2025 CVEs (page 344)
Page 344 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-25234 | High | 7.1 | 2025-04-17 | Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able to bypass administra… |
CVE-2025-29015 | Medium | 6.1 | 2025-04-17 | Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages_account.php. |
CVE-2025-3760 | Medium | 5.4 | 2025-04-17 | A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q… |
CVE-2025-3487 | Medium | 6.4 | 2025-04-17 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ param… |
CVE-2025-3479 | Medium | 5.3 | 2025-04-17 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including… |
CVE-2025-3453 | Medium | 5.3 | 2025-04-17 | The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin f… |
CVE-2025-26478 | Low | 3.1 | 2025-04-17 | Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could pot… |
CVE-2025-26477 | Medium | 4.3 | 2025-04-17 | Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. A low privileged attacker with remote access could potentially exploit t… |
CVE-2025-29931 | Low | 3.7 | 2025-04-17 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected product does not properly validate a length field in a… |
CVE-2025-2197 | Medium | 4.3 | 2025-04-17 | Browser is affected by type confusion vulnerability, successful exploitation of this vulnerability may affect service availability. |
CVE-2025-2188 | High | 8.1 | 2025-04-17 | There is a whitelist mechanism bypass in GameCenter ,successful exploitation of this vulnerability may affect service confidentiality and integrity. |
CVE-2025-1532 | High | 8.1 | 2025-04-17 | Phoneservice module is affected by code injection vulnerability, successful exploitation of this vulnerability may affect service confidentiality and integrity. |
CVE-2025-3615 | Medium | 6.4 | 2025-04-17 | The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form-submission.js script in all versions up to, and including, 6.0… |
CVE-2025-3113 | | 2025-04-17 | A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the applicatio… | |
CVE-2025-2903 | | 2025-04-17 | An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining… | |
CVE-2025-3295 | Medium | 4.9 | 2025-04-17 | The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated… |
CVE-2025-3294 | High | 7.2 | 2025-04-17 | The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. Th… |
CVE-2025-1525 | Low | 3.5 | 2025-04-17 | The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2025-1524 | Low | 3.5 | 2025-04-17 | The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2025-1523 | Low | 3.5 | 2025-04-17 | The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2025-43717 | Medium | 5.4 | 2025-04-17 | In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, refl… |
CVE-2025-43715 | High | 8.1 | 2025-04-17 | Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the tempor… |
CVE-2025-31340 | | 2025-04-17 | A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro vers… | |
CVE-2025-31339 | | 2025-04-17 | An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro versions 5.0 through 5.2 allows remote… | |
CVE-2025-31338 | | 2025-04-17 | A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to obt… | |
CVE-2025-43708 | Low | 3.3 | 2025-04-17 | VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError when reference='… |
CVE-2025-1290 | High | 8.1 | 2025-04-17 | A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and… |
CVE-2025-43704 | Medium | 4.7 | 2025-04-16 | Arctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use HTTP Basic Authentication to a Dell Isilon OneFS server. |
CVE-2025-2073 | High | 8.8 | 2025-04-16 | Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS [6.1, 5.15, 5.10, 5.4, 4.19] allows a local attacker with low privileges to trigger an out-of-bo… |
CVE-2025-24911 | Medium | 4.9 | 2025-04-16 | Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is… |
CVE-2025-24910 | Medium | 4.9 | 2025-04-16 | Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is… |
CVE-2025-24909 | Medium | 4.4 | 2025-04-16 | Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page t… |
CVE-2025-24908 | Medium | 6.8 | 2025-04-16 | Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '… |
CVE-2025-24907 | Medium | 6.8 | 2025-04-16 | Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '… |
CVE-2025-1704 | Medium | 6.5 | 2025-04-16 | ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices… |
CVE-2025-1568 | High | 8.8 | 2025-04-16 | Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to in… |
CVE-2025-1566 | High | 7.5 | 2025-04-16 | DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to pro… |
CVE-2025-0758 | Medium | 6.1 | 2025-04-16 | Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors… |
CVE-2025-0757 | Medium | 4.4 | 2025-04-16 | Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page th… |
CVE-2025-0756 | Critical | 9.1 | 2025-04-16 | Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an id… |
CVE-2025-43703 | Medium | 6.1 | 2025-04-16 | An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the at… |
CVE-2025-32791 | Medium | 4.3 | 2025-04-16 | The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend… |
CVE-2025-32789 | Low | 3.1 | 2025-04-16 | EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an at… |
CVE-2025-32787 | Low | 3.1 | 2025-04-16 | SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in `DeleteIPv6De… |
CVE-2025-32783 | Medium | 4.7 | 2025-04-16 | XWiki Platform is a generic wiki platform. A vulnerability in versions from 5.0 to 16.7.1 affects users with Message Stream enabled and a wiki configured as cl… |
CVE-2025-32433 | Critical | 10.0 | 2025-04-16 | Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an… |
CVE-2025-31478 | High | 8.2 | 2025-04-16 | Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a s… |
CVE-2025-25230 | High | 7.8 | 2025-04-16 | Omnissa Horizon Client for Windows contains an LPE Vulnerability. A malicious actor with local access where Horizon Client for Windows is installed may be able… |
CVE-2025-3730 | Low | 3.3 | 2025-04-16 | A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/AT… |
CVE-2025-3729 | High | 7.3 | 2025-04-16 | A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some u… |
CVE-2025-3728 | Medium | 5.3 | 2025-04-16 | A vulnerability classified as critical was found in SourceCodester Simple Hotel Booking System 1.0. This vulnerability affects the function Login. The manipula… |
CVE-2025-3727 | High | 7.3 | 2025-04-16 | A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component STATUS Command Handler. The mani… |
CVE-2025-3620 | High | 8.8 | 2025-04-16 | Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2025-3619 | High | 8.8 | 2025-04-16 | Heap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2025-29710 | Medium | 6.1 | 2025-04-16 | SourceCodester Company Website CMS 1.0 is vulnerable to Cross Site Scripting (XSS) via /dashboard/Services. |
CVE-2025-29709 | Critical | 9.8 | 2025-04-16 | SourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio" file /dashboard/portfolio. |
CVE-2025-29708 | Critical | 9.8 | 2025-04-16 | SourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create Services" file /dashboard/Services. |
CVE-2025-28072 | High | 7.5 | 2025-04-16 | PHPGurukul Pre-School Enrollment System is vulnerable to Directory Traversal in manage-teachers.php. |
CVE-2025-26153 | Medium | 5.4 | 2025-04-16 | A Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28. Attackers can inject malicious scripts into messages, which execute wh… |
CVE-2025-3726 | High | 7.3 | 2025-04-16 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component CD Co… |
CVE-2025-3725 | High | 7.3 | 2025-04-16 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the compon… |
CVE-2025-3724 | High | 7.3 | 2025-04-16 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component DIR Command Handler… |
CVE-2025-3723 | High | 7.3 | 2025-04-16 | A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. This issue affects some unknown processing of the component MDTM Command Handle… |
CVE-2025-32817 | Medium | 6.1 | 2025-04-16 | A Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) client, this results in unauthorized file overwrite… |
CVE-2025-31201 | Critical | 9.8 | 2025-04-16 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4… |
CVE-2025-31200 | Critical | 9.8 | 2025-04-16 | A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1… |
CVE-2025-39472 | Medium | 4.3 | 2025-04-16 | Cross-Site Request Forgery (CSRF) vulnerability in wpweb WooCommerce Social Login woo-social-login allows Cross Site Request Forgery.This issue affects WooComm… |
CVE-2025-32872 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32871 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32870 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32869 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32868 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32867 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32866 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32865 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32864 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32863 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32862 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32861 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32860 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32859 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32858 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32857 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32856 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32855 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32854 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32853 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32852 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32851 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32850 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32849 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32848 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32847 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32846 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32845 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32844 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32843 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32842 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32841 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |
CVE-2025-32840 | High | 8.8 | 2025-04-16 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the… |