2025 CVEs (page 315)
Page 315 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4724 | High | 7.3 | 2025-05-15 | A vulnerability, which was classified as critical, has been found in itsourcecode Placement Management System 1.0. Affected by this issue is some unknown funct… |
CVE-2025-4723 | High | 7.3 | 2025-05-15 | A vulnerability classified as critical was found in itsourcecode Placement Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-4722 | High | 7.3 | 2025-05-15 | A vulnerability classified as critical has been found in itsourcecode Placement Management System 1.0. Affected is an unknown function of the file /edit_profil… |
CVE-2025-47287 | High | 7.5 | 2025-05-15 | Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warni… |
CVE-2025-47275 | Critical | 9.1 | 2025-05-15 | Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of ap… |
CVE-2025-4721 | High | 7.3 | 2025-05-15 | A vulnerability was found in itsourcecode Placement Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fil… |
CVE-2025-4720 | Medium | 5.4 | 2025-05-15 | A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2025-4719 | High | 7.3 | 2025-05-15 | A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-4718 | High | 7.3 | 2025-05-15 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-47929 | | 2025-05-15 | DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload func… | |
CVE-2025-1138 | Medium | 4.3 | 2025-05-15 | IBM InfoSphere Information Server 11.7 could disclose sensitive information to an authenticated user that could aid in further attacks against the system throu… |
CVE-2025-4717 | High | 7.3 | 2025-05-15 | A vulnerability, which was classified as critical, was found in PHPGurukul Company Visitor Management System 2.0. Affected is an unknown function of the file /… |
CVE-2025-4716 | High | 7.3 | 2025-05-15 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2025-4715 | High | 7.3 | 2025-05-15 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2025-47928 | Critical | 9.1 | 2025-05-15 | Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/i… |
CVE-2025-47789 | Medium | 6.1 | 2025-05-15 | Horilla is a free and open source Human Resource Management System (HRMS). In versions up to and including 1.3, an attacker can craft a Horilla URL that refers… |
CVE-2025-47788 | | 2025-05-15 | Atheos is a self-hosted browser-based cloud IDE. Prior to v602, similar to GHSA-rgjm-6p59-537v/CVE-2025-22152, the `$target` parameter in `/controller.php` was… | |
CVE-2025-47787 | Critical | 9.8 | 2025-05-15 | Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a cri… |
CVE-2025-47786 | Medium | 4.8 | 2025-05-15 | Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct ma… |
CVE-2025-47785 | High | 8.3 | 2025-05-15 | Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/articl… |
CVE-2025-47784 | Critical | 9.8 | 2025-05-15 | Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nicknam… |
CVE-2025-47161 | High | 7.8 | 2025-05-15 | Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
CVE-2025-46834 | | 2025-05-15 | Alchemy's Modular Account is a smart contract account that is compatible with ERC-4337 and ERC-6900. In versions on the 2.x branch prior to commit 5e6f540d249a… | |
CVE-2025-2248 | Medium | 5.4 | 2025-05-15 | The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL inject… |
CVE-2025-2247 | Medium | 5.4 | 2025-05-15 | The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admi… |
CVE-2025-2203 | Medium | 6.1 | 2025-05-15 | The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injec… |
CVE-2025-1454 | Medium | 5.4 | 2025-05-15 | The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2025-1303 | Medium | 6.1 | 2025-05-15 | The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2025-1289 | Medium | 4.8 | 2025-05-15 | The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2025-1288 | Medium | 6.1 | 2025-05-15 | The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacke… |
CVE-2025-1286 | Medium | 6.1 | 2025-05-15 | The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl… |
CVE-2025-1033 | Medium | 4.8 | 2025-05-15 | The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2025-0688 | Medium | 6.1 | 2025-05-15 | The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back i… |
CVE-2025-0687 | Medium | 6.1 | 2025-05-15 | The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back i… |
CVE-2025-0329 | Medium | 4.8 | 2025-05-15 | The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2025-4714 | High | 7.3 | 2025-05-15 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/r… |
CVE-2025-4713 | High | 7.3 | 2025-05-15 | A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages… |
CVE-2025-4712 | High | 7.3 | 2025-05-15 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pag… |
CVE-2025-32922 | High | 7.1 | 2025-05-15 | Cross-Site Request Forgery (CSRF) vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Stored XSS.This issue affects WP2LEADS: from n/a through <… |
CVE-2025-30476 | Medium | 5.3 | 2025-05-15 | Dell PowerScale InsightIQ, version 5.2, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote access could poten… |
CVE-2025-30475 | High | 8.1 | 2025-05-15 | Dell PowerScale InsightIQ, versions 5.0 through 5.2, contains an improper privilege management vulnerability. An unauthenticated attacker with remote access co… |
CVE-2025-26481 | High | 7.5 | 2025-05-15 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.9.0.0, contains an uncontrolled resource consumption vulnerability. A remote unprivileged attacker could pote… |
CVE-2025-4711 | High | 7.3 | 2025-05-15 | A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. This affects an unknown part of the file /pages/stock… |
CVE-2025-4710 | High | 7.3 | 2025-05-15 | A vulnerability, which was classified as critical, has been found in Campcodes Sales and Inventory System 1.0. Affected by this issue is some unknown functiona… |
CVE-2025-4709 | High | 7.3 | 2025-05-15 | A vulnerability classified as critical was found in Campcodes Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-47774 | | 2025-05-15 | Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side eff… | |
CVE-2025-47285 | | 2025-05-15 | Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side e… | |
CVE-2025-47279 | Low | 3.1 | 2025-05-15 | Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vuln… |
CVE-2025-44110 | Medium | 5.4 | 2025-05-15 | FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php. |
CVE-2025-43853 | Medium | 5.5 | 2025-05-15 | The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and com… |
CVE-2025-4708 | High | 7.3 | 2025-05-15 | A vulnerability classified as critical has been found in Campcodes Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/sales_add… |
CVE-2025-4707 | High | 7.3 | 2025-05-15 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /p… |
CVE-2025-4706 | High | 7.3 | 2025-05-15 | A vulnerability was found in projectworlds Online Examination System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2025-47580 | Medium | 5.4 | 2025-05-15 | Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-30421 | High | 7.8 | 2025-05-15 | There is a memory corruption vulnerability due to a stack-based buffer overflow in DrObjectStorage::XML_Serialize() when using the SymbolEditor in NI Circuit D… |
CVE-2025-30420 | High | 7.8 | 2025-05-15 | There is a memory corruption vulnerability due to an out of bounds read in Bitmap::InternalDraw() when using the SymbolEditor in NI Circuit Design Suite. This… |
CVE-2025-30419 | High | 7.8 | 2025-05-15 | There is a memory corruption vulnerability due to an out of bounds read in GetSymbolBorderRectSize() when using the SymbolEditor in NI Circuit Design Suite. T… |
CVE-2025-30418 | High | 7.8 | 2025-05-15 | There is a memory corruption vulnerability due to an out of bounds write in CheckPins() when using the SymbolEditor in NI Circuit Design Suite. This vulnerabi… |
CVE-2025-30417 | High | 7.8 | 2025-05-15 | There is a memory corruption vulnerability due to an out of bounds write in Library!DecodeBase64() when using the SymbolEditor in NI Circuit Design Suite. Thi… |
CVE-2025-1647 | Medium | 5.6 | 2025-05-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This i… |
CVE-2025-4705 | High | 7.3 | 2025-05-15 | A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been classified as critical. This affects an unknown part of the file /a… |
CVE-2025-4704 | High | 7.3 | 2025-05-15 | A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2025-4703 | High | 7.3 | 2025-05-15 | A vulnerability has been found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2025-48051 | Medium | 4.7 | 2025-05-15 | powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM no… |
CVE-2025-48050 | High | 7.5 | 2025-05-15 | In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier… |
CVE-2025-3440 | Medium | 5.5 | 2025-05-15 | IBM Security Guardium 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the… |
CVE-2025-2570 | Low | 2.7 | 2025-05-15 | Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which… |
CVE-2025-2527 | Medium | 4.3 | 2025-05-15 | Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view… |
CVE-2025-4702 | High | 7.3 | 2025-05-15 | A vulnerability, which was classified as critical, was found in PHPGurukul Vehicle Parking Management System 1.13. Affected is an unknown function of the file… |
CVE-2025-4701 | Medium | 5.3 | 2025-05-15 | A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421. This issue affects the function torch.load of the… |
CVE-2025-46053 | Medium | 5.1 | 2025-05-15 | A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload in… |
CVE-2025-44185 | Medium | 5.4 | 2025-05-15 | SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/change_pass.php via the password parameter. |
CVE-2025-4699 | High | 7.3 | 2025-05-15 | A vulnerability classified as critical was found in PHPGurukul Apartment Visitors Management System 1.0. This vulnerability affects unknown code of the file /a… |
CVE-2025-4698 | High | 7.3 | 2025-05-15 | A vulnerability classified as critical has been found in PHPGurukul Directory Management System 2.0. This affects an unknown part of the file /admin/forget-pas… |
CVE-2025-4516 | | 2025-05-15 | There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an erro… | |
CVE-2025-46052 | Critical | 9.8 | 2025-05-15 | An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a… |
CVE-2025-44183 | Medium | 6.1 | 2025-05-15 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the name, email, and mobile parameters. |
CVE-2025-44182 | Medium | 6.1 | 2025-05-15 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the vehiclename, modelnumber, regnumber, vehiclesubtype, chasi… |
CVE-2025-44181 | Medium | 6.1 | 2025-05-15 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/add-brand.php via the brandname parameter. |
CVE-2025-44180 | Medium | 6.1 | 2025-05-15 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit-brand.php?bid={brandId}. |
CVE-2025-4697 | High | 7.3 | 2025-05-15 | A vulnerability was found in PHPGurukul Directory Management System 2.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-4696 | Medium | 6.3 | 2025-05-15 | A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unkn… |
CVE-2025-4695 | Medium | 6.3 | 2025-05-15 | A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. It has been classified as critical. Affected is an unknown function of the… |
CVE-2025-4762 | | 2025-05-15 | Insecure Direct Object Reference (IDOR) vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthentic… | |
CVE-2025-4564 | Critical | 9.8 | 2025-05-15 | The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation via the 'delpdf'… |
CVE-2025-3446 | Medium | 4.3 | 2025-05-15 | Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated us… |
CVE-2025-31947 | Medium | 5.8 | 2025-05-15 | Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which… |
CVE-2025-32738 | Medium | 5.3 | 2025-05-15 | Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a… |
CVE-2025-32002 | Critical | 9.8 | 2025-05-15 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard disk 'HDL-T Series' f… |
CVE-2025-4737 | Medium | 6.2 | 2025-05-15 | Insufficient encryption vulnerability in the mobile application (com.transsion.aivoiceassistant) may lead to the risk of sensitive information leakage. |
CVE-2025-27525 | Low | 3.9 | 2025-05-15 | Information Exposure vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Sm… |
CVE-2025-27524 | Medium | 5.3 | 2025-05-15 | Weak encryption vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart D… |
CVE-2025-27523 | High | 8.7 | 2025-05-15 | XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manage… |
CVE-2025-48027 | Medium | 5.4 | 2025-05-15 | The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginserver. |
CVE-2025-3742 | Medium | 6.8 | 2025-05-15 | The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post… |
CVE-2025-48024 | Medium | 5.0 | 2025-05-15 | In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint. |
CVE-2025-3053 | High | 8.8 | 2025-05-15 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and… |
CVE-2025-4591 | Medium | 6.4 | 2025-05-15 | The Weluka Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'weluka-map' shortcode in all versions up to, and including… |
CVE-2025-4589 | Medium | 6.4 | 2025-05-15 | The Bon Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt-map' shortcode in all versions up to, and including, 1.3… |
CVE-2025-4126 | Medium | 6.4 | 2025-05-15 | The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in all versions up to, and including, 2.1.1… |