2025 CVEs (page 339)
Page 339 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3472 | Medium | 6.5 | 2025-04-22 | The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software al… |
CVE-2025-3458 | Medium | 6.4 | 2025-04-22 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter in all versions up to, and including, 2… |
CVE-2025-3457 | Medium | 6.4 | 2025-04-22 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions up to, and includin… |
CVE-2025-2092 | High | 7.5 | 2025-04-22 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p29, <2.2.0p41 and <=2.1.0p49 (EOL) causes remote site authentication… |
CVE-2025-46254 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcom… |
CVE-2025-46253 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit gutenkit-blocks-addon allows Stored XSS… |
CVE-2025-46252 | High | 7.6 | 2025-04-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message… |
CVE-2025-46251 | High | 7.1 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Cross Site Request Forgery.This issue affects VikRestaurants… |
CVE-2025-46250 | Medium | 5.9 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUForm v-form allows Stored XSS.This issue… |
CVE-2025-46249 | Medium | 4.3 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor allows Cross Site Request Forgery.This i… |
CVE-2025-46247 | Medium | 5.3 | 2025-04-22 | Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constra… |
CVE-2025-46246 | Medium | 4.3 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Cross Site Request Forgery.This issue affects CM Answers… |
CVE-2025-46245 | Medium | 4.3 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Ad Changer cm-ad-changer allows Cross Site Request Forgery.This issue affects CM A… |
CVE-2025-46244 | Medium | 5.3 | 2025-04-22 | Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce linked-variation allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-46243 | Medium | 4.3 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows Cross Site Request Forg… |
CVE-2025-46242 | High | 7.6 | 2025-04-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affect… |
CVE-2025-46241 | High | 8.2 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects… |
CVE-2025-46240 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Download Counter simple-download-counte… |
CVE-2025-46239 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Theme Switcha theme-switcha allows Stored XSS… |
CVE-2025-46238 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer List Last Changes list-last-changes allows Stored X… |
CVE-2025-46237 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows Stored… |
CVE-2025-46236 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Stored XSS… |
CVE-2025-46235 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This… |
CVE-2025-46233 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sirv CDN and Image Hosting Sirv sirv allows Stored XSS.Th… |
CVE-2025-46232 | Medium | 4.3 | 2025-04-22 | Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-46231 | Medium | 5.4 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Cross Site Request Forgery.This… |
CVE-2025-46229 | Medium | 5.9 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Israpil Textmetrics webtexttool allows Stored XSS.This is… |
CVE-2025-46228 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows DOM-Based XSS.Thi… |
CVE-2025-46227 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brecht Custom Related Posts custom-related-posts allows S… |
CVE-2025-46226 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ferranfg MPL-Publisher mpl-publisher allows Stored XSS.Th… |
CVE-2025-46225 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Post in page for Elementor allows DOM-Based XSS… |
CVE-2025-3519 | | 2025-04-22 | An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file. Every uploaded file in Unblu gets assigne… | |
CVE-2025-3518 | Medium | 4.3 | 2025-04-22 | It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can… |
CVE-2025-26413 | High | 7.5 | 2025-04-22 | Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an inde… |
CVE-2025-3814 | Medium | 6.4 | 2025-04-22 | The Tax Switch for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class-name’ parameter in all versions up to, and incl… |
CVE-2025-2839 | Medium | 6.4 | 2025-04-22 | The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and inclu… |
CVE-2025-2594 | High | 8.1 | 2025-04-22 | The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowi… |
CVE-2025-3616 | High | 8.8 | 2025-04-22 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb… |
CVE-2025-2300 | Medium | 5.5 | 2025-04-22 | Hitachi Ops Center Common Services within Hitachi Ops Center OVA contains an information exposure vulnerability. This issue affects Hitachi Ops Center Common S… |
CVE-2025-3577 | Medium | 4.9 | 2025-04-22 | **UNSUPPORTED WHEN ASSIGNED** A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00(AAJC.16)C0 could a… |
CVE-2025-1732 | Medium | 6.7 | 2025-04-22 | An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an au… |
CVE-2025-1731 | High | 7.8 | 2025-04-22 | An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could… |
CVE-2025-3856 | Medium | 6.3 | 2025-04-22 | A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPag… |
CVE-2025-3855 | Medium | 4.3 | 2025-04-22 | A vulnerability was found in CodeCanyon RISE Ultimate Project Manager 3.8.2 and classified as problematic. Affected by this issue is some unknown functionality… |
CVE-2025-3854 | High | 8.0 | 2025-04-22 | A vulnerability, which was classified as critical, was found in H3C GR-3000AX up to V100R006. Affected is the function EnableIpv6/UpdateWanModeMulti/UpdateIpv6… |
CVE-2025-3850 | Low | 3.7 | 2025-04-22 | A vulnerability, which was classified as problematic, has been found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This issue affects some unknown processing of th… |
CVE-2025-3849 | Medium | 4.3 | 2025-04-22 | A vulnerability classified as problematic was found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This vulnerability affects unknown code of the file /api/studentP… |
CVE-2025-2987 | Low | 3.8 | 2025-04-22 | IBM Maximo Asset Management 7.6.1.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests… |
CVE-2025-3847 | High | 7.3 | 2025-04-21 | A vulnerability classified as critical has been found in markparticle WebServer up to 1.0. This affects an unknown part of the file code/http/httprequest.cpp o… |
CVE-2025-3846 | High | 7.3 | 2025-04-21 | A vulnerability was found in markparticle WebServer up to 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-3845 | High | 7.3 | 2025-04-21 | A vulnerability was found in markparticle WebServer up to 1.0. It has been declared as critical. Affected by this vulnerability is the function Buffer::HasWrit… |
CVE-2025-3843 | Medium | 4.3 | 2025-04-21 | A vulnerability was found in panhainan DS-Java 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-sit… |
CVE-2025-3842 | Medium | 6.3 | 2025-04-21 | A vulnerability was found in panhainan DS-Java 1.0 and classified as critical. This issue affects the function uploadUserPic.action of the file src/com/phn/act… |
CVE-2025-32958 | Critical | 9.8 | 2025-04-21 | Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the m… |
CVE-2025-32956 | High | 8.0 | 2025-04-21 | ManageWiki is a MediaWiki extension allowing users to manage wikis. Versions before commit f504ed8, are vulnerable to SQL injection when renaming a namespace i… |
CVE-2025-32955 | Medium | 6.0 | 2025-04-21 | Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Versions from 0.12.0 to before 2.12.0 are vulnerable to `disable-sud… |
CVE-2025-3841 | Low | 3.3 | 2025-04-21 | A vulnerability, which was classified as problematic, was found in wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9. This affects an unknown pa… |
CVE-2025-28104 | Critical | 9.1 | 2025-04-21 | Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input. |
CVE-2025-28103 | Medium | 6.4 | 2025-04-21 | Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request. |
CVE-2025-27086 | High | 8.1 | 2025-04-21 | A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication. |
CVE-2025-28102 | Medium | 6.1 | 2025-04-21 | A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into th… |
CVE-2025-28099 | Medium | 4.3 | 2025-04-21 | opencms V2.3 is vulnerable to Arbitrary file read in src/main/webapp/view/admin/document/dataPage.jsp, |
CVE-2025-23174 | High | 7.5 | 2025-04-21 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2025-43922 | High | 8.1 | 2025-04-21 | The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to SYSTEM. |
CVE-2025-3857 | High | 7.5 | 2025-04-21 | When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underl… |
CVE-2025-32793 | Medium | 4.0 | 2025-04-21 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2… |
CVE-2025-32431 | Critical | 9.1 | 2025-04-21 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability… |
CVE-2025-28367 | Medium | 6.5 | 2025-04-21 | mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerabili… |
CVE-2025-2517 | | 2025-04-21 | Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager. | |
CVE-2025-2298 | | 2025-04-21 | An improper authorization vulnerability in Dremio Software allows authenticated users to delete arbitrary files that the system has access to, including system… | |
CVE-2025-29660 | Critical | 9.8 | 2025-04-21 | A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789. This service lacks proper input valida… |
CVE-2025-29659 | Critical | 9.8 | 2025-04-21 | Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function located in the "cmd" binary. |
CVE-2025-29287 | Critical | 9.8 | 2025-04-21 | An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2025-28121 | Medium | 6.1 | 2025-04-21 | code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" parameter allowing remote attackers to e… |
CVE-2025-43916 | Low | 3.4 | 2025-04-21 | Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authority component, which… |
CVE-2025-32408 | Low | 2.5 | 2025-04-21 | In Soffid Console 3.6.31 before 3.6.32, authorization to use the pam service is mishandled. |
CVE-2025-3840 | | 2025-04-21 | An improper neutralization of input vulnerability was identified in the End of Life (EOL) OVA based connect installer component which is deployed for installat… | |
CVE-2025-3838 | | 2025-04-21 | An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer inter… | |
CVE-2025-3837 | | 2025-04-21 | An improper input validation vulnerability is identified in the End of Life (EOL) OVA based connect component which is deployed for installation purposes in th… | |
CVE-2025-25228 | Low | 3.8 | 2025-04-21 | A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the produc… |
CVE-2025-0632 | | 2025-04-21 | Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitra… | |
CVE-2025-43973 | Medium | 6.8 | 2025-04-21 | An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are a… |
CVE-2025-43972 | Medium | 6.8 | 2025-04-21 | An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a… |
CVE-2025-43971 | High | 8.6 | 2025-04-21 | An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen. |
CVE-2025-43970 | Medium | 4.3 | 2025-04-21 | An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36… |
CVE-2025-43967 | Low | 2.9 | 2025-04-21 | libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent ima… |
CVE-2025-43966 | Low | 2.9 | 2025-04-21 | libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc. |
CVE-2025-43964 | Low | 2.9 | 2025-04-21 | In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values. |
CVE-2025-43963 | Low | 2.9 | 2025-04-21 | In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0… |
CVE-2025-43962 | Low | 2.9 | 2025-04-21 | In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or t… |
CVE-2025-43961 | Low | 2.9 | 2025-04-21 | In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser. |
CVE-2025-43955 | Low | 2.2 | 2025-04-20 | TwsCachedXPathAPI in Convertigo through 8.3.4 does not restrict the use of commons-jxpath APIs. |
CVE-2025-43954 | Medium | 4.9 | 2025-04-20 | QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set. |
CVE-2025-3830 | Medium | 6.3 | 2025-04-20 | A vulnerability was found in kuangstudy KuangSimpleBBS 1.0. It has been declared as critical. Affected by this vulnerability is the function fileUpload of the… |
CVE-2025-3829 | High | 7.3 | 2025-04-20 | A vulnerability was found in PHPGurukul Men Salon Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin… |
CVE-2025-3828 | High | 7.3 | 2025-04-20 | A vulnerability was found in PHPGurukul Men Salon Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /adm… |
CVE-2025-3827 | High | 7.3 | 2025-04-20 | A vulnerability has been found in PHPGurukul Men Salon Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /a… |
CVE-2025-3826 | Low | 2.4 | 2025-04-20 | A vulnerability, which was classified as problematic, was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown par… |
CVE-2025-3825 | Low | 2.4 | 2025-04-20 | A vulnerability, which was classified as problematic, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this issue… |
CVE-2025-3824 | Low | 2.4 | 2025-04-20 | A vulnerability classified as problematic was found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this vulnerability is an un… |