2025 CVEs (page 323)
Page 323 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47424 | High | 7.1 | 2025-05-09 | Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host header can be manipulated. |
CVE-2025-3794 | Medium | 5.4 | 2025-05-09 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-4494 | High | 7.3 | 2025-05-09 | A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0. Affected is the function toLogin of the file NoNeedLoginController.java… |
CVE-2025-4492 | High | 7.3 | 2025-05-09 | A vulnerability, which was classified as critical, has been found in Campcodes Online Food Ordering System 1.0. This issue affects some unknown processing of t… |
CVE-2025-4491 | High | 7.3 | 2025-05-09 | A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /routers/tic… |
CVE-2025-4490 | High | 7.3 | 2025-05-09 | A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. This affects an unknown part of the file /view-ticket-admin… |
CVE-2025-4489 | High | 7.3 | 2025-05-09 | A vulnerability was found in Campcodes Online Food Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-4447 | High | 7.8 | 2025-05-09 | In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can be caused by modifying a file on disk that is read wh… |
CVE-2025-47269 | High | 8.3 | 2025-05-09 | code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result… |
CVE-2025-4488 | High | 7.3 | 2025-05-09 | A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-4487 | High | 7.3 | 2025-05-09 | A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php?… |
CVE-2025-4486 | High | 7.3 | 2025-05-09 | A vulnerability was found in itsourcecode Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.ph… |
CVE-2025-4485 | High | 7.3 | 2025-05-09 | A vulnerability has been found in itsourcecode Gym Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax… |
CVE-2025-4484 | High | 7.3 | 2025-05-09 | A vulnerability, which was classified as critical, was found in itsourcecode Gym Management System 1.0. This affects an unknown part of the file /ajax.php?acti… |
CVE-2025-4483 | High | 7.3 | 2025-05-09 | A vulnerability, which was classified as critical, has been found in itsourcecode Gym Management System 1.0. Affected by this issue is some unknown functionali… |
CVE-2025-4482 | High | 7.3 | 2025-05-09 | A vulnerability classified as critical was found in Project Worlds Student Project Allocation System 1.0. Affected by this vulnerability is an unknown function… |
CVE-2025-1993 | Medium | 5.1 | 2025-05-09 | IBM App Connect Enterprise Certified Container 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12… |
CVE-2025-4481 | High | 7.3 | 2025-05-09 | A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been rated as critical. This issue affects some unknown processing… |
CVE-2025-4480 | Medium | 5.3 | 2025-05-09 | A vulnerability was found in code-projects Simple College Management System 1.0. It has been declared as critical. This vulnerability affects the function inpu… |
CVE-2025-46192 | Critical | 9.8 | 2025-05-09 | SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_payment_update.php via the order_id POST parameter. |
CVE-2025-46191 | Critical | 9.8 | 2025-05-09 | Arbitrary File Upload in user_payment_update.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files… |
CVE-2025-46190 | Critical | 9.8 | 2025-05-09 | SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_delivery_update.php via the order_id POST parameter. |
CVE-2025-29509 | High | 8.8 | 2025-05-09 | Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to opening external websit… |
CVE-2025-1278 | Medium | 5.3 | 2025-05-09 | An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain cond… |
CVE-2025-0549 | Medium | 6.8 | 2025-05-09 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.3 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17… |
CVE-2025-4432 | Medium | 5.3 | 2025-05-09 | A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to indu… |
CVE-2025-46193 | Critical | 9.8 | 2025-05-09 | SourceCodester Client Database Management System 1.0 is vulnerable to Remote code execution via Arbitrary file upload in user_proposal_update_order.php. |
CVE-2025-46189 | Critical | 9.8 | 2025-05-09 | SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_order_customer_update.php via the order_id POST parameter. |
CVE-2025-46188 | Critical | 9.8 | 2025-05-09 | SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in superadmin_phpmyadmin.php. |
CVE-2025-45513 | Critical | 9.8 | 2025-05-09 | Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.P2pListFilter. |
CVE-2025-28203 | High | 8.8 | 2025-05-09 | Victure RX1800 EN_V1.0.0_r12_110933 was discovered to contain a command injection vulnerability. |
CVE-2025-28202 | High | 8.8 | 2025-05-09 | Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services without authentication. |
CVE-2025-28201 | Medium | 6.8 | 2025-05-09 | An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access. |
CVE-2025-28200 | Critical | 9.8 | 2025-05-09 | Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address. |
CVE-2025-45887 | Critical | 9.1 | 2025-05-09 | Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent. |
CVE-2025-45885 | Critical | 9.8 | 2025-05-09 | PHPGURUKUL Vehicle Parking Management System v1.13 is vulnerable to SQL injection in the /vpms/users/login.php file. Attackers can inject malicious code from t… |
CVE-2025-4382 | Medium | 5.9 | 2025-05-09 | A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks… |
CVE-2025-4206 | High | 7.2 | 2025-05-09 | The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to… |
CVE-2025-3897 | Medium | 5.9 | 2025-05-09 | The EUCookieLaw plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.7.2 via the 'file_get_contents' function. Thi… |
CVE-2025-3528 | High | 8.2 | 2025-05-09 | A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the `/etc/passwd`. Thi… |
CVE-2025-1087 | | 2025-05-09 | Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability… | |
CVE-2025-46392 | Medium | 6.5 | 2025-05-09 | Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that all… |
CVE-2025-4403 | Critical | 9.8 | 2025-05-09 | The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6… |
CVE-2025-3949 | Medium | 4.3 | 2025-05-09 | The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized ac… |
CVE-2025-4472 | Medium | 5.3 | 2025-05-09 | A vulnerability was found in code-projects Departmental Store Management System 1.0. It has been classified as critical. Affected is the function bill. The man… |
CVE-2025-4471 | Medium | 5.3 | 2025-05-09 | A vulnerability, which was classified as critical, has been found in code-projects Jewelery Store Management system 1.0. Affected by this issue is some unknown… |
CVE-2025-4470 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic was found in SourceCodester Online Student Clearance System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2025-4469 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic has been found in SourceCodester Online Student Clearance System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-4468 | High | 7.3 | 2025-05-09 | A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-4467 | High | 7.3 | 2025-05-09 | A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2025-3605 | Critical | 9.8 | 2025-05-09 | The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including… |
CVE-2025-3455 | High | 8.8 | 2025-05-09 | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2025-37889 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Consistently treat platform_max as control value This reverts commit 9bdd10d57… |
CVE-2025-37888 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() Add NULL check for mlx5_… |
CVE-2025-37887 | High | 7.1 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result If the FW doesn't support the… |
CVE-2025-37886 | High | 7.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: pds_core: make wait_context part of q_info Make the wait_context a full part of the q_inf… |
CVE-2025-37885 | High | 8.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if *new* route isn't postable Restore an IRTE back t… |
CVE-2025-37884 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock between rcu_tasks_trace and event_mutex. Fix the following deadlock: CP… |
CVE-2025-37883 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Add check for get_zeroed_page() Add check for the return value of get_zeroed_p… |
CVE-2025-37882 | High | 7.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these… |
CVE-2025-37881 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() The variable d->name… |
CVE-2025-37880 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: um: work around sched_yield not yielding in time-travel mode sched_yield by a userspace m… |
CVE-2025-37879 | Critical | 9.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative read/write replies In p9_client_write() a… |
CVE-2025-37878 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init Move the get_ctx(child_ct… |
CVE-2025-37877 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: iommu: Clear iommu-dma ops on cleanup If iommu_device_register() encounters an error, it… |
CVE-2025-37876 | High | 7.0 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS When testing a special config: CON… |
CVE-2025-37875 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: igc: fix PTM cycle trigger logic Writing to clear the PTM status 'valid' bit while the PT… |
CVE-2025-37874 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix memory leak in ngbe_probe() error path When ngbe_sw_init() is called, memo… |
CVE-2025-37873 | High | 7.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix missing ring index trim on error path Commit under Fixes converted tx_prod… |
CVE-2025-37872 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix memory leak in txgbe_probe() error path When txgbe_sw_init() is called, m… |
CVE-2025-37871 | High | 7.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: nfsd: decrease sc_count directly if fail to queue dl_recall A deadlock warning occurred w… |
CVE-2025-37870 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: prevent hang on link training fail [Why] When link training fails, the p… |
CVE-2025-37869 | High | 7.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use local fence in error path of xe_migrate_clear The intent of the error path in… |
CVE-2025-37868 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: fix notifier vs folio deadlock User is reporting what smells like notifie… |
CVE-2025-37867 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Silence oversized kvmalloc() warning syzkaller triggered an oversized kvmalloc… |
CVE-2025-37866 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() A warning is seen whe… |
CVE-2025-37865 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported Russell King… |
CVE-2025-37864 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: clean up FDB, MDB, VLAN entries on unbind As explained in many places such as c… |
CVE-2025-37863 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: ovl: don't allow datadir only In theory overlayfs could support upper layer directly refe… |
CVE-2025-37862 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fix null pointer dereference in pidff_find_fields This function triggered a n… |
CVE-2025-37861 | High | 7.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue When the task ma… |
CVE-2025-37859 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: page_pool: avoid infinite loop to schedule delayed worker We noticed the kworker in page_… |
CVE-2025-37858 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Prevent integer overflow in AG size calculation The JFS filesystem calculates all… |
CVE-2025-37857 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix array overflow in st_setup() Change the array size to follow parms size ins… |
CVE-2025-37856 | High | 7.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: btrfs: harden block_group::bg_list against list_del() races As far as I can tell, these c… |
CVE-2025-37855 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Guard Possible Null Pointer Dereference [WHY] In some situations, dc->re… |
CVE-2025-37854 | High | 7.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to… |
CVE-2025-37853 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: debugfs hang_hws skip GPU with MES debugfs hang_hws is used by GPU reset test… |
CVE-2025-37852 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() Add error… |
CVE-2025-37851 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: Add 'plane' value check Function dispc_ovl_setup is not intended to work w… |
CVE-2025-37850 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() With CONFIG_COMPILE_TEST &… |
CVE-2025-37849 | High | 8.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to sha… |
CVE-2025-37848 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix PM related deadlocks in MS IOCTLs Prevent runtime resume/suspend while MS… |
CVE-2025-37847 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix deadlock in ivpu_ms_cleanup() Fix deadlock in ivpu_ms_cleanup() by preven… |
CVE-2025-37846 | High | 7.1 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: arm64: mops: Do not dereference src reg for a set operation The source register is not us… |
CVE-2025-37845 | High | 7.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: tracing: fprobe events: Fix possible UAF on modules Commit ac91052f0ae5 ("tracing: tprobe… |
CVE-2025-37844 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: cifs: avoid NULL pointer dereference in dbg call cifs_server_dbg() implies server to be n… |
CVE-2025-37843 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: PCI: pciehp: Avoid unnecessary device replacement check Hot-removal of nested PCI hotplug… |
CVE-2025-37842 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage… |
CVE-2025-37841 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: pm: cpupower: bench: Prevent NULL dereference on malloc failure If malloc returns NULL du… |