2025 CVEs (page 335)
Page 335 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4068 | Medium | 5.3 | 2025-04-29 | A vulnerability classified as critical was found in code-projects Simple Movie Ticket Booking System 1.0. Affected by this vulnerability is the function change… |
CVE-2025-46346 | Medium | 5.4 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, a stored cross-site scripting (XSS) vulnerability was discovered in the application’s comments… |
CVE-2025-40619 | High | 7.5 | 2025-04-29 | Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentic… |
CVE-2025-40618 | Critical | 9.8 | 2025-04-29 | SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request t… |
CVE-2025-40617 | Critical | 9.8 | 2025-04-29 | SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request t… |
CVE-2025-40616 | Medium | 6.1 | 2025-04-29 | Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sendi… |
CVE-2025-40615 | Medium | 6.1 | 2025-04-29 | Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sendi… |
CVE-2025-32354 | High | 8.8 | 2025-04-29 | In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) o… |
CVE-2025-25962 | Critical | 9.8 | 2025-04-29 | An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function |
CVE-2025-25403 | Critical | 9.8 | 2025-04-29 | Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php. |
CVE-2025-23179 | Medium | 5.5 | 2025-04-29 | CWE-798: Use of Hard-coded Credentials |
CVE-2025-23178 | High | 7.6 | 2025-04-29 | CWE-923: Improper Restriction of Communication Channel to Intended Endpoints |
CVE-2025-23177 | High | 7.6 | 2025-04-29 | CWE-427: Uncontrolled Search Path Element |
CVE-2025-1551 | Medium | 6.1 | 2025-04-29 | IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, and 9.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated… |
CVE-2025-4067 | Medium | 5.3 | 2025-04-29 | A vulnerability classified as critical has been found in ScriptAndTools Online-Travling-System 1.0. Affected is an unknown function of the file /admin/viewpack… |
CVE-2025-4066 | High | 7.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /… |
CVE-2025-4065 | High | 7.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /… |
CVE-2025-4093 | High | 8.1 | 2025-04-29 | Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort thi… |
CVE-2025-4092 | Medium | 6.5 | 2025-04-29 | Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-4091 | High | 8.1 | 2025-04-29 | Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption a… |
CVE-2025-4090 | Medium | 5.3 | 2025-04-29 | A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefo… |
CVE-2025-4089 | Medium | 5.1 | 2025-04-29 | Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading t… |
CVE-2025-4088 | Medium | 6.5 | 2025-04-29 | A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invo… |
CVE-2025-4087 | Medium | 4.8 | 2025-04-29 | A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This cou… |
CVE-2025-4086 | Medium | 6.5 | 2025-04-29 | A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. … |
CVE-2025-4085 | High | 7.1 | 2025-04-29 | An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. Th… |
CVE-2025-4084 | Medium | 5.7 | 2025-04-29 | Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leadi… |
CVE-2025-4083 | Critical | 9.1 | 2025-04-29 | A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level docu… |
CVE-2025-4082 | Medium | 5.9 | 2025-04-29 | Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate… |
CVE-2025-4064 | Medium | 5.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/vie… |
CVE-2025-4063 | Medium | 5.3 | 2025-04-29 | A vulnerability was found in code-projects Student Information Management System 1.0 and classified as critical. Affected by this issue is the function cancel… |
CVE-2025-4062 | Medium | 5.3 | 2025-04-29 | A vulnerability has been found in code-projects Theater Seat Booking System 1.0 and classified as critical. Affected by this vulnerability is the function canc… |
CVE-2025-3301 | | 2025-04-29 | DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on all Series 2 modules and SoCs due to a la… | |
CVE-2025-2817 | High | 8.8 | 2025-04-29 | Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By… |
CVE-2025-4061 | Medium | 5.3 | 2025-04-29 | A vulnerability, which was classified as critical, was found in code-projects Clothing Store Management System up to 1.0. Affected is the function add_item. Th… |
CVE-2025-4060 | High | 7.3 | 2025-04-29 | A vulnerability, which was classified as critical, has been found in PHPGurukul Notice Board System 1.0. This issue affects some unknown processing of the file… |
CVE-2025-4035 | Medium | 4.3 | 2025-04-29 | A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at leas… |
CVE-2025-4059 | Medium | 5.3 | 2025-04-29 | A vulnerability classified as critical was found in code-projects Prison Management System 1.0. This vulnerability affects the function addrecord of the compon… |
CVE-2025-4058 | High | 7.3 | 2025-04-29 | A vulnerability classified as critical has been found in Projectworlds Online Examination System 1.0. This affects an unknown part of the file /Bloodgroop_proc… |
CVE-2025-3929 | Medium | 6.1 | 2025-04-29 | An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in a… |
CVE-2025-3891 | High | 7.5 | 2025-04-29 | A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending… |
CVE-2025-30194 | High | 7.5 | 2025-04-29 | When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illeg… |
CVE-2025-1194 | Medium | 6.5 | 2025-04-29 | A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt… |
CVE-2025-3452 | Medium | 4.3 | 2025-04-29 | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'secup… |
CVE-2025-2893 | Medium | 6.4 | 2025-04-29 | The Gutenverse – Ultimate Block Addons and Page Builder for Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's coun… |
CVE-2025-46343 | Medium | 5.0 | 2025-04-29 | n8n is a workflow automation platform. Prior to version 1.90.0, n8n is vulnerable to stored cross-site scripting (XSS) through the attachments view endpoint. n… |
CVE-2025-46338 | Medium | 6.1 | 2025-04-29 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.21.0, an improper input handling vulnerability in the `/api/upload` endpoint a… |
CVE-2025-46330 | Low | 3.3 | 2025-04-29 | libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, incorrectly treat malformed requests that caused the HTT… |
CVE-2025-46329 | Low | 3.3 | 2025-04-29 | libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information… |
CVE-2025-31203 | Medium | 6.5 | 2025-04-29 | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Son… |
CVE-2025-31202 | Medium | 5.5 | 2025-04-29 | A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, vision… |
CVE-2025-31197 | Medium | 5.7 | 2025-04-29 | The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ve… |
CVE-2025-30445 | Medium | 6.5 | 2025-04-29 | A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14… |
CVE-2025-24271 | Medium | 5.4 | 2025-04-29 | An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sono… |
CVE-2025-24270 | Medium | 5.7 | 2025-04-29 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7… |
CVE-2025-24252 | High | 8.8 | 2025-04-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS… |
CVE-2025-24251 | Medium | 6.5 | 2025-04-29 | The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ve… |
CVE-2025-24206 | High | 7.7 | 2025-04-29 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS… |
CVE-2025-24179 | Medium | 5.7 | 2025-04-29 | A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, ma… |
CVE-2025-46328 | Low | 3.3 | 2025-04-28 | snowflake-connector-nodejs is a NodeJS driver for Snowflake. Versions starting from 1.10.0 to before 2.0.4, are vulnerable to a Time-of-Check to Time-of-Use (T… |
CVE-2025-46327 | Low | 3.3 | 2025-04-28 | gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condi… |
CVE-2025-46326 | Low | 3.3 | 2025-04-28 | snowflake-connector-net is the Snowflake Connector for .NET. Versions starting from 2.1.2 to before 4.4.1, are vulnerable to a Time-of-Check to Time-of-Use (TO… |
CVE-2025-4039 | High | 7.3 | 2025-04-28 | A vulnerability was found in PHPGurukul Rail Pass Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-4038 | Medium | 5.3 | 2025-04-28 | A vulnerability was found in code-projects Train Ticket Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is the functio… |
CVE-2025-4037 | Medium | 4.4 | 2025-04-28 | A vulnerability was found in code-projects ATM Banking 1.0. It has been classified as critical. Affected is the function moneyDeposit/moneyWithdraw. The manipu… |
CVE-2025-0049 | Low | 3.5 | 2025-04-28 | When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server p… |
CVE-2025-4036 | Medium | 6.3 | 2025-04-28 | A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/g… |
CVE-2025-4034 | High | 7.3 | 2025-04-28 | A vulnerability classified as critical was found in projectworlds Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-45953 | Critical | 9.1 | 2025-04-28 | A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component. Imp… |
CVE-2025-45949 | Critical | 9.8 | 2025-04-28 | A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the… |
CVE-2025-45947 | Critical | 9.8 | 2025-04-28 | An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/change-password.php file of the My Account… |
CVE-2025-3224 | High | 7.8 | 2025-04-28 | A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged attacker to escalate privilege… |
CVE-2025-34491 | High | 8.8 | 2025-04-28 | GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbitrary code by sendi… |
CVE-2025-31651 | Critical | 9.8 | 2025-04-28 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was poss… |
CVE-2025-31650 | High | 7.5 | 2025-04-28 | Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of th… |
CVE-2025-4033 | High | 7.3 | 2025-04-28 | A vulnerability classified as critical has been found in PHPGurukul Nipah Virus Testing Management System 1.0. Affected is an unknown function of the file /pat… |
CVE-2025-4032 | Medium | 5.0 | 2025-04-28 | A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function… |
CVE-2025-34490 | Medium | 6.5 | 2025-04-28 | GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP reques… |
CVE-2025-34489 | High | 7.8 | 2025-04-28 | GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a… |
CVE-2025-4031 | High | 7.3 | 2025-04-28 | A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2025-4030 | High | 7.3 | 2025-04-28 | A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been classified as critical. This affects an unknown part of the file /se… |
CVE-2025-4029 | Medium | 5.3 | 2025-04-28 | A vulnerability was found in code-projects Personal Diary Management System 1.0 and classified as critical. Affected by this issue is the function addrecord of… |
CVE-2025-4028 | High | 7.3 | 2025-04-28 | A vulnerability has been found in PHPGurukul COVID19 Testing Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-4027 | High | 7.3 | 2025-04-28 | A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /adm… |
CVE-2025-4026 | High | 7.3 | 2025-04-28 | A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown proc… |
CVE-2025-46614 | Low | 3.3 | 2025-04-28 | In Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL query at the INFO level, aka Insertion of Sensitive Information i… |
CVE-2025-43857 | Medium | 6.5 | 2025-04-28 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possib… |
CVE-2025-43854 | Medium | 6.1 | 2025-04-28 | DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY applicatio… |
CVE-2025-4025 | High | 7.3 | 2025-04-28 | A vulnerability classified as critical was found in itsourcecode Placement Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-4024 | High | 7.3 | 2025-04-28 | A vulnerability classified as critical has been found in itsourcecode Placement Management System 1.0. Affected is an unknown function of the file /add_drive.p… |
CVE-2025-25776 | Medium | 5.0 | 2025-04-28 | Cross-Site Scripting (XSS) vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1.0 allows an attack… |
CVE-2025-23377 | Medium | 4.2 | 2025-04-28 | Dell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability. A high privileged attack… |
CVE-2025-23376 | Low | 2.3 | 2025-04-28 | Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine v… |
CVE-2025-23375 | High | 7.8 | 2025-04-28 | Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability. A low privileged attacker with local… |
CVE-2025-4023 | High | 7.3 | 2025-04-28 | A vulnerability was found in itsourcecode Placement Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fil… |
CVE-2025-4022 | Medium | 6.3 | 2025-04-28 | A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMLContentEvaluator o… |
CVE-2025-4021 | Medium | 6.3 | 2025-04-28 | A vulnerability was found in code-projects Patient Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file /… |
CVE-2025-4020 | High | 7.3 | 2025-04-28 | A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-46661 | Critical | 10.0 | 2025-04-28 | IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions… |
CVE-2025-32472 | Medium | 5.3 | 2025-04-28 | The multiScan and picoScan are vulnerable to a denial-of-service (DoS) attack. A remote attacker can exploit this vulnerability by conducting a Slowloris-type… |