2025 CVEs (page 324)
Page 324 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-37840 | High | 7.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: brcmnand: fix PM resume warning Fixed warning on PM resume as shown below c… |
CVE-2025-37839 | High | 7.8 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not determined by sb->s_sequ… |
CVE-2025-37837 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() Two WARNINGs are observed… |
CVE-2025-37836 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pci_register_host_bridge() If device_register() fails, call pu… |
CVE-2025-2253 | Critical | 9.8 | 2025-05-09 | The IMITHEMES Listing plugin is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3. This is due to the plugin no… |
CVE-2025-4466 | High | 7.3 | 2025-05-09 | A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?act… |
CVE-2025-4465 | High | 7.3 | 2025-05-09 | A vulnerability was found in itsourcecode Gym Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-4464 | High | 7.3 | 2025-05-09 | A vulnerability has been found in itsourcecode Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-4377 | | 2025-05-09 | Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it… | |
CVE-2025-4376 | | 2025-05-09 | Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting (XSS). This issue affects P… | |
CVE-2025-4375 | | 2025-05-09 | Cross-Site Request Forgery (CSRF) vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Re… | |
CVE-2025-3463 | | 2025-05-09 | "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS Dr… | |
CVE-2025-3462 | | 2025-05-09 | "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may al… | |
CVE-2025-4463 | High | 7.3 | 2025-05-09 | A vulnerability, which was classified as critical, was found in itsourcecode Gym Management System 1.0. Affected is an unknown function of the file /ajax.php?a… |
CVE-2025-4462 | High | 8.8 | 2025-05-09 | A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525. This issue affects some unknown processing of the file /b… |
CVE-2025-4461 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525. This vulnerability affects unknown code of the component Virtual Server… |
CVE-2025-47737 | Low | 2.9 | 2025-05-09 | lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero. |
CVE-2025-47736 | Low | 2.9 | 2025-05-09 | dialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8. |
CVE-2025-47735 | Low | 2.9 | 2025-05-09 | inner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization. |
CVE-2025-4460 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the component URL Filtering Page… |
CVE-2025-4459 | Medium | 6.3 | 2025-05-09 | A vulnerability was found in code-projects Patient Record Management System 1.0. It has been rated as critical. Affected by this issue is some unknown function… |
CVE-2025-4458 | Medium | 6.3 | 2025-05-09 | A vulnerability was found in code-projects Patient Record Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2025-4457 | High | 7.3 | 2025-05-09 | A vulnerability classified as critical was found in Project Worlds Car Rental Project 1.0. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-4456 | High | 7.3 | 2025-05-09 | A vulnerability classified as critical has been found in Project Worlds Car Rental Project 1.0. Affected is an unknown function of the file /signup.php. The ma… |
CVE-2025-3714 | Critical | 9.8 | 2025-05-09 | The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote att… |
CVE-2025-3713 | High | 7.5 | 2025-05-09 | The LCD KVM over IP Switch CL5708IM has a Heap-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote atta… |
CVE-2025-3712 | High | 7.5 | 2025-05-09 | The LCD KVM over IP Switch CL5708IM has a Heap-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote atta… |
CVE-2025-3711 | Critical | 9.8 | 2025-05-09 | The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote att… |
CVE-2025-3710 | Critical | 9.8 | 2025-05-09 | The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote att… |
CVE-2025-4455 | High | 7.0 | 2025-05-09 | A vulnerability was found in Patch My PC Home Updater up to 5.1.3.0. It has been rated as critical. This issue affects some unknown processing in the library a… |
CVE-2025-4454 | Medium | 6.3 | 2025-05-09 | A vulnerability was found in D-Link DIR-619L 2.04B04. It has been declared as critical. This vulnerability affects the function wake_on_lan. The manipulation o… |
CVE-2025-4453 | Medium | 6.3 | 2025-05-09 | A vulnerability was found in D-Link DIR-619L 2.04B04. It has been classified as critical. This affects the function formSysCmd. The manipulation of the argumen… |
CVE-2025-3811 | Critical | 9.8 | 2025-05-09 | The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the pl… |
CVE-2025-3810 | Critical | 9.8 | 2025-05-09 | The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the pl… |
CVE-2025-4452 | High | 8.8 | 2025-05-09 | A vulnerability was found in D-Link DIR-619L 2.04B04 and classified as critical. Affected by this issue is the function formSetWizard2. The manipulation of the… |
CVE-2025-4451 | High | 8.8 | 2025-05-09 | A vulnerability has been found in D-Link DIR-619L 2.04B04 and classified as critical. Affected by this vulnerability is the function formSetWAN_Wizard52. The m… |
CVE-2025-4450 | High | 8.8 | 2025-05-09 | A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.04B04. Affected is the function formSetEasy_Wizard. The manipulation of the a… |
CVE-2025-4449 | High | 8.8 | 2025-05-09 | A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.04B04. This issue affects the function formEasySetupWizard3. The manipul… |
CVE-2025-4448 | High | 8.8 | 2025-05-09 | A vulnerability classified as critical was found in D-Link DIR-619L 2.04B04. This vulnerability affects the function formEasySetupWizard. The manipulation of t… |
CVE-2025-4446 | High | 8.0 | 2025-05-09 | A vulnerability has been found in H3C GR-5400AX up to 100R008 and classified as critical. This vulnerability affects the function Edit_List_SSID of the file /g… |
CVE-2025-4445 | Medium | 6.3 | 2025-05-09 | A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01. Affected is the function wake_on_lan. The manipulation of the argument mac le… |
CVE-2025-4443 | Medium | 6.3 | 2025-05-09 | A vulnerability was found in D-Link DIR-605L 2.13B01. It has been rated as critical. This issue affects the function sub_454F2C. The manipulation of the argume… |
CVE-2025-4442 | High | 8.8 | 2025-05-09 | A vulnerability was found in D-Link DIR-605L 2.13B01. It has been declared as critical. This vulnerability affects the function formSetWAN_Wizard55. The manipu… |
CVE-2025-4441 | High | 8.8 | 2025-05-08 | A vulnerability was found in D-Link DIR-605L 2.13B01. It has been classified as critical. This affects the function formSetWAN_Wizard534. The manipulation of t… |
CVE-2025-4440 | High | 8.0 | 2025-05-08 | A vulnerability was found in H3C GR-1800AX up to 100R008 and classified as critical. Affected by this issue is the function EnableIpv6 of the file /goform/aspF… |
CVE-2025-47733 | Critical | 9.1 | 2025-05-08 | Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network |
CVE-2025-47732 | High | 8.7 | 2025-05-08 | Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. |
CVE-2025-33072 | High | 8.1 | 2025-05-08 | Improper access control in Azure allows an unauthorized attacker to disclose information over a network. |
CVE-2025-31946 | Medium | 6.2 | 2025-05-08 | Pixmeo OsiriX MD is vulnerable to a local use after free scenario, which could allow an attacker to locally import a crafted DICOM file and cause memory corru… |
CVE-2025-29972 | Critical | 9.9 | 2025-05-08 | Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing over a network. |
CVE-2025-29827 | Critical | 9.9 | 2025-05-08 | Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network. |
CVE-2025-29813 | Critical | 10.0 | 2025-05-08 | Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-27720 | High | 7.4 | 2025-05-08 | The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials. |
CVE-2025-27578 | High | 7.5 | 2025-05-08 | Pixmeo OsiriX MD is vulnerable to a use after free scenario, which could allow an attacker to upload a crafted DICOM file and cause memory corruption leading t… |
CVE-2025-1331 | High | 7.8 | 2025-05-08 | IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the use of unsafe use… |
CVE-2025-1330 | High | 7.8 | 2025-05-08 | IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to failure to handle DNS… |
CVE-2025-1329 | High | 7.8 | 2025-05-08 | IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to failure to handle DNS… |
CVE-2025-28074 | Medium | 6.1 | 2025-05-08 | phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitable when the appli… |
CVE-2025-46833 | | 2025-05-08 | Programs/P73_SimplePythonEncryption.py illustrates a simple Python encryption example using the RSA Algorithm. In versions prior to commit 6ce60b1, an attacker… | |
CVE-2025-46812 | | 2025-05-08 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious cod… | |
CVE-2025-46712 | Low | 3.7 | 2025-05-08 | Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2… |
CVE-2025-46336 | Medium | 4.2 | 2025-05-08 | Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware… |
CVE-2025-45798 | Critical | 9.8 | 2025-05-08 | A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is located in the setNoticeCfg interface within the… |
CVE-2025-45797 | Critical | 9.8 | 2025-05-08 | TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the NoticeUrl… |
CVE-2025-45790 | Critical | 9.8 | 2025-05-08 | TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the priority parameter in the setMacQos interface of /lib/cste_modules/firewall.so. |
CVE-2025-45789 | Critical | 9.8 | 2025-05-08 | TOTOLINK A3100R V5.9c.1527 is vulnerable to buffer overflow via the urlKeyword parameter in setParentalRules. |
CVE-2025-45788 | Critical | 9.8 | 2025-05-08 | TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the comment parameter in setMacFilterRules. |
CVE-2025-45787 | Critical | 9.8 | 2025-05-08 | TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow viathe comment parameter in setIpPortFilterRules. |
CVE-2025-44023 | Medium | 6.5 | 2025-05-08 | An issue in dlink DNS-320 v.1.00 and DNS-320LW v.1.01.0914.20212 allows an attacker to execute arbitrary via the account_mgr.cgi->cgi_chg_admin_pw components. |
CVE-2025-28073 | Medium | 6.1 | 2025-05-08 | phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by… |
CVE-2025-27695 | Medium | 4.9 | 2025-05-08 | Dell Wyse Management Suite, versions prior to WMS 5.1 contain an Authentication Bypass by Spoofing vulnerability. A high privileged attacker with remote access… |
CVE-2025-0505 | Critical | 10.0 | 2025-05-08 | On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision sys… |
CVE-2025-4098 | | 2025-05-08 | Horner Automation Cscape version 10.0 (10.0.415.2) SP1 is vulnerable to an out-of-bounds read vulnerability that could allow an attacker to disclose informatio… | |
CVE-2025-30102 | Medium | 5.5 | 2025-05-08 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.1.0, contains an out-of-bounds write vulnerability. A local low privileged attacker could potentially expl… |
CVE-2025-30101 | Medium | 4.4 | 2025-05-08 | Dell PowerScale OneFS, versions 9.8.0.0 through 9.10.1.0, contain a time-of-check time-of-use (TOCTOU) race condition vulnerability. An unauthenticated attacke… |
CVE-2025-1948 | High | 7.5 | 2025-05-08 | In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIS… |
CVE-2025-44021 | Low | 2.8 | 2025-05-08 | OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious… |
CVE-2025-26847 | High | 7.5 | 2025-05-08 | An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked. |
CVE-2025-26845 | Critical | 9.8 | 2025-05-08 | An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a command executed by… |
CVE-2025-45847 | Medium | 6.5 | 2025-05-08 | ALFA AIP-W512 v3.2.2.2.3 was discovered to contain an authenticated stack overflow via the targetAPMac parameter in the formWsc function. |
CVE-2025-45846 | High | 8.8 | 2025-05-08 | ALFA AIP-W512 v3.2.2.2.3 was discovered to contain an authenticated stack overflow via the torrentsindex parameter in the formBTClinetSetting function. |
CVE-2025-45845 | High | 8.8 | 2025-05-08 | TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyGuestCfg function. |
CVE-2025-45844 | High | 8.8 | 2025-05-08 | TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiBasicCfg function. |
CVE-2025-45843 | High | 8.8 | 2025-05-08 | TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiGuestCfg function. |
CVE-2025-45842 | High | 8.8 | 2025-05-08 | TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyCfg function. |
CVE-2025-45841 | Critical | 9.8 | 2025-05-08 | TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function. |
CVE-2025-43926 | Medium | 6.1 | 2025-05-08 | An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user p… |
CVE-2025-26844 | Critical | 9.8 | 2025-05-08 | An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag. |
CVE-2025-26842 | High | 7.5 | 2025-05-08 | An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visible to users with ac… |
CVE-2025-4207 | Medium | 5.9 | 2025-05-08 | Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte… |
CVE-2025-45820 | Medium | 6.5 | 2025-05-08 | Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/bibliography/pop_author_edit.php. |
CVE-2025-45819 | Medium | 6.5 | 2025-05-08 | Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/author.php. |
CVE-2025-45818 | Medium | 6.5 | 2025-05-08 | Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/item_status.php. |
CVE-2025-47730 | Medium | 4.8 | 2025-05-08 | The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Signal) app with the… |
CVE-2025-47729 | Low | 1.9 | 2025-05-08 | The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functio… |
CVE-2025-4208 | Medium | 6.3 | 2025-05-08 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and inc… |
CVE-2025-3862 | Medium | 6.4 | 2025-05-08 | Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to in… |
CVE-2025-3506 | Medium | 5.3 | 2025-05-08 | Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and <Checkmk 2.4.0b6 allows attacker to a… |
CVE-2025-3468 | Medium | 6.4 | 2025-05-08 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the clean_html and fo… |
CVE-2025-2806 | Medium | 6.1 | 2025-05-08 | The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions… |