2025 CVEs (page 331)
Page 331 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47245 | High | 8.1 | 2025-05-04 | In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role. |
CVE-2025-47244 | High | 7.3 | 2025-05-03 | Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of… |
CVE-2025-47241 | Medium | 4.0 | 2025-05-03 | In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component. |
CVE-2025-4244 | Medium | 6.3 | 2025-05-03 | A vulnerability, which was classified as critical, was found in code-projects Online Bus Reservation System 1.0. This affects an unknown part of the file /seat… |
CVE-2025-4243 | Medium | 6.3 | 2025-05-03 | A vulnerability, which was classified as critical, has been found in code-projects Online Bus Reservation System 1.0. Affected by this issue is some unknown fu… |
CVE-2025-4242 | High | 7.3 | 2025-05-03 | A vulnerability classified as critical was found in PHPGurukul Online Birth Certificate System 2.0. Affected by this vulnerability is an unknown functionality… |
CVE-2025-1838 | Medium | 6.5 | 2025-05-03 | IBM Cloud Pak for Business Automation 24.0.0 and 24.0.1 through 24.0.1 IF001 Authoring allows an authenticated user to bypass client-side data validation i… |
CVE-2025-4241 | High | 7.3 | 2025-05-03 | A vulnerability classified as critical has been found in PHPGurukul Teacher Subject Allocation Management System 1.0. Affected is an unknown function of the fi… |
CVE-2025-4240 | High | 7.3 | 2025-05-03 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. This issue affects some unknown processing of the component LCD Command Han… |
CVE-2025-4239 | High | 7.3 | 2025-05-03 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknown code of the component TYPE Command Ha… |
CVE-2025-4238 | High | 7.3 | 2025-05-03 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component MGET Command Handler. Th… |
CVE-2025-1495 | Medium | 4.3 | 2025-05-03 | IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation. |
CVE-2025-4237 | High | 7.3 | 2025-05-03 | A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MDELETE C… |
CVE-2025-4236 | High | 7.3 | 2025-05-03 | A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the componen… |
CVE-2025-37799 | High | 8.6 | 2025-05-03 | In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 driver's XDP handling… |
CVE-2025-4226 | High | 7.3 | 2025-05-03 | A vulnerability classified as critical has been found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. This affects an unknown part of the file /add-c… |
CVE-2025-3815 | Medium | 6.4 | 2025-05-03 | The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.12.32 due to insu… |
CVE-2025-4222 | Medium | 5.9 | 2025-05-03 | The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored i… |
CVE-2025-4199 | Medium | 6.1 | 2025-05-03 | The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02. This is due to missing or… |
CVE-2025-4198 | Medium | 6.1 | 2025-05-03 | The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1. This is due to missing or incorrect… |
CVE-2025-4188 | Medium | 6.1 | 2025-05-03 | The Advanced Reorder Image Text Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due… |
CVE-2025-4172 | Medium | 6.4 | 2025-05-03 | The VerticalResponse Newsletter Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'verticalresponse' shortcode in all v… |
CVE-2025-4170 | Medium | 6.4 | 2025-05-03 | The Xavin's Review Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xrr' shortcode in all versions up to, and i… |
CVE-2025-4168 | Medium | 6.4 | 2025-05-03 | The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including… |
CVE-2025-47229 | Low | 2.9 | 2025-05-03 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet assertion failure and application exit) via crafted… |
CVE-2025-3918 | Critical | 9.8 | 2025-05-03 | The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the register_action() function in versions 0.1… |
CVE-2025-3779 | Medium | 6.4 | 2025-05-03 | The Personizely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘widgetId’ parameter in all versions up to, and including, 0.10 due t… |
CVE-2025-46723 | | 2025-05-02 | OpenVM is a performant and modular zkVM framework built for customization and extensibility. In version 1.0.0, OpenVM is vulnerable to overflow through byte de… | |
CVE-2025-21572 | Medium | 6.1 | 2025-05-02 | OpenGrok 1.13.25 has a reflected Cross-Site Scripting (XSS) issue when producing the history view page. This happens through improper handling of path segments… |
CVE-2025-4218 | Medium | 5.3 | 2025-05-02 | A vulnerability was found in handrew browserpilot up to 0.2.51. It has been declared as critical. Affected by this vulnerability is the function GPTSeleniumAge… |
CVE-2025-4215 | Low | 3.1 | 2025-05-02 | A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the… |
CVE-2025-47226 | Medium | 5.0 | 2025-05-02 | Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information. |
CVE-2025-4214 | High | 7.3 | 2025-05-02 | A vulnerability was found in PHPGuruku Online DJ Booking Management System 1.0 and classified as critical. This issue affects some unknown processing of the fi… |
CVE-2025-4213 | High | 7.3 | 2025-05-02 | A vulnerability has been found in PHPGurukul Online Birth Certificate System 1.0 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2025-46332 | Medium | 6.5 | 2025-05-02 | Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1… |
CVE-2025-45800 | Critical | 9.8 | 2025-05-02 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, s… |
CVE-2025-3879 | Medium | 6.6 | 2025-05-02 | Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypas… |
CVE-2025-4210 | High | 7.3 | 2025-05-02 | A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go o… |
CVE-2025-4166 | Medium | 4.5 | 2025-05-02 | Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submi… |
CVE-2025-44877 | Critical | 9.8 | 2025-05-02 | Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via the usbname parameter. This vulnerabil… |
CVE-2025-44872 | Critical | 9.8 | 2025-05-02 | Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via the deviceName parameter. This vulnera… |
CVE-2025-44868 | Critical | 9.8 | 2025-05-02 | Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter. This vuln… |
CVE-2025-3927 | Critical | 9.8 | 2025-05-02 | Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address to connect and com… |
CVE-2025-37798 | High | 7.8 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() After making all ->qle… |
CVE-2025-37797 | High | 7.8 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-F… |
CVE-2025-1884 | High | 7.8 | 2025-05-02 | Use-After-Free vulnerability exists in the SLDPRT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could a… |
CVE-2025-1883 | High | 7.8 | 2025-05-02 | Out-Of-Bounds Write vulnerability exists in the OBJ file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could… |
CVE-2025-4204 | High | 7.5 | 2025-05-02 | The Ultimate Auction Pro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 1.5.2 due to… |
CVE-2025-2605 | Critical | 9.9 | 2025-05-02 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This is… |
CVE-2025-2488 | Medium | 6.1 | 2025-05-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Profelis Informatics SambaBox allows Cross-Site Sc… |
CVE-2025-2421 | Critical | 9.8 | 2025-05-02 | Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Informatics SambaBox allows Code Injection. This issue affects SambaBox: b… |
CVE-2025-1301 | Medium | 6.1 | 2025-05-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yordam Informatics Library Automation System allow… |
CVE-2025-0427 | High | 7.8 | 2025-05-02 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2025-0072 | High | 7.8 | 2025-05-02 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
CVE-2025-2812 | Critical | 9.8 | 2025-05-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mydata Informatics Ticket Sales Automation allows Blind S… |
CVE-2025-47201 | Medium | 4.4 | 2025-05-02 | In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS. |
CVE-2025-3514 | Low | 3.5 | 2025-05-02 | The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to pe… |
CVE-2025-3513 | Low | 3.5 | 2025-05-02 | The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to pe… |
CVE-2025-3488 | Medium | 6.4 | 2025-05-02 | The WPML plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpml_language_switcher shortcode in versions 3.6.0 - 4.7.3 due to i… |
CVE-2025-3438 | Medium | 6.5 | 2025-05-02 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and in… |
CVE-2025-3858 | Medium | 6.4 | 2025-05-02 | The Formality plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.5.8 due to in… |
CVE-2025-3748 | Medium | 6.4 | 2025-05-02 | The Taxonomy Chain Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pn_chain_menu shortcode in all versions up to, and i… |
CVE-2025-3709 | Critical | 9.8 | 2025-05-02 | Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perf… |
CVE-2025-3708 | Critical | 9.8 | 2025-05-02 | Le-show medical practice management system from Le-yan has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL com… |
CVE-2025-3707 | Medium | 6.5 | 2025-05-02 | The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL command to read database… |
CVE-2025-3510 | Medium | 6.4 | 2025-05-02 | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to… |
CVE-2025-1327 | Medium | 4.3 | 2025-05-02 | The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_delete_user_account'… |
CVE-2025-1326 | Medium | 4.3 | 2025-05-02 | The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in a… |
CVE-2025-4179 | High | 7.3 | 2025-05-02 | The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser() function in all ve… |
CVE-2025-4177 | Medium | 5.3 | 2025-05-02 | The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() function in all version… |
CVE-2025-4131 | Medium | 6.4 | 2025-05-02 | The GmapsMania plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gmap shortcode in all versions up to, and including, 1.1 due… |
CVE-2025-3746 | Critical | 9.8 | 2025-05-02 | The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. This is due to the p… |
CVE-2025-3670 | Medium | 6.4 | 2025-05-02 | The KiwiChat NextClient plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 6.2 due… |
CVE-2025-2880 | Medium | 5.3 | 2025-05-02 | The Yame | Link In Bio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.0 through the publicly ac… |
CVE-2025-4197 | Medium | 6.3 | 2025-05-02 | A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Affected is an unknown function of the file /edit_… |
CVE-2025-4196 | Medium | 6.3 | 2025-05-02 | A vulnerability was found in SourceCodester Patient Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2025-29825 | Medium | 6.5 | 2025-05-02 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2025-4195 | High | 7.3 | 2025-05-02 | A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /aja… |
CVE-2025-4193 | High | 7.3 | 2025-05-02 | A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-4192 | High | 7.3 | 2025-05-02 | A vulnerability was found in itsourcecode Restaurant Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin… |
CVE-2025-4191 | High | 7.3 | 2025-05-02 | A vulnerability has been found in PHPGurukul Employee Record Management System 1.3 and classified as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-4186 | Medium | 6.3 | 2025-05-02 | A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 2024. Affected is an unknown function of the file /?g=route_ispinfo_expor… |
CVE-2025-4185 | Medium | 6.3 | 2025-05-02 | A vulnerability, which was classified as critical, has been found in Wangshen SecGate 3600 2024. This issue affects some unknown processing of the file ?g=obj_… |
CVE-2025-4184 | High | 7.3 | 2025-05-02 | A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component QUOTE Command Handler. The… |
CVE-2025-4183 | High | 7.3 | 2025-05-01 | A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RECV Command Handler. The manipu… |
CVE-2025-4182 | High | 7.3 | 2025-05-01 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component BELL… |
CVE-2025-4181 | High | 7.3 | 2025-05-01 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the compon… |
CVE-2025-4180 | High | 7.3 | 2025-05-01 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component TRACE Command Handler… |
CVE-2025-4178 | Medium | 5.4 | 2025-05-01 | A vulnerability was found in xiaowei1118 java_server up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows and classified as critical. This issue affects s… |
CVE-2025-4176 | High | 7.3 | 2025-05-01 | A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as critical. This vulnerability affects unknown code of th… |
CVE-2025-43595 | High | 7.8 | 2025-05-01 | An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the 'Onli… |
CVE-2025-27365 | Medium | 6.5 | 2025-05-01 | IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 throug… |
CVE-2025-1333 | Medium | 6.0 | 2025-05-01 | IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5… |
CVE-2025-4175 | Medium | 6.3 | 2025-05-01 | A vulnerability, which was classified as critical, was found in AlanBinu007 Spring-Boot-Advanced-Projects up to 3.1.3. This affects the function uploadUserProf… |
CVE-2025-46635 | High | 7.1 | 2025-05-01 | An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the ro… |
CVE-2025-46634 | High | 8.2 | 2025-05-01 | Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenti… |
CVE-2025-46633 | High | 8.2 | 2025-05-01 | Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the… |
CVE-2025-46632 | Medium | 6.5 | 2025-05-01 | Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more easil… |
CVE-2025-46631 | Medium | 6.5 | 2025-05-01 | Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the… |
CVE-2025-46630 | Medium | 6.5 | 2025-05-01 | Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' (a remote syst… |