2025 CVEs (page 328)
Page 328 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4311 | High | 7.3 | 2025-05-06 | A vulnerability classified as critical was found in itsourcecode Content Management System 1.0. This vulnerability affects unknown code of the file /admin/upda… |
CVE-2025-4310 | Medium | 4.7 | 2025-05-06 | A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. This affects an unknown part of the file /admin/add_topic… |
CVE-2025-4309 | High | 7.3 | 2025-05-06 | A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2025-4308 | High | 7.3 | 2025-05-06 | A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been declared as critical. Affected by this vulnerability is an unknown funct… |
CVE-2025-4307 | High | 7.3 | 2025-05-06 | A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been classified as critical. Affected is an unknown function of the file /adm… |
CVE-2025-4306 | High | 7.3 | 2025-05-06 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2025-3610 | High | 8.8 | 2025-05-06 | The Reales WP STPT plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.1.2. This is due to… |
CVE-2025-3609 | Medium | 5.3 | 2025-05-06 | The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'reales… |
CVE-2025-4305 | Medium | 6.3 | 2025-05-06 | A vulnerability has been found in kefaming mayi up to 1.3.9 and classified as critical. This vulnerability affects the function Upload of the file app/tools/co… |
CVE-2025-4304 | High | 7.3 | 2025-05-06 | A vulnerability, which was classified as critical, was found in PHPGurukul Cyber Cafe Management System 1.0. This affects an unknown part of the file /adminpro… |
CVE-2025-4303 | High | 7.3 | 2025-05-06 | A vulnerability, which was classified as critical, has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected by this issue is… |
CVE-2025-4301 | High | 7.3 | 2025-05-06 | A vulnerability classified as critical was found in itsourcecode Content Management System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-46728 | High | 7.5 | 2025-05-06 | cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming… |
CVE-2025-2509 | High | 7.8 | 2025-05-06 | Out-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to achieve arbitrary address access within the crosvm sandboxed process… |
CVE-2025-4300 | High | 7.3 | 2025-05-06 | A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. Affected is an unknown function of the file /search_list.p… |
CVE-2025-4299 | High | 8.8 | 2025-05-06 | A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been rated as critical. This issue affects the function setSchedWifi of the file /goform/op… |
CVE-2025-4298 | High | 8.8 | 2025-05-06 | A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been declared as critical. This vulnerability affects the function formSetCfm of the file /… |
CVE-2025-4297 | High | 7.3 | 2025-05-05 | A vulnerability was found in PHPGurukul Men Salon Management System 2.0. It has been classified as critical. This affects an unknown part of the file /admin/ch… |
CVE-2025-4293 | Low | 2.4 | 2025-05-05 | A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/group/edit.do o… |
CVE-2025-4292 | Low | 2.4 | 2025-05-05 | A vulnerability has been found in MRCMS 3.1.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/user… |
CVE-2025-4291 | Medium | 6.3 | 2025-05-05 | A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leads to unrestricted… |
CVE-2025-4290 | High | 7.3 | 2025-05-05 | A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SMNT C… |
CVE-2025-44074 | Critical | 9.8 | 2025-05-05 | SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php. |
CVE-2025-44072 | Critical | 9.8 | 2025-05-05 | SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php. |
CVE-2025-44071 | Critical | 9.8 | 2025-05-05 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. This vulnerability allows attackers to execu… |
CVE-2025-4289 | High | 7.3 | 2025-05-05 | A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component RNTO Command Handler. The… |
CVE-2025-4288 | High | 7.3 | 2025-05-05 | A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RNFR Command Handler. The manipu… |
CVE-2025-1493 | Medium | 5.3 | 2025-05-05 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service du… |
CVE-2025-1000 | Medium | 5.3 | 2025-05-05 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause… |
CVE-2025-0915 | Medium | 5.3 | 2025-05-05 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 under specific configurations could allow… |
CVE-2025-4287 | Low | 3.3 | 2025-05-05 | A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file t… |
CVE-2025-4286 | Low | 2.7 | 2025-05-05 | A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Disposi… |
CVE-2025-46813 | Medium | 5.8 | 2025-05-05 | Discourse is an open-source community platform. A data leak vulnerability affects sites deployed between commits 10df7fdee060d44accdee7679d66d778d1136510 and 8… |
CVE-2025-46734 | Medium | 6.4 | 2025-05-05 | league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1… |
CVE-2025-46731 | High | 7.2 | 2025-05-05 | Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remot… |
CVE-2025-46730 | Medium | 6.8 | 2025-05-05 | MobSF is a mobile application security testing tool used. Typically, MobSF is deployed on centralized internal or cloud-based servers that also host other secu… |
CVE-2025-46726 | Critical | 9.1 | 2025-05-05 | Langroid is a framework for building large-language-model-powered applications. Prior to version 0.53.4, a LLM application leveraging `XMLToolMessage` class ma… |
CVE-2025-45618 | Medium | 6.5 | 2025-05-05 | Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to access sensitive infor… |
CVE-2025-45617 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45616 | Critical | 9.8 | 2025-05-05 | Incorrect access control in the /admin/** API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request. |
CVE-2025-45615 | Critical | 9.8 | 2025-05-05 | Incorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain access to Admin rights via a crafted request. |
CVE-2025-45614 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45613 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45612 | Critical | 9.8 | 2025-05-05 | Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index. |
CVE-2025-45611 | Critical | 9.8 | 2025-05-05 | Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET request. |
CVE-2025-45610 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information via a crafted payloa… |
CVE-2025-45609 | High | 7.5 | 2025-05-05 | Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45608 | High | 7.5 | 2025-05-05 | Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45607 | Critical | 9.8 | 2025-05-05 | An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request. |
CVE-2025-1909 | Critical | 9.8 | 2025-05-05 | The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient ve… |
CVE-2025-4318 | | 2025-05-05 | The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an a… | |
CVE-2025-4283 | High | 7.3 | 2025-05-05 | A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2025-4279 | High | 8.8 | 2025-05-05 | The External image replace plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'external_image_replace_get_… |
CVE-2025-46720 | Low | 3.1 | 2025-05-05 | Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete` mut… |
CVE-2025-46719 | Medium | 5.4 | 2025-05-05 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, a vulnerability in the way certain h… |
CVE-2025-46571 | Medium | 5.4 | 2025-05-05 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged users can upload HTML… |
CVE-2025-46559 | Medium | 5.4 | 2025-05-05 | Misskey is an open source, federated social media platform. Starting in version 12.31.0 and prior to version 2025.4.1, missing validation in `Mk:api` allows ma… |
CVE-2025-46553 | Medium | 6.1 | 2025-05-05 | @misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` f… |
CVE-2025-46340 | High | 7.2 | 2025-05-05 | Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation per… |
CVE-2025-46335 | Medium | 5.4 | 2025-05-05 | Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting (XS… |
CVE-2025-43852 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43851 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43850 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43849 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-29573 | Medium | 6.1 | 2025-05-05 | Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module. |
CVE-2025-4282 | Medium | 4.3 | 2025-05-05 | A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as problematic. This vulnerability affects unknown code o… |
CVE-2025-4096 | High | 8.8 | 2025-05-05 | Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2025-4052 | Critical | 9.8 | 2025-05-05 | Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-4051 | Medium | 6.3 | 2025-05-05 | Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-4050 | High | 8.8 | 2025-05-05 | Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gesture… |
CVE-2025-45239 | Medium | 5.3 | 2025-05-05 | An issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a directory traversal. |
CVE-2025-45238 | Critical | 9.1 | 2025-05-05 | foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method. |
CVE-2025-45237 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file containing sensitive account information… |
CVE-2025-45236 | Medium | 5.4 | 2025-05-05 | A stored cross-site scripting (XSS) vulnerability in the Edit Profile feature of DBSyncer v2.0.6 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2025-43848 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43847 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43846 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43845 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to code injection. The ckpt_pa… |
CVE-2025-43844 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The vari… |
CVE-2025-45242 | High | 7.7 | 2025-05-05 | Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin.controller.php. |
CVE-2025-45240 | Medium | 6.5 | 2025-05-05 | foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php. |
CVE-2025-43915 | Medium | 6.5 | 2025-05-05 | In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17… |
CVE-2025-43843 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The vari… |
CVE-2025-43842 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The vari… |
CVE-2025-24977 | Critical | 9.1 | 2025-05-05 | OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability `manage customizations` can execute commands… |
CVE-2025-1992 | Medium | 5.3 | 2025-05-05 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user in federati… |
CVE-2025-0217 | High | 7.8 | 2025-05-05 | BeyondTrust Privileged Remote Access (PRA) versions prior to 25.1 are vulnerable to a local authentication bypass. A local authenticated attacker can view the… |
CVE-2025-4281 | Medium | 4.3 | 2025-05-05 | A vulnerability, which was classified as problematic, was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This affects an u… |
CVE-2025-45322 | High | 8.8 | 2025-05-05 | kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in osms/Requester/CheckStatus.php via the checkid parameter. |
CVE-2025-45321 | High | 8.8 | 2025-05-05 | kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in /osms/Requester/Requesterchangepass.php via the parameter: rPassword. |
CVE-2025-45320 | Medium | 5.3 | 2025-05-05 | A Directory Listing Vulnerability was found in the /osms/Requester/ directory of the Kashipara Online Service Management Portal V1.0. |
CVE-2025-45042 | Critical | 9.8 | 2025-05-05 | Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function. |
CVE-2025-28062 | High | 8.1 | 2025-05-05 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized a… |
CVE-2025-27921 | Medium | 6.1 | 2025-05-05 | A reflected cross-site scripting (XSS) vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web a… |
CVE-2025-27920 | High | 7.2 | 2025-05-05 | Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attack… |
CVE-2025-26241 | Medium | 6.5 | 2025-05-05 | A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL… |
CVE-2025-25504 | Medium | 6.5 | 2025-05-05 | An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connec… |
CVE-2025-4316 | Medium | 4.3 | 2025-05-05 | Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy v… |
CVE-2025-47268 | Medium | 6.5 | 2025-05-05 | ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a… |
CVE-2025-45751 | Medium | 6.1 | 2025-05-05 | SourceCodester Web Based Pharmacy Product Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add-admin.php via the Fullname text field. |