2025 CVEs (page 317)
Page 317 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4711 | High | 7.3 | 2025-05-15 | A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. This affects an unknown part of the file /pages/stock… |
CVE-2025-4710 | High | 7.3 | 2025-05-15 | A vulnerability, which was classified as critical, has been found in Campcodes Sales and Inventory System 1.0. Affected by this issue is some unknown functiona… |
CVE-2025-4709 | High | 7.3 | 2025-05-15 | A vulnerability classified as critical was found in Campcodes Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-47774 | | 2025-05-15 | Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side eff… | |
CVE-2025-47285 | | 2025-05-15 | Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side e… | |
CVE-2025-47279 | Low | 3.1 | 2025-05-15 | Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vuln… |
CVE-2025-44110 | Medium | 5.4 | 2025-05-15 | FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php. |
CVE-2025-43853 | Medium | 5.5 | 2025-05-15 | The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and com… |
CVE-2025-4708 | High | 7.3 | 2025-05-15 | A vulnerability classified as critical has been found in Campcodes Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/sales_add… |
CVE-2025-4707 | High | 7.3 | 2025-05-15 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /p… |
CVE-2025-4706 | High | 7.3 | 2025-05-15 | A vulnerability was found in projectworlds Online Examination System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2025-47580 | Medium | 5.4 | 2025-05-15 | Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-30421 | High | 7.8 | 2025-05-15 | There is a memory corruption vulnerability due to a stack-based buffer overflow in DrObjectStorage::XML_Serialize() when using the SymbolEditor in NI Circuit D… |
CVE-2025-30420 | High | 7.8 | 2025-05-15 | There is a memory corruption vulnerability due to an out of bounds read in Bitmap::InternalDraw() when using the SymbolEditor in NI Circuit Design Suite. This… |
CVE-2025-30419 | High | 7.8 | 2025-05-15 | There is a memory corruption vulnerability due to an out of bounds read in GetSymbolBorderRectSize() when using the SymbolEditor in NI Circuit Design Suite. T… |
CVE-2025-30418 | High | 7.8 | 2025-05-15 | There is a memory corruption vulnerability due to an out of bounds write in CheckPins() when using the SymbolEditor in NI Circuit Design Suite. This vulnerabi… |
CVE-2025-30417 | High | 7.8 | 2025-05-15 | There is a memory corruption vulnerability due to an out of bounds write in Library!DecodeBase64() when using the SymbolEditor in NI Circuit Design Suite. Thi… |
CVE-2025-1647 | Medium | 5.6 | 2025-05-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This i… |
CVE-2025-4705 | High | 7.3 | 2025-05-15 | A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been classified as critical. This affects an unknown part of the file /a… |
CVE-2025-4704 | High | 7.3 | 2025-05-15 | A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2025-4703 | High | 7.3 | 2025-05-15 | A vulnerability has been found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2025-48051 | Medium | 4.7 | 2025-05-15 | powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM no… |
CVE-2025-48050 | High | 7.5 | 2025-05-15 | In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier… |
CVE-2025-3440 | Medium | 5.5 | 2025-05-15 | IBM Security Guardium 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the… |
CVE-2025-2570 | Low | 2.7 | 2025-05-15 | Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which… |
CVE-2025-2527 | Medium | 4.3 | 2025-05-15 | Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view… |
CVE-2025-4702 | High | 7.3 | 2025-05-15 | A vulnerability, which was classified as critical, was found in PHPGurukul Vehicle Parking Management System 1.13. Affected is an unknown function of the file… |
CVE-2025-4701 | Medium | 5.3 | 2025-05-15 | A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421. This issue affects the function torch.load of the… |
CVE-2025-46053 | Medium | 5.1 | 2025-05-15 | A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload in… |
CVE-2025-44185 | Medium | 5.4 | 2025-05-15 | SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/change_pass.php via the password parameter. |
CVE-2025-4699 | High | 7.3 | 2025-05-15 | A vulnerability classified as critical was found in PHPGurukul Apartment Visitors Management System 1.0. This vulnerability affects unknown code of the file /a… |
CVE-2025-4698 | High | 7.3 | 2025-05-15 | A vulnerability classified as critical has been found in PHPGurukul Directory Management System 2.0. This affects an unknown part of the file /admin/forget-pas… |
CVE-2025-4516 | | 2025-05-15 | There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an erro… | |
CVE-2025-46052 | Critical | 9.8 | 2025-05-15 | An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a… |
CVE-2025-44183 | Medium | 6.1 | 2025-05-15 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the name, email, and mobile parameters. |
CVE-2025-44182 | Medium | 6.1 | 2025-05-15 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the vehiclename, modelnumber, regnumber, vehiclesubtype, chasi… |
CVE-2025-44181 | Medium | 6.1 | 2025-05-15 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/add-brand.php via the brandname parameter. |
CVE-2025-44180 | Medium | 6.1 | 2025-05-15 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit-brand.php?bid={brandId}. |
CVE-2025-4697 | High | 7.3 | 2025-05-15 | A vulnerability was found in PHPGurukul Directory Management System 2.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-4696 | Medium | 6.3 | 2025-05-15 | A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unkn… |
CVE-2025-4695 | Medium | 6.3 | 2025-05-15 | A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. It has been classified as critical. Affected is an unknown function of the… |
CVE-2025-4762 | | 2025-05-15 | Insecure Direct Object Reference (IDOR) vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthentic… | |
CVE-2025-4564 | Critical | 9.8 | 2025-05-15 | The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation via the 'delpdf'… |
CVE-2025-3446 | Medium | 4.3 | 2025-05-15 | Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated us… |
CVE-2025-31947 | Medium | 5.8 | 2025-05-15 | Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which… |
CVE-2025-32738 | Medium | 5.3 | 2025-05-15 | Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a… |
CVE-2025-32002 | Critical | 9.8 | 2025-05-15 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard disk 'HDL-T Series' f… |
CVE-2025-4737 | Medium | 6.2 | 2025-05-15 | Insufficient encryption vulnerability in the mobile application (com.transsion.aivoiceassistant) may lead to the risk of sensitive information leakage. |
CVE-2025-27525 | Low | 3.9 | 2025-05-15 | Information Exposure vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Sm… |
CVE-2025-27524 | Medium | 5.3 | 2025-05-15 | Weak encryption vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart D… |
CVE-2025-27523 | High | 8.7 | 2025-05-15 | XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manage… |
CVE-2025-48027 | Medium | 5.4 | 2025-05-15 | The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginserver. |
CVE-2025-3742 | Medium | 6.8 | 2025-05-15 | The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post… |
CVE-2025-48024 | Medium | 5.0 | 2025-05-15 | In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint. |
CVE-2025-3053 | High | 8.8 | 2025-05-15 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and… |
CVE-2025-4591 | Medium | 6.4 | 2025-05-15 | The Weluka Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'weluka-map' shortcode in all versions up to, and including… |
CVE-2025-4589 | Medium | 6.4 | 2025-05-15 | The Bon Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt-map' shortcode in all versions up to, and including, 1.3… |
CVE-2025-4126 | Medium | 6.4 | 2025-05-15 | The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in all versions up to, and including, 2.1.1… |
CVE-2025-3917 | Critical | 9.8 | 2025-05-15 | The 百度站长SEO合集(支持百度/神马/Bing/头条推送) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download_remote_image_… |
CVE-2025-4579 | High | 7.2 | 2025-05-15 | The WP Content Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blocked-uri and effective-directive parameters in all… |
CVE-2025-47783 | Medium | 6.1 | 2025-05-14 | Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script int… |
CVE-2025-46836 | Medium | 6.6 | 2025-05-14 | net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and includ… |
CVE-2025-32421 | Low | 3.7 | 2025-05-14 | Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue onl… |
CVE-2025-29691 | Medium | 6.1 | 2025-05-14 | A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2025-29690 | Medium | 6.1 | 2025-05-14 | A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2025-29689 | Medium | 6.1 | 2025-05-14 | A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2025-29688 | Medium | 6.1 | 2025-05-14 | A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2025-29686 | Medium | 6.1 | 2025-05-14 | A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2025-47889 | Critical | 9.8 | 2025-05-14 | In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticate… |
CVE-2025-47888 | Medium | 5.9 | 2025-05-14 | Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webho… |
CVE-2025-47887 | Medium | 4.3 | 2025-05-14 | Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to… |
CVE-2025-47886 | Medium | 4.3 | 2025-05-14 | A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers to connect to an a… |
CVE-2025-47885 | High | 8.8 | 2025-05-14 | Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stor… |
CVE-2025-47884 | Critical | 9.1 | 2025-05-14 | In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment vari… |
CVE-2025-44879 | High | 7.5 | 2025-05-14 | WS-WN572HP3 V230525 was discovered to contain a buffer overflow in the component /www/cgi-bin/upload.cgi. This vulnerability allows attackers to cause a Denial… |
CVE-2025-44024 | Medium | 6.1 | 2025-05-14 | Cross-Site Scripting (XSS) vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of u… |
CVE-2025-27891 | Critical | 9.1 | 2025-05-14 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, W920… |
CVE-2025-26783 | High | 7.5 | 2025-05-14 | An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, W1000, Modem 5300, a… |
CVE-2025-32363 | Critical | 9.8 | 2025-05-14 | mediDOK before 2.5.18.43 allows remote attackers to achieve remote code execution on a target system via deserialization of untrusted data. |
CVE-2025-25370 | Medium | 4.6 | 2025-05-14 | An issue in realme GT 2 (RMX3311) running Android 14 with realme UI 5.0 allows a physically proximate attacker to obtain sensitive information via the show app… |
CVE-2025-4641 | | 2025-05-14 | Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux (XML parsing compo… | |
CVE-2025-4640 | | 2025-05-14 | Out-of-bounds Write vulnerability in PointCloudLibrary pcl allows Overflow Buffers. Since version 1.14.0, PCL by default uses a zlib installation from the syst… | |
CVE-2025-33104 | Medium | 4.4 | 2025-05-14 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W… |
CVE-2025-2900 | High | 7.5 | 2025-05-14 | IBM Semeru Runtime 8.0.302.0 through 8.0.442.0, 11.0.12.0 through 11.0.26.0, 17.0.0.0 through 17.0.14.0, and 21.0.0.0 through 12.0.6.0 is vulnerable to a denia… |
CVE-2025-0138 | | 2025-05-14 | Web sessions in the web interface of Palo Alto Networks Prisma® Cloud Compute Edition do not expire when users are deleted, which makes Prisma Cloud Compute Ed… | |
CVE-2025-0137 | | 2025-05-14 | An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated rea… | |
CVE-2025-0136 | | 2025-05-14 | Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Se… | |
CVE-2025-0135 | Low | 3.3 | 2025-05-14 | An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrativ… |
CVE-2025-0134 | | 2025-05-14 | A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on t… | |
CVE-2025-0133 | | 2025-05-14 | A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution… | |
CVE-2025-0132 | | 2025-05-14 | A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the B… | |
CVE-2025-0131 | | 2025-05-14 | An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows d… | |
CVE-2025-4664 | Medium | 4.3 | 2025-05-14 | Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2025-4639 | | 2025-05-14 | CWE-611 Improper Restriction of XML External Entity Reference in the getDocumentBuilder() method of WebDav servlet in Peergos. This issue affects Peergos throu… | |
CVE-2025-4638 | Critical | 9.8 | 2025-05-14 | A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL). This issue may allow context-depen… |
CVE-2025-4637 | | 2025-05-14 | Divide By Zero vulnerability in davisking dlib allows remote attackers to cause a denial of service via a crafted file. .This issue affects dlib: before <19… | |
CVE-2025-46786 | Medium | 4.3 | 2025-05-14 | Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to impact app integrity via network access. |
CVE-2025-46785 | Medium | 6.5 | 2025-05-14 | Buffer over-read in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-30668 | Medium | 6.5 | 2025-05-14 | Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-30667 | Medium | 6.5 | 2025-05-14 | NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. |