2025 CVEs (page 335)
Page 335 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3970 | Low | 3.5 | 2025-04-27 | A vulnerability classified as problematic has been found in baseweb JSite up to 1.0. Affected is an unknown function of the file /sys/office/save. The manipula… |
CVE-2025-3969 | Medium | 6.3 | 2025-04-27 | A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2025-3968 | Medium | 6.3 | 2025-04-27 | A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been declared as critical. This vulnerability affects unknown code of the… |
CVE-2025-3967 | Medium | 5.4 | 2025-04-27 | A vulnerability was found in itwanger paicoding 1.0.3. It has been classified as critical. This affects an unknown part of the file /article/api/post of the co… |
CVE-2025-3886 | High | 8.1 | 2025-04-27 | An issue in CatoNetworks CatoClient before v.5.8.0 allows attackers to escalate privileges and achieve a race condition (TOCTOU) via the PrivilegedHelperTool c… |
CVE-2025-3966 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/hom… |
CVE-2025-3965 | Low | 3.5 | 2025-04-27 | A vulnerability has been found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-3964 | Medium | 4.3 | 2025-04-27 | A vulnerability, which was classified as problematic, was found in withstars Books-Management-System 1.0. Affected is an unknown function of the file /api/arti… |
CVE-2025-3963 | High | 7.3 | 2025-04-27 | A vulnerability, which was classified as critical, has been found in withstars Books-Management-System 1.0. This issue affects some unknown processing of the f… |
CVE-2025-3962 | Low | 3.5 | 2025-04-27 | A vulnerability classified as problematic was found in withstars Books-Management-System 1.0. This vulnerability affects unknown code of the file /api/comment/… |
CVE-2025-3961 | Low | 3.5 | 2025-04-27 | A vulnerability classified as problematic has been found in withstars Books-Management-System 1.0. This affects an unknown part of the file /admin/article/add/… |
CVE-2025-3960 | High | 7.3 | 2025-04-27 | A vulnerability was found in withstars Books-Management-System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-3959 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in withstars Books-Management-System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functiona… |
CVE-2025-3958 | Low | 3.5 | 2025-04-27 | A vulnerability was found in withstars Books-Management-System 1.0. It has been classified as problematic. Affected is an unknown function of the file /book_ed… |
CVE-2025-3957 | Medium | 6.3 | 2025-04-27 | A vulnerability was found in opplus springboot-admin 1.0 and classified as critical. This issue affects some unknown processing of the file \src\main\resources… |
CVE-2025-3956 | Medium | 6.3 | 2025-04-27 | A vulnerability has been found in 201206030 novel-cloud 1.4.0 and classified as critical. This vulnerability affects the function RestResp of the file novel-cl… |
CVE-2025-46580 | High | 7.7 | 2025-04-27 | There is a code-related vulnerability in the GoldenDB database product. Attackers can access system tables to disrupt the normal operation of business SQL. |
CVE-2025-46579 | High | 8.4 | 2025-04-27 | There is a DDE injection vulnerability in the GoldenDB database product. Attackers can inject DDE expressions through the interface, and when users download an… |
CVE-2025-46578 | Medium | 6.5 | 2025-04-27 | There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product. Attackers can exploit these interfaces to inject commands and… |
CVE-2025-46577 | Medium | 6.5 | 2025-04-27 | There is a SQL injection vulnerability in the GoldenDB database product. Attackers can inject commands to extract database information. |
CVE-2025-46576 | Medium | 5.4 | 2025-04-27 | There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Attackers can manipulate requests to bypass privilege restr… |
CVE-2025-46575 | Medium | 4.9 | 2025-04-27 | There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive inform… |
CVE-2025-46574 | Medium | 4.1 | 2025-04-27 | There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive inform… |
CVE-2025-46675 | Low | 3.5 | 2025-04-27 | In NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking. |
CVE-2025-46674 | Low | 3.5 | 2025-04-27 | NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended for use during flight), potentially leading to a keystream oracl… |
CVE-2025-46673 | Medium | 4.9 | 2025-04-27 | NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security p… |
CVE-2025-46672 | Low | 3.5 | 2025-04-27 | NASA CryptoLib before 1.3.2 does not check the OTAR crypto function returned status, potentially leading to spacecraft hijacking. |
CVE-2025-3955 | Medium | 6.3 | 2025-04-27 | A vulnerability, which was classified as critical, was found in codeprojects Patient Record Management System 1.0. This affects an unknown part of the file /ed… |
CVE-2025-46656 | Low | 2.9 | 2025-04-26 | python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This causes memory consu… |
CVE-2025-3954 | Low | 3.7 | 2025-04-26 | A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Affected by this issue is some unknown functionality of the component… |
CVE-2025-46655 | Medium | 4.9 | 2025-04-26 | CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain c… |
CVE-2025-46654 | Medium | 4.9 | 2025-04-26 | CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file tha… |
CVE-2025-46653 | Low | 3.1 | 2025-04-26 | Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, he… |
CVE-2025-46652 | Medium | 6.1 | 2025-04-26 | In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark… |
CVE-2025-46646 | Medium | 4.5 | 2025-04-26 | In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix f… |
CVE-2025-2101 | High | 8.1 | 2025-04-26 | The Edumall theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.4 via the 'template' parameter of the 'edumall_… |
CVE-2025-2851 | High | 8.0 | 2025-04-26 | A vulnerability classified as critical has been found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate… |
CVE-2025-2850 | Low | 3.5 | 2025-04-26 | A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT180… |
CVE-2025-2811 | Medium | 5.7 | 2025-04-26 | A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT180… |
CVE-2025-3915 | Medium | 4.3 | 2025-04-26 | The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aeropageDeletePost' fu… |
CVE-2025-3914 | High | 8.8 | 2025-04-26 | The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aeropage_media_download… |
CVE-2025-3906 | High | 8.8 | 2025-04-26 | The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wep_… |
CVE-2025-3491 | High | 7.2 | 2025-04-26 | The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2… |
CVE-2025-2907 | Critical | 9.8 | 2025-04-26 | The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper ch… |
CVE-2025-2105 | High | 8.1 | 2025-04-26 | The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted inp… |
CVE-2025-1458 | Medium | 6.4 | 2025-04-26 | The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2025-2801 | High | 7.3 | 2025-04-26 | The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in… |
CVE-2025-46333 | | 2025-04-25 | z2d is a pure Zig 2D graphics library. Versions of z2d after `0.5.1` and up to and including `0.6.0`, when writing from one surface to another using `z2d.compo… | |
CVE-2025-32986 | High | 7.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint. |
CVE-2025-32985 | Critical | 9.8 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files. |
CVE-2025-32984 | Medium | 6.1 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows Stored Cross-Site Scripting (XSS) via a certain POST parameter. |
CVE-2025-32983 | High | 7.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows Technical Information Disclosure via a Stack Trace. |
CVE-2025-32982 | High | 7.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module. |
CVE-2025-32981 | High | 7.1 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows local users to leverage Insecure Permissions for the nGeniusCLI File. |
CVE-2025-32980 | Critical | 9.8 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 P11 b3245 has a Weak Sudo Configuration. |
CVE-2025-32979 | Medium | 6.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows Arbitrary File Creation by authenticated users. |
CVE-2025-28128 | High | 7.0 | 2025-04-25 | An issue in Mytel Telecom Online Account System v1.0 allows attackers to bypass the OTP verification process via a crafted request. |
CVE-2025-3935 | High | 8.1 | 2025-04-25 | ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page an… |
CVE-2025-25775 | Critical | 9.8 | 2025-04-25 | Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder. |
CVE-2025-3928 | High | 8.8 | 2025-04-25 | Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webserve… |
CVE-2025-2070 | Medium | 5.0 | 2025-04-25 | An improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary file reads on the system if a crafted url is visited by a loc… |
CVE-2025-2069 | Medium | 5.0 | 2025-04-25 | A cross-site scripting vulnerability was reported in the FileZ client that could allow execution of code if a crafted url is visited by a local user. |
CVE-2025-2068 | Medium | 5.0 | 2025-04-25 | An open redirect vulnerability was reported in the FileZ client that could allow information disclosure if a crafted url is visited by a local user. |
CVE-2025-46618 | Low | 3.5 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab |
CVE-2025-46433 | Medium | 4.9 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible |
CVE-2025-46432 | Medium | 4.3 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs |
CVE-2025-43862 | High | 7.6 | 2025-04-25 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web… |
CVE-2025-43016 | Medium | 5.4 | 2025-04-25 | In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session |
CVE-2025-3647 | Medium | 4.3 | 2025-04-25 | A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve. |
CVE-2025-3645 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses. |
CVE-2025-3644 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify. |
CVE-2025-3643 | Medium | 5.4 | 2025-04-25 | A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk. |
CVE-2025-3642 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers a… |
CVE-2025-3641 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers a… |
CVE-2025-3640 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and p… |
CVE-2025-3638 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSR… |
CVE-2025-3637 | Low | 3.1 | 2025-04-25 | A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through… |
CVE-2025-3636 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks. |
CVE-2025-3635 | Low | 3.5 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against… |
CVE-2025-3628 | Medium | 4.3 | 2025-04-25 | A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. |
CVE-2025-3627 | Medium | 4.3 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying thei… |
CVE-2025-3625 | High | 7.1 | 2025-04-25 | A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging i… |
CVE-2025-32432 | Critical | 10.0 | 2025-04-25 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-R… |
CVE-2025-32045 | Medium | 5.3 | 2025-04-25 | A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hi… |
CVE-2025-32044 | High | 7.5 | 2025-04-25 | A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, an… |
CVE-2025-28076 | Medium | 6.5 | 2025-04-25 | Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.4 and CO2Scope <= 1.3.4 allows remote authenticated attackers to execute arbitrary SQL comman… |
CVE-2025-3634 | Medium | 4.3 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Spec… |
CVE-2025-28354 | Medium | 6.5 | 2025-04-25 | An issue in the Printer Manager Systm of Entrust Corp Printer Manager D3.18.4-3 and below allows attackers to execute a directory traversal via a crafted POST… |
CVE-2025-3912 | Medium | 5.3 | 2025-04-25 | The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability… |
CVE-2025-2986 | Medium | 5.5 | 2025-04-25 | IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript cod… |
CVE-2025-2470 | Critical | 9.8 | 2025-04-25 | The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation i… |
CVE-2025-1565 | High | 7.5 | 2025-04-25 | The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_… |
CVE-2025-3870 | Medium | 6.1 | 2025-04-25 | The 1 Decembrie 1918 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.dec.2012. This is due to missing… |
CVE-2025-1279 | High | 8.8 | 2025-04-25 | The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capabilit… |
CVE-2025-46535 | Medium | 5.4 | 2025-04-25 | Missing Authorization vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-46482 | Medium | 6.5 | 2025-04-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyThemeShop WP Quiz wp-quiz allows Stored XSS.This issue… |
CVE-2025-46617 | High | 7.2 | 2025-04-25 | Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration paramet… |
CVE-2025-46616 | Critical | 9.9 | 2025-04-25 | Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file. This affects StorNext RYO before 7.2.4… |
CVE-2025-3868 | Medium | 6.1 | 2025-04-25 | The Custom Admin-Bar Favorites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menuObject' parameter in all versions up to, and i… |
CVE-2025-3867 | Medium | 6.1 | 2025-04-25 | The Ajax Comment Form CST plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or… |