2025 CVEs (page 337)
Page 337 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2850 | Low | 3.5 | 2025-04-26 | A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT180… |
CVE-2025-2811 | Medium | 5.7 | 2025-04-26 | A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT180… |
CVE-2025-3915 | Medium | 4.3 | 2025-04-26 | The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aeropageDeletePost' fu… |
CVE-2025-3914 | High | 8.8 | 2025-04-26 | The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aeropage_media_download… |
CVE-2025-3906 | High | 8.8 | 2025-04-26 | The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wep_… |
CVE-2025-3491 | High | 7.2 | 2025-04-26 | The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2… |
CVE-2025-2907 | Critical | 9.8 | 2025-04-26 | The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper ch… |
CVE-2025-2105 | High | 8.1 | 2025-04-26 | The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted inp… |
CVE-2025-1458 | Medium | 6.4 | 2025-04-26 | The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2025-2801 | High | 7.3 | 2025-04-26 | The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in… |
CVE-2025-46333 | | 2025-04-25 | z2d is a pure Zig 2D graphics library. Versions of z2d after `0.5.1` and up to and including `0.6.0`, when writing from one surface to another using `z2d.compo… | |
CVE-2025-32986 | High | 7.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint. |
CVE-2025-32985 | Critical | 9.8 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files. |
CVE-2025-32984 | Medium | 6.1 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows Stored Cross-Site Scripting (XSS) via a certain POST parameter. |
CVE-2025-32983 | High | 7.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows Technical Information Disclosure via a Stack Trace. |
CVE-2025-32982 | High | 7.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module. |
CVE-2025-32981 | High | 7.1 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows local users to leverage Insecure Permissions for the nGeniusCLI File. |
CVE-2025-32980 | Critical | 9.8 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 P11 b3245 has a Weak Sudo Configuration. |
CVE-2025-32979 | Medium | 6.5 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows Arbitrary File Creation by authenticated users. |
CVE-2025-28128 | High | 7.0 | 2025-04-25 | An issue in Mytel Telecom Online Account System v1.0 allows attackers to bypass the OTP verification process via a crafted request. |
CVE-2025-3935 | High | 8.1 | 2025-04-25 | ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page an… |
CVE-2025-25775 | Critical | 9.8 | 2025-04-25 | Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder. |
CVE-2025-3928 | High | 8.8 | 2025-04-25 | Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webserve… |
CVE-2025-2070 | Medium | 5.0 | 2025-04-25 | An improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary file reads on the system if a crafted url is visited by a loc… |
CVE-2025-2069 | Medium | 5.0 | 2025-04-25 | A cross-site scripting vulnerability was reported in the FileZ client that could allow execution of code if a crafted url is visited by a local user. |
CVE-2025-2068 | Medium | 5.0 | 2025-04-25 | An open redirect vulnerability was reported in the FileZ client that could allow information disclosure if a crafted url is visited by a local user. |
CVE-2025-46618 | Low | 3.5 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab |
CVE-2025-46433 | Medium | 4.9 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible |
CVE-2025-46432 | Medium | 4.3 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs |
CVE-2025-43862 | High | 7.6 | 2025-04-25 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web… |
CVE-2025-43016 | Medium | 5.4 | 2025-04-25 | In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session |
CVE-2025-3647 | Medium | 4.3 | 2025-04-25 | A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve. |
CVE-2025-3645 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses. |
CVE-2025-3644 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify. |
CVE-2025-3643 | Medium | 5.4 | 2025-04-25 | A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk. |
CVE-2025-3642 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers a… |
CVE-2025-3641 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers a… |
CVE-2025-3640 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and p… |
CVE-2025-3638 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSR… |
CVE-2025-3637 | Low | 3.1 | 2025-04-25 | A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through… |
CVE-2025-3636 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks. |
CVE-2025-3635 | Low | 3.5 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against… |
CVE-2025-3628 | Medium | 4.3 | 2025-04-25 | A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. |
CVE-2025-3627 | Medium | 4.3 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying thei… |
CVE-2025-3625 | High | 7.1 | 2025-04-25 | A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging i… |
CVE-2025-32432 | Critical | 10.0 | 2025-04-25 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-R… |
CVE-2025-32045 | Medium | 5.3 | 2025-04-25 | A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hi… |
CVE-2025-32044 | High | 7.5 | 2025-04-25 | A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, an… |
CVE-2025-28076 | Medium | 6.5 | 2025-04-25 | Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.4 and CO2Scope <= 1.3.4 allows remote authenticated attackers to execute arbitrary SQL comman… |
CVE-2025-3634 | Medium | 4.3 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Spec… |
CVE-2025-28354 | Medium | 6.5 | 2025-04-25 | An issue in the Printer Manager Systm of Entrust Corp Printer Manager D3.18.4-3 and below allows attackers to execute a directory traversal via a crafted POST… |
CVE-2025-3912 | Medium | 5.3 | 2025-04-25 | The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability… |
CVE-2025-2986 | Medium | 5.5 | 2025-04-25 | IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript cod… |
CVE-2025-2470 | Critical | 9.8 | 2025-04-25 | The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation i… |
CVE-2025-1565 | High | 7.5 | 2025-04-25 | The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_… |
CVE-2025-3870 | Medium | 6.1 | 2025-04-25 | The 1 Decembrie 1918 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.dec.2012. This is due to missing… |
CVE-2025-1279 | High | 8.8 | 2025-04-25 | The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capabilit… |
CVE-2025-46535 | Medium | 5.4 | 2025-04-25 | Missing Authorization vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-46482 | Medium | 6.5 | 2025-04-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyThemeShop WP Quiz wp-quiz allows Stored XSS.This issue… |
CVE-2025-46617 | High | 7.2 | 2025-04-25 | Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration paramet… |
CVE-2025-46616 | Critical | 9.9 | 2025-04-25 | Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file. This affects StorNext RYO before 7.2.4… |
CVE-2025-3868 | Medium | 6.1 | 2025-04-25 | The Custom Admin-Bar Favorites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menuObject' parameter in all versions up to, and i… |
CVE-2025-3867 | Medium | 6.1 | 2025-04-25 | The Ajax Comment Form CST plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or… |
CVE-2025-3866 | Medium | 6.1 | 2025-04-25 | The Add Google +1 (Plus one) social share Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0… |
CVE-2025-3743 | Medium | 5.3 | 2025-04-25 | The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0. This is due to… |
CVE-2025-2238 | High | 8.8 | 2025-04-25 | The Vikinger theme for WordPress is vulnerable to privilege in all versions up to, and including, 1.9.30. This is due to insufficient user_meta restrictions in… |
CVE-2025-46613 | High | 7.5 | 2025-04-25 | OpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after the parent stack frame becomes unavail… |
CVE-2025-3923 | Medium | 5.3 | 2025-04-25 | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-3861 | Medium | 5.4 | 2025-04-25 | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access and modification of data| due to a misconfigured… |
CVE-2025-3511 | High | 7.5 | 2025-04-25 | Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-Link IE TSN Analog-Dig… |
CVE-2025-2580 | Medium | 4.9 | 2025-04-25 | The Contact Form by Bit Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.18… |
CVE-2025-0671 | Medium | 6.1 | 2025-04-25 | The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high privilege users such as… |
CVE-2025-46599 | Medium | 6.8 | 2025-04-25 | CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is se… |
CVE-2025-3775 | Medium | 6.5 | 2025-04-25 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Ser… |
CVE-2025-3752 | Medium | 6.4 | 2025-04-25 | The Able Player, accessible HTML5 media player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘preload’ parameter in all versions up… |
CVE-2025-46595 | Medium | 6.4 | 2025-04-25 | An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a module that allows flags to be added to nodes, comments, users, and… |
CVE-2025-46547 | Medium | 5.4 | 2025-04-25 | In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting XSS attacks, adding… |
CVE-2025-46546 | Low | 3.5 | 2025-04-25 | In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This affects api/gui/asset/list, /api/gui/fi… |
CVE-2025-46545 | Medium | 4.4 | 2025-04-25 | In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter… |
CVE-2025-46544 | Medium | 6.4 | 2025-04-25 | In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles. |
CVE-2025-43865 | High | 8.2 | 2025-04-25 | React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the r… |
CVE-2025-43864 | High | 7.5 | 2025-04-25 | React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by addin… |
CVE-2025-3606 | High | 7.5 | 2025-04-25 | Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing sensitive information, such as credenti… |
CVE-2025-2185 | High | 8.0 | 2025-04-25 | ALBEDO Telecom Net.Time - PTP/NTP clock (Serial No. NBC0081P) software release 1.4.4 is vulnerable to an insufficient session expiration vulnerability, which … |
CVE-2025-46275 | Critical | 9.8 | 2025-04-24 | WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing creden… |
CVE-2025-46274 | Critical | 9.8 | 2025-04-24 | UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database. |
CVE-2025-46273 | Critical | 9.8 | 2025-04-24 | UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices. |
CVE-2025-46272 | Critical | 9.1 | 2025-04-24 | WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host s… |
CVE-2025-46271 | Critical | 9.1 | 2025-04-24 | UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data. |
CVE-2025-3749 | Medium | 6.4 | 2025-04-24 | The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cal_size’ parameter in all versions up to, and including, 1.2.3 d… |
CVE-2025-1294 | High | 7.2 | 2025-04-24 | The eForm - WordPress Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.18.0 due to insuff… |
CVE-2025-43861 | Medium | 4.4 | 2025-04-24 | ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 2f177dc, ManageWiki is vulnerable to reflected or stored XSS in the review… |
CVE-2025-29529 | Medium | 6.5 | 2025-04-24 | ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component Forgotpassword.aspx. |
CVE-2025-25777 | High | 8.0 | 2025-04-24 | Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in… |
CVE-2025-26382 | | 2025-04-24 | Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issue | |
CVE-2025-43859 | Critical | 9.1 | 2025-04-24 | h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead… |
CVE-2025-43858 | Critical | 9.2 | 2025-04-24 | YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe c… |
CVE-2025-31324 | Critical | 10.0 | 2025-04-24 | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious ex… |
CVE-2025-46542 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeXpert Xpert Tab xpert-tab allows Stored XSS.This iss… |
CVE-2025-46541 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elrata_ WP-reCAPTCHA-bp wp-recaptcha-bp allows Stored XSS… |