2025 CVEs (page 340)
Page 340 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3823 | Low | 2.4 | 2025-04-20 | A vulnerability classified as problematic has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected is an unknown function of… |
CVE-2025-3822 | Low | 2.4 | 2025-04-20 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been rated as problematic. This issue affects some unknown… |
CVE-2025-3821 | Low | 2.4 | 2025-04-20 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as problematic. This vulnerability affects u… |
CVE-2025-43929 | Medium | 4.1 | 2025-04-20 | open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted do… |
CVE-2025-43928 | Medium | 5.8 | 2025-04-20 | In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username fi… |
CVE-2025-43921 | Medium | 5.3 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third par… |
CVE-2025-43920 | Medium | 5.4 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS comma… |
CVE-2025-43919 | Medium | 5.8 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/ma… |
CVE-2025-43918 | Medium | 6.4 | 2025-04-19 | SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued f… |
CVE-2025-3820 | High | 8.8 | 2025-04-19 | A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644) and classified as critical. Affected by this issue is the function cgiSysUplinkCheck… |
CVE-2025-3819 | High | 7.3 | 2025-04-19 | A vulnerability has been found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2025-3818 | Medium | 6.3 | 2025-04-19 | A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db… |
CVE-2025-43917 | High | 8.2 | 2025-04-19 | In Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate privileges after uninstalling the product. Specifically, an ad… |
CVE-2025-3817 | Medium | 6.3 | 2025-04-19 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the… |
CVE-2025-3816 | Medium | 4.7 | 2025-04-19 | A vulnerability classified as critical was found in westboy CicadasCMS 2.0. This vulnerability affects unknown code of the file /system/schedule/save of the co… |
CVE-2025-3808 | Medium | 4.3 | 2025-04-19 | A vulnerability has been found in zhenfeng13 My-BBS 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross… |
CVE-2025-3807 | Medium | 6.3 | 2025-04-19 | A vulnerability, which was classified as critical, was found in zhenfeng13 My-BBS 1.0. This affects the function Upload of the file src/main/java/com/my/bbs/co… |
CVE-2025-3806 | Low | 2.4 | 2025-04-19 | A vulnerability, which was classified as problematic, has been found in dazhouda lecms up to 3.0.3. Affected by this issue is some unknown functionality of the… |
CVE-2025-3805 | Medium | 5.3 | 2025-04-19 | A vulnerability classified as critical was found in sarrionandia tournatrack up to 4c13a23f43da5317eea4614870a7a8510fc540ec. Affected by this vulnerability is… |
CVE-2025-3804 | Medium | 5.3 | 2025-04-19 | A vulnerability classified as critical has been found in thautwarm vscode-diana 0.0.1. Affected is an unknown function of the file Gen.py of the component Jinj… |
CVE-2025-3803 | High | 8.8 | 2025-04-19 | A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). It has been rated as critical. This issue affects the function cgiSysScheduleReboot… |
CVE-2025-3802 | High | 8.8 | 2025-04-19 | A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). It has been declared as critical. This vulnerability affects the function cgiPingSe… |
CVE-2025-3801 | Low | 2.4 | 2025-04-19 | A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Set… |
CVE-2025-3800 | High | 7.3 | 2025-04-19 | A vulnerability has been found in WCMS 11 and classified as critical. Affected by this vulnerability is an unknown functionality of the file app/controllers/An… |
CVE-2025-3799 | High | 7.3 | 2025-04-19 | A vulnerability, which was classified as critical, was found in WCMS 11. Affected is an unknown function of the file app/controllers/AnonymousController.php. T… |
CVE-2025-3798 | Medium | 4.7 | 2025-04-19 | A vulnerability, which was classified as critical, has been found in WCMS 11. This issue affects the function sub of the file app/admin/AdvadminController.php… |
CVE-2025-3661 | Medium | 6.4 | 2025-04-19 | The SB Chart block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.2.6… |
CVE-2025-3404 | High | 8.8 | 2025-04-19 | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function in all… |
CVE-2025-3797 | Medium | 4.7 | 2025-04-19 | A vulnerability classified as critical was found in SeaCMS up to 13.3. This vulnerability affects unknown code of the file /admin_topic.php?action=delall. The… |
CVE-2025-3809 | High | 7.2 | 2025-04-19 | The Debug Log Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the auto-refresh debug log in all versions up to, and including, 2… |
CVE-2025-2111 | High | 7.5 | 2025-04-19 | The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to mis… |
CVE-2025-3103 | High | 7.5 | 2025-04-19 | The CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress is vulnerable to arbitrary file read due to… |
CVE-2025-3275 | Medium | 6.4 | 2025-04-19 | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider widget in all versions up to, and inc… |
CVE-2025-1457 | Medium | 6.4 | 2025-04-19 | The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2025-1093 | Critical | 9.8 | 2025-04-19 | The AIHub theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the generate_image function in all versions up to… |
CVE-2025-3284 | Medium | 4.3 | 2025-04-19 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in… |
CVE-2025-3278 | Critical | 9.8 | 2025-04-19 | The UrbanGo Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.4. This is due to the plugin allowing u… |
CVE-2025-2010 | High | 7.5 | 2025-04-19 | The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parame… |
CVE-2025-43903 | Medium | 4.3 | 2025-04-18 | NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries. |
CVE-2025-3796 | Medium | 6.3 | 2025-04-18 | A vulnerability classified as critical has been found in PHPGurukul Men Salon Management System 1.0. This affects an unknown part of the file /admin/contact-us… |
CVE-2025-32953 | High | 8.7 | 2025-04-18 | z80pack is a mature emulator of multiple platforms with 8080 and Z80 CPU. In version 1.38 and prior, the `makefile-ubuntu.yml` workflow file uses `actions/uplo… |
CVE-2025-29058 | Critical | 9.8 | 2025-04-18 | An issue in Qimou CMS v.3.34.0 allows a remote attacker to execute arbitrary code via the upgrade.php component. |
CVE-2025-3795 | Low | 2.4 | 2025-04-18 | A vulnerability was found in DaiCuo 1.3.13. It has been rated as problematic. Affected by this issue is some unknown functionality of the component SEO Optimiz… |
CVE-2025-36625 | Medium | 4.3 | 2025-04-18 | In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application. |
CVE-2025-32377 | Medium | 6.5 | 2025-04-18 | Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been ident… |
CVE-2025-28197 | Critical | 9.1 | 2025-04-18 | Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py. |
CVE-2025-25985 | Low | 2.6 | 2025-04-18 | An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code… |
CVE-2025-25984 | Medium | 6.8 | 2025-04-18 | An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code… |
CVE-2025-25983 | Low | 3.4 | 2025-04-18 | An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive… |
CVE-2025-28355 | Medium | 4.7 | 2025-04-18 | Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery (CSRF) allowing attackers to execute arbitrary code and obtain sensitive… |
CVE-2025-24914 | High | 7.8 | 2025-04-18 | When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sub-directories. Thi… |
CVE-2025-29513 | Medium | 6.1 | 2025-04-18 | Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator. |
CVE-2025-29512 | Medium | 6.1 | 2025-04-18 | Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP fu… |
CVE-2025-28242 | Critical | 9.8 | 2025-04-18 | Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack. |
CVE-2025-28238 | Critical | 9.8 | 2025-04-18 | Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack. |
CVE-2025-28237 | High | 8.8 | 2025-04-18 | An issue in WorldCast Systems ECRESO FM/DAB/TV Transmitter v1.10.1 allows authenticated attackers to escalate privileges via a crafted JSON payload. |
CVE-2025-28236 | Critical | 9.8 | 2025-04-18 | Nautel VX Series transmitters VX SW v6.4.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the firmware update process. This… |
CVE-2025-28235 | High | 7.5 | 2025-04-18 | An information disclosure vulnerability in the component /socket.io/1/websocket/ of Soundcraft Ui Series Model(s) Ui12 and Ui16 Firmware v1.0.7x and v1.0.5x al… |
CVE-2025-28233 | Critical | 9.1 | 2025-04-18 | Incorrect access control in BW Broadcast TX600 (14980), TX300 (32990) (31448), TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, Cont… |
CVE-2025-28231 | Critical | 9.1 | 2025-04-18 | Incorrect access control in Itel Electronics IP Stream v1.7.0.6 allows unauthorized attackers to execute arbitrary commands with Administrator privileges. |
CVE-2025-1697 | High | 7.8 | 2025-04-18 | A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior to 4.2.2439. This… |
CVE-2025-28059 | High | 7.5 | 2025-04-18 | An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalid… |
CVE-2025-32796 | Medium | 6.5 | 2025-04-18 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disab… |
CVE-2025-32795 | Medium | 6.5 | 2025-04-18 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly gran… |
CVE-2025-32792 | | 2025-04-18 | SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0… | |
CVE-2025-32442 | High | 7.5 | 2025-04-18 | Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different valida… |
CVE-2025-32434 | Critical | 9.8 | 2025-04-18 | PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In ve… |
CVE-2025-32389 | Medium | 6.5 | 2025-04-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by provi… |
CVE-2025-31120 | Medium | 5.3 | 2025-04-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mechanism in the forum… |
CVE-2025-31118 | High | 7.1 | 2025-04-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, forum quick reply feature (view_topic.php) doe… |
CVE-2025-30357 | High | 7.3 | 2025-04-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments o… |
CVE-2025-30158 | High | 7.1 | 2025-04-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the forum allows users to post iframe elements… |
CVE-2025-29953 | Critical | 9.8 | 2025-04-18 | Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client. This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 wh… |
CVE-2025-29784 | High | 7.5 | 2025-04-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum sear… |
CVE-2025-27599 | Medium | 6.5 | 2025-04-18 | Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicio… |
CVE-2025-3792 | Medium | 4.7 | 2025-04-18 | A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3. This issue affects some unknown processing of the file /admin_link.php?… |
CVE-2025-3791 | Medium | 5.3 | 2025-04-18 | A vulnerability classified as critical was found in symisc UnQLite up to 957c377cb691a4f617db9aba5cc46d90425071e2. This vulnerability affects the function jx9M… |
CVE-2025-37838 | High | 7.8 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Con… |
CVE-2025-2950 | Medium | 5.4 | 2025-04-18 | IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. A… |
CVE-2025-29625 | High | 7.8 | 2025-04-18 | A buffer overflow vulnerability in Astrolog v7.70 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via an overly long environment… |
CVE-2025-29209 | Critical | 9.8 | 2025-04-18 | TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi. |
CVE-2025-28232 | Critical | 9.1 | 2025-04-18 | Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication. |
CVE-2025-28230 | Critical | 9.1 | 2025-04-18 | Incorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials. |
CVE-2025-28229 | Critical | 9.8 | 2025-04-18 | Incorrect access control in Orban OPTIMOD 5950 Firmware v1.0.0.2 and System v2.2.15 allows attackers to bypass authentication and gain Administrator privileges. |
CVE-2025-28228 | High | 7.5 | 2025-04-18 | A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized… |
CVE-2025-40364 | High | 7.8 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_req_prep_async with provided buffers io_req_prep_async() can import prov… |
CVE-2025-3790 | Medium | 5.3 | 2025-04-18 | A vulnerability classified as critical has been found in baseweb JSite 1.0. This affects an unknown part of the file /druid/index.html of the component Apache… |
CVE-2025-3789 | Low | 3.5 | 2025-04-18 | A vulnerability was found in baseweb JSite 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /a/sys/area/… |
CVE-2025-32790 | Medium | 6.3 | 2025-04-18 | Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improper… |
CVE-2025-3788 | Low | 3.5 | 2025-04-18 | A vulnerability was found in baseweb JSite 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /a/… |
CVE-2025-3787 | Low | 2.7 | 2025-04-18 | A vulnerability was found in PbootCMS 3.2.5. It has been classified as problematic. Affected is an unknown function of the component Image Handler. The manipul… |
CVE-2025-3106 | Medium | 6.4 | 2025-04-18 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Table of Contents widget in all vers… |
CVE-2025-3786 | High | 8.8 | 2025-04-18 | A vulnerability was found in Tenda AC15 up to 15.03.05.19 and classified as critical. This issue affects the function fromSetWirelessRepeat of the file /goform… |
CVE-2025-3785 | High | 8.8 | 2025-04-18 | A vulnerability has been found in D-Link DWR-M961 1.1.36 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formStaticDHCP… |
CVE-2025-3056 | Medium | 5.4 | 2025-04-18 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.12 due to… |
CVE-2025-2492 | | 2025-04-18 | An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthoriz… | |
CVE-2025-40325 | Medium | 5.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: wait barrier before returning discard request with REQ_NOWAIT raid10_handle_di… |
CVE-2025-40114 | High | 7.8 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: iio: light: Add check for array bounds in veml6075_read_int_time_ms The array contains on… |
CVE-2025-40014 | High | 7.8 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq() If speed_hz < AMD… |
CVE-2025-39989 | Medium | 5.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: x86/mce: use is_copy_from_user() to determine copy-from-user context Patch series "mm/hwp… |