2025 CVEs (page 316)
Page 316 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2306 | Medium | 5.9 | 2025-05-16 | An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sensitive documents wit… |
CVE-2025-2305 | High | 8.6 | 2025-05-16 | A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to download arbitrary files… |
CVE-2025-4772 | High | 7.3 | 2025-05-16 | A vulnerability has been found in PHPGurukul Online Course Registration 3.1 and classified as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-4771 | High | 7.3 | 2025-05-16 | A vulnerability, which was classified as critical, was found in PHPGurukul Online Course Registration 3.1. Affected is an unknown function of the file /admin/c… |
CVE-2025-4770 | Medium | 6.3 | 2025-05-16 | A vulnerability, which was classified as critical, has been found in PHPGurukul Park Ticketing Management System 2.0. This issue affects some unknown processin… |
CVE-2025-4769 | High | 7.0 | 2025-05-16 | A vulnerability classified as critical was found in CBEWIN Anytxt Searcher 1.3.1128.0. This vulnerability affects unknown code of the file ATService.exe. The m… |
CVE-2025-40632 | Medium | 6.1 | 2025-05-16 | Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicio… |
CVE-2025-40631 | Medium | 6.1 | 2025-05-16 | HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScri… |
CVE-2025-40630 | Medium | 6.1 | 2025-05-16 | Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sendi… |
CVE-2025-4768 | Medium | 6.3 | 2025-05-16 | A vulnerability classified as critical has been found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. This affects the function uploadPicture of the file… |
CVE-2025-4767 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in defog-ai introspect up to 0.1.4. It has been rated as critical. Affected by this issue is the function test_custom_tool of the fil… |
CVE-2025-4766 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-4765 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been classified as critical. Affected is an unknown function of the file /admin/conta… |
CVE-2025-4679 | Medium | 6.5 | 2025-05-16 | A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors. |
CVE-2025-1975 | High | 7.5 | 2025-05-16 | A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the manifest content and s… |
CVE-2025-4761 | High | 7.3 | 2025-05-16 | A vulnerability has been found in PHPGurukul Complaint Management System 2.0 and classified as critical. This vulnerability affects unknown code of the file /a… |
CVE-2025-4758 | High | 7.3 | 2025-05-16 | A vulnerability classified as critical has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected is an unknown function of the file /contact… |
CVE-2025-4757 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Beauty Parlour Management System 1.1. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2025-4756 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125). It has been declared as problematic. This vulnerability affects unknown code of the file /H… |
CVE-2025-4755 | High | 7.3 | 2025-05-16 | A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125). It has been classified as critical. This affects the function sub_497DE4 of the file /H5/ne… |
CVE-2025-4753 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-3624 | Medium | 4.3 | 2025-05-16 | Missing Authorization vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component).This issue affects Hitachi Ops Center An… |
CVE-2025-1531 | Medium | 6.5 | 2025-05-16 | Authentication credentials leakage vulnerability in Hitachi Ops Center Analyzer viewpoint.This issue affects Hitachi Ops Center Analyzer viewpoint: from 10.0… |
CVE-2025-4752 | Medium | 5.3 | 2025-05-16 | A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2025-4751 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected is an unknown function of the file /index.da… |
CVE-2025-4750 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). This issue affects some unknown processing of th… |
CVE-2025-3516 | Medium | 5.9 | 2025-05-16 | The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could a… |
CVE-2025-3201 | Medium | 5.9 | 2025-05-16 | The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow hig… |
CVE-2025-1245 | Medium | 6.5 | 2025-05-16 | Bypass Connection Restriction vulnerability in Hitachi Infrastructure Analytics Advisor (Data Center Analytics component), Hitachi Ops Center Analyzer (Hitach… |
CVE-2025-4759 | High | 8.3 | 2025-05-16 | Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package U… |
CVE-2025-4749 | High | 7.5 | 2025-05-16 | A vulnerability classified as critical was found in D-Link DI-7003GV2 24.04.18D1 R(68125). This vulnerability affects the function sub_4983B0 of the file /H5/b… |
CVE-2025-4747 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical. This issue affects some unknown processing of the file /systemstatus/ip_s… |
CVE-2025-4746 | High | 7.3 | 2025-05-16 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pag… |
CVE-2025-48175 | Medium | 4.5 | 2025-05-16 | In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes. |
CVE-2025-48174 | Medium | 4.5 | 2025-05-16 | In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size. |
CVE-2025-4745 | Low | 3.5 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in code-projects Employee Record System 1.0. This affects an unknown part of the file current_e… |
CVE-2025-4744 | Low | 3.5 | 2025-05-16 | A vulnerability, which was classified as problematic, has been found in code-projects Employee Record System 1.0. Affected by this issue is some unknown functi… |
CVE-2025-4743 | Medium | 6.3 | 2025-05-16 | A vulnerability classified as critical was found in code-projects Employee Record System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-4742 | Medium | 5.3 | 2025-05-16 | A vulnerability classified as problematic has been found in XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856. Affected is the function main of… |
CVE-2025-4741 | High | 7.3 | 2025-05-16 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /p… |
CVE-2025-4740 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in BeamCtrl Airiana up to 11.0. It has been declared as problematic. This vulnerability affects unknown code of the file coef. The ma… |
CVE-2025-4739 | High | 7.3 | 2025-05-16 | A vulnerability was found in projectworlds Hospital Database Management System 1.0. It has been classified as critical. This affects an unknown part of the fil… |
CVE-2025-4169 | Medium | 6.4 | 2025-05-16 | The Posts per Cat [Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all versions up to, and i… |
CVE-2025-4736 | High | 7.3 | 2025-05-16 | A vulnerability was found in PHPGurukul Daily Expense Tracker 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-4735 | Medium | 6.3 | 2025-05-16 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-4734 | High | 7.3 | 2025-05-16 | A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/ci… |
CVE-2025-4733 | High | 8.8 | 2025-05-16 | A vulnerability, which was classified as critical, has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This issue affects some unknown processi… |
CVE-2025-4732 | High | 8.8 | 2025-05-16 | A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boaf… |
CVE-2025-47809 | High | 8.2 | 2025-05-16 | Wibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation (before a logoff or reboot). For exploitation, there must have… |
CVE-2025-4731 | High | 8.8 | 2025-05-16 | A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/for… |
CVE-2025-4730 | High | 8.8 | 2025-05-16 | A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue is some unknown functional… |
CVE-2025-4729 | Medium | 6.3 | 2025-05-16 | A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown f… |
CVE-2025-47930 | Medium | 5.3 | 2025-05-16 | Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanis… |
CVE-2025-4728 | High | 7.3 | 2025-05-15 | A vulnerability was found in SourceCodester Best Online News Portal 1.0. It has been classified as critical. Affected is an unknown function of the file /searc… |
CVE-2025-4727 | Low | 3.7 | 2025-05-15 | A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/li… |
CVE-2025-4726 | High | 7.3 | 2025-05-15 | A vulnerability has been found in itsourcecode Placement Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-0921 | Medium | 6.5 | 2025-05-15 | Execution with Unnecessary Privileges vulnerability in multiple services of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONI… |
CVE-2025-4725 | High | 7.3 | 2025-05-15 | A vulnerability, which was classified as critical, was found in itsourcecode Placement Management System 1.0. This affects an unknown part of the file /view_dr… |
CVE-2025-4724 | High | 7.3 | 2025-05-15 | A vulnerability, which was classified as critical, has been found in itsourcecode Placement Management System 1.0. Affected by this issue is some unknown funct… |
CVE-2025-4723 | High | 7.3 | 2025-05-15 | A vulnerability classified as critical was found in itsourcecode Placement Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-4722 | High | 7.3 | 2025-05-15 | A vulnerability classified as critical has been found in itsourcecode Placement Management System 1.0. Affected is an unknown function of the file /edit_profil… |
CVE-2025-47287 | High | 7.5 | 2025-05-15 | Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warni… |
CVE-2025-47275 | Critical | 9.1 | 2025-05-15 | Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of ap… |
CVE-2025-4721 | High | 7.3 | 2025-05-15 | A vulnerability was found in itsourcecode Placement Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fil… |
CVE-2025-4720 | Medium | 5.4 | 2025-05-15 | A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2025-4719 | High | 7.3 | 2025-05-15 | A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-4718 | High | 7.3 | 2025-05-15 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-47929 | | 2025-05-15 | DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload func… | |
CVE-2025-1138 | Medium | 4.3 | 2025-05-15 | IBM InfoSphere Information Server 11.7 could disclose sensitive information to an authenticated user that could aid in further attacks against the system throu… |
CVE-2025-4717 | High | 7.3 | 2025-05-15 | A vulnerability, which was classified as critical, was found in PHPGurukul Company Visitor Management System 2.0. Affected is an unknown function of the file /… |
CVE-2025-4716 | High | 7.3 | 2025-05-15 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2025-4715 | High | 7.3 | 2025-05-15 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2025-47928 | Critical | 9.1 | 2025-05-15 | Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/i… |
CVE-2025-47789 | Medium | 6.1 | 2025-05-15 | Horilla is a free and open source Human Resource Management System (HRMS). In versions up to and including 1.3, an attacker can craft a Horilla URL that refers… |
CVE-2025-47788 | | 2025-05-15 | Atheos is a self-hosted browser-based cloud IDE. Prior to v602, similar to GHSA-rgjm-6p59-537v/CVE-2025-22152, the `$target` parameter in `/controller.php` was… | |
CVE-2025-47787 | Critical | 9.8 | 2025-05-15 | Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a cri… |
CVE-2025-47786 | Medium | 4.8 | 2025-05-15 | Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct ma… |
CVE-2025-47785 | High | 8.3 | 2025-05-15 | Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/articl… |
CVE-2025-47784 | Critical | 9.8 | 2025-05-15 | Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nicknam… |
CVE-2025-47161 | High | 7.8 | 2025-05-15 | Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
CVE-2025-46834 | | 2025-05-15 | Alchemy's Modular Account is a smart contract account that is compatible with ERC-4337 and ERC-6900. In versions on the 2.x branch prior to commit 5e6f540d249a… | |
CVE-2025-2248 | Medium | 5.4 | 2025-05-15 | The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL inject… |
CVE-2025-2247 | Medium | 5.4 | 2025-05-15 | The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admi… |
CVE-2025-2203 | Medium | 6.1 | 2025-05-15 | The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injec… |
CVE-2025-1454 | Medium | 5.4 | 2025-05-15 | The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2025-1303 | Medium | 6.1 | 2025-05-15 | The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2025-1289 | Medium | 4.8 | 2025-05-15 | The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2025-1288 | Medium | 6.1 | 2025-05-15 | The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacke… |
CVE-2025-1286 | Medium | 6.1 | 2025-05-15 | The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl… |
CVE-2025-1033 | Medium | 4.8 | 2025-05-15 | The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2025-0688 | Medium | 6.1 | 2025-05-15 | The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back i… |
CVE-2025-0687 | Medium | 6.1 | 2025-05-15 | The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back i… |
CVE-2025-0329 | Medium | 4.8 | 2025-05-15 | The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2025-4714 | High | 7.3 | 2025-05-15 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/r… |
CVE-2025-4713 | High | 7.3 | 2025-05-15 | A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages… |
CVE-2025-4712 | High | 7.3 | 2025-05-15 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pag… |
CVE-2025-32922 | High | 7.1 | 2025-05-15 | Cross-Site Request Forgery (CSRF) vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Stored XSS.This issue affects WP2LEADS: from n/a through <… |
CVE-2025-30476 | Medium | 5.3 | 2025-05-15 | Dell PowerScale InsightIQ, version 5.2, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote access could poten… |
CVE-2025-30475 | High | 8.1 | 2025-05-15 | Dell PowerScale InsightIQ, versions 5.0 through 5.2, contains an improper privilege management vulnerability. An unauthenticated attacker with remote access co… |
CVE-2025-26481 | High | 7.5 | 2025-05-15 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.9.0.0, contains an uncontrolled resource consumption vulnerability. A remote unprivileged attacker could pote… |