vulnerability, which was classified as critical, has been found in PHPGurukul Park Ticketing Management System 2.0. This issue affects some unknown processin… |
CVE-2025-4769 | High | 7.0 | 2025-05-16 | A vulnerability classified as critical was found in CBEWIN Anytxt Searcher 1.3.1128.0. This vulnerability affects unknown code of the file ATService.exe. The m… |
CVE-2025-40632 | Medium | 6.1 | 2025-05-16 | Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicio… |
CVE-2025-40631 | Medium | 6.1 | 2025-05-16 | HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScri… |
CVE-2025-40630 | Medium | 6.1 | 2025-05-16 | Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sendi… |
CVE-2025-4768 | Medium | 6.3 | 2025-05-16 | A vulnerability classified as critical has been found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. This affects the function uploadPicture of the file… |
CVE-2025-4767 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in defog-ai introspect up to 0.1.4. It has been rated as critical. Affected by this issue is the function test_custom_tool of the fil… |
CVE-2025-4766 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-4765 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been classified as critical. Affected is an unknown function of the file /admin/conta… |
CVE-2025-4679 | Medium | 6.5 | 2025-05-16 | A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors. |
CVE-2025-1975 | High | 7.5 | 2025-05-16 | A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the manifest content and s… |
CVE-2025-4761 | High | 7.3 | 2025-05-16 | A vulnerability has been found in PHPGurukul Complaint Management System 2.0 and classified as critical. This vulnerability affects unknown code of the file /a… |
CVE-2025-4758 | High | 7.3 | 2025-05-16 | A vulnerability classified as critical has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected is an unknown function of the file /contact… |
CVE-2025-4757 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Beauty Parlour Management System 1.1. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2025-4756 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125). It has been declared as problematic. This vulnerability affects unknown code of the file /H… |
CVE-2025-4755 | High | 7.3 | 2025-05-16 | A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125). It has been classified as critical. This affects the function sub_497DE4 of the file /H5/ne… |
CVE-2025-4753 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-3624 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component).This issue affects Hitachi Ops Center An… |
CVE-2025-1531 | Medium | 6.5 | 2025-05-16 | Authentication credentials leakage vulnerability in Hitachi Ops Center Analyzer viewpoint.This issue affects Hitachi Ops Center Analyzer viewpoint: from 10.0… |
CVE-2025-4752 | Medium | 5.3 | 2025-05-16 | A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2025-4751 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected is an unknown function of the file /index.da… |
CVE-2025-4750 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). This issue affects some unknown processing of th… |
CVE-2025-3516 | Medium | 5.9 | 2025-05-16 | The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could a… |
CVE-2025-3201 | Medium | 5.9 | 2025-05-16 | The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow hig… |
CVE-2025-1245 | Medium | 6.5 | 2025-05-16 | Bypass Connection Restriction vulnerability in Hitachi Infrastructure Analytics Advisor (Data Center Analytics component), Hitachi Ops Center Analyzer (Hitach… |
CVE-2025-4759 | High | 8.3 | 2025-05-16 | Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package U… |
CVE-2025-4749 | High | 7.5 | 2025-05-16 | A vulnerability classified as critical was found in D-Link DI-7003GV2 24.04.18D1 R(68125). This vulnerability affects the function sub_4983B0 of the file /H5/b… |
CVE-2025-4747 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical. This issue affects some unknown processing of the file /systemstatus/ip_s… |
CVE-2025-4746 | High | 7.3 | 2025-05-16 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pag… |
CVE-2025-48175 | Medium | 4.5 | 2025-05-16 | In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes. |
CVE-2025-48174 | Medium | 4.5 | 2025-05-16 | In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size. |
CVE-2025-4745 | Low | 3.5 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in code-projects Employee Record System 1.0. This affects an unknown part of the file current_e… |
CVE-2025-4744 | Low | 3.5 | 2025-05-16 | A vulnerability, which was classified as problematic, has been found in code-projects Employee Record System 1.0. Affected by this issue is some unknown functi… |
CVE-2025-4743 | Medium | 6.3 | 2025-05-16 | A vulnerability classified as critical was found in code-projects Employee Record System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-4742 | Medium | 5.3 | 2025-05-16 | A vulnerability classified as problematic has been found in XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856. Affected is the function main of… |
CVE-2025-4741 | High | 7.3 | 2025-05-16 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /p… |
CVE-2025-4740 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in BeamCtrl Airiana up to 11.0. It has been declared as problematic. This vulnerability affects unknown code of the file coef. The ma… |
CVE-2025-4739 | High | 7.3 | 2025-05-16 | A vulnerability was found in projectworlds Hospital Database Management System 1.0. It has been classified as critical. This affects an unknown part of the fil… |
CVE-2025-4169 | Medium | 6.4 | 2025-05-16 | The Posts per Cat [Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all versions up to, and i… |
CVE-2025-4736 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Daily Expense Tracker 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-4735 | Medium | 6.3 | 2025-05-16 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-4734 | High | 7.3 | 2025-05-16 | A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/ci… |
CVE-2025-4733 | High | 8.8 | 2025-05-16 | A vulnerability, which was classified as critical, has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This issue affects some unknown processi… |
CVE-2025-4732 | High | 8.8 | 2025-05-16 | A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boaf… |
CVE-2025-47809 | High | 8.2 | 2025-05-16 | Wibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation (before a logoff or reboot). For exploitation, there must have… |
CVE-2025-4731 | High | 8.8 | 2025-05-16 | A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/for… |
CVE-2025-4730 | High | 8.8 | 2025-05-16 | A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue is some unknown functional… |
CVE-2025-4729 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown f… |
CVE-2025-47930 | Medium | 5.3 | 2025-05-16 | Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanis… |
CVE-2025-4728 | High | 7.3 | 2025-05-15 | A vulnerability was found in SourceCodester Best Online News Portal 1.0. It has been classified as critical. Affected is an unknown function of the file /searc… |
CVE-2025-4727 | Low | 3.7 | 2025-05-15 | A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/li… |
CVE-2025-4726 | High | 7.3 | 2025-05-15 | A vulnerability has been found in itsourcecode Placement Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-0921 | Medium | 6.5 | 2025-05-15 | Execution with Unnecessary Privileges vulnerability in multiple services of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONI… |
CVE-2025-4725 | High | 7.3 | 2025-05-15 | A vulnerability, which was classified as critical, was found in itsourcecode Placement Management System 1.0. This affects an unknown part of the file /view_dr… |