2025 CVEs (page 321)
Page 321 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4531 | Medium | 6.3 | 2025-05-11 | A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been rated as critical. Affected by this issue is the function postData o… |
CVE-2025-4530 | Medium | 4.3 | 2025-05-11 | A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. It has been declared as problematic. Affected by this vulnerability is the func… |
CVE-2025-4529 | Medium | 4.3 | 2025-05-11 | A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been classified as problematic. Affected is the function Download of the… |
CVE-2025-4528 | Medium | 4.3 | 2025-05-11 | A weakness has been identified in Dígitro NGC Explorer up to 3.48.21. This affects an unknown function. Executing a manipulation can lead to session expiration… |
CVE-2025-4527 | Low | 3.7 | 2025-05-11 | A security flaw has been discovered in Dígitro NGC Explorer up to 3.48.21. The impacted element is an unknown function of the component Password Transmission H… |
CVE-2025-47828 | Medium | 6.4 | 2025-05-11 | Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings. |
CVE-2025-4526 | Medium | 4.3 | 2025-05-11 | A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21. The affected element is an unknown function of the component Configuration Page. Such man… |
CVE-2025-4525 | High | 7.0 | 2025-05-10 | A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the l… |
CVE-2025-47817 | High | 8.8 | 2025-05-10 | In BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter. |
CVE-2025-47816 | Low | 2.9 | 2025-05-10 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml_parse_attributes out-of-bounds read, related to extra content at… |
CVE-2025-47815 | Medium | 4.5 | 2025-05-10 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from zip_member_read_all) in… |
CVE-2025-47814 | Medium | 4.5 | 2025-05-10 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from spv_read_xml_member) in… |
CVE-2025-4515 | Medium | 4.3 | 2025-05-10 | A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The ma… |
CVE-2025-4514 | Medium | 6.3 | 2025-05-10 | A vulnerability, which was classified as critical, has been found in Zhengzhou Jiuhua Electronic Technology mayicms up to 5.8E. Affected by this issue is some… |
CVE-2025-4513 | Medium | 4.3 | 2025-05-10 | A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle. Affected by this vulnerability is an unknown… |
CVE-2025-4512 | Medium | 4.3 | 2025-05-10 | A vulnerability classified as problematic has been found in Inetum IODAS 7.2-LTS.4.1-JDK7/7.2-RC3.2-JDK7. Affected is an unknown function of the file /astre/io… |
CVE-2025-4511 | Medium | 6.3 | 2025-05-10 | A vulnerability was found in vector4wang spring-boot-quick up to 20250422. It has been rated as critical. This issue affects the function ResponseEntity of the… |
CVE-2025-4510 | Medium | 6.3 | 2025-05-10 | A vulnerability was found in Changjietong UFIDA CRM 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /optnty/optntyda… |
CVE-2025-4509 | High | 7.3 | 2025-05-10 | A vulnerability, which was classified as critical, has been found in PHPGurukul e-Diary Management System 1.0. This issue affects some unknown processing of th… |
CVE-2025-4508 | High | 7.3 | 2025-05-10 | A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. This vulnerability affects unknown code of the file /my-profile.p… |
CVE-2025-4507 | High | 7.3 | 2025-05-10 | A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. This affects an unknown part of the file /routers/add-item… |
CVE-2025-4506 | High | 7.3 | 2025-05-10 | A vulnerability was found in Campcodes Online Food Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-4505 | High | 7.3 | 2025-05-10 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknow… |
CVE-2025-4504 | High | 7.3 | 2025-05-10 | A vulnerability was found in SourceCodester Online College Library System 1.0. It has been classified as critical. Affected is an unknown function of the file… |
CVE-2025-4503 | High | 7.3 | 2025-05-10 | A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages… |
CVE-2025-4502 | High | 7.3 | 2025-05-10 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pag… |
CVE-2025-1752 | High | 7.5 | 2025-05-10 | A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ lates… |
CVE-2025-4501 | Medium | 5.3 | 2025-05-10 | A vulnerability, which was classified as critical, was found in code-projects Album Management System 1.0. This affects the function searchalbum of the compone… |
CVE-2025-4500 | Medium | 5.3 | 2025-05-10 | A vulnerability, which was classified as critical, has been found in code-projects Hotel Management System 1.0. Affected by this issue is the function Edit of… |
CVE-2025-4499 | Medium | 5.3 | 2025-05-10 | A vulnerability classified as critical was found in code-projects Simple Hospital Management System 1.0. Affected by this vulnerability is the function Add of… |
CVE-2025-3878 | Medium | 6.4 | 2025-05-10 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_verify shortcode in all v… |
CVE-2025-3876 | High | 8.8 | 2025-05-10 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handl… |
CVE-2025-4498 | Medium | 5.3 | 2025-05-10 | A vulnerability classified as critical has been found in code-projects Simple Bus Reservation System 1.0. Affected is the function a::install of the component… |
CVE-2025-2158 | High | 8.8 | 2025-05-10 | The WordPress Review Plugin: The Ultimate Solution for Building a Review Website plugin for WordPress is vulnerable to Local File Inclusion in all versions up… |
CVE-2025-4497 | Medium | 5.3 | 2025-05-10 | A vulnerability was found in code-projects Simple Banking System up to 1.0. It has been rated as critical. This issue affects some unknown processing of the co… |
CVE-2025-2944 | Medium | 6.4 | 2025-05-10 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets in all versions up… |
CVE-2025-4496 | High | 8.8 | 2025-05-10 | A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulne… |
CVE-2025-1137 | High | 7.5 | 2025-05-10 | IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neu… |
CVE-2025-4495 | Low | 3.5 | 2025-05-10 | A vulnerability has been found in JAdmin-JAVA JAdmin 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-47424 | High | 7.1 | 2025-05-09 | Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host header can be manipulated. |
CVE-2025-3794 | Medium | 5.4 | 2025-05-09 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-4494 | High | 7.3 | 2025-05-09 | A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0. Affected is the function toLogin of the file NoNeedLoginController.java… |
CVE-2025-4492 | High | 7.3 | 2025-05-09 | A vulnerability, which was classified as critical, has been found in Campcodes Online Food Ordering System 1.0. This issue affects some unknown processing of t… |
CVE-2025-4491 | High | 7.3 | 2025-05-09 | A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /routers/tic… |
CVE-2025-4490 | High | 7.3 | 2025-05-09 | A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. This affects an unknown part of the file /view-ticket-admin… |
CVE-2025-4489 | High | 7.3 | 2025-05-09 | A vulnerability was found in Campcodes Online Food Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-4447 | High | 7.8 | 2025-05-09 | In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can be caused by modifying a file on disk that is read wh… |
CVE-2025-47269 | High | 8.3 | 2025-05-09 | code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result… |
CVE-2025-4488 | High | 7.3 | 2025-05-09 | A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-4487 | High | 7.3 | 2025-05-09 | A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php?… |
CVE-2025-4486 | High | 7.3 | 2025-05-09 | A vulnerability was found in itsourcecode Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.ph… |
CVE-2025-4485 | High | 7.3 | 2025-05-09 | A vulnerability has been found in itsourcecode Gym Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax… |
CVE-2025-4484 | High | 7.3 | 2025-05-09 | A vulnerability, which was classified as critical, was found in itsourcecode Gym Management System 1.0. This affects an unknown part of the file /ajax.php?acti… |
CVE-2025-4483 | High | 7.3 | 2025-05-09 | A vulnerability, which was classified as critical, has been found in itsourcecode Gym Management System 1.0. Affected by this issue is some unknown functionali… |
CVE-2025-4482 | High | 7.3 | 2025-05-09 | A vulnerability classified as critical was found in Project Worlds Student Project Allocation System 1.0. Affected by this vulnerability is an unknown function… |
CVE-2025-1993 | Medium | 5.1 | 2025-05-09 | IBM App Connect Enterprise Certified Container 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12… |
CVE-2025-4481 | High | 7.3 | 2025-05-09 | A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been rated as critical. This issue affects some unknown processing… |
CVE-2025-4480 | Medium | 5.3 | 2025-05-09 | A vulnerability was found in code-projects Simple College Management System 1.0. It has been declared as critical. This vulnerability affects the function inpu… |
CVE-2025-46192 | Critical | 9.8 | 2025-05-09 | SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_payment_update.php via the order_id POST parameter. |
CVE-2025-46191 | Critical | 9.8 | 2025-05-09 | Arbitrary File Upload in user_payment_update.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files… |
CVE-2025-46190 | Critical | 9.8 | 2025-05-09 | SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_delivery_update.php via the order_id POST parameter. |
CVE-2025-29509 | High | 8.8 | 2025-05-09 | Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to opening external websit… |
CVE-2025-1278 | Medium | 5.3 | 2025-05-09 | An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain cond… |
CVE-2025-0549 | Medium | 6.8 | 2025-05-09 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.3 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17… |
CVE-2025-4432 | Medium | 5.3 | 2025-05-09 | A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to indu… |
CVE-2025-46193 | Critical | 9.8 | 2025-05-09 | SourceCodester Client Database Management System 1.0 is vulnerable to Remote code execution via Arbitrary file upload in user_proposal_update_order.php. |
CVE-2025-46189 | Critical | 9.8 | 2025-05-09 | SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_order_customer_update.php via the order_id POST parameter. |
CVE-2025-46188 | Critical | 9.8 | 2025-05-09 | SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in superadmin_phpmyadmin.php. |
CVE-2025-45513 | Critical | 9.8 | 2025-05-09 | Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.P2pListFilter. |
CVE-2025-28203 | High | 8.8 | 2025-05-09 | Victure RX1800 EN_V1.0.0_r12_110933 was discovered to contain a command injection vulnerability. |
CVE-2025-28202 | High | 8.8 | 2025-05-09 | Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services without authentication. |
CVE-2025-28201 | Medium | 6.8 | 2025-05-09 | An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access. |
CVE-2025-28200 | Critical | 9.8 | 2025-05-09 | Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address. |
CVE-2025-45887 | Critical | 9.1 | 2025-05-09 | Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent. |
CVE-2025-45885 | Critical | 9.8 | 2025-05-09 | PHPGURUKUL Vehicle Parking Management System v1.13 is vulnerable to SQL injection in the /vpms/users/login.php file. Attackers can inject malicious code from t… |
CVE-2025-4382 | Medium | 5.9 | 2025-05-09 | A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks… |
CVE-2025-4206 | High | 7.2 | 2025-05-09 | The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to… |
CVE-2025-3897 | Medium | 5.9 | 2025-05-09 | The EUCookieLaw plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.7.2 via the 'file_get_contents' function. Thi… |
CVE-2025-3528 | High | 8.2 | 2025-05-09 | A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the `/etc/passwd`. Thi… |
CVE-2025-1087 | | 2025-05-09 | Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability… | |
CVE-2025-46392 | Medium | 6.5 | 2025-05-09 | Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that all… |
CVE-2025-4403 | Critical | 9.8 | 2025-05-09 | The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6… |
CVE-2025-3949 | Medium | 4.3 | 2025-05-09 | The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized ac… |
CVE-2025-4472 | Medium | 5.3 | 2025-05-09 | A vulnerability was found in code-projects Departmental Store Management System 1.0. It has been classified as critical. Affected is the function bill. The man… |
CVE-2025-4471 | Medium | 5.3 | 2025-05-09 | A vulnerability, which was classified as critical, has been found in code-projects Jewelery Store Management system 1.0. Affected by this issue is some unknown… |
CVE-2025-4470 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic was found in SourceCodester Online Student Clearance System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2025-4469 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic has been found in SourceCodester Online Student Clearance System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-4468 | High | 7.3 | 2025-05-09 | A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-4467 | High | 7.3 | 2025-05-09 | A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2025-3605 | Critical | 9.8 | 2025-05-09 | The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including… |
CVE-2025-3455 | High | 8.8 | 2025-05-09 | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2025-37889 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Consistently treat platform_max as control value This reverts commit 9bdd10d57… |
CVE-2025-37888 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() Add NULL check for mlx5_… |
CVE-2025-37887 | High | 7.1 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result If the FW doesn't support the… |
CVE-2025-37886 | High | 7.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: pds_core: make wait_context part of q_info Make the wait_context a full part of the q_inf… |
CVE-2025-37885 | High | 8.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if *new* route isn't postable Restore an IRTE back t… |
CVE-2025-37884 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock between rcu_tasks_trace and event_mutex. Fix the following deadlock: CP… |
CVE-2025-37883 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Add check for get_zeroed_page() Add check for the return value of get_zeroed_p… |
CVE-2025-37882 | High | 7.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these… |
CVE-2025-37881 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() The variable d->name… |