2025 CVEs (page 322)
Page 322 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-46742 | Medium | 4.3 | 2025-05-12 | Users who were required to change their password could still access system information before changing their password |
CVE-2025-46741 | Medium | 5.7 | 2025-05-12 | A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred. |
CVE-2025-46740 | High | 7.5 | 2025-05-12 | An authenticated user without user administrative permissions could change the administrator Account Name. |
CVE-2025-46739 | High | 8.1 | 2025-05-12 | An unauthenticated user could discover account credentials via a brute-force attack without rate limiting |
CVE-2025-45779 | Critical | 9.8 | 2025-05-12 | Tenda AC10 V1.0re_V15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST parameter. |
CVE-2025-3632 | High | 7.5 | 2025-05-12 | IBM 4769 Developers Toolkit 7.0.0 through 7.5.52 could allow a remote attacker to cause a denial of service in the Hardware Security Module (HSM) due to improp… |
CVE-2025-47578 | Medium | 6.5 | 2025-05-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edward Caissie BNS Twitter Follow Button bns-twitter-foll… |
CVE-2025-46738 | Medium | 6.6 | 2025-05-12 | An authenticated attacker can maliciously modify layout data files in the SEL-5033 installation directory to execute arbitrary code. |
CVE-2025-46737 | High | 7.4 | 2025-05-12 | SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application. This… |
CVE-2025-44830 | Critical | 9.8 | 2025-05-12 | EngineerCMS v1.02 through v.2.0.5 has a SQL injection vulnerability in the /project/addprojtemplet interface. |
CVE-2025-44022 | Critical | 9.8 | 2025-05-12 | An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. |
CVE-2025-47274 | | 2025-05-12 | ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Due to the ordering of code used to start an… | |
CVE-2025-46718 | Low | 3.3 | 2025-05-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges (e.g. execution of a single… |
CVE-2025-46717 | Low | 3.3 | 2025-05-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine w… |
CVE-2025-46611 | Medium | 6.1 | 2025-05-12 | Cross Site Scripting vulnerability in ARTEC EMA Mail v6.92 allows an attacker to execute arbitrary code via a crafted script. |
CVE-2025-46610 | High | 8.8 | 2025-05-12 | ARTEC EMA Mail 6.92 allows CSRF. |
CVE-2025-26846 | Critical | 9.8 | 2025-05-12 | An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadata. |
CVE-2025-26841 | Medium | 6.1 | 2025-05-12 | Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload. |
CVE-2025-45835 | High | 7.5 | 2025-05-12 | A null pointer dereference vulnerability was discovered in Netis WF2880 v2.1.40207. The vulnerability exists in the FUN_004904c8 function of the cgitest.cgi fi… |
CVE-2025-40627 | Medium | 6.1 | 2025-05-12 | Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sendi… |
CVE-2025-40626 | Medium | 6.1 | 2025-05-12 | Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sendi… |
CVE-2025-47271 | | 2025-05-12 | The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13… | |
CVE-2025-47270 | High | 7.5 | 2025-05-12 | nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. The `nimiq-network-libp2p` su… |
CVE-2025-46729 | | 2025-05-12 | julmud/phpDVDProfiler is an adoption of the defunct phpDVDProfiler project, which allows users to display on the web their DVD collections maintained with Inve… | |
CVE-2025-32390 | High | 8.5 | 2025-05-12 | EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Knowledge Base (KB) articles leads to compl… |
CVE-2025-22247 | Medium | 6.1 | 2025-05-12 | VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to… |
CVE-2025-1533 | | 2025-05-12 | A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (… | |
CVE-2025-41393 | Medium | 6.1 | 2025-05-12 | Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploit… |
CVE-2025-3496 | High | 7.5 | 2025-05-12 | An unauthenticated remote attacker can cause a buffer overflow which could lead to unexpected behaviour or DoS via Bluetooth or RS-232 interface. |
CVE-2025-4561 | High | 8.8 | 2025-05-12 | The KFOX from KingFor has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privilege to upload and execute web shell backdoors, t… |
CVE-2025-4560 | Medium | 6.5 | 2025-05-12 | The ISOinsight from Netvision has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access certain system functions. These f… |
CVE-2025-4559 | Critical | 9.8 | 2025-05-12 | The ISOinsight from Netvision has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, an… |
CVE-2025-3649 | Medium | 6.8 | 2025-05-12 | The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contr… |
CVE-2025-3597 | Medium | 5.9 | 2025-05-12 | The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery… |
CVE-2025-4558 | Critical | 9.8 | 2025-05-12 | The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the… |
CVE-2025-4557 | Critical | 9.1 | 2025-05-12 | The specific APIs of Parking Management System from ZONG YU has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access spe… |
CVE-2025-4556 | Critical | 9.8 | 2025-05-12 | The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote atta… |
CVE-2025-4555 | Critical | 9.8 | 2025-05-12 | The web management interface of Okcat Parking Management Platform from ZONG YU has a Missing Authentication vulnerability, allowing unauthenticated remote atta… |
CVE-2025-4554 | High | 7.3 | 2025-05-12 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been classified as critical. This affects an unknown part of the file… |
CVE-2025-4553 | High | 7.3 | 2025-05-12 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. Affected by this issue is some unknown functionali… |
CVE-2025-4552 | Medium | 5.4 | 2025-05-12 | A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2025-4551 | Low | 3.5 | 2025-05-11 | A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Affected is an unknown function of the file /dev-api/common/file… |
CVE-2025-4550 | High | 7.3 | 2025-05-11 | A vulnerability, which was classified as critical, has been found in PHPGurukul Apartment Visitors Management System 1.0. This issue affects some unknown proce… |
CVE-2025-4549 | High | 7.3 | 2025-05-11 | A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /routers/reg… |
CVE-2025-4548 | High | 7.3 | 2025-05-11 | A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. This affects an unknown part of the file /routers/router.ph… |
CVE-2025-4547 | Low | 2.4 | 2025-05-11 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been rated as problematic. Affected by this issue is some… |
CVE-2025-4546 | Medium | 4.7 | 2025-05-11 | A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-4545 | Medium | 5.4 | 2025-05-11 | A vulnerability was found in CTCMS Content Management System 2.1.2. It has been classified as critical. Affected is the function del of the file ctcms\apps\con… |
CVE-2025-4544 | Medium | 6.6 | 2025-05-11 | A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /ddos.asp of th… |
CVE-2025-4543 | High | 7.3 | 2025-05-11 | A vulnerability, which was classified as critical, was found in LyLme Spage 2.1. This affects an unknown part of the file lylme_spage/blob/master/admin/ajax_li… |
CVE-2025-4542 | Low | 3.1 | 2025-05-11 | A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2. Affected by this issue is some unknown functional… |
CVE-2025-4541 | Medium | 6.3 | 2025-05-11 | A vulnerability classified as critical has been found in LmxCMS 1.41. Affected is the function manageZt of the file c\admin\ZtAction.class.php of the component… |
CVE-2025-4540 | High | 7.0 | 2025-05-11 | A vulnerability was found in MTSoftware C-Lodop 6.6.1.1 on Windows. It has been rated as critical. This issue affects some unknown processing of the component… |
CVE-2025-4539 | High | 7.0 | 2025-05-11 | A vulnerability was found in Hainan ToDesk 4.7.6.3. It has been declared as critical. This vulnerability affects unknown code in the library profapi.dll of the… |
CVE-2025-4538 | Medium | 6.3 | 2025-05-11 | A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of th… |
CVE-2025-4537 | Low | 3.1 | 2025-05-11 | A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-4536 | Medium | 5.3 | 2025-05-11 | A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnera… |
CVE-2025-4535 | Medium | 5.3 | 2025-05-11 | A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unk… |
CVE-2025-4534 | Low | 3.7 | 2025-05-11 | A vulnerability, which was classified as problematic, has been found in SunGrow Logger1000 01_A. This issue affects some unknown processing. The manipulation l… |
CVE-2025-4533 | Low | 2.7 | 2025-05-11 | A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/k… |
CVE-2025-4532 | High | 7.0 | 2025-05-11 | A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in th… |
CVE-2025-4531 | Medium | 6.3 | 2025-05-11 | A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been rated as critical. Affected by this issue is the function postData o… |
CVE-2025-4530 | Medium | 4.3 | 2025-05-11 | A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. It has been declared as problematic. Affected by this vulnerability is the func… |
CVE-2025-4529 | Medium | 4.3 | 2025-05-11 | A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been classified as problematic. Affected is the function Download of the… |
CVE-2025-4528 | Medium | 4.3 | 2025-05-11 | A weakness has been identified in Dígitro NGC Explorer up to 3.48.21. This affects an unknown function. Executing a manipulation can lead to session expiration… |
CVE-2025-4527 | Low | 3.7 | 2025-05-11 | A security flaw has been discovered in Dígitro NGC Explorer up to 3.48.21. The impacted element is an unknown function of the component Password Transmission H… |
CVE-2025-47828 | Medium | 6.4 | 2025-05-11 | Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings. |
CVE-2025-4526 | Medium | 4.3 | 2025-05-11 | A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21. The affected element is an unknown function of the component Configuration Page. Such man… |
CVE-2025-4525 | High | 7.0 | 2025-05-10 | A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the l… |
CVE-2025-47817 | High | 8.8 | 2025-05-10 | In BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter. |
CVE-2025-47816 | Low | 2.9 | 2025-05-10 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml_parse_attributes out-of-bounds read, related to extra content at… |
CVE-2025-47815 | Medium | 4.5 | 2025-05-10 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from zip_member_read_all) in… |
CVE-2025-47814 | Medium | 4.5 | 2025-05-10 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from spv_read_xml_member) in… |
CVE-2025-4515 | Medium | 4.3 | 2025-05-10 | A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The ma… |
CVE-2025-4514 | Medium | 6.3 | 2025-05-10 | A vulnerability, which was classified as critical, has been found in Zhengzhou Jiuhua Electronic Technology mayicms up to 5.8E. Affected by this issue is some… |
CVE-2025-4513 | Medium | 4.3 | 2025-05-10 | A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle. Affected by this vulnerability is an unknown… |
CVE-2025-4512 | Medium | 4.3 | 2025-05-10 | A vulnerability classified as problematic has been found in Inetum IODAS 7.2-LTS.4.1-JDK7/7.2-RC3.2-JDK7. Affected is an unknown function of the file /astre/io… |
CVE-2025-4511 | Medium | 6.3 | 2025-05-10 | A vulnerability was found in vector4wang spring-boot-quick up to 20250422. It has been rated as critical. This issue affects the function ResponseEntity of the… |
CVE-2025-4510 | Medium | 6.3 | 2025-05-10 | A vulnerability was found in Changjietong UFIDA CRM 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /optnty/optntyda… |
CVE-2025-4509 | High | 7.3 | 2025-05-10 | A vulnerability, which was classified as critical, has been found in PHPGurukul e-Diary Management System 1.0. This issue affects some unknown processing of th… |
CVE-2025-4508 | High | 7.3 | 2025-05-10 | A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. This vulnerability affects unknown code of the file /my-profile.p… |
CVE-2025-4507 | High | 7.3 | 2025-05-10 | A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. This affects an unknown part of the file /routers/add-item… |
CVE-2025-4506 | High | 7.3 | 2025-05-10 | A vulnerability was found in Campcodes Online Food Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-4505 | High | 7.3 | 2025-05-10 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknow… |
CVE-2025-4504 | High | 7.3 | 2025-05-10 | A vulnerability was found in SourceCodester Online College Library System 1.0. It has been classified as critical. Affected is an unknown function of the file… |
CVE-2025-4503 | High | 7.3 | 2025-05-10 | A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages… |
CVE-2025-4502 | High | 7.3 | 2025-05-10 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pag… |
CVE-2025-1752 | High | 7.5 | 2025-05-10 | A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ lates… |
CVE-2025-4501 | Medium | 5.3 | 2025-05-10 | A vulnerability, which was classified as critical, was found in code-projects Album Management System 1.0. This affects the function searchalbum of the compone… |
CVE-2025-4500 | Medium | 5.3 | 2025-05-10 | A vulnerability, which was classified as critical, has been found in code-projects Hotel Management System 1.0. Affected by this issue is the function Edit of… |
CVE-2025-4499 | Medium | 5.3 | 2025-05-10 | A vulnerability classified as critical was found in code-projects Simple Hospital Management System 1.0. Affected by this vulnerability is the function Add of… |
CVE-2025-3878 | Medium | 6.4 | 2025-05-10 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_verify shortcode in all v… |
CVE-2025-3876 | High | 8.8 | 2025-05-10 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handl… |
CVE-2025-4498 | Medium | 5.3 | 2025-05-10 | A vulnerability classified as critical has been found in code-projects Simple Bus Reservation System 1.0. Affected is the function a::install of the component… |
CVE-2025-2158 | High | 8.8 | 2025-05-10 | The WordPress Review Plugin: The Ultimate Solution for Building a Review Website plugin for WordPress is vulnerable to Local File Inclusion in all versions up… |
CVE-2025-4497 | Medium | 5.3 | 2025-05-10 | A vulnerability was found in code-projects Simple Banking System up to 1.0. It has been rated as critical. This issue affects some unknown processing of the co… |
CVE-2025-2944 | Medium | 6.4 | 2025-05-10 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets in all versions up… |
CVE-2025-4496 | High | 8.8 | 2025-05-10 | A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulne… |
CVE-2025-1137 | High | 7.5 | 2025-05-10 | IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neu… |
CVE-2025-4495 | Low | 3.5 | 2025-05-10 | A vulnerability has been found in JAdmin-JAVA JAdmin 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file… |