2025 CVEs (page 330)
Page 330 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-45618 | Medium | 6.5 | 2025-05-05 | Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to access sensitive infor… |
CVE-2025-45617 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45616 | Critical | 9.8 | 2025-05-05 | Incorrect access control in the /admin/** API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request. |
CVE-2025-45615 | Critical | 9.8 | 2025-05-05 | Incorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain access to Admin rights via a crafted request. |
CVE-2025-45614 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45613 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45612 | Critical | 9.8 | 2025-05-05 | Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index. |
CVE-2025-45611 | Critical | 9.8 | 2025-05-05 | Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET request. |
CVE-2025-45610 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information via a crafted payloa… |
CVE-2025-45609 | High | 7.5 | 2025-05-05 | Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45608 | High | 7.5 | 2025-05-05 | Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45607 | Critical | 9.8 | 2025-05-05 | An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request. |
CVE-2025-1909 | Critical | 9.8 | 2025-05-05 | The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient ve… |
CVE-2025-4318 | | 2025-05-05 | The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an a… | |
CVE-2025-4283 | High | 7.3 | 2025-05-05 | A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2025-4279 | High | 8.8 | 2025-05-05 | The External image replace plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'external_image_replace_get_… |
CVE-2025-46720 | Low | 3.1 | 2025-05-05 | Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete` mut… |
CVE-2025-46719 | Medium | 5.4 | 2025-05-05 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, a vulnerability in the way certain h… |
CVE-2025-46571 | Medium | 5.4 | 2025-05-05 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged users can upload HTML… |
CVE-2025-46559 | Medium | 5.4 | 2025-05-05 | Misskey is an open source, federated social media platform. Starting in version 12.31.0 and prior to version 2025.4.1, missing validation in `Mk:api` allows ma… |
CVE-2025-46553 | Medium | 6.1 | 2025-05-05 | @misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` f… |
CVE-2025-46340 | High | 7.2 | 2025-05-05 | Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation per… |
CVE-2025-46335 | Medium | 5.4 | 2025-05-05 | Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting (XS… |
CVE-2025-43852 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43851 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43850 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43849 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-29573 | Medium | 6.1 | 2025-05-05 | Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module. |
CVE-2025-4282 | Medium | 4.3 | 2025-05-05 | A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as problematic. This vulnerability affects unknown code o… |
CVE-2025-4096 | High | 8.8 | 2025-05-05 | Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2025-4052 | Critical | 9.8 | 2025-05-05 | Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-4051 | Medium | 6.3 | 2025-05-05 | Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-4050 | High | 8.8 | 2025-05-05 | Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gesture… |
CVE-2025-45239 | Medium | 5.3 | 2025-05-05 | An issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a directory traversal. |
CVE-2025-45238 | Critical | 9.1 | 2025-05-05 | foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method. |
CVE-2025-45237 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file containing sensitive account information… |
CVE-2025-45236 | Medium | 5.4 | 2025-05-05 | A stored cross-site scripting (XSS) vulnerability in the Edit Profile feature of DBSyncer v2.0.6 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2025-43848 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43847 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43846 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43845 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to code injection. The ckpt_pa… |
CVE-2025-43844 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The vari… |
CVE-2025-45242 | High | 7.7 | 2025-05-05 | Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin.controller.php. |
CVE-2025-45240 | Medium | 6.5 | 2025-05-05 | foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php. |
CVE-2025-43915 | Medium | 6.5 | 2025-05-05 | In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17… |
CVE-2025-43843 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The vari… |
CVE-2025-43842 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The vari… |
CVE-2025-24977 | Critical | 9.1 | 2025-05-05 | OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability `manage customizations` can execute commands… |
CVE-2025-1992 | Medium | 5.3 | 2025-05-05 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user in federati… |
CVE-2025-0217 | High | 7.8 | 2025-05-05 | BeyondTrust Privileged Remote Access (PRA) versions prior to 25.1 are vulnerable to a local authentication bypass. A local authenticated attacker can view the… |
CVE-2025-4281 | Medium | 4.3 | 2025-05-05 | A vulnerability, which was classified as problematic, was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This affects an u… |
CVE-2025-45322 | High | 8.8 | 2025-05-05 | kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in osms/Requester/CheckStatus.php via the checkid parameter. |
CVE-2025-45321 | High | 8.8 | 2025-05-05 | kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in /osms/Requester/Requesterchangepass.php via the parameter: rPassword. |
CVE-2025-45320 | Medium | 5.3 | 2025-05-05 | A Directory Listing Vulnerability was found in the /osms/Requester/ directory of the Kashipara Online Service Management Portal V1.0. |
CVE-2025-45042 | Critical | 9.8 | 2025-05-05 | Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function. |
CVE-2025-28062 | High | 8.1 | 2025-05-05 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized a… |
CVE-2025-27921 | Medium | 6.1 | 2025-05-05 | A reflected cross-site scripting (XSS) vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web a… |
CVE-2025-27920 | High | 7.2 | 2025-05-05 | Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attack… |
CVE-2025-26241 | Medium | 6.5 | 2025-05-05 | A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL… |
CVE-2025-25504 | Medium | 6.5 | 2025-05-05 | An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connec… |
CVE-2025-4316 | Medium | 4.3 | 2025-05-05 | Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy v… |
CVE-2025-47268 | Medium | 6.5 | 2025-05-05 | ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a… |
CVE-2025-45751 | Medium | 6.1 | 2025-05-05 | SourceCodester Web Based Pharmacy Product Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add-admin.php via the Fullname text field. |
CVE-2025-28168 | Medium | 6.4 | 2025-05-05 | The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validatio… |
CVE-2025-2545 | | 2025-05-05 | Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails… | |
CVE-2025-4272 | High | 7.0 | 2025-05-05 | A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. Affected by this issue is some unknown functionality in the libr… |
CVE-2025-2905 | Critical | 9.1 | 2025-05-05 | Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resol… |
CVE-2025-4271 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-4270 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cg… |
CVE-2025-4269 | Medium | 6.5 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi… |
CVE-2025-4268 | Medium | 5.3 | 2025-05-05 | A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.c… |
CVE-2025-4267 | Medium | 4.7 | 2025-05-05 | A vulnerability, which was classified as critical, was found in SourceCodester/oretnom23 Stock Management System 1.0. This affects an unknown part of the file… |
CVE-2025-4266 | High | 7.3 | 2025-05-05 | A vulnerability, which was classified as critical, has been found in PHPGurukul Notice Board System 1.0. Affected by this issue is some unknown functionality o… |
CVE-2025-3583 | Medium | 4.8 | 2025-05-05 | The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2025-39363 | Medium | 6.5 | 2025-05-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows… |
CVE-2025-4265 | High | 7.3 | 2025-05-05 | A vulnerability classified as critical was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-4264 | High | 7.3 | 2025-05-05 | A vulnerability classified as critical has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /admin/e… |
CVE-2025-4263 | High | 7.3 | 2025-05-05 | A vulnerability was found in PHPGurukul Online DJ Booking Management System 1.0. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-4262 | High | 7.3 | 2025-05-05 | A vulnerability was found in PHPGurukul Online DJ Booking Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2025-4261 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in GAIR-NLP factool up to 3f3914bc090b644be044b7e0005113c135d8b20f. It has been classified as critical. This affects the function run… |
CVE-2025-4260 | Medium | 4.3 | 2025-05-05 | A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0 and classified as problematic. Affected by this issue is the function impsave of the file m\web… |
CVE-2025-4259 | Medium | 6.3 | 2025-05-05 | A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall… |
CVE-2025-20671 | High | 7.0 | 2025-05-05 | In thermal, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already… |
CVE-2025-20670 | Medium | 5.7 | 2025-05-05 | In Modem, there is a possible permission bypass due to improper certificate validation. This could lead to remote information disclosure, if a UE has connected… |
CVE-2025-20668 | High | 7.8 | 2025-05-05 | In scp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alread… |
CVE-2025-20667 | High | 7.5 | 2025-05-05 | In Modem, there is a possible information disclosure due to incorrect error handling. This could lead to remote information disclosure, if a UE has connected t… |
CVE-2025-20666 | High | 7.5 | 2025-05-05 | In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base sta… |
CVE-2025-20665 | Medium | 5.5 | 2025-05-05 | In devinfo, there is a possible information disclosure due to a missing SELinux policy. This could lead to local information disclosure of device identifier wi… |
CVE-2025-4258 | Medium | 6.3 | 2025-05-05 | A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu up to 4.2.0. Affected is the function Upload of the file \youkefu-master… |
CVE-2025-4257 | Low | 3.5 | 2025-05-05 | A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2. This issue affects some unknown processing of the file /admin_pay.php. The… |
CVE-2025-4256 | Low | 3.5 | 2025-05-05 | A vulnerability classified as problematic was found in SeaCMS 13.2. This vulnerability affects unknown code of the file /admin_paylog.php. The manipulation of… |
CVE-2025-4255 | High | 7.3 | 2025-05-05 | A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RMD Command Handler. The manipul… |
CVE-2025-4254 | High | 7.3 | 2025-05-05 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component LIST… |
CVE-2025-4253 | High | 7.3 | 2025-05-04 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the compon… |
CVE-2025-4252 | High | 7.3 | 2025-05-04 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component APPEND Command Handle… |
CVE-2025-4251 | High | 7.3 | 2025-05-04 | A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. This issue affects some unknown processing of the component RMDIR Command Handl… |
CVE-2025-4250 | High | 7.3 | 2025-05-04 | A vulnerability was found in code-projects Nero Social Networking Site 1.0. It has been classified as critical. This affects an unknown part of the file /index… |
CVE-2025-4249 | High | 7.3 | 2025-05-04 | A vulnerability was found in PHPGurukul e-Diary Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-4248 | Medium | 6.3 | 2025-05-04 | A vulnerability has been found in SourceCodester Simple To-Do List System 1.0 and classified as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-4247 | Medium | 6.3 | 2025-05-04 | A vulnerability, which was classified as critical, was found in SourceCodester Simple To-Do List System 1.0. Affected is an unknown function of the file /delet… |