2025 CVEs (page 348)
Page 348 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27575 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID. |
CVE-2025-27565 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. |
CVE-2025-27561 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can rename "rooms" of arbitrary users. |
CVE-2025-27011 | High | 7.5 | 2025-04-15 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam Booking and Rental Mana… |
CVE-2025-27008 | High | 7.5 | 2025-04-15 | Missing Authorization vulnerability in NotFound Unlimited Timeline unlimited-timeline allows Accessing Functionality Not Properly Constrained by ACLs.This issu… |
CVE-2025-26998 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This… |
CVE-2025-26996 | Medium | 6.5 | 2025-04-15 | Improper Control of Generation of Code ('Code Injection') vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Code Injection.This issue affects… |
CVE-2025-26953 | High | 7.5 | 2025-04-15 | Missing Authorization vulnerability in Crocoblock JetMenu jet-menu allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetMenu… |
CVE-2025-26951 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in covertnine C9 Blocks c9-blocks allows DOM-Based XSS.This… |
CVE-2025-26950 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonsPress Nepali Date Converter nepali-date-converter a… |
CVE-2025-26934 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in graphthemes Glossy Blog glossy-blog allows Stored XSS.Thi… |
CVE-2025-26930 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alleythemes Home Services home-services allows DOM-Based… |
CVE-2025-26927 | Critical | 10.0 | 2025-04-15 | Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes AI Hub aihub allows Upload a Web Shell to a Web Server.This issue affects AI Hub… |
CVE-2025-26919 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tainacan Tainá taina allows Stored XSS.This issue affects… |
CVE-2025-26908 | High | 7.6 | 2025-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gurmehub Kargo Entegratör kargo-entegrator allows SQL Inj… |
CVE-2025-26906 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accoun… |
CVE-2025-26903 | Medium | 4.3 | 2025-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in RealMag777 InPost Gallery inpost-gallery allows Cross Site Request Forgery.This issue affects InPost Gallery… |
CVE-2025-26880 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows Stored XS… |
CVE-2025-26870 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This… |
CVE-2025-26857 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). |
CVE-2025-26749 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce… |
CVE-2025-26748 | High | 8.1 | 2025-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in looswebstudio Arkhe arkhe allows PHP Local File Inclusion.This issue affects Arkhe: from n/a through <= 3.12… |
CVE-2025-26746 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in caalami Advanced Custom Fields: Link Picker Field acf-lin… |
CVE-2025-26740 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware SpaBiz spabiz allows DOM-Based XSS.This is… |
CVE-2025-26730 | High | 7.5 | 2025-04-15 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NotFound Macro Calculator with Admin Email Optin & Data. This issue… |
CVE-2025-25276 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can hijack other users' devices and potentially control them. |
CVE-2025-24850 | Medium | 5.3 | 2025-04-15 | An attacker can export other users' plant information. |
CVE-2025-24315 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users). |
CVE-2025-24297 | Critical | 9.8 | 2025-04-15 | Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal. |
CVE-2025-22269 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allow… |
CVE-2025-22268 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learnda… |
CVE-2025-22263 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Global Gallery allows Reflected XSS. This issue… |
CVE-2025-32778 | | 2025-04-15 | Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project (Lissy… | |
CVE-2025-32021 | Low | 2.2 | 2025-04-15 | Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL… |
CVE-2025-31949 | Medium | 5.3 | 2025-04-15 | An authenticated attacker can obtain any plant name by knowing the plant ID. |
CVE-2025-31941 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain a list of smart devices by knowing a valid username. |
CVE-2025-31933 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can check the existence of usernames in the system by querying an API. |
CVE-2025-31499 | High | 8.8 | 2025-04-15 | Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in FFmpeg. This can be leveraged to possibly… |
CVE-2025-31357 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain a user's plant list by knowing the username. |
CVE-2025-30740 | Medium | 6.5 | 2025-04-15 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-30737 | Medium | 5.7 | 2025-04-15 | Vulnerability in the Oracle Smart View for Office product of Oracle Hyperion (component: Core Smart View). The supported version that is affected is 24.200… |
CVE-2025-30736 | High | 7.4 | 2025-04-15 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and 23.4-23.7. Difficult to… |
CVE-2025-30735 | High | 8.1 | 2025-04-15 | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Page and Field Configuration). The supporte… |
CVE-2025-30733 | Medium | 6.5 | 2025-04-15 | Vulnerability in the RDBMS Listener component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and 23.4-23.7. Easil… |
CVE-2025-30732 | Medium | 6.1 | 2025-04-15 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-1… |
CVE-2025-30731 | Low | 3.6 | 2025-04-15 | Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration). Supported versions that are affected… |
CVE-2025-30730 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.5-1… |
CVE-2025-30729 | Medium | 5.5 | 2025-04-15 | Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported version… |
CVE-2025-30728 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.14. Easily… |
CVE-2025-30727 | Critical | 9.8 | 2025-04-15 | Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-30726 | Medium | 5.3 | 2025-04-15 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-1… |
CVE-2025-30725 | Medium | 6.7 | 2025-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.6. Difficult to e… |
CVE-2025-30724 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.6.0.0.0 and 12.2.1… |
CVE-2025-30723 | Medium | 5.4 | 2025-04-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.6.0.0.0 and 12.2.1… |
CVE-2025-30722 | Medium | 5.3 | 2025-04-15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-30721 | Medium | 4.0 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9… |
CVE-2025-30720 | Medium | 6.1 | 2025-04-15 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Orders). Supported versions that are affected are 12.2.3-12.2.14. Easi… |
CVE-2025-30719 | Medium | 6.1 | 2025-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.6. Easily exploit… |
CVE-2025-30718 | Medium | 5.4 | 2025-04-15 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload). Supported versions that are affec… |
CVE-2025-30717 | Medium | 6.5 | 2025-04-15 | Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Diagnostics Scripts). Supported versions that are affected are… |
CVE-2025-30716 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are aff… |
CVE-2025-30715 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.41, 8.4… |
CVE-2025-30714 | Medium | 4.8 | 2025-04-15 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0-9.2.0. Difficult t… |
CVE-2025-30713 | Medium | 5.4 | 2025-04-15 | Vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager product of Oracle PeopleSoft (component: Job Opening). The supported version that i… |
CVE-2025-30712 | High | 8.1 | 2025-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.6. Easily exploit… |
CVE-2025-30711 | Medium | 5.4 | 2025-04-15 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload). Supported versions that are affec… |
CVE-2025-30710 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDBCluster Plugin). Supported versions that are affected are 8.0.0-8.0.41, 8.4… |
CVE-2025-30709 | Medium | 6.1 | 2025-04-15 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-30708 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Search and Register Users). Supported versions that are affected ar… |
CVE-2025-30707 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). Supported versions that are affected are 12.2.3-12.2.14. E… |
CVE-2025-30706 | High | 7.5 | 2025-04-15 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.0. Difficult to exp… |
CVE-2025-30705 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0… |
CVE-2025-30704 | Medium | 4.4 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.41, 8.4… |
CVE-2025-30703 | Low | 2.7 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-30702 | Medium | 5.3 | 2025-04-15 | Vulnerability in the Fleet Patching and amp; Provisioning component of Oracle Database Server. Supported versions that are affected are 19.3-19.26. Easily exp… |
CVE-2025-30701 | High | 7.3 | 2025-04-15 | Vulnerability in the RAS Security component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and 23.4-23.7. Easily… |
CVE-2025-30700 | Low | 3.5 | 2025-04-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). The supported version that is affected is 11. Eas… |
CVE-2025-30699 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-… |
CVE-2025-30698 | Medium | 5.6 | 2025-04-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions t… |
CVE-2025-30697 | Medium | 5.4 | 2025-04-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.6… |
CVE-2025-30696 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0… |
CVE-2025-30695 | Medium | 5.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-30694 | Medium | 5.4 | 2025-04-15 | Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and 23.4-23.7. Easily… |
CVE-2025-30693 | Medium | 5.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-30692 | Medium | 6.5 | 2025-04-15 | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.7-12.2… |
CVE-2025-30691 | Medium | 4.8 | 2025-04-15 | Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.6, 24; Oracle GraalVM for JDK: 21.0.6 and… |
CVE-2025-30690 | High | 7.2 | 2025-04-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Difficult to exploit vul… |
CVE-2025-30689 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-30688 | Medium | 6.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-30687 | Medium | 6.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-30686 | High | 7.6 | 2025-04-15 | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: EMC). Supported versions that are affected are 1… |
CVE-2025-30685 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4… |
CVE-2025-30684 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4… |
CVE-2025-30683 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4… |
CVE-2025-30682 | Medium | 6.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-30681 | Low | 2.7 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4… |
CVE-2025-30514 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes"). |
CVE-2025-30511 | High | 8.8 | 2025-04-15 | An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant. |
CVE-2025-30254 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username. |
CVE-2025-2497 | High | 7.8 | 2025-04-15 | A maliciously crafted DWG file, when parsed through Autodesk Revit, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this… |