2025 CVEs (page 337)
Page 337 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-46453 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreatorTeam Zoho Creator Forms allows Stored XSS. This is… |
CVE-2025-46452 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Olav Kolbu Google News allows Stored XSS. This issue affects Google News: from n/a through 2.5.1. |
CVE-2025-46451 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Floating Social Bar floating-social-bar allow… |
CVE-2025-46450 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in x000x occupancyplan occupancyplan allows Stored XSS.This issue affects occupancyplan: from n/a through <= 1… |
CVE-2025-46449 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Novium WoWHead Tooltips wowhead-tooltips allows Stored XS… |
CVE-2025-46447 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFable Fable Extra fable-extra allows DOM-Based XSS.This… |
CVE-2025-46445 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pReya External Markdown external-markdown allows Stored X… |
CVE-2025-46443 | Medium | 4.9 | 2025-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Adam Pery Animate animate allows Server Side Request Forgery.This issue affects Animate: from n/a through <… |
CVE-2025-46442 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Casey Johnson Loan Calculator repayment-calculator allows Stored XSS.This issue affects Loan Calculator: fro… |
CVE-2025-46439 | High | 7.4 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Plugin Central plugin-central allows Path Traversal.This issue affects Plugin Central: fro… |
CVE-2025-46438 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in warmwhisky GTDB Guitar Tuners guitar-tuner allows Stored… |
CVE-2025-46436 | Medium | 4.3 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Sebastian Echeverry SCSS-Library scss-library allows Cross Site Request Forgery.This issue affects SCSS-Libr… |
CVE-2025-46435 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Yash Binani Time Based Greeting time-based-greeting allows Stored XSS.This issue affects Time Based Greeting… |
CVE-2025-46264 | Critical | 9.9 | 2025-04-24 | Unrestricted Upload of File with Dangerous Type vulnerability in blubrry PowerPress Podcasting powerpress allows Upload a Web Shell to a Web Server.This issue… |
CVE-2025-46261 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple… |
CVE-2025-46260 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor sky-elementor-addons all… |
CVE-2025-46248 | Critical | 9.3 | 2025-04-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard al… |
CVE-2025-46234 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Razib Control Listings control-listings al… |
CVE-2025-46230 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GhozyLab Popup Builder easy-notify-lit… |
CVE-2025-39408 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress BruteGuard – Brute Force Login Protection brute… |
CVE-2025-39404 | Medium | 4.7 | 2025-04-24 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Phishing.This issue affects S… |
CVE-2025-39400 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Refl… |
CVE-2025-39399 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashraful Sarkar Naiem License For Enva… |
CVE-2025-39397 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus@hotmail.com Anything Popup anything-popup allows… |
CVE-2025-39391 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zamartz Checkout Field Visibility for… |
CVE-2025-39390 | Medium | 5.3 | 2025-04-24 | Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Accessing Functionality Not… |
CVE-2025-39387 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpoperations Opstore opstore allows PH… |
CVE-2025-39385 | Medium | 4.3 | 2025-04-24 | Missing Authorization vulnerability in vowelweb Sirat sirat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sirat: f… |
CVE-2025-39384 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cedcommerce Product Lister for eBay pr… |
CVE-2025-39383 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb Xews Lite xews-lite allows… |
CVE-2025-39382 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in danielpataki ACF: Google Font Selector acf-google-font-se… |
CVE-2025-39381 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Kiotviet KiotViet Sync allows Stored XSS. This issue affects KiotViet Sync: from n/a through 1.8.4. |
CVE-2025-39379 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Capturly Capturly capturly-optimize-yo… |
CVE-2025-39378 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Holest Engineering Spreadsheet Price C… |
CVE-2025-39377 | High | 8.5 | 2025-04-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Appsero Helper appsero-helper allows SQL Injection… |
CVE-2025-39360 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in everestthemes Grace Mag grace-mag allo… |
CVE-2025-39359 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb CWW Portfolio cww-portfoli… |
CVE-2025-32921 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpoperations Arrival arrival allows PH… |
CVE-2025-44135 | Medium | 6.5 | 2025-04-24 | A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 in /Scheduling/pages/profile_update.php. Manipulating the parameter user… |
CVE-2025-44134 | Medium | 6.5 | 2025-04-24 | A vulnerability was found in Code-Projects Online Class and Exam Scheduling System 1.0 in the file /Scheduling/pages/class_save.php. Manipulation of parameter… |
CVE-2025-29568 | Medium | 4.8 | 2025-04-24 | A vulnerability has been discovered in the code-projects Online Class and Exam Scheduling System 1.0. The issue affects some unknown features in the file /Sche… |
CVE-2025-43855 | | 2025-04-24 | tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled er… | |
CVE-2025-30409 | Medium | 5.5 | 2025-04-24 | Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build… |
CVE-2025-30408 | Medium | 6.7 | 2025-04-24 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39… |
CVE-2025-46421 | Medium | 6.8 | 2025-04-24 | A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redir… |
CVE-2025-46420 | Medium | 6.5 | 2025-04-24 | A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elemen… |
CVE-2025-27820 | High | 7.5 | 2025-04-24 | A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apac… |
CVE-2025-3872 | High | 7.2 | 2025-04-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) a… |
CVE-2025-3832 | Medium | 6.4 | 2025-04-24 | The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘successredirect’ parameter in all versions up to, and including, 6.7 du… |
CVE-2025-3793 | Medium | 4.2 | 2025-04-24 | The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's id… |
CVE-2025-3776 | High | 8.3 | 2025-04-24 | The Verification SMS with TargetSMS plugin for WordPress is vulnerable to limited Remote Code Execution in all versions up to, and including, 1.5 via the 'targ… |
CVE-2025-3607 | High | 8.8 | 2025-04-24 | The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including… |
CVE-2025-3604 | Critical | 9.8 | 2025-04-24 | The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to t… |
CVE-2025-3603 | Critical | 9.8 | 2025-04-24 | The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to t… |
CVE-2025-3300 | High | 7.2 | 2025-04-24 | The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2. This mak… |
CVE-2025-3280 | Medium | 6.5 | 2025-04-24 | The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value_filter' para… |
CVE-2025-3101 | High | 8.8 | 2025-04-24 | The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.7. This is due to the plugin n… |
CVE-2025-3065 | Critical | 9.1 | 2025-04-24 | The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and includin… |
CVE-2025-3058 | High | 8.8 | 2025-04-24 | The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability ch… |
CVE-2025-2579 | Medium | 6.4 | 2025-04-24 | The Lottie Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 1.1.8 due to insuffi… |
CVE-2025-2543 | Medium | 6.4 | 2025-04-24 | The Advanced Accordion Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ… |
CVE-2025-1284 | Medium | 4.3 | 2025-04-24 | The Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) plugin for WordPress is vulnerable to Insecure Direct Object Reference in… |
CVE-2025-1908 | High | 7.7 | 2025-04-24 | An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, a… |
CVE-2025-0639 | Medium | 6.5 | 2025-04-24 | An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7, 17.10 before 17.1… |
CVE-2025-41423 | Low | 3.1 | 2025-04-24 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/… |
CVE-2025-41395 | Medium | 6.5 | 2025-04-24 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in… |
CVE-2025-3761 | High | 8.8 | 2025-04-24 | The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.16. This is du… |
CVE-2025-35965 | Medium | 6.5 | 2025-04-24 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTask… |
CVE-2025-32730 | Medium | 5.5 | 2025-04-24 | Use of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network system for i-PRO Co., Ltd. surveillance cameras and recorders… |
CVE-2025-2558 | High | 8.6 | 2025-04-24 | The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenti… |
CVE-2025-1453 | Medium | 4.8 | 2025-04-24 | The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2025-3435 | Medium | 4.4 | 2025-04-24 | The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the board_header and board_footer parameters in all versions up to, and… |
CVE-2025-1976 | Medium | 6.7 | 2025-04-24 | Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with… |
CVE-2025-46419 | Medium | 5.9 | 2025-04-24 | Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet. |
CVE-2025-46417 | High | 7.5 | 2025-04-24 | The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS after deserialization. |
CVE-2025-27581 | Medium | 4.3 | 2025-04-24 | NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct req… |
CVE-2025-27580 | High | 7.5 | 2025-04-24 | NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7… |
CVE-2025-25046 | Low | 3.7 | 2025-04-23 | IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be exposed to an unauth… |
CVE-2025-25045 | Medium | 4.3 | 2025-04-23 | IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. Th… |
CVE-2025-46400 | Medium | 5.5 | 2025-04-23 | In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via read_arcobject functio… |
CVE-2025-46399 | Medium | 5.5 | 2025-04-23 | A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function. |
CVE-2025-46398 | Medium | 5.5 | 2025-04-23 | In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects function. |
CVE-2025-46397 | High | 7.8 | 2025-04-23 | A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function. |
CVE-2025-32818 | High | 7.5 | 2025-04-23 | A Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a remote, unauthenticated attacker to crash the firewall, potent… |
CVE-2025-28169 | High | 8.1 | 2025-04-23 | BYD QIN PLUS DM-i Dilink OS v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0 was discovered to cend broadcasts to the manufacturer's cloud server unencrypted… |
CVE-2025-3907 | Medium | 4.3 | 2025-04-23 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 befo… |
CVE-2025-3904 | High | 7.3 | 2025-04-23 | Vulnerability in Drupal Sportsleague.This issue affects Sportsleague: *.*. |
CVE-2025-3903 | High | 7.3 | 2025-04-23 | Vulnerability in Drupal UEditor - 百度编辑器.This issue affects UEditor - 百度编辑器: *.*. |
CVE-2025-3902 | Medium | 6.1 | 2025-04-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site Scripting (XSS).This… |
CVE-2025-3901 | Medium | 6.1 | 2025-04-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Bootstrap Site Alert allows Cross-Site Scripting (… |
CVE-2025-3900 | Medium | 6.1 | 2025-04-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS).This is… |
CVE-2025-2773 | High | 7.2 | 2025-04-23 | BEC Technologies Multiple Routers sys ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-2772 | Medium | 6.5 | 2025-04-23 | BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attacke… |
CVE-2025-2771 | Medium | 5.3 | 2025-04-23 | BEC Technologies Multiple Routers Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installa… |
CVE-2025-2770 | Medium | 6.5 | 2025-04-23 | BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensi… |
CVE-2025-2769 | High | 7.8 | 2025-04-23 | Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2025-2768 | High | 7.8 | 2025-04-23 | Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2025-2767 | Critical | 9.6 | 2025-04-23 | Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2025-2765 | High | 8.8 | 2025-04-23 | CarlinKit CPC200-CCPA Wireless Hotspot Hard-Coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypa… |
CVE-2025-2764 | High | 8.0 | 2025-04-23 | CarlinKit CPC200-CCPA update.cgi Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows network-adjacent atta… |