2025 CVEs (page 332)
Page 332 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4150 | High | 8.8 | 2025-05-01 | A vulnerability was found in Netgear EX6200 1.0.3.94. It has been declared as critical. This vulnerability affects the function sub_54340. The manipulation of… |
CVE-2025-4099 | Medium | 6.4 | 2025-05-01 | The List Children plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'list_children' shortcode in all versions up to, and inclu… |
CVE-2025-3952 | High | 8.1 | 2025-05-01 | The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due… |
CVE-2025-4149 | High | 8.8 | 2025-05-01 | A vulnerability was found in Netgear EX6200 1.0.3.94. It has been classified as critical. This affects the function sub_54014. The manipulation of the argument… |
CVE-2025-4148 | High | 8.8 | 2025-05-01 | A vulnerability was found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this issue is the function sub_503FC. The manipulation of the argu… |
CVE-2025-2168 | Medium | 4.3 | 2025-05-01 | The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for… |
CVE-2025-1305 | High | 8.8 | 2025-05-01 | The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorr… |
CVE-2025-1304 | High | 8.8 | 2025-05-01 | The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin()… |
CVE-2025-2816 | High | 8.1 | 2025-05-01 | The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability ch… |
CVE-2025-4147 | High | 8.8 | 2025-05-01 | A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this vulnerability is the function sub_47F7C. The manipulatio… |
CVE-2025-4146 | High | 8.8 | 2025-05-01 | A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. Affected is the function sub_41940. The manipulation of the argument h… |
CVE-2025-4145 | High | 8.8 | 2025-05-01 | A vulnerability, which was classified as critical, has been found in Netgear EX6200 1.0.3.94. This issue affects the function sub_3D0BC. The manipulation of th… |
CVE-2025-4144 | Critical | 9.8 | 2025-05-01 | PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However… |
CVE-2025-4143 | Medium | 6.1 | 2025-05-01 | The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that r… |
CVE-2025-4142 | High | 8.8 | 2025-04-30 | A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. This vulnerability affects the function sub_3C8EC. The manipulation of th… |
CVE-2025-4141 | High | 8.8 | 2025-04-30 | A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. This affects the function sub_3C03C. The manipulation of the argument… |
CVE-2025-4140 | High | 8.8 | 2025-04-30 | A vulnerability, which was classified as critical, has been found in Netgear EX6120 1.0.3.94. Affected by this issue is the function sub_30394. The manipulatio… |
CVE-2025-4139 | High | 8.8 | 2025-04-30 | A vulnerability classified as critical was found in Netgear EX6120 1.0.0.68. Affected by this vulnerability is the function fwAcosCgiInbound. The manipulation… |
CVE-2025-30422 | Medium | 6.5 | 2025-04-30 | A buffer overflow was addressed with improved input validation. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on… |
CVE-2025-24132 | Medium | 6.5 | 2025-04-30 | The issue was addressed with improved memory handling. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on the local… |
CVE-2025-4136 | Medium | 5.4 | 2025-04-30 | A vulnerability was found in Weitong Mall 1.0.0. It has been classified as critical. This affects an unknown part of the component Sale Endpoint. The manipulat… |
CVE-2025-2082 | High | 7.5 | 2025-04-30 | Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on aff… |
CVE-2025-27611 | | 2025-04-30 | base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vu… | |
CVE-2025-46558 | Critical | 9.0 | 2025-04-30 | XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown. In versions starting from 8.2 to befor… |
CVE-2025-46557 | Critical | 9.8 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16… |
CVE-2025-46554 | Medium | 5.3 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and… |
CVE-2025-46331 | Critical | 9.8 | 2025-04-30 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Hel… |
CVE-2025-32777 | | 2025-04-30 | Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacke… | |
CVE-2025-2170 | High | 7.2 | 2025-04-30 | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific conditions could potent… |
CVE-2025-24887 | Medium | 6.3 | 2025-04-30 | OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing… |
CVE-2025-4135 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear WG302v2 up to 5.2.9 and classified as critical. Affected by this issue is the function ui_get_input_value. The manipulatio… |
CVE-2025-46619 | High | 7.6 | 2025-04-30 | A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sens… |
CVE-2025-44194 | High | 7.3 | 2025-04-30 | SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_household. |
CVE-2025-44193 | High | 7.6 | 2025-04-30 | SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_complaint. |
CVE-2025-44192 | Critical | 9.8 | 2025-04-30 | SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_clearance. |
CVE-2025-39413 | Medium | 4.3 | 2025-04-30 | Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap simple-sitemap.This issue affects Simple Sitemap – Create… |
CVE-2025-33074 | High | 7.5 | 2025-04-30 | Improper verification of cryptographic signature in Microsoft Azure Functions allows an authorized attacker to execute code over a network. |
CVE-2025-30392 | Critical | 9.8 | 2025-04-30 | Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-30391 | High | 8.1 | 2025-04-30 | Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network. |
CVE-2025-30390 | Critical | 9.9 | 2025-04-30 | Improper authorization in Azure allows an authorized attacker to elevate privileges over a network. |
CVE-2025-30389 | High | 8.7 | 2025-04-30 | Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-24091 | Medium | 5.5 | 2025-04-30 | An app could impersonate system notifications. Sensitive notifications now require restricted entitlements. This issue is fixed in iOS 18.3 and iPadOS 18.3, iP… |
CVE-2025-21416 | High | 8.5 | 2025-04-30 | Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network. |
CVE-2025-3859 | Medium | 6.1 | 2025-04-30 | Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into… |
CVE-2025-3599 | Medium | 6.5 | 2025-04-30 | Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which m… |
CVE-2025-4122 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been rated as critical. Affected by this issue is the function sub_435E04. The manipulation of… |
CVE-2025-46342 | High | 8.5 | 2025-04-30 | Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using nam… |
CVE-2025-32974 | Critical | 9.0 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doe… |
CVE-2025-32973 | Critical | 9.0 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16… |
CVE-2025-32972 | Low | 2.7 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to befo… |
CVE-2025-32971 | Low | 3.8 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-… |
CVE-2025-32970 | Medium | 6.1 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16… |
CVE-2025-32376 | Medium | 4.3 | 2025-04-30 | Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can… |
CVE-2025-27409 | High | 7.5 | 2025-04-30 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, pat… |
CVE-2025-27134 | High | 8.8 | 2025-04-30 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a p… |
CVE-2025-4121 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function cmd_wireless. The ma… |
CVE-2025-4120 | High | 8.8 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been classified as critical. Affected is the function sub_4238E8. The manipulation of the argu… |
CVE-2025-4119 | Medium | 5.3 | 2025-04-30 | A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Produc… |
CVE-2025-4118 | Medium | 5.3 | 2025-04-30 | A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the component Product His… |
CVE-2025-45021 | Medium | 5.3 | 2025-04-30 | A SQL Injection vulnerability was identified in the admin/edit-directory.php file of the PHPGurukul Directory Management System v2.0. Attackers can exploit thi… |
CVE-2025-45019 | Medium | 5.4 | 2025-04-30 | A SQL injection vulnerability was discovered in /add-foreigners-ticket.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows… |
CVE-2025-45018 | Critical | 9.8 | 2025-04-30 | A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulner… |
CVE-2025-45017 | Critical | 9.8 | 2025-04-30 | A SQL injection vulnerability was discovered in edit-ticket.php of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers… |
CVE-2025-45015 | Medium | 6.1 | 2025-04-30 | A Cross-Site Scripting (XSS) vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0… |
CVE-2025-45011 | Medium | 5.3 | 2025-04-30 | A HTML Injection vulnerability was discovered in the foreigner-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows r… |
CVE-2025-45010 | Medium | 5.3 | 2025-04-30 | A HTML Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerab… |
CVE-2025-45009 | Medium | 5.3 | 2025-04-30 | A HTML Injection vulnerability was discovered in the normal-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remo… |
CVE-2025-4117 | Medium | 5.5 | 2025-04-30 | A vulnerability, which was classified as critical, was found in Netgear JWNR2000v2 1.0.0.11. This affects the function sub_41A914. The manipulation of the argu… |
CVE-2025-4116 | High | 8.8 | 2025-04-30 | A vulnerability, which was classified as critical, has been found in Netgear JWNR2000v2 1.0.0.11. Affected by this issue is the function get_cur_lang_ver. The… |
CVE-2025-4115 | High | 8.8 | 2025-04-30 | A vulnerability classified as critical was found in Netgear JWNR2000v2 1.0.0.11. Affected by this vulnerability is the function default_version_is_new. The man… |
CVE-2025-45020 | High | 7.2 | 2025-04-30 | A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerabi… |
CVE-2025-45007 | Medium | 4.8 | 2025-04-30 | A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the profile.php file of PHPGurukul Timetable Generator System v1.0. This vulnerability a… |
CVE-2025-3395 | High | 7.1 | 2025-04-30 | Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Au… |
CVE-2025-3394 | High | 7.8 | 2025-04-30 | Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0. |
CVE-2025-4114 | High | 8.8 | 2025-04-30 | A vulnerability classified as critical has been found in Netgear JWNR2000v2 1.0.0.11. Affected is the function check_language_file. The manipulation of the arg… |
CVE-2025-27532 | Medium | 6.5 | 2025-04-30 | A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access sec… |
CVE-2025-24351 | High | 8.8 | 2025-04-30 | A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to execute arb… |
CVE-2025-24350 | High | 7.1 | 2025-04-30 | A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to writ… |
CVE-2025-24349 | High | 7.1 | 2025-04-30 | A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to delete t… |
CVE-2025-24348 | Medium | 5.4 | 2025-04-30 | A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipul… |
CVE-2025-24347 | Medium | 6.5 | 2025-04-30 | A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipul… |
CVE-2025-24346 | High | 7.5 | 2025-04-30 | A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to manipulate the “/etc/… |
CVE-2025-24345 | Medium | 6.3 | 2025-04-30 | A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the “host… |
CVE-2025-24344 | Medium | 6.3 | 2025-04-30 | A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbitrary HTML tags an… |
CVE-2025-24343 | Medium | 5.4 | 2025-04-30 | A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arb… |
CVE-2025-24342 | Medium | 5.3 | 2025-04-30 | A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple cr… |
CVE-2025-24341 | Medium | 6.5 | 2025-04-30 | A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoS) condition on the… |
CVE-2025-4113 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2025-4112 | High | 7.3 | 2025-04-30 | A vulnerability was found in PHPGurukul Student Record System 3.20. It has been declared as critical. This vulnerability affects unknown code of the file /add-… |
CVE-2025-4111 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/v… |
CVE-2025-4110 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-24340 | Medium | 6.5 | 2025-04-30 | A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of ot… |
CVE-2025-24339 | Medium | 5.0 | 2025-04-30 | A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system… |
CVE-2025-24338 | High | 7.1 | 2025-04-30 | A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to execute ar… |
CVE-2025-4109 | Medium | 6.3 | 2025-04-30 | A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-4108 | High | 7.3 | 2025-04-30 | A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Affected is an unknown function of the file /add-subject… |
CVE-2025-4125 | High | 7.8 | 2025-04-30 | Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsin… |
CVE-2025-4124 | High | 7.8 | 2025-04-30 | Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsin… |
CVE-2025-2890 | Medium | 6.5 | 2025-04-30 | The tagDiv Opt-In Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘subscriptionCouponId’ parameter in all versions up to, and in… |
CVE-2025-22884 | High | 7.8 | 2025-04-30 | Delta Electronics ISPSoft version 3.20 is vulnerable to a Stack-Based buffer overflow vulnerability that could allow an attacker to execute arbitrary code when… |