2025 CVEs (page 334)
Page 334 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30392 | Critical | 9.8 | 2025-04-30 | Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-30391 | High | 8.1 | 2025-04-30 | Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network. |
CVE-2025-30390 | Critical | 9.9 | 2025-04-30 | Improper authorization in Azure allows an authorized attacker to elevate privileges over a network. |
CVE-2025-30389 | High | 8.7 | 2025-04-30 | Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-24091 | Medium | 5.5 | 2025-04-30 | An app could impersonate system notifications. Sensitive notifications now require restricted entitlements. This issue is fixed in iOS 18.3 and iPadOS 18.3, iP… |
CVE-2025-21416 | High | 8.5 | 2025-04-30 | Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network. |
CVE-2025-3859 | Medium | 6.1 | 2025-04-30 | Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into… |
CVE-2025-3599 | Medium | 6.5 | 2025-04-30 | Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which m… |
CVE-2025-4122 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been rated as critical. Affected by this issue is the function sub_435E04. The manipulation of… |
CVE-2025-46342 | High | 8.5 | 2025-04-30 | Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using nam… |
CVE-2025-32974 | Critical | 9.0 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doe… |
CVE-2025-32973 | Critical | 9.0 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16… |
CVE-2025-32972 | Low | 2.7 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to befo… |
CVE-2025-32971 | Low | 3.8 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-… |
CVE-2025-32970 | Medium | 6.1 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16… |
CVE-2025-32376 | Medium | 4.3 | 2025-04-30 | Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can… |
CVE-2025-27409 | High | 7.5 | 2025-04-30 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, pat… |
CVE-2025-27134 | High | 8.8 | 2025-04-30 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a p… |
CVE-2025-4121 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function cmd_wireless. The ma… |
CVE-2025-4120 | High | 8.8 | 2025-04-30 | A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been classified as critical. Affected is the function sub_4238E8. The manipulation of the argu… |
CVE-2025-4119 | Medium | 5.3 | 2025-04-30 | A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Produc… |
CVE-2025-4118 | Medium | 5.3 | 2025-04-30 | A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the component Product His… |
CVE-2025-45021 | Medium | 5.3 | 2025-04-30 | A SQL Injection vulnerability was identified in the admin/edit-directory.php file of the PHPGurukul Directory Management System v2.0. Attackers can exploit thi… |
CVE-2025-45019 | Medium | 5.4 | 2025-04-30 | A SQL injection vulnerability was discovered in /add-foreigners-ticket.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows… |
CVE-2025-45018 | Critical | 9.8 | 2025-04-30 | A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulner… |
CVE-2025-45017 | Critical | 9.8 | 2025-04-30 | A SQL injection vulnerability was discovered in edit-ticket.php of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers… |
CVE-2025-45015 | Medium | 6.1 | 2025-04-30 | A Cross-Site Scripting (XSS) vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0… |
CVE-2025-45011 | Medium | 5.3 | 2025-04-30 | A HTML Injection vulnerability was discovered in the foreigner-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows r… |
CVE-2025-45010 | Medium | 5.3 | 2025-04-30 | A HTML Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerab… |
CVE-2025-45009 | Medium | 5.3 | 2025-04-30 | A HTML Injection vulnerability was discovered in the normal-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remo… |
CVE-2025-4117 | Medium | 5.5 | 2025-04-30 | A vulnerability, which was classified as critical, was found in Netgear JWNR2000v2 1.0.0.11. This affects the function sub_41A914. The manipulation of the argu… |
CVE-2025-4116 | High | 8.8 | 2025-04-30 | A vulnerability, which was classified as critical, has been found in Netgear JWNR2000v2 1.0.0.11. Affected by this issue is the function get_cur_lang_ver. The… |
CVE-2025-4115 | High | 8.8 | 2025-04-30 | A vulnerability classified as critical was found in Netgear JWNR2000v2 1.0.0.11. Affected by this vulnerability is the function default_version_is_new. The man… |
CVE-2025-45020 | High | 7.2 | 2025-04-30 | A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerabi… |
CVE-2025-45007 | Medium | 4.8 | 2025-04-30 | A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the profile.php file of PHPGurukul Timetable Generator System v1.0. This vulnerability a… |
CVE-2025-3395 | High | 7.1 | 2025-04-30 | Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Au… |
CVE-2025-3394 | High | 7.8 | 2025-04-30 | Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0. |
CVE-2025-4114 | High | 8.8 | 2025-04-30 | A vulnerability classified as critical has been found in Netgear JWNR2000v2 1.0.0.11. Affected is the function check_language_file. The manipulation of the arg… |
CVE-2025-27532 | Medium | 6.5 | 2025-04-30 | A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access sec… |
CVE-2025-24351 | High | 8.8 | 2025-04-30 | A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to execute arb… |
CVE-2025-24350 | High | 7.1 | 2025-04-30 | A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to writ… |
CVE-2025-24349 | High | 7.1 | 2025-04-30 | A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to delete t… |
CVE-2025-24348 | Medium | 5.4 | 2025-04-30 | A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipul… |
CVE-2025-24347 | Medium | 6.5 | 2025-04-30 | A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipul… |
CVE-2025-24346 | High | 7.5 | 2025-04-30 | A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to manipulate the “/etc/… |
CVE-2025-24345 | Medium | 6.3 | 2025-04-30 | A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the “host… |
CVE-2025-24344 | Medium | 6.3 | 2025-04-30 | A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbitrary HTML tags an… |
CVE-2025-24343 | Medium | 5.4 | 2025-04-30 | A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arb… |
CVE-2025-24342 | Medium | 5.3 | 2025-04-30 | A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple cr… |
CVE-2025-24341 | Medium | 6.5 | 2025-04-30 | A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoS) condition on the… |
CVE-2025-4113 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2025-4112 | High | 7.3 | 2025-04-30 | A vulnerability was found in PHPGurukul Student Record System 3.20. It has been declared as critical. This vulnerability affects unknown code of the file /add-… |
CVE-2025-4111 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/v… |
CVE-2025-4110 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-24340 | Medium | 6.5 | 2025-04-30 | A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of ot… |
CVE-2025-24339 | Medium | 5.0 | 2025-04-30 | A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system… |
CVE-2025-24338 | High | 7.1 | 2025-04-30 | A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to execute ar… |
CVE-2025-4109 | Medium | 6.3 | 2025-04-30 | A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-4108 | High | 7.3 | 2025-04-30 | A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Affected is an unknown function of the file /add-subject… |
CVE-2025-4125 | High | 7.8 | 2025-04-30 | Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsin… |
CVE-2025-4124 | High | 7.8 | 2025-04-30 | Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsin… |
CVE-2025-2890 | Medium | 6.5 | 2025-04-30 | The tagDiv Opt-In Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘subscriptionCouponId’ parameter in all versions up to, and in… |
CVE-2025-22884 | High | 7.8 | 2025-04-30 | Delta Electronics ISPSoft version 3.20 is vulnerable to a Stack-Based buffer overflow vulnerability that could allow an attacker to execute arbitrary code when… |
CVE-2025-22883 | High | 7.8 | 2025-04-30 | Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsin… |
CVE-2025-22882 | High | 7.8 | 2025-04-30 | Delta Electronics ISPSoft version 3.20 is vulnerable to a Stack-Based buffer overflow vulnerability that could allow an attacker to leverage debugging logic to… |
CVE-2025-3953 | Medium | 5.4 | 2025-04-30 | The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2025-3471 | Medium | 4.9 | 2025-04-30 | The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributo… |
CVE-2025-46560 | Medium | 6.5 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critica… |
CVE-2025-32444 | Critical | 10.0 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration… |
CVE-2025-30202 | High | 7.5 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial… |
CVE-2025-46552 | | 2025-04-29 | KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on ver… | |
CVE-2025-29906 | High | 8.6 | 2025-04-29 | Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the `tty` configuration… |
CVE-2025-46550 | Medium | 4.3 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the `/?BazaR` endpoint and `idformulaire` parameter are vulnerable to cross-site scripting. An… |
CVE-2025-46549 | Medium | 4.3 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authentic… |
CVE-2025-46348 | Critical | 10.0 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication… |
CVE-2025-46344 | | 2025-04-29 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke… | |
CVE-2025-3910 | Medium | 5.4 | 2025-04-29 | A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirem… |
CVE-2025-3501 | High | 8.2 | 2025-04-29 | A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended. |
CVE-2025-4080 | Medium | 6.3 | 2025-04-29 | A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-4078 | Medium | 4.3 | 2025-04-29 | A vulnerability, which was classified as problematic, has been found in Wangshen SecGate 3600 2400. This issue affects some unknown processing of the file ?g=l… |
CVE-2025-0520 | | 2025-04-29 | An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code… | |
CVE-2025-4079 | High | 7.3 | 2025-04-29 | A vulnerability, which was classified as critical, was found in PCMan FTP Server up to 2.0.7. Affected is an unknown function of the component RENAME Command H… |
CVE-2025-4095 | | 2025-04-29 | Registry Access Management (RAM) is a security feature allowing administrators to restrict access for their developers to only allowed registries. When a MacOS… | |
CVE-2025-4077 | Medium | 5.3 | 2025-04-29 | A vulnerability classified as critical was found in code-projects School Billing System 1.0. This vulnerability affects the function searchrec. The manipulatio… |
CVE-2025-4076 | Medium | 6.3 | 2025-04-29 | A vulnerability classified as critical has been found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function easy_uci_set_option_string_0 of the file /cg… |
CVE-2025-4075 | Medium | 4.3 | 2025-04-29 | A vulnerability was found in VMSMan up to 20250416. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /login.p… |
CVE-2025-4074 | High | 7.3 | 2025-04-29 | A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-46350 | Low | 3.5 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authentic… |
CVE-2025-46349 | High | 7.6 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any… |
CVE-2025-46347 | Critical | 9.8 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki vulnerable to remote code execution. An arbitrary file write can be used to write a fi… |
CVE-2025-3911 | | 2025-04-29 | Recording of environment variables, configured for running containers, in Docker Desktop application logs could lead to unintentional disclosure of sensitive i… | |
CVE-2025-4073 | High | 7.3 | 2025-04-29 | A vulnerability was found in PHPGurukul Student Record System 3.20. It has been classified as critical. Affected is an unknown function of the file /change-pas… |
CVE-2025-4072 | Medium | 6.3 | 2025-04-29 | A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This issue affects some unknown processing of the file /admi… |
CVE-2025-45956 | High | 8.8 | 2025-04-29 | A SQL injection vulnerability in manage_damage.php in Sourcecodester Computer Laboratory Management System v1.0 allows an authenticated attacker to execute arb… |
CVE-2025-23181 | High | 8.0 | 2025-04-29 | CWE-250: Execution with Unnecessary Privileges |
CVE-2025-23180 | High | 8.0 | 2025-04-29 | CWE-250: Execution with Unnecessary Privileges |
CVE-2025-0716 | Medium | 4.8 | 2025-04-29 | Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image sou… |
CVE-2025-4071 | High | 7.3 | 2025-04-29 | A vulnerability has been found in PHPGurukul COVID19 Testing Management System 1.0 and classified as critical. This vulnerability affects unknown code of the f… |
CVE-2025-4070 | High | 7.3 | 2025-04-29 | A vulnerability, which was classified as critical, was found in PHPGurukul Rail Pass Management System 1.0. This affects an unknown part of the file /admin/cha… |
CVE-2025-4069 | Medium | 5.3 | 2025-04-29 | A vulnerability, which was classified as critical, has been found in code-projects Product Management System 1.0. Affected by this issue is the function add_it… |