2025 CVEs (page 340)
Page 340 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-42602 | | 2025-04-23 | This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentication process. A rem… | |
CVE-2025-42601 | | 2025-04-23 | This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote attacker could exp… | |
CVE-2025-42600 | | 2025-04-23 | This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password (OTP) attempts through certain API end… | |
CVE-2025-1054 | Medium | 6.4 | 2025-04-23 | The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the UI Counter, UI Icon Box, U… |
CVE-2025-3530 | High | 7.5 | 2025-04-23 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to… |
CVE-2025-3529 | High | 8.2 | 2025-04-23 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'fi… |
CVE-2025-2595 | Medium | 5.3 | 2025-04-23 | An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of… |
CVE-2025-0618 | Medium | 6.5 | 2025-04-23 | A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamper protection event t… |
CVE-2025-1056 | Medium | 6.1 | 2025-04-23 | Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A non-admin user can m… |
CVE-2025-0926 | Medium | 5.9 | 2025-04-23 | Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files causing a boot loop… |
CVE-2025-1021 | High | 7.5 | 2025-04-23 | Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attac… |
CVE-2025-37088 | Medium | 6.8 | 2025-04-22 | A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on race conditions and configuration, this vulnerability… |
CVE-2025-27087 | Medium | 5.5 | 2025-04-22 | A vulnerability in the kernel of the Cray Operating System (COS) could allow an attacker to perform a local Denial of Service (DoS) attack. |
CVE-2025-37087 | Critical | 9.8 | 2025-04-22 | A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary file on the server hos… |
CVE-2025-32965 | | 2025-04-22 | xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were… | |
CVE-2025-29743 | Medium | 6.5 | 2025-04-22 | D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in /goform/delRouting. |
CVE-2025-26159 | Medium | 6.1 | 2025-04-22 | Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject maliciou… |
CVE-2025-31328 | Medium | 4.6 | 2025-04-22 | SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to… |
CVE-2025-31327 | Medium | 4.3 | 2025-04-22 | SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could be externally modi… |
CVE-2025-29621 | High | 7.3 | 2025-04-22 | Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My Preferences module. This… |
CVE-2025-23253 | Low | 2.5 | 2025-04-22 | NVIDIA NvContainer service for Windows contains a vulnerability in its usage of OpenSSL, where an attacker could exploit a hard-coded constant issue by copying… |
CVE-2025-43952 | Medium | 6.1 | 2025-04-22 | A cross-site scripting (reflected XSS) vulnerability was found in Mettler Toledo FreeWeight.Net Web Reports Viewer 8.4.0 (440). It allows an attacker to inject… |
CVE-2025-43951 | Critical | 9.8 | 2025-04-22 | LabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve arbitrary files from the environment via the objectname request… |
CVE-2025-43950 | High | 7.8 | 2025-04-22 | DPMAdirektPro 4.1.5 is vulnerable to DLL Hijacking. It happens by placing a malicious DLL in a directory (in the absence of a legitimate DLL), which is then lo… |
CVE-2025-43949 | Critical | 9.8 | 2025-04-22 | MuM (aka Mensch und Maschine) MapEdit (aka mapedit-web) 24.2.3 is vulnerable to SQL Injection that allows an attacker to execute malicious SQL statements that… |
CVE-2025-43948 | High | 7.3 | 2025-04-22 | Codemers KLIMS 1.6.DEV allows Python code injection. A user can provide Python code as an input value for a parameter or qualifier (such as for sorting), which… |
CVE-2025-43947 | High | 7.3 | 2025-04-22 | Codemers KLIMS 1.6.DEV lacks a proper access control mechanism, allowing a normal KLIMS user to perform all the actions that an admin can perform, such as modi… |
CVE-2025-43946 | Critical | 9.8 | 2025-04-22 | TCPWave DDI 11.34P1C2 allows Remote Code Execution via Unrestricted File Upload (combined with Path Traversal). |
CVE-2025-32964 | Medium | 4.6 | 2025-04-22 | ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 00bebea, when enabling a conflicting extension, a restricted extension woul… |
CVE-2025-32963 | | 2025-04-22 | MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the defa… | |
CVE-2025-32961 | Medium | 6.4 | 2025-04-22 | The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTTP requests. Prior to version 1.1.1, the… |
CVE-2025-32960 | Medium | 6.4 | 2025-04-22 | The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file path and name, can be… |
CVE-2025-32959 | Medium | 6.5 | 2025-04-22 | CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file storage implementation does not restri… |
CVE-2025-32952 | Medium | 6.5 | 2025-04-22 | Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local fil… |
CVE-2025-32951 | Medium | 6.4 | 2025-04-22 | Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input par… |
CVE-2025-32950 | Medium | 6.5 | 2025-04-22 | Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers cou… |
CVE-2025-32788 | Medium | 4.3 | 2025-04-22 | OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an a… |
CVE-2025-28039 | Critical | 9.8 | 2025-04-22 | TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setUpgradeFW function through the FileNa… |
CVE-2025-28038 | Critical | 9.8 | 2025-04-22 | TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setWebWlanIdx function through the webWl… |
CVE-2025-28036 | Critical | 9.8 | 2025-04-22 | TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeU… |
CVE-2025-28035 | Critical | 9.8 | 2025-04-22 | TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUr… |
CVE-2025-28029 | High | 7.3 | 2025-04-22 | TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain… |
CVE-2025-28027 | High | 7.3 | 2025-04-22 | TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 was found to contain a… |
CVE-2025-28026 | High | 7.3 | 2025-04-22 | TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain… |
CVE-2025-34028 | Critical | 10.0 | 2025-04-22 | The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the… |
CVE-2025-29339 | High | 7.5 | 2025-04-22 | An issue in UPF in Open5GS UPF versions up to v2.7.2 results an assertion failure vulnerability in PFCP session parameter validation. When processing a PFCP Se… |
CVE-2025-27907 | Medium | 4.1 | 2025-04-22 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized… |
CVE-2025-3767 | High | 7.2 | 2025-04-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Inj… |
CVE-2025-28037 | Critical | 9.8 | 2025-04-22 | TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to contain a pre-auth remote command execution vulnerability in the setDia… |
CVE-2025-28031 | Medium | 6.5 | 2025-04-22 | TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a hardcoded password for the telnet service in product.ini. |
CVE-2025-28030 | High | 8.8 | 2025-04-22 | TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a stack overflow via the startTime and endTime parameters in setParentalRules function. |
CVE-2025-28024 | Critical | 9.8 | 2025-04-22 | TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the cstecgi.cgi |
CVE-2025-23251 | High | 7.6 | 2025-04-22 | NVIDIA NeMo Framework contains a vulnerability where a user could cause an improper control of generation of code by remote code execution. A successful exploi… |
CVE-2025-23250 | High | 7.6 | 2025-04-22 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause an improper limitation of a pathname to a restricted directory by an arbitrary fil… |
CVE-2025-23249 | High | 7.6 | 2025-04-22 | NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of t… |
CVE-2025-29547 | High | 7.0 | 2025-04-22 | In Rollback Rx Professional 12.8.0.0, the driver file shieldm.sys allows local users to cause a denial of service because of a null pointer dereference from IO… |
CVE-2025-23176 | High | 8.8 | 2025-04-22 | CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
CVE-2025-1951 | High | 8.4 | 2025-04-22 | IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands as a privileged user due to executio… |
CVE-2025-1950 | Critical | 9.3 | 2025-04-22 | IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands locally due to improper validation o… |
CVE-2025-28034 | Critical | 9.8 | 2025-04-22 | TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201… |
CVE-2025-28033 | High | 7.3 | 2025-04-22 | TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201… |
CVE-2025-28032 | High | 7.3 | 2025-04-22 | TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201… |
CVE-2025-23175 | Medium | 6.1 | 2025-04-22 | Multiple XSS (CWE-79) |
CVE-2025-3472 | Medium | 6.5 | 2025-04-22 | The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software al… |
CVE-2025-3458 | Medium | 6.4 | 2025-04-22 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter in all versions up to, and including, 2… |
CVE-2025-3457 | Medium | 6.4 | 2025-04-22 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions up to, and includin… |
CVE-2025-2092 | High | 7.5 | 2025-04-22 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p29, <2.2.0p41 and <=2.1.0p49 (EOL) causes remote site authentication… |
CVE-2025-46254 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcom… |
CVE-2025-46253 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit gutenkit-blocks-addon allows Stored XSS… |
CVE-2025-46252 | High | 7.6 | 2025-04-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome Message Filter for Contact Form 7 allows SQL… |
CVE-2025-46251 | High | 7.1 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Cross Site Request Forgery.This issue affects VikRestaurants… |
CVE-2025-46250 | Medium | 5.9 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUForm v-form allows Stored XSS.This issue… |
CVE-2025-46249 | Medium | 4.3 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor allows Cross Site Request Forgery.This i… |
CVE-2025-46247 | Medium | 5.3 | 2025-04-22 | Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constra… |
CVE-2025-46246 | Medium | 4.3 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Cross Site Request Forgery.This issue affects CM Answers… |
CVE-2025-46245 | Medium | 4.3 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Ad Changer cm-ad-changer allows Cross Site Request Forgery.This issue affects CM A… |
CVE-2025-46244 | Medium | 5.3 | 2025-04-22 | Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce linked-variation allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-46243 | Medium | 4.3 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows Cross Site Request Forg… |
CVE-2025-46242 | High | 7.6 | 2025-04-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affect… |
CVE-2025-46241 | High | 8.2 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects… |
CVE-2025-46240 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Download Counter simple-download-counte… |
CVE-2025-46239 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Theme Switcha theme-switcha allows Stored XSS… |
CVE-2025-46238 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer List Last Changes list-last-changes allows Stored X… |
CVE-2025-46237 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows Stored… |
CVE-2025-46236 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Stored XSS… |
CVE-2025-46235 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This… |
CVE-2025-46233 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sirv CDN and Image Hosting Sirv sirv allows Stored XSS.Th… |
CVE-2025-46232 | Medium | 4.3 | 2025-04-22 | Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-46231 | Medium | 5.4 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Cross Site Request Forgery.This… |
CVE-2025-46229 | Medium | 5.9 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Israpil Textmetrics webtexttool allows Stored XSS.This is… |
CVE-2025-46228 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows DOM-Based XSS.Thi… |
CVE-2025-46227 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brecht Custom Related Posts custom-related-posts allows S… |
CVE-2025-46226 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ferranfg MPL-Publisher mpl-publisher allows Stored XSS.Th… |
CVE-2025-46225 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Post in page for Elementor allows DOM-Based XSS… |
CVE-2025-3519 | | 2025-04-22 | An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file. Every uploaded file in Unblu gets assigne… | |
CVE-2025-3518 | Medium | 4.3 | 2025-04-22 | It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can… |
CVE-2025-26413 | High | 7.5 | 2025-04-22 | Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an inde… |
CVE-2025-3814 | Medium | 6.4 | 2025-04-22 | The Tax Switch for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class-name’ parameter in all versions up to, and incl… |
CVE-2025-2839 | Medium | 6.4 | 2025-04-22 | The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and inclu… |
CVE-2025-2594 | High | 8.1 | 2025-04-22 | The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowi… |