2025 CVEs (page 347)
Page 347 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-39556 | Medium | 5.3 | 2025-04-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mediavine Mediavine Control Panel mediavine-control-panel allows Re… |
CVE-2025-39555 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Stored XSS.Th… |
CVE-2025-39552 | Medium | 5.4 | 2025-04-16 | Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-39549 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in whiletrue Most And Least Read Posts Widget most-and-least… |
CVE-2025-39548 | High | 7.1 | 2025-04-16 | Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Right Click Disable OR Ban right-click-disable-or-ban allows Stored XSS.This issue affects Right C… |
CVE-2025-39547 | High | 7.1 | 2025-04-16 | Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Internal Link Optimiser internal-link-finder allows Stored XSS.This issue affects Internal Lin… |
CVE-2025-39546 | Medium | 4.3 | 2025-04-16 | Cross-Site Request Forgery (CSRF) vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite allows Cross Site Request Forgery.This iss… |
CVE-2025-39545 | Medium | 5.4 | 2025-04-16 | Missing Authorization vulnerability in miniOrange WordPress REST API Authentication wp-rest-api-authentication allows Exploiting Incorrectly Configured Access… |
CVE-2025-39544 | High | 7.4 | 2025-04-16 | Cross-Site Request Forgery (CSRF) vulnerability in sminozzi WP Tools wptools allows Path Traversal.This issue affects WP Tools: from n/a through <= 5.18. |
CVE-2025-39543 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons al… |
CVE-2025-39540 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhys Wynne WP Flipclock wp-flipclock allows DOM-Based XSS… |
CVE-2025-39538 | Medium | 6.6 | 2025-04-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Mathieu Chartier WP-Advanced-Search wp-advanced-search allows Upload a Web Shell to a Web Serv… |
CVE-2025-39531 | Medium | 5.3 | 2025-04-16 | Missing Authorization vulnerability in slazzercom Slazzer Background Changer slazzer-background-changer allows Accessing Functionality Not Properly Constrained… |
CVE-2025-39530 | High | 7.1 | 2025-04-16 | Cross-Site Request Forgery (CSRF) vulnerability in dsky Site Search 360 site-search-360 allows Stored XSS.This issue affects Site Search 360: from n/a through… |
CVE-2025-39529 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin Cornett Scriptless Social Sharing scriptless-social… |
CVE-2025-39528 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes rescue-shortcodes allows… |
CVE-2025-39525 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Logo Carousel Slider logo-carousel-slider allows St… |
CVE-2025-39524 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS… |
CVE-2025-39522 | Medium | 5.4 | 2025-04-16 | Missing Authorization vulnerability in Service2Client LLC Dynamic Post dynamic-post allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-39520 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-fi… |
CVE-2025-39518 | High | 7.6 | 2025-04-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedefiningTheWeb BMA Lite bma-lite-appointment-booking-an… |
CVE-2025-39517 | Medium | 4.3 | 2025-04-16 | Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Basic Interactive World Map basic-interactive-world-map allows Cross Site Request Forgery.Thi… |
CVE-2025-39516 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alan Petersen Author WIP Progress Bar author-work-in-prog… |
CVE-2025-39515 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tnomi Attendance Manager attendance-manager allows Stored… |
CVE-2025-39514 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asgaros Asgaros Forum asgaros-forum allows Stored XSS.Thi… |
CVE-2025-39513 | Medium | 5.3 | 2025-04-16 | Missing Authorization vulnerability in ActiveDEMAND Online Agency Marketing Automation ActiveDEMAND activedemand allows Accessing Functionality Not Properly Co… |
CVE-2025-39512 | Medium | 4.3 | 2025-04-16 | Cross-Site Request Forgery (CSRF) vulnerability in Yuya Hoshino Bulk Term Editor bulk-term-editor allows Cross Site Request Forgery.This issue affects Bulk Ter… |
CVE-2025-1983 | | 2025-04-16 | A cross-site scripting (XSS) vulnerability in Ready_'s File Explorer upload functionality allows injection of arbitrary JavaScript code in filename. Injected c… | |
CVE-2025-1982 | | 2025-04-16 | Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the file:// protocol thu… | |
CVE-2025-1981 | | 2025-04-16 | Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready_'s Invoices module allows for SQL Injection attack… | |
CVE-2025-1980 | | 2025-04-16 | The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was… | |
CVE-2025-3688 | Low | 2.4 | 2025-04-16 | A vulnerability, which was classified as problematic, was found in mirweiye Seven Bears Library CMS 2023. This affects an unknown part of the component Backgro… |
CVE-2025-3687 | Medium | 4.3 | 2025-04-16 | A vulnerability, which was classified as problematic, has been found in misstt123 oasys 1.0. Affected by this issue is some unknown functionality of the compon… |
CVE-2025-3686 | Medium | 4.3 | 2025-04-16 | A vulnerability classified as problematic was found in misstt123 oasys 1.0. Affected by this vulnerability is the function image of the file /show. The manipul… |
CVE-2025-3685 | Medium | 6.3 | 2025-04-16 | A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Affected is an unknown function of the file /edit_… |
CVE-2025-3684 | Medium | 6.3 | 2025-04-16 | A vulnerability was found in Xianqi Kindergarten Management System 2.0 Bulid 20190808. It has been rated as critical. This issue affects some unknown processin… |
CVE-2025-3683 | High | 7.3 | 2025-04-16 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknown code of the component SIZE Command Ha… |
CVE-2025-3682 | High | 7.3 | 2025-04-16 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component PASV Command Handler. Th… |
CVE-2025-30960 | High | 8.3 | 2025-04-16 | Missing Authorization vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through <= 6.5.8. |
CVE-2025-22023 | High | 7.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Don't skip on Stopped - Length Invalid Up until commit d56b0b2ab142 ("usb: xhc… |
CVE-2025-22022 | High | 7.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two clearly different specime… |
CVE-2025-22021 | Critical | 10.0 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrac… |
CVE-2025-22020 | High | 7.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the f… |
CVE-2025-22019 | High | 7.3 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: bcachefs: bch2_ioctl_subvolume_destroy() fixes bch2_evict_subvolume_inodes() was getting… |
CVE-2025-3681 | High | 7.3 | 2025-04-16 | A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MODE Comm… |
CVE-2025-3680 | High | 7.3 | 2025-04-16 | A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the componen… |
CVE-2025-3679 | High | 7.3 | 2025-04-16 | A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component HOST Command Handler… |
CVE-2025-31363 | Low | 3.0 | 2025-04-16 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authe… |
CVE-2025-27936 | Medium | 5.3 | 2025-04-16 | Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time compari… |
CVE-2025-3678 | High | 7.3 | 2025-04-16 | A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component HELP C… |
CVE-2025-3677 | Medium | 5.3 | 2025-04-16 | A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem o… |
CVE-2025-3104 | Medium | 5.3 | 2025-04-16 | The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capabil… |
CVE-2025-3676 | Medium | 6.3 | 2025-04-16 | A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/search/books. The manipu… |
CVE-2025-3077 | Medium | 6.4 | 2025-04-16 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and… |
CVE-2025-27571 | Medium | 4.3 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching… |
CVE-2025-27538 | Low | 2.2 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the ta… |
CVE-2025-24839 | Low | 3.1 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows… |
CVE-2025-0101 | Medium | 6.5 | 2025-04-16 | A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes some functions to work… |
CVE-2025-3675 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been rated as critical. Affected by this issue is the function setL2tpServerCfg of t… |
CVE-2025-3674 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilt… |
CVE-2025-3247 | Medium | 5.3 | 2025-04-16 | The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' functi… |
CVE-2025-3668 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. This vulnerability affects the function setScheduleCfg of… |
CVE-2025-3667 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-b… |
CVE-2025-22018 | Medium | 5.5 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: atm: Fix NULL pointer dereference When MPOA_cache_impos_rcvd() receives the msg, it can t… |
CVE-2025-3666 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as critical. Affected by this issue is the function setDdnsCfg of the file /c… |
CVE-2025-3698 | High | 7.5 | 2025-04-16 | Interface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to information leakage risk. |
CVE-2025-3665 | Medium | 5.3 | 2025-04-16 | A vulnerability has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as critical. Affected by this vulnerability is the function setSmartQosC… |
CVE-2025-3664 | Medium | 5.3 | 2025-04-16 | A vulnerability, which was classified as critical, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWiFiEasyGuestCfg of the file… |
CVE-2025-3663 | Medium | 5.3 | 2025-04-16 | A vulnerability, which was classified as critical, has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. This issue affects the function setWiFiEasyCfg/setW… |
CVE-2025-3495 | Critical | 9.8 | 2025-04-16 | Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs (CWE-338). An attacker could easily brute force a session ID a… |
CVE-2025-2314 | Medium | 6.4 | 2025-04-16 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2025-30100 | Medium | 6.7 | 2025-04-16 | Dell Alienware Command Center 6.x, versions prior to 6.7.37.0 contain an Improper Access Control Vulnerability. A low privileged attacker with local access cou… |
CVE-2025-32385 | Medium | 5.3 | 2025-04-16 | EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbitrary URLs. As the… |
CVE-2025-30215 | Critical | 9.6 | 2025-04-16 | NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11… |
CVE-2025-32435 | Low | 2.6 | 2025-04-15 | Hydra is a Continuous Integration service for Nix based projects. Evaluation of untrusted non-flake nix code could potentially access secrets that are accessib… |
CVE-2025-32388 | Medium | 5.4 | 2025-04-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vu… |
CVE-2025-25458 | Medium | 4.6 | 2025-04-15 | Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serverName2. |
CVE-2025-25453 | Medium | 4.6 | 2025-04-15 | Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serviceName2. |
CVE-2025-22911 | Medium | 5.6 | 2025-04-15 | RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formiNICbasicREP function. |
CVE-2025-32923 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Tourmaster tourmaster allows Reflected XSS.Thi… |
CVE-2025-32784 | | 2025-04-15 | conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability h… | |
CVE-2025-32782 | Medium | 5.3 | 2025-04-15 | Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking… |
CVE-2025-31950 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain EV charger energy consumption information of other users. |
CVE-2025-31945 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain other users' charger information. |
CVE-2025-31654 | Medium | 5.3 | 2025-04-15 | An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms"). |
CVE-2025-31360 | Medium | 6.5 | 2025-04-15 | Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. |
CVE-2025-31147 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users. |
CVE-2025-30984 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dzynit SEO Tools seo-automatic-seo-tools allows Reflected… |
CVE-2025-30982 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookProgress by Stormhill Media mybookprogres… |
CVE-2025-30970 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scottwallick Easy Contact easy-contact allows Reflected X… |
CVE-2025-30967 | Critical | 9.6 | 2025-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in NotFound WPJobBoard allows Upload a Web Shell to a Web Server. This issue affects WPJobBoard: from n/a throu… |
CVE-2025-30966 | Medium | 5.4 | 2025-04-15 | Path Traversal vulnerability in NotFound WPJobBoard allows Path Traversal. This issue affects WPJobBoard: from n/a through n/a. |
CVE-2025-30512 | Medium | 6.5 | 2025-04-15 | Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off). |
CVE-2025-30510 | Critical | 9.8 | 2025-04-15 | An attacker can upload an arbitrary file instead of a plant image. |
CVE-2025-30257 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account. |
CVE-2025-29471 | High | 8.3 | 2025-04-15 | Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field. |
CVE-2025-27929 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts. |
CVE-2025-27927 | Medium | 5.3 | 2025-04-15 | An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API. |
CVE-2025-27892 | Medium | 6.8 | 2025-04-15 | Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-202… |
CVE-2025-27719 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can query an API endpoint and get device details. |