2025 CVEs (page 315)
Page 315 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4793 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Online Course Registration 3.1. It has been classified as critical. Affected is an unknown function of the file /edit-s… |
CVE-2025-4792 | High | 7.3 | 2025-05-16 | A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the component MDELETE Command H… |
CVE-2025-4476 | Medium | 4.3 | 2025-05-16 | A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unau… |
CVE-2025-4791 | High | 7.3 | 2025-05-16 | A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the component HASH Command Ha… |
CVE-2025-4790 | High | 7.3 | 2025-05-16 | A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component GLOB Command Handler. T… |
CVE-2025-4789 | High | 7.3 | 2025-05-16 | A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the comp… |
CVE-2025-4788 | High | 7.3 | 2025-05-16 | A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component DELET… |
CVE-2025-4787 | Medium | 6.3 | 2025-05-16 | A vulnerability classified as critical has been found in SourceCodester/oretnom23 Stock Management System 1.0. Affected is an unknown function of the file /adm… |
CVE-2025-4786 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2025-48146 | High | 7.1 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Lups SEO Flow by LupsOnline lupsonline-link-netwerk allows Stored XSS.This issue affects SEO Flow by… |
CVE-2025-48144 | High | 7.1 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Impo… |
CVE-2025-48138 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-48137 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in proxymis Interview interview allows SQL Injection.This is… |
CVE-2025-48136 | High | 7.5 | 2025-05-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Mortgage Calculator Estatik es… |
CVE-2025-48135 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aptivadadev Aptivada for WP aptivada-for-wp allows DOM-Ba… |
CVE-2025-48134 | High | 7.2 | 2025-05-16 | Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects WP Tabs: from n/a th… |
CVE-2025-48132 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows… |
CVE-2025-48131 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-eleme… |
CVE-2025-48128 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in Sharespine Sharespine Woocommerce Connector sharespine-woocommerce-connector allows Exploiting Incorrectly Configured Ac… |
CVE-2025-48127 | Medium | 6.5 | 2025-05-16 | Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Co… |
CVE-2025-48121 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Puddick WP Notes Widget wp-notes-widget allows DOM-… |
CVE-2025-48120 | Medium | 5.3 | 2025-05-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issu… |
CVE-2025-48119 | Medium | 5.3 | 2025-05-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in RS WP THEMES RS WP Book Showcase rs-wp-books-showcase allows Code Injection.This iss… |
CVE-2025-48117 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-48116 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in Ashan Perera EventON eventon-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Eve… |
CVE-2025-48115 | Medium | 4.3 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue a… |
CVE-2025-48114 | High | 7.1 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in Shayan Farhang Pazhooh ShayanWeb Admin FontChanger shayanweb-admin-fontchanger allows Stored XSS.This issue… |
CVE-2025-48113 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS… |
CVE-2025-48112 | High | 7.1 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc… |
CVE-2025-48080 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learnda… |
CVE-2025-48079 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access… |
CVE-2025-47693 | High | 7.5 | 2025-05-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Services Booking fat-servi… |
CVE-2025-47567 | High | 7.6 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Video Player & FullScreen Video Background u… |
CVE-2025-47564 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: fro… |
CVE-2025-47563 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in villatheme CURCY woocommerce-multi-currency allows Accessing Functionality Not Properly Constrained by ACLs.This issue a… |
CVE-2025-47562 | Medium | 5.3 | 2025-05-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg allows Code Injection.This issue affects MapSVG: from n/a th… |
CVE-2025-47560 | Medium | 5.0 | 2025-05-16 | Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSV… |
CVE-2025-47557 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg allows Stored XSS.This issue affe… |
CVE-2025-47556 | Medium | 5.4 | 2025-05-16 | Missing Authorization vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Exploiting Incorrectly Confi… |
CVE-2025-47534 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-46464 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Stored XSS.Thi… |
CVE-2025-40906 | Critical | 9.8 | 2025-05-16 | BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790… |
CVE-2025-39537 | High | 7.1 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blaze Concepts Better Customer List for WooCommerce woo-b… |
CVE-2025-39511 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-39509 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode TNC FlipBook pdf-viewer-for-wordpress allows S… |
CVE-2025-39507 | High | 7.5 | 2025-05-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core nasa-core allows P… |
CVE-2025-39493 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in ValvePress Rankie valvepress-rankie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-39492 | High | 7.5 | 2025-05-16 | Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision. |
CVE-2025-39491 | High | 8.1 | 2025-05-16 | Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision. |
CVE-2025-39482 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eve… |
CVE-2025-39481 | Critical | 9.3 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in imithemes Eventer eventer allows Blind SQL Injection.This… |
CVE-2025-32643 | Critical | 9.3 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPGYM allows Blind SQL Injection. This issue aff… |
CVE-2025-32310 | High | 8.8 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeMove QuickCal - Appointment Booking Calendar for WordPress quickcal allows Privilege Escalation.This is… |
CVE-2025-32307 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Chameleon HTML5 Audio Player With/Without Pl… |
CVE-2025-32306 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Radio Player Shoutcast & Icecast WordPress P… |
CVE-2025-32301 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup CountDown Pro WP Plugin circular_countdown a… |
CVE-2025-32299 | Medium | 4.3 | 2025-05-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress q… |
CVE-2025-32296 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-32295 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-32290 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Sticky HTML5 Music Player lbg-audio3-html5 a… |
CVE-2025-32287 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playl… |
CVE-2025-32245 | Medium | 6.5 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in Chaser324 Featured Posts Scroll featured-posts-scroll allows Stored XSS.This issue affects Featured Posts Sc… |
CVE-2025-32180 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojofywp Product Carousel For WooCommerce – WoorouSell wo… |
CVE-2025-31928 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Multimedia Responsive Carousel with Image Vi… |
CVE-2025-31926 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutca… |
CVE-2025-31923 | Medium | 5.4 | 2025-05-16 | Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-31922 | High | 7.1 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Stored XSS.This issue affects CSS3 Accordi… |
CVE-2025-31921 | Medium | 4.3 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Ultimate Tours Builder WP_UltimateToursBuilder allows Cross Site Request Forgery.This issue affect… |
CVE-2025-31915 | Medium | 5.4 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Cross Site Request… |
CVE-2025-31641 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup UberSlider uber-classic allows SQL Injection… |
CVE-2025-31640 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPre… |
CVE-2025-31639 | Medium | 4.3 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in themeton Spare allows Cross Site Request Forgery. This issue affects Spare: from n/a through 1.7. |
CVE-2025-31637 | High | 8.5 | 2025-05-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup SHOUT lbg-audio8-html5-radio_ads allows SQL… |
CVE-2025-31630 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in themeton The Business allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Bu… |
CVE-2025-31071 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-31068 | Medium | 4.3 | 2025-05-16 | Cross-Site Request Forgery (CSRF) vulnerability in themeton Seven Stars allows Cross Site Request Forgery. This issue affects Seven Stars: from n/a through 1.4… |
CVE-2025-31066 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in themeton Acerola acerola allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acer… |
CVE-2025-31065 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rozario: fr… |
CVE-2025-31063 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in redqteam Wishlist wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wi… |
CVE-2025-31062 | Medium | 4.3 | 2025-05-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in redqteam Wishlist wishlist allows Retrieve Embedded Sensitive Data… |
CVE-2025-4785 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality o… |
CVE-2025-4782 | Medium | 6.3 | 2025-05-16 | A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This vulnerability affects unknown code of t… |
CVE-2025-4781 | Medium | 6.3 | 2025-05-16 | A vulnerability classified as critical has been found in PHPGurukul Park Ticketing Management System 2.0. Affected is an unknown function of the file /forgot-p… |
CVE-2025-4478 | Medium | 6.5 | 2025-05-16 | A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the… |
CVE-2025-47916 | Critical | 10.0 | 2025-05-16 | Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor contr… |
CVE-2025-47794 | Low | 2.6 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0… |
CVE-2025-47793 | Medium | 4.3 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or… |
CVE-2025-47792 | Medium | 5.0 | 2025-05-16 | Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user m… |
CVE-2025-47791 | Medium | 4.3 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28… |
CVE-2025-4780 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2025-4778 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been declared as critical. This vulnerability affects unknown code of the… |
CVE-2025-4600 | High | 7.5 | 2025-05-16 | A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This… |
CVE-2025-4211 | | 2025-05-16 | Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows… | |
CVE-2025-47790 | Medium | 6.4 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13… |
CVE-2025-32962 | Medium | 4.3 | 2025-05-16 | Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to pe… |
CVE-2025-4777 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been classified as critical. This affects an unknown part of the file /vie… |
CVE-2025-4773 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Online Course Registration 3.1 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-40907 | Medium | 5.3 | 2025-05-16 | FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI library is affected by… |
CVE-2025-40629 | | 2025-05-16 | PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file… | |
CVE-2025-37890 | High | 7.8 | 2025-05-16 | In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described… |