2025 CVEs (page 324)
Page 324 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4043 | Medium | 6.8 | 2025-05-07 | An admin user can gain unauthorized write access to the /etc/rc.local file on the device, which is executed on a system boot. |
CVE-2025-3925 | High | 7.8 | 2025-05-07 | BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 contain an execution with unnecessary privileges vulnerabi… |
CVE-2025-31177 | Medium | 5.5 | 2025-05-07 | gnuplot is affected by a heap buffer overflow at function utf8_copy_one. |
CVE-2025-45514 | Medium | 6.5 | 2025-05-07 | Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.frmL7ImForm. |
CVE-2025-45388 | Medium | 6.1 | 2025-05-07 | Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting (XSS) in the document upload functionality. Attackers can inject malicious code inside a PDF f… |
CVE-2025-3476 | | 2025-05-07 | Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allows privilege escalation by authenticated users.This i… | |
CVE-2025-3272 | | 2025-05-07 | Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allow authenticated users to change their password with… | |
CVE-2025-30147 | | 2025-05-07 | Besu Native contains scripts and tooling that is used to build and package the native libraries used by the Ethereum client Hyperledger Besu. Besu 24.7.1 throu… | |
CVE-2025-29746 | Medium | 6.1 | 2025-05-07 | Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components |
CVE-2025-26169 | High | 8.1 | 2025-05-07 | IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be contr… |
CVE-2025-26168 | High | 8.1 | 2025-05-07 | IXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configuration file that can be… |
CVE-2025-47423 | Medium | 5.8 | 2025-05-07 | Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to… |
CVE-2025-47203 | Medium | 4.5 | 2025-05-07 | dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used. |
CVE-2025-46828 | Critical | 9.8 | 2025-05-07 | WeGIA is a web manager for charitable institutions. An unauthenticated SQL Injection vulnerability was identified in versions up to and including 3.3.0 in the… |
CVE-2025-46824 | Low | 3.1 | 2025-05-07 | The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on u… |
CVE-2025-32821 | High | 7.2 | 2025-05-07 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to u… |
CVE-2025-32820 | High | 8.8 | 2025-05-07 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the… |
CVE-2025-32819 | High | 8.8 | 2025-05-07 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file p… |
CVE-2025-20223 | Medium | 4.7 | 2025-05-07 | A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to read and modify data in a repository that… |
CVE-2025-20221 | Medium | 5.3 | 2025-05-07 | A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4… |
CVE-2025-20216 | Medium | 4.7 | 2025-05-07 | A vulnerability in the web interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to inject… |
CVE-2025-20214 | Medium | 4.3 | 2025-05-07 | A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unau… |
CVE-2025-20213 | Medium | 5.5 | 2025-05-07 | A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to overwrite arbitrary… |
CVE-2025-20210 | High | 7.3 | 2025-05-07 | A vulnerability in the management API of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to read and modify t… |
CVE-2025-20202 | High | 7.4 | 2025-05-07 | A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on… |
CVE-2025-20201 | Medium | 6.7 | 2025-05-07 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the u… |
CVE-2025-20200 | Medium | 6.7 | 2025-05-07 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the u… |
CVE-2025-20199 | Medium | 4.6 | 2025-05-07 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the u… |
CVE-2025-20198 | Medium | 4.6 | 2025-05-07 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the u… |
CVE-2025-20197 | Medium | 6.7 | 2025-05-07 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the u… |
CVE-2025-20196 | Medium | 5.3 | 2025-05-07 | A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacke… |
CVE-2025-20195 | Medium | 4.3 | 2025-05-07 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a CSRF attack and exe… |
CVE-2025-20194 | Medium | 5.4 | 2025-05-07 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an inje… |
CVE-2025-20193 | Medium | 6.5 | 2025-05-07 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an inje… |
CVE-2025-20192 | High | 7.7 | 2025-05-07 | A vulnerability in the Internet Key Exchange version 1 (IKEv1) implementation of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a… |
CVE-2025-20191 | High | 7.4 | 2025-05-07 | A vulnerability in the Switch Integrated Security Features (SISF) of Cisco IOS Software, Cisco IOS XE Software, Cisco NX-OS Software, and Cisco Wireless LAN Co… |
CVE-2025-20190 | Medium | 6.5 | 2025-05-07 | A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbi… |
CVE-2025-20189 | High | 7.4 | 2025-05-07 | A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Process… |
CVE-2025-20188 | Critical | 10.0 | 2025-05-07 | A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE So… |
CVE-2025-20187 | Medium | 6.5 | 2025-05-07 | A vulnerability in the application data endpoints of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacke… |
CVE-2025-20186 | High | 8.8 | 2025-05-07 | A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote atta… |
CVE-2025-20182 | High | 8.6 | 2025-05-07 | A vulnerability in the Internet Key Exchange version 2 (IKEv2) protocol processing of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat… |
CVE-2025-20181 | Medium | 6.8 | 2025-05-07 | A vulnerability in Cisco IOS Software for Cisco Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches could allow an authenticated, local attacker with pr… |
CVE-2025-20164 | High | 8.3 | 2025-05-07 | A vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticated, remote attacker to elevate priv… |
CVE-2025-20162 | High | 8.6 | 2025-05-07 | A vulnerability in the DHCP snooping security feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a full interface queue… |
CVE-2025-20157 | Medium | 5.9 | 2025-05-07 | A vulnerability in certificate validation processing of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote at… |
CVE-2025-20155 | Medium | 6.0 | 2025-05-07 | A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. … |
CVE-2025-20154 | High | 8.6 | 2025-05-07 | A vulnerability in the Two-Way Active Measurement Protocol (TWAMP) server feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticate… |
CVE-2025-20151 | Medium | 4.3 | 2025-05-07 | A vulnerability in the implementation of the Simple Network Management Protocol Version 3 (SNMPv3) feature of Cisco IOS Software and Cisco IOS XE Software coul… |
CVE-2025-20147 | Medium | 5.4 | 2025-05-07 | A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote att… |
CVE-2025-20140 | High | 7.4 | 2025-05-07 | A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adja… |
CVE-2025-20137 | Medium | 4.7 | 2025-05-07 | A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and Cisco Catalyst 2960L Swi… |
CVE-2025-20122 | High | 7.8 | 2025-05-07 | A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to gain privileges of… |
CVE-2025-46551 | Low | 3.7 | 2025-05-07 | JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4 (c… |
CVE-2025-46827 | High | 8.0 | 2025-05-07 | Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an… |
CVE-2025-47692 | Medium | 4.3 | 2025-05-07 | Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-47691 | Medium | 5.5 | 2025-05-07 | Improper Control of Generation of Code ('Code Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Code Injection.This issue aff… |
CVE-2025-47688 | Medium | 5.3 | 2025-05-07 | Missing Authorization vulnerability in Saad Iqbal Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-47686 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Stored XSS.This is… |
CVE-2025-47685 | High | 7.1 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in Moloni Contribuinte Checkout contribuinte-checkout allows Stored XSS.This issue affects Contribuinte Checkou… |
CVE-2025-47684 | Medium | 5.4 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in Smaily Smaily for WP smaily-for-wp allows Cross Site Request Forgery.This issue affects Smaily for WP: from… |
CVE-2025-47683 | High | 7.2 | 2025-05-07 | Deserialization of Untrusted Data vulnerability in Florent Maillefaud WP Maintenance wp-maintenance allows Object Injection.This issue affects WP Maintenance… |
CVE-2025-47681 | Medium | 4.3 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows Cross Site Request Forgery.This… |
CVE-2025-47679 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RS WP THEMES RS WP Book Showcase rs-wp-books-showcase all… |
CVE-2025-47677 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows St… |
CVE-2025-47676 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Faiyaz Alam User Login History user-login-history allows… |
CVE-2025-47675 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woobox Woobox woobox allows DOM-Based XSS.This issue affe… |
CVE-2025-47674 | Medium | 4.3 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in Credova Financial Credova_Financial credova-financial allows Cross Site Request Forgery.This issue affects C… |
CVE-2025-47669 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sabuj Kundu CBX Map for Google Map & OpenStreetMap cbxgoo… |
CVE-2025-47668 | Medium | 5.9 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cookiecode CookieCode cookiecode allows Stored XSS.This i… |
CVE-2025-47667 | Medium | 5.4 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in qusupport LiveAgent liveagent allows Cross Site Request Forgery.This issue affects LiveAgent: from n/a throu… |
CVE-2025-47665 | Medium | 5.9 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bistromatic N360 | Splash Screen n360-splash-screen allow… |
CVE-2025-47664 | Medium | 4.4 | 2025-05-07 | Server-Side Request Forgery (SSRF) vulnerability in ThimPress WP Pipes allows Server Side Request Forgery. This issue affects WP Pipes: from n/a through 1.4.2. |
CVE-2025-47662 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woobox Woobox woobox allows Stored XSS.This issue affects… |
CVE-2025-47661 | Medium | 5.4 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Cross Site Request Forgery.This issue affects 워드프레스 결제… |
CVE-2025-47659 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-v… |
CVE-2025-47657 | Critical | 9.3 | 2025-05-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Productive Minds Productive Commerce productive-commerce… |
CVE-2025-47656 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiracle Themes Spiraclethemes Site Library spiracletheme… |
CVE-2025-47655 | High | 7.1 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in themarketer2023 theMarketer themarketer allows Stored XSS.This issue affects theMarketer: from n/a through <… |
CVE-2025-47653 | High | 7.5 | 2025-05-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in tggfref WP-Recall allows PHP Local Fil… |
CVE-2025-47649 | High | 8.8 | 2025-05-07 | Path Traversal: '.../...//' vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows PHP Local File Inclusion.This issue affects Open Close… |
CVE-2025-47648 | High | 7.1 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – W… |
CVE-2025-47647 | Medium | 4.3 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Sidebar Manager Light sidebar-manager-light allows Cross Site Request Forgery.This issue affects S… |
CVE-2025-47644 | Medium | 4.7 | 2025-05-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integrations of Zoho CRM with Elementor form integrations-of-zoho-crm-wi… |
CVE-2025-47643 | High | 7.6 | 2025-05-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX Product Feed for WooCommerce allows SQL… |
CVE-2025-47639 | High | 7.1 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in Supertext Supertext Translation and Proofreading polylang-supertext allows Stored XSS.This issue affects Sup… |
CVE-2025-47638 | Medium | 5.9 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarvesh M Rao WP Discord Invite wp-discord-invite allows… |
CVE-2025-47636 | High | 7.5 | 2025-05-07 | Path Traversal: '.../...//' vulnerability in Fernando Briano List category posts list-category-posts allows PHP Local File Inclusion.This issue affects List ca… |
CVE-2025-47635 | Medium | 5.5 | 2025-05-07 | Server-Side Request Forgery (SSRF) vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Server Side Request Forgery.This issue affects Webinar… |
CVE-2025-47633 | Medium | 4.3 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in Awin Awin – Advertiser Tracking for WooCommerce awin-advertiser-tracking allows Cross Site Request Forgery.T… |
CVE-2025-47632 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery awesome-gallery allows Sto… |
CVE-2025-47630 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Stored… |
CVE-2025-47629 | High | 7.2 | 2025-05-07 | Deserialization of Untrusted Data vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Object Injection.This issue affects WP-CRM System: from n/a… |
CVE-2025-47628 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in quomodosoft QS Dark Mode qs-dark-mode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-47626 | Medium | 5.9 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Submission DOM tracking for Contact Form 7 cf… |
CVE-2025-47625 | Medium | 5.9 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case a… |
CVE-2025-47624 | Medium | 4.3 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Cross Site Request Forgery.This issue affects… |
CVE-2025-47623 | Medium | 5.9 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Easy PayPal Buy Now Button wp-ecommerce-pa… |
CVE-2025-47622 | Medium | 5.9 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Email Notification on Login email-notificatio… |
CVE-2025-47621 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Flexible Shortcodes meks-flexible-shortcodes al… |