2025 CVEs (page 343)
Page 343 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-29456 | Medium | 6.5 | 2025-04-17 | An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the create Notes function. |
CVE-2025-29453 | Medium | 6.5 | 2025-04-17 | An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the my-contacts-settings… |
CVE-2025-29455 | Medium | 6.5 | 2025-04-17 | An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Travel Ideas" functio… |
CVE-2025-29454 | Medium | 6.5 | 2025-04-17 | An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function. |
CVE-2025-29452 | High | 7.6 | 2025-04-17 | An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Proxy Manager component. |
CVE-2025-29451 | High | 7.6 | 2025-04-17 | An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component. |
CVE-2025-29450 | Medium | 6.5 | 2025-04-17 | An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the site settings component. |
CVE-2025-29449 | Medium | 6.5 | 2025-04-17 | An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the link identification function. |
CVE-2025-3765 | Medium | 6.3 | 2025-04-17 | A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some u… |
CVE-2025-3764 | Medium | 6.3 | 2025-04-17 | A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This vulnerability affects unknown code of… |
CVE-2025-3763 | Medium | 5.3 | 2025-04-17 | A vulnerability classified as critical has been found in SourceCodester Phone Management System 1.0. This affects the function main of the component Password H… |
CVE-2025-3762 | High | 7.3 | 2025-04-17 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component MPUT… |
CVE-2025-29316 | Medium | 6.2 | 2025-04-17 | An issue in DataPatrol Screenshot watermark, printing watermark agent v.3.5.2.0 allows a physically proximate attacker to obtain sensitive information. NOTE: t… |
CVE-2025-29722 | Medium | 6.3 | 2025-04-17 | A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missi… |
CVE-2025-28101 | Medium | 6.5 | 2025-04-17 | An arbitrary file deletion vulnerability in the /post/{postTitle} component of flaskBlog v2.6.1 allows attackers to delete article titles created by other user… |
CVE-2025-28009 | Critical | 9.8 | 2025-04-17 | A SQL Injection vulnerability exists in the `u` parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20. |
CVE-2025-26269 | Low | 3.3 | 2025-04-17 | DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that re… |
CVE-2025-26268 | Low | 3.3 | 2025-04-17 | DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted Redis command. The validity of the sca… |
CVE-2025-25455 | High | 7.5 | 2025-04-17 | Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanMTU2. |
CVE-2025-25454 | High | 7.5 | 2025-04-17 | Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanSpeed2. |
CVE-2025-32415 | Low | 2.9 | 2025-04-17 | In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XM… |
CVE-2025-2947 | High | 7.2 | 2025-04-17 | IBM i 7.6 contains a privilege escalation vulnerability due to incorrect profile swapping in an OS command. A malicious actor can use the command to elevate… |
CVE-2025-29662 | Critical | 9.8 | 2025-04-17 | A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote network access. |
CVE-2025-29661 | High | 7.2 | 2025-04-17 | Litepubl CMS <= 7.0.9 is vulnerable to RCE in admin/service/run. |
CVE-2025-29181 | High | 7.2 | 2025-04-17 | FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php. |
CVE-2025-29180 | High | 7.2 | 2025-04-17 | In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters are direc… |
CVE-2025-29039 | High | 7.2 | 2025-04-17 | An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8 |
CVE-2025-43015 | High | 8.3 | 2025-04-17 | In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces |
CVE-2025-43014 | Medium | 6.1 | 2025-04-17 | In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation |
CVE-2025-43013 | Medium | 6.9 | 2025-04-17 | In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible |
CVE-2025-43012 | High | 8.3 | 2025-04-17 | In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible |
CVE-2025-42921 | Medium | 4.2 | 2025-04-17 | In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin |
CVE-2025-39596 | Critical | 9.8 | 2025-04-17 | Weak Authentication vulnerability in Quentn.com GmbH Quentn WP quentn-wp allows Privilege Escalation.This issue affects Quentn WP: from n/a through <= 1.2.8. |
CVE-2025-39595 | Critical | 9.3 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Quentn.com GmbH Quentn WP quentn-wp allows SQL Injection… |
CVE-2025-39594 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Arigato Autoresponder and Newsletter bft-autoresponde… |
CVE-2025-39588 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Object Injection.This issue affects U… |
CVE-2025-39587 | Critical | 9.3 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder… |
CVE-2025-39586 | High | 8.5 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-a… |
CVE-2025-39583 | High | 7.1 | 2025-04-17 | Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-39580 | Medium | 5.8 | 2025-04-17 | Missing Authorization vulnerability in jidaikobo Dashi dashi allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dashi: from n/a… |
CVE-2025-39569 | High | 8.5 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows Blind SQL Inje… |
CVE-2025-39568 | High | 7.5 | 2025-04-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arture B.V. StoreContrl Woocommerce storecontrl-wp-connection a… |
CVE-2025-39567 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows Ref… |
CVE-2025-39562 | Medium | 5.9 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Payment Form for PayPal Pro payment-form-for-p… |
CVE-2025-39559 | Medium | 6.5 | 2025-04-17 | Missing Authorization vulnerability in Eivin Landa Bring Fraktguiden for WooCommerce bring-fraktguiden-for-woocommerce allows Exploiting Incorrectly Configured… |
CVE-2025-39558 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This i… |
CVE-2025-39554 | Medium | 6.5 | 2025-04-17 | Missing Authorization vulnerability in Elliot Sowersby / RelyWP AI Text to Speech ai-text-to-speech allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-39551 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Object Injection.This issue affects FluentBoards: from… |
CVE-2025-39550 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Object Injection.This issue affects FluentCommunity… |
CVE-2025-39542 | High | 8.8 | 2025-04-17 | Incorrect Privilege Assignment vulnerability in Jauhari Xelion Xelion Webchat xelion-webchat allows Privilege Escalation.This issue affects Xelion Webchat: fro… |
CVE-2025-39535 | High | 7.2 | 2025-04-17 | Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: f… |
CVE-2025-39533 | High | 8.8 | 2025-04-17 | Missing Authorization vulnerability in Starfish Reviews Starfish Review Generation & Marketing starfish-reviews allows Privilege Escalation.This issue affects… |
CVE-2025-39532 | High | 7.5 | 2025-04-17 | Missing Authorization vulnerability in spicethemes Spice Blocks spice-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-39527 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebS… |
CVE-2025-39526 | High | 8.1 | 2025-04-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allow… |
CVE-2025-39521 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani Contact Form vCard Generator contact-form-vc… |
CVE-2025-39519 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in runthings.dev Bulk Page Stub Creator bulk-page-stub-creat… |
CVE-2025-39464 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtowebsites AdminQuickbar adminquickbar allows Reflected… |
CVE-2025-39462 | High | 7.5 | 2025-04-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in teamzt Smart Agreements smart-agreemen… |
CVE-2025-39461 | High | 7.5 | 2025-04-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nawawi Jamili Docket Cache docket-cach… |
CVE-2025-39457 | Medium | 5.3 | 2025-04-17 | Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Confi… |
CVE-2025-39456 | Medium | 5.4 | 2025-04-17 | Missing Authorization vulnerability in iTRON WP Logger wp-data-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-39455 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in IP2Location IP2Location Variables ip2location-variables allows Reflected XSS.This issue affects IP2Location… |
CVE-2025-39453 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advanced-dynamic-pricing-for-woocommerce allows Cross Si… |
CVE-2025-39452 | High | 7.5 | 2025-04-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics WPCafe wp-cafe allows PHP Lo… |
CVE-2025-39444 | Medium | 5.9 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry MaxButtons maxbuttons allows Stored XSS.This i… |
CVE-2025-39443 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through… |
CVE-2025-39442 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in MessageMetric Review Wave – Google Places Reviews review-wave-google-places-reviews allows Stored XSS.This i… |
CVE-2025-39441 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Dashboard Notepads dashboard-notepads allows Stored XSS.This issue affects Dashboard Notepads: f… |
CVE-2025-39440 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Broken Links Remover broken-links-remover allows Stored XSS.This issue affects Broken Links Remover… |
CVE-2025-39439 | Medium | 5.3 | 2025-04-17 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Markus Drubba wpLike2Get wplike2get allows Retrieve Embedded Sensit… |
CVE-2025-39438 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in momen2009 Theme Changer theme-changer allows Cross Site Request Forgery.This issue affects Theme Changer: fr… |
CVE-2025-39437 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Boone Gorges Anthologize anthologize allows Cross Site Request Forgery.This issue affects Anthologize: from… |
CVE-2025-39436 | Critical | 9.1 | 2025-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through <… |
CVE-2025-39435 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in davidfcarr My Marginalia my-marginalia allows Stored XSS.This issue affects My Marginalia: from n/a through… |
CVE-2025-39434 | Medium | 4.3 | 2025-04-17 | Authorization Bypass Through User-Controlled Key vulnerability in Scott Taylor Avatar avatar allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-39433 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in beke_ro Bknewsticker bknewsticker allows Stored XSS.This issue affects Bknewsticker: from n/a through <= 1.0… |
CVE-2025-39432 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antonchanning bbPress2 shortcode whitelist bbpress2-short… |
CVE-2025-39431 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Aaron Forgue Amazon Showcase WordPress Plugin amazon-showcase-wordpress-widget allows Stored XSS.This issue… |
CVE-2025-39430 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Alexander Rauscha mLanguage mlanguage allows Stored XSS.This issue affects mLanguage: from n/a through <= 1… |
CVE-2025-39429 | High | 7.5 | 2025-04-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Földesi, Mihály Széchenyi 2020 Logo sz… |
CVE-2025-39428 | Medium | 5.9 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maros Pristas Gravity Forms CSS Themes with Fontawesome a… |
CVE-2025-39427 | Medium | 5.9 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beth Tucker Long WP Post to PDF Enhanced wp-post-to-pdf-e… |
CVE-2025-39426 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in illow illow – Cookies Consent lgpd-compliant-cookie-banner allows Cross Site Request Forgery.This issue affe… |
CVE-2025-39425 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in pixelgrade Style Manager style-manager allows Cross Site Request Forgery.This issue affects Style Manager: f… |
CVE-2025-39424 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in simplemaps Simple Maps interactive-maps allows Stored XSS.This issue affects Simple Maps: from n/a through <… |
CVE-2025-39423 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Jenst Add to Header add-to-header allows Stored XSS.This issue affects Add to Header: from n/a through <= 1… |
CVE-2025-39422 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in PResponsive WP Social Bookmarking wp-social-bookmarking allows Stored XSS.This issue affects WP Social Bookm… |
CVE-2025-39421 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Mustafa KUCUK WP Sticky Side Buttons wp-sticky-side-buttons allows Stored XSS.This issue affects WP Sticky S… |
CVE-2025-39420 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ruudkok WP Twitter Button wp-twitter-button allows Stored… |
CVE-2025-39419 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in David Miller Revision Diet revision-diet allows Stored XSS.This issue affects Revision Diet: from n/a throug… |
CVE-2025-39418 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in ajayver RSS Manager rss-manager allows Stored XSS.This issue affects RSS Manager: from n/a through <= 0.06. |
CVE-2025-39417 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Eslam Mahmoud Redirect wordpress to welcome or landing page redirect-to-welcome-or-landing-page allows Store… |
CVE-2025-39416 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Ichi translit it! translit-it allows Stored XSS.This issue affects translit it!: from n/a through <= 1.6. |
CVE-2025-39415 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Jayesh Parejiya Social Media Links social-media-links allows Stored XSS.This issue affects Social Media Link… |
CVE-2025-39414 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Mike spam-stopper spam-stopper allows Stored XSS.This issue affects spam-stopper: from n/a through <= 3.1.3. |
CVE-2025-32686 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in WPSpeedo Team Members wps-team allows Object Injection.This issue affects Team Members: from n/a through <=… |
CVE-2025-32682 | Critical | 9.9 | 2025-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server… |
CVE-2025-32674 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Excel Import Export & Bulk Edit for Woo… |
CVE-2025-32670 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Parnell Spark GF Failed Submissions spark-gf-failed-… |