2025 CVEs (page 329)
Page 329 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-28168 | Medium | 6.4 | 2025-05-05 | The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validatio… |
CVE-2025-2545 | | 2025-05-05 | Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails… | |
CVE-2025-4272 | High | 7.0 | 2025-05-05 | A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. Affected by this issue is some unknown functionality in the libr… |
CVE-2025-2905 | Critical | 9.1 | 2025-05-05 | Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resol… |
CVE-2025-4271 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-4270 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cg… |
CVE-2025-4269 | Medium | 6.5 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi… |
CVE-2025-4268 | Medium | 5.3 | 2025-05-05 | A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.c… |
CVE-2025-4267 | Medium | 4.7 | 2025-05-05 | A vulnerability, which was classified as critical, was found in SourceCodester/oretnom23 Stock Management System 1.0. This affects an unknown part of the file… |
CVE-2025-4266 | High | 7.3 | 2025-05-05 | A vulnerability, which was classified as critical, has been found in PHPGurukul Notice Board System 1.0. Affected by this issue is some unknown functionality o… |
CVE-2025-3583 | Medium | 4.8 | 2025-05-05 | The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2025-39363 | Medium | 6.5 | 2025-05-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows… |
CVE-2025-4265 | High | 7.3 | 2025-05-05 | A vulnerability classified as critical was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-4264 | High | 7.3 | 2025-05-05 | A vulnerability classified as critical has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /admin/e… |
CVE-2025-4263 | High | 7.3 | 2025-05-05 | A vulnerability was found in PHPGurukul Online DJ Booking Management System 1.0. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-4262 | High | 7.3 | 2025-05-05 | A vulnerability was found in PHPGurukul Online DJ Booking Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2025-4261 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in GAIR-NLP factool up to 3f3914bc090b644be044b7e0005113c135d8b20f. It has been classified as critical. This affects the function run… |
CVE-2025-4260 | Medium | 4.3 | 2025-05-05 | A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0 and classified as problematic. Affected by this issue is the function impsave of the file m\web… |
CVE-2025-4259 | Medium | 6.3 | 2025-05-05 | A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall… |
CVE-2025-20671 | High | 7.0 | 2025-05-05 | In thermal, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already… |
CVE-2025-20670 | Medium | 5.7 | 2025-05-05 | In Modem, there is a possible permission bypass due to improper certificate validation. This could lead to remote information disclosure, if a UE has connected… |
CVE-2025-20668 | High | 7.8 | 2025-05-05 | In scp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alread… |
CVE-2025-20667 | High | 7.5 | 2025-05-05 | In Modem, there is a possible information disclosure due to incorrect error handling. This could lead to remote information disclosure, if a UE has connected t… |
CVE-2025-20666 | High | 7.5 | 2025-05-05 | In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base sta… |
CVE-2025-20665 | Medium | 5.5 | 2025-05-05 | In devinfo, there is a possible information disclosure due to a missing SELinux policy. This could lead to local information disclosure of device identifier wi… |
CVE-2025-4258 | Medium | 6.3 | 2025-05-05 | A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu up to 4.2.0. Affected is the function Upload of the file \youkefu-master… |
CVE-2025-4257 | Low | 3.5 | 2025-05-05 | A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2. This issue affects some unknown processing of the file /admin_pay.php. The… |
CVE-2025-4256 | Low | 3.5 | 2025-05-05 | A vulnerability classified as problematic was found in SeaCMS 13.2. This vulnerability affects unknown code of the file /admin_paylog.php. The manipulation of… |
CVE-2025-4255 | High | 7.3 | 2025-05-05 | A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RMD Command Handler. The manipul… |
CVE-2025-4254 | High | 7.3 | 2025-05-05 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component LIST… |
CVE-2025-4253 | High | 7.3 | 2025-05-04 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the compon… |
CVE-2025-4252 | High | 7.3 | 2025-05-04 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component APPEND Command Handle… |
CVE-2025-4251 | High | 7.3 | 2025-05-04 | A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. This issue affects some unknown processing of the component RMDIR Command Handl… |
CVE-2025-4250 | High | 7.3 | 2025-05-04 | A vulnerability was found in code-projects Nero Social Networking Site 1.0. It has been classified as critical. This affects an unknown part of the file /index… |
CVE-2025-4249 | High | 7.3 | 2025-05-04 | A vulnerability was found in PHPGurukul e-Diary Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-4248 | Medium | 6.3 | 2025-05-04 | A vulnerability has been found in SourceCodester Simple To-Do List System 1.0 and classified as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-4247 | Medium | 6.3 | 2025-05-04 | A vulnerability, which was classified as critical, was found in SourceCodester Simple To-Do List System 1.0. Affected is an unknown function of the file /delet… |
CVE-2025-47245 | High | 8.1 | 2025-05-04 | In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role. |
CVE-2025-47244 | High | 7.3 | 2025-05-03 | Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of… |
CVE-2025-47241 | Medium | 4.0 | 2025-05-03 | In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component. |
CVE-2025-4244 | Medium | 6.3 | 2025-05-03 | A vulnerability, which was classified as critical, was found in code-projects Online Bus Reservation System 1.0. This affects an unknown part of the file /seat… |
CVE-2025-4243 | Medium | 6.3 | 2025-05-03 | A vulnerability, which was classified as critical, has been found in code-projects Online Bus Reservation System 1.0. Affected by this issue is some unknown fu… |
CVE-2025-4242 | High | 7.3 | 2025-05-03 | A vulnerability classified as critical was found in PHPGurukul Online Birth Certificate System 2.0. Affected by this vulnerability is an unknown functionality… |
CVE-2025-1838 | Medium | 6.5 | 2025-05-03 | IBM Cloud Pak for Business Automation 24.0.0 and 24.0.1 through 24.0.1 IF001 Authoring allows an authenticated user to bypass client-side data validation i… |
CVE-2025-4241 | High | 7.3 | 2025-05-03 | A vulnerability classified as critical has been found in PHPGurukul Teacher Subject Allocation Management System 1.0. Affected is an unknown function of the fi… |
CVE-2025-4240 | High | 7.3 | 2025-05-03 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. This issue affects some unknown processing of the component LCD Command Han… |
CVE-2025-4239 | High | 7.3 | 2025-05-03 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknown code of the component TYPE Command Ha… |
CVE-2025-4238 | High | 7.3 | 2025-05-03 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component MGET Command Handler. Th… |
CVE-2025-1495 | Medium | 4.3 | 2025-05-03 | IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation. |
CVE-2025-4237 | High | 7.3 | 2025-05-03 | A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MDELETE C… |
CVE-2025-4236 | High | 7.3 | 2025-05-03 | A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the componen… |
CVE-2025-37799 | High | 8.6 | 2025-05-03 | In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 driver's XDP handling… |
CVE-2025-4226 | High | 7.3 | 2025-05-03 | A vulnerability classified as critical has been found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. This affects an unknown part of the file /add-c… |
CVE-2025-3815 | Medium | 6.4 | 2025-05-03 | The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.12.32 due to insu… |
CVE-2025-4222 | Medium | 5.9 | 2025-05-03 | The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored i… |
CVE-2025-4199 | Medium | 6.1 | 2025-05-03 | The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02. This is due to missing or… |
CVE-2025-4198 | Medium | 6.1 | 2025-05-03 | The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1. This is due to missing or incorrect… |
CVE-2025-4188 | Medium | 6.1 | 2025-05-03 | The Advanced Reorder Image Text Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due… |
CVE-2025-4172 | Medium | 6.4 | 2025-05-03 | The VerticalResponse Newsletter Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'verticalresponse' shortcode in all v… |
CVE-2025-4170 | Medium | 6.4 | 2025-05-03 | The Xavin's Review Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xrr' shortcode in all versions up to, and i… |
CVE-2025-4168 | Medium | 6.4 | 2025-05-03 | The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including… |
CVE-2025-47229 | Low | 2.9 | 2025-05-03 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet assertion failure and application exit) via crafted… |
CVE-2025-3918 | Critical | 9.8 | 2025-05-03 | The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the register_action() function in versions 0.1… |
CVE-2025-3779 | Medium | 6.4 | 2025-05-03 | The Personizely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘widgetId’ parameter in all versions up to, and including, 0.10 due t… |
CVE-2025-46723 | | 2025-05-02 | OpenVM is a performant and modular zkVM framework built for customization and extensibility. In version 1.0.0, OpenVM is vulnerable to overflow through byte de… | |
CVE-2025-21572 | Medium | 6.1 | 2025-05-02 | OpenGrok 1.13.25 has a reflected Cross-Site Scripting (XSS) issue when producing the history view page. This happens through improper handling of path segments… |
CVE-2025-4218 | Medium | 5.3 | 2025-05-02 | A vulnerability was found in handrew browserpilot up to 0.2.51. It has been declared as critical. Affected by this vulnerability is the function GPTSeleniumAge… |
CVE-2025-4215 | Low | 3.1 | 2025-05-02 | A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the… |
CVE-2025-47226 | Medium | 5.0 | 2025-05-02 | Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information. |
CVE-2025-4214 | High | 7.3 | 2025-05-02 | A vulnerability was found in PHPGuruku Online DJ Booking Management System 1.0 and classified as critical. This issue affects some unknown processing of the fi… |
CVE-2025-4213 | High | 7.3 | 2025-05-02 | A vulnerability has been found in PHPGurukul Online Birth Certificate System 1.0 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2025-46332 | Medium | 6.5 | 2025-05-02 | Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1… |
CVE-2025-45800 | Critical | 9.8 | 2025-05-02 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, s… |
CVE-2025-3879 | Medium | 6.6 | 2025-05-02 | Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypas… |
CVE-2025-4210 | High | 7.3 | 2025-05-02 | A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go o… |
CVE-2025-4166 | Medium | 4.5 | 2025-05-02 | Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submi… |
CVE-2025-44877 | Critical | 9.8 | 2025-05-02 | Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via the usbname parameter. This vulnerabil… |
CVE-2025-44872 | Critical | 9.8 | 2025-05-02 | Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via the deviceName parameter. This vulnera… |
CVE-2025-44868 | Critical | 9.8 | 2025-05-02 | Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter. This vuln… |
CVE-2025-3927 | Critical | 9.8 | 2025-05-02 | Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address to connect and com… |
CVE-2025-37798 | High | 7.8 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() After making all ->qle… |
CVE-2025-37797 | High | 7.8 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-F… |
CVE-2025-1884 | High | 7.8 | 2025-05-02 | Use-After-Free vulnerability exists in the SLDPRT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could a… |
CVE-2025-1883 | High | 7.8 | 2025-05-02 | Out-Of-Bounds Write vulnerability exists in the OBJ file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could… |
CVE-2025-4204 | High | 7.5 | 2025-05-02 | The Ultimate Auction Pro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 1.5.2 due to… |
CVE-2025-2605 | Critical | 9.9 | 2025-05-02 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This is… |
CVE-2025-2488 | Medium | 6.1 | 2025-05-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Profelis Informatics SambaBox allows Cross-Site Sc… |
CVE-2025-2421 | Critical | 9.8 | 2025-05-02 | Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Informatics SambaBox allows Code Injection. This issue affects SambaBox: b… |
CVE-2025-1301 | Medium | 6.1 | 2025-05-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yordam Informatics Library Automation System allow… |
CVE-2025-0427 | High | 7.8 | 2025-05-02 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2025-0072 | High | 7.8 | 2025-05-02 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
CVE-2025-2812 | Critical | 9.8 | 2025-05-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mydata Informatics Ticket Sales Automation allows Blind S… |
CVE-2025-47201 | Medium | 4.4 | 2025-05-02 | In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS. |
CVE-2025-3514 | Low | 3.5 | 2025-05-02 | The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to pe… |
CVE-2025-3513 | Low | 3.5 | 2025-05-02 | The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to pe… |
CVE-2025-3488 | Medium | 6.4 | 2025-05-02 | The WPML plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpml_language_switcher shortcode in versions 3.6.0 - 4.7.3 due to i… |
CVE-2025-3438 | Medium | 6.5 | 2025-05-02 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and in… |
CVE-2025-3858 | Medium | 6.4 | 2025-05-02 | The Formality plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.5.8 due to in… |
CVE-2025-3748 | Medium | 6.4 | 2025-05-02 | The Taxonomy Chain Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pn_chain_menu shortcode in all versions up to, and i… |
CVE-2025-3709 | Critical | 9.8 | 2025-05-02 | Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perf… |