2025 CVEs (page 349)
Page 349 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3682 | High | 7.3 | 2025-04-16 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component PASV Command Handler. Th… |
CVE-2025-30960 | High | 8.3 | 2025-04-16 | Missing Authorization vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through <= 6.5.8. |
CVE-2025-22023 | High | 7.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Don't skip on Stopped - Length Invalid Up until commit d56b0b2ab142 ("usb: xhc… |
CVE-2025-22022 | High | 7.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two clearly different specime… |
CVE-2025-22021 | Critical | 10.0 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrac… |
CVE-2025-22020 | High | 7.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the f… |
CVE-2025-22019 | High | 7.3 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: bcachefs: bch2_ioctl_subvolume_destroy() fixes bch2_evict_subvolume_inodes() was getting… |
CVE-2025-3681 | High | 7.3 | 2025-04-16 | A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MODE Comm… |
CVE-2025-3680 | High | 7.3 | 2025-04-16 | A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the componen… |
CVE-2025-3679 | High | 7.3 | 2025-04-16 | A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component HOST Command Handler… |
CVE-2025-31363 | Low | 3.0 | 2025-04-16 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authe… |
CVE-2025-27936 | Medium | 5.3 | 2025-04-16 | Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time compari… |
CVE-2025-3678 | High | 7.3 | 2025-04-16 | A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component HELP C… |
CVE-2025-3677 | Medium | 5.3 | 2025-04-16 | A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem o… |
CVE-2025-3104 | Medium | 5.3 | 2025-04-16 | The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capabil… |
CVE-2025-3676 | Medium | 6.3 | 2025-04-16 | A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/search/books. The manipu… |
CVE-2025-3077 | Medium | 6.4 | 2025-04-16 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and… |
CVE-2025-27571 | Medium | 4.3 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching… |
CVE-2025-27538 | Low | 2.2 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the ta… |
CVE-2025-24839 | Low | 3.1 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows… |
CVE-2025-0101 | Medium | 6.5 | 2025-04-16 | A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes some functions to work… |
CVE-2025-3675 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been rated as critical. Affected by this issue is the function setL2tpServerCfg of t… |
CVE-2025-3674 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilt… |
CVE-2025-3247 | Medium | 5.3 | 2025-04-16 | The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' functi… |
CVE-2025-3668 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. This vulnerability affects the function setScheduleCfg of… |
CVE-2025-3667 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-b… |
CVE-2025-22018 | Medium | 5.5 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: atm: Fix NULL pointer dereference When MPOA_cache_impos_rcvd() receives the msg, it can t… |
CVE-2025-3666 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as critical. Affected by this issue is the function setDdnsCfg of the file /c… |
CVE-2025-3698 | High | 7.5 | 2025-04-16 | Interface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to information leakage risk. |
CVE-2025-3665 | Medium | 5.3 | 2025-04-16 | A vulnerability has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as critical. Affected by this vulnerability is the function setSmartQosC… |
CVE-2025-3664 | Medium | 5.3 | 2025-04-16 | A vulnerability, which was classified as critical, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWiFiEasyGuestCfg of the file… |
CVE-2025-3663 | Medium | 5.3 | 2025-04-16 | A vulnerability, which was classified as critical, has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. This issue affects the function setWiFiEasyCfg/setW… |
CVE-2025-3495 | Critical | 9.8 | 2025-04-16 | Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs (CWE-338). An attacker could easily brute force a session ID a… |
CVE-2025-2314 | Medium | 6.4 | 2025-04-16 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2025-30100 | Medium | 6.7 | 2025-04-16 | Dell Alienware Command Center 6.x, versions prior to 6.7.37.0 contain an Improper Access Control Vulnerability. A low privileged attacker with local access cou… |
CVE-2025-32385 | Medium | 5.3 | 2025-04-16 | EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbitrary URLs. As the… |
CVE-2025-30215 | Critical | 9.6 | 2025-04-16 | NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11… |
CVE-2025-32435 | Low | 2.6 | 2025-04-15 | Hydra is a Continuous Integration service for Nix based projects. Evaluation of untrusted non-flake nix code could potentially access secrets that are accessib… |
CVE-2025-32388 | Medium | 5.4 | 2025-04-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vu… |
CVE-2025-25458 | Medium | 4.6 | 2025-04-15 | Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serverName2. |
CVE-2025-25453 | Medium | 4.6 | 2025-04-15 | Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serviceName2. |
CVE-2025-22911 | Medium | 5.6 | 2025-04-15 | RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formiNICbasicREP function. |
CVE-2025-32923 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Tourmaster tourmaster allows Reflected XSS.Thi… |
CVE-2025-32784 | | 2025-04-15 | conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability h… | |
CVE-2025-32782 | Medium | 5.3 | 2025-04-15 | Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking… |
CVE-2025-31950 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain EV charger energy consumption information of other users. |
CVE-2025-31945 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain other users' charger information. |
CVE-2025-31654 | Medium | 5.3 | 2025-04-15 | An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms"). |
CVE-2025-31360 | Medium | 6.5 | 2025-04-15 | Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. |
CVE-2025-31147 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users. |
CVE-2025-30984 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dzynit SEO Tools seo-automatic-seo-tools allows Reflected… |
CVE-2025-30982 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookProgress by Stormhill Media mybookprogres… |
CVE-2025-30970 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scottwallick Easy Contact easy-contact allows Reflected X… |
CVE-2025-30967 | Critical | 9.6 | 2025-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in NotFound WPJobBoard allows Upload a Web Shell to a Web Server. This issue affects WPJobBoard: from n/a throu… |
CVE-2025-30966 | Medium | 5.4 | 2025-04-15 | Path Traversal vulnerability in NotFound WPJobBoard allows Path Traversal. This issue affects WPJobBoard: from n/a through n/a. |
CVE-2025-30512 | Medium | 6.5 | 2025-04-15 | Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off). |
CVE-2025-30510 | Critical | 9.8 | 2025-04-15 | An attacker can upload an arbitrary file instead of a plant image. |
CVE-2025-30257 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account. |
CVE-2025-29471 | High | 8.3 | 2025-04-15 | Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field. |
CVE-2025-27929 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts. |
CVE-2025-27927 | Medium | 5.3 | 2025-04-15 | An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API. |
CVE-2025-27892 | Medium | 6.8 | 2025-04-15 | Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-202… |
CVE-2025-27719 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can query an API endpoint and get device details. |
CVE-2025-27575 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID. |
CVE-2025-27565 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. |
CVE-2025-27561 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can rename "rooms" of arbitrary users. |
CVE-2025-27011 | High | 7.5 | 2025-04-15 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam Booking and Rental Mana… |
CVE-2025-27008 | High | 7.5 | 2025-04-15 | Missing Authorization vulnerability in NotFound Unlimited Timeline unlimited-timeline allows Accessing Functionality Not Properly Constrained by ACLs.This issu… |
CVE-2025-26998 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This… |
CVE-2025-26996 | Medium | 6.5 | 2025-04-15 | Improper Control of Generation of Code ('Code Injection') vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Code Injection.This issue affects… |
CVE-2025-26953 | High | 7.5 | 2025-04-15 | Missing Authorization vulnerability in Crocoblock JetMenu jet-menu allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetMenu… |
CVE-2025-26951 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in covertnine C9 Blocks c9-blocks allows DOM-Based XSS.This… |
CVE-2025-26950 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonsPress Nepali Date Converter nepali-date-converter a… |
CVE-2025-26934 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in graphthemes Glossy Blog glossy-blog allows Stored XSS.Thi… |
CVE-2025-26930 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alleythemes Home Services home-services allows DOM-Based… |
CVE-2025-26927 | Critical | 10.0 | 2025-04-15 | Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes AI Hub aihub allows Upload a Web Shell to a Web Server.This issue affects AI Hub… |
CVE-2025-26919 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tainacan Tainá taina allows Stored XSS.This issue affects… |
CVE-2025-26908 | High | 7.6 | 2025-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gurmehub Kargo Entegratör kargo-entegrator allows SQL Inj… |
CVE-2025-26906 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accoun… |
CVE-2025-26903 | Medium | 4.3 | 2025-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in RealMag777 InPost Gallery inpost-gallery allows Cross Site Request Forgery.This issue affects InPost Gallery… |
CVE-2025-26880 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows Stored XS… |
CVE-2025-26870 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This… |
CVE-2025-26857 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). |
CVE-2025-26749 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce… |
CVE-2025-26748 | High | 8.1 | 2025-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in looswebstudio Arkhe arkhe allows PHP Local File Inclusion.This issue affects Arkhe: from n/a through <= 3.12… |
CVE-2025-26746 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in caalami Advanced Custom Fields: Link Picker Field acf-lin… |
CVE-2025-26740 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware SpaBiz spabiz allows DOM-Based XSS.This is… |
CVE-2025-26730 | High | 7.5 | 2025-04-15 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NotFound Macro Calculator with Admin Email Optin & Data. This issue… |
CVE-2025-25276 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can hijack other users' devices and potentially control them. |
CVE-2025-24850 | Medium | 5.3 | 2025-04-15 | An attacker can export other users' plant information. |
CVE-2025-24315 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users). |
CVE-2025-24297 | Critical | 9.8 | 2025-04-15 | Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal. |
CVE-2025-22269 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allow… |
CVE-2025-22268 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learnda… |
CVE-2025-22263 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Global Gallery allows Reflected XSS. This issue… |
CVE-2025-32778 | | 2025-04-15 | Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project (Lissy… | |
CVE-2025-32021 | Low | 2.2 | 2025-04-15 | Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL… |
CVE-2025-31949 | Medium | 5.3 | 2025-04-15 | An authenticated attacker can obtain any plant name by knowing the plant ID. |
CVE-2025-31941 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can obtain a list of smart devices by knowing a valid username. |
CVE-2025-31933 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can check the existence of usernames in the system by querying an API. |