2025 CVEs (page 350)
Page 350 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1688 | Medium | 5.5 | 2025-04-15 | Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after the upgrading from ol… |
CVE-2025-2083 | Medium | 6.4 | 2025-04-15 | The Logo Carousel Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sliderId’ parameter in all versions up to, and inc… |
CVE-2025-3579 | | 2025-04-15 | In versions prior to Aidex 1.7, an authenticated malicious user, taking advantage of an open registry, could execute unauthorised commands within the system. T… | |
CVE-2025-3578 | | 2025-04-15 | A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, lis… | |
CVE-2025-3575 | | 2025-04-15 | Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario… | |
CVE-2025-3574 | | 2025-04-15 | Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario… | |
CVE-2025-3622 | Medium | 5.5 | 2025-04-15 | A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference… |
CVE-2025-3576 | Medium | 5.9 | 2025-04-15 | A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum desi… |
CVE-2025-32993 | Medium | 6.5 | 2025-04-15 | Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_username parameter. Authe… |
CVE-2025-2225 | Medium | 6.4 | 2025-04-15 | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2025-3573 | Medium | 6.1 | 2025-04-15 | Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a u… |
CVE-2025-29984 | Medium | 6.7 | 2025-04-15 | Dell Trusted Device, versions prior to 7.0.3.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could pote… |
CVE-2025-29983 | Medium | 6.7 | 2025-04-15 | Dell Trusted Device, versions prior to 7.0.3.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attac… |
CVE-2025-3613 | Low | 3.5 | 2025-04-15 | A vulnerability has been found in Demtec Graphytics 5.0.7 and classified as problematic. This vulnerability affects unknown code of the file /visualization. Th… |
CVE-2025-3612 | Medium | 4.3 | 2025-04-15 | A vulnerability, which was classified as problematic, was found in Demtec Graphytics 5.0.7. This affects an unknown part of the file /visualization of the comp… |
CVE-2025-3470 | Medium | 4.9 | 2025-04-15 | The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the s parameter in all versions up to, and in… |
CVE-2025-32997 | Medium | 4.0 | 2025-04-15 | In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. |
CVE-2025-32996 | Medium | 4.0 | 2025-04-15 | In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. |
CVE-2025-32987 | Medium | 6.0 | 2025-04-15 | Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line in EVSearcher. |
CVE-2025-32428 | | 2025-04-15 | Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by… | |
CVE-2025-31494 | Low | 3.5 | 2025-04-15 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Pl… |
CVE-2025-31491 | High | 8.6 | 2025-04-15 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1… |
CVE-2025-24797 | Critical | 9.4 | 2025-04-15 | Meshtastic is an open source mesh networking solution. A fault in the handling of mesh packets containing invalid protobuf data can result in an attacker-contr… |
CVE-2025-3593 | Medium | 6.3 | 2025-04-14 | A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been declared as critical. This vulnerability affects the function Upload of th… |
CVE-2025-31490 | High | 7.5 | 2025-04-14 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1… |
CVE-2025-3592 | Low | 3.5 | 2025-04-14 | A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been classified as problematic. This affects an unknown part of the file /admin… |
CVE-2025-3591 | Low | 3.5 | 2025-04-14 | A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0 and classified as problematic. Affected by this issue is some unknown functionality of… |
CVE-2025-3590 | Medium | 6.3 | 2025-04-14 | A vulnerability has been found in Adianti Framework up to 8.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manip… |
CVE-2025-3589 | Medium | 6.3 | 2025-04-14 | A vulnerability, which was classified as critical, was found in SourceCodester Music Class Enrollment System 1.0. Affected is an unknown function of the file /… |
CVE-2025-3588 | Medium | 5.3 | 2025-04-14 | A vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1.2.2. This issue affects the function apply of the file… |
CVE-2025-3587 | Medium | 6.3 | 2025-04-14 | A vulnerability classified as critical was found in ZeroWdd/code-projects studentmanager 1.0. This vulnerability affects unknown code of the file /getTeacherLi… |
CVE-2025-1782 | Critical | 9.9 | 2025-04-14 | In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbit… |
CVE-2025-3585 | Medium | 6.3 | 2025-04-14 | A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /upload/ of the component JSP Parser… |
CVE-2025-3277 | Critical | 9.8 | 2025-04-14 | An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then w… |
CVE-2025-29720 | Medium | 4.8 | 2025-04-14 | Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. |
CVE-2025-32931 | Critical | 9.1 | 2025-04-14 | DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php a… |
CVE-2025-2572 | Medium | 5.6 | 2025-04-14 | In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of Whats… |
CVE-2025-22373 | | 2025-04-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SicommNet BASEC on SaaS allows Reflected XSS, XSS… | |
CVE-2025-22372 | | 2025-04-14 | Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversi… | |
CVE-2025-22371 | | 2025-04-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unaut… | |
CVE-2025-3571 | Medium | 6.3 | 2025-04-14 | A vulnerability was found in Fannuo Enterprise Content Management System 凡诺企业网站管理系统 1.1/4.0. It has been declared as critical. This vulnerability affects unkno… |
CVE-2025-3570 | Low | 3.5 | 2025-04-14 | A vulnerability was found in JamesZBL/code-projects db-hospital-drug 1.0. It has been classified as problematic. This affects the function Save of the file Con… |
CVE-2025-32914 | High | 7.4 | 2025-04-14 | A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP cli… |
CVE-2025-32912 | Medium | 6.5 | 2025-04-14 | A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash. |
CVE-2025-32910 | Medium | 6.5 | 2025-04-14 | A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to cras… |
CVE-2025-32909 | Medium | 5.3 | 2025-04-14 | A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniff_mp4 function. The HTTP server may cause the libsou… |
CVE-2025-2475 | Medium | 5.4 | 2025-04-14 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an… |
CVE-2025-2424 | Low | 3.1 | 2025-04-14 | Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the… |
CVE-2025-2161 | High | 7.1 | 2025-04-14 | Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup |
CVE-2025-2160 | High | 8.1 | 2025-04-14 | Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup |
CVE-2025-3569 | Medium | 6.3 | 2025-04-14 | A vulnerability was found in JamesZBL/code-projects db-hospital-drug 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-3568 | Low | 3.5 | 2025-04-14 | A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-32913 | High | 7.5 | 2025-04-14 | A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a… |
CVE-2025-32908 | High | 7.5 | 2025-04-14 | A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a… |
CVE-2025-32907 | Medium | 5.3 | 2025-04-14 | A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to r… |
CVE-2025-32906 | High | 7.5 | 2025-04-14 | A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to us… |
CVE-2025-3567 | Medium | 4.3 | 2025-04-14 | A vulnerability, which was classified as problematic, was found in veal98 小牛肉 Echo 开源社区系统 4.2. Affected is the function preHandle of the file src/main/java/com… |
CVE-2025-3566 | High | 7.3 | 2025-04-14 | A vulnerability, which was classified as critical, has been found in veal98 小牛肉 Echo 开源社区系统 4.2. This issue affects the function uploadMdPic of the file /discu… |
CVE-2025-3565 | Medium | 4.7 | 2025-04-14 | A vulnerability classified as critical was found in huanfenz/code-projects StudentManager 1.0. This vulnerability affects unknown code of the file /upload/uplo… |
CVE-2025-3564 | Medium | 4.3 | 2025-04-14 | A vulnerability classified as problematic has been found in huanfenz/code-projects StudentManager up to 1.0. This affects an unknown part of the component Teac… |
CVE-2025-3563 | Medium | 4.7 | 2025-04-14 | A vulnerability was found in WuzhiCMS 4.1. It has been rated as critical. Affected by this issue is the function Set of the file /index.php?m=attachment&f=inde… |
CVE-2025-3562 | Medium | 4.3 | 2025-04-14 | A vulnerability was found in Yonyou YonBIP MA2.7. It has been declared as problematic. Affected by this vulnerability is the function FileInputStream of the fi… |
CVE-2025-27009 | High | 7.1 | 2025-04-14 | Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auction… |
CVE-2025-3561 | Medium | 4.3 | 2025-04-14 | A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cro… |
CVE-2025-3560 | Low | 3.5 | 2025-04-14 | A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /product. The ma… |
CVE-2025-3559 | Medium | 6.3 | 2025-04-14 | A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical. This vulnerability affects the function ForeProductListController of… |
CVE-2025-3558 | Medium | 6.3 | 2025-04-14 | A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHead… |
CVE-2025-24859 | High | 8.8 | 2025-04-14 | A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes… |
CVE-2025-3557 | Medium | 4.3 | 2025-04-14 | A vulnerability, which was classified as problematic, has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this issue is some unknown fun… |
CVE-2025-3556 | Low | 3.7 | 2025-04-14 | A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality… |
CVE-2025-31344 | High | 7.3 | 2025-04-14 | Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects gifli… |
CVE-2025-3555 | Low | 3.7 | 2025-04-14 | A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php… |
CVE-2025-3554 | Medium | 4.3 | 2025-04-14 | A vulnerability was found in phpshe 1.8. It has been rated as problematic. This issue affects some unknown processing of the file api.php?mod=cron&act=buyer. T… |
CVE-2025-32093 | Medium | 4.7 | 2025-04-14 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, whic… |
CVE-2025-30516 | Low | 2.0 | 2025-04-14 | Mattermost Mobile Apps versions <=2.25.0 fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized use… |
CVE-2025-3553 | Medium | 6.3 | 2025-04-14 | A vulnerability was found in phpshe 1.8. It has been declared as critical. This vulnerability affects the function pe_delete of the file /admin.php?mod=brand&a… |
CVE-2025-2563 | High | 8.1 | 2025-04-14 | The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leadin… |
CVE-2025-3550 | Medium | 4.3 | 2025-04-14 | A vulnerability has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by this vulnerability is… |
CVE-2025-3572 | High | 7.5 | 2025-04-14 | SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access ar… |
CVE-2025-3549 | Medium | 5.3 | 2025-04-14 | A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD3Importer::ValidateS… |
CVE-2025-3548 | Medium | 5.3 | 2025-04-14 | A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the function aiString::Se… |
CVE-2025-3547 | Medium | 6.3 | 2025-04-14 | A vulnerability classified as critical was found in frdel Agent-Zero 0.8.1.2. This vulnerability affects unknown code of the file /get_work_dir_files. The mani… |
CVE-2025-3546 | High | 8.0 | 2025-04-14 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affec… |
CVE-2025-3545 | High | 8.0 | 2025-04-14 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Aff… |
CVE-2025-3544 | High | 8.0 | 2025-04-14 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue a… |
CVE-2025-3543 | High | 8.0 | 2025-04-14 | A vulnerability has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014 and classified as critical. This vulnerability aff… |
CVE-2025-3542 | High | 8.0 | 2025-04-14 | A vulnerability, which was classified as critical, was found in H3C Magic NX15, Magic NX400 and Magic R3010 up to V100R014. This affects the function FCGI_Wiza… |
CVE-2025-3541 | High | 8.0 | 2025-04-13 | A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by th… |
CVE-2025-3540 | High | 8.0 | 2025-04-13 | A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability… |
CVE-2025-3539 | High | 8.0 | 2025-04-13 | A vulnerability classified as critical has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected is… |
CVE-2025-3445 | High | 8.1 | 2025-04-13 | A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path trave… |
CVE-2025-3538 | High | 8.8 | 2025-04-13 | A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function auth_asp of the file /auth.asp of the co… |
CVE-2025-3537 | Medium | 5.3 | 2025-04-13 | A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /ad… |
CVE-2025-3536 | Medium | 6.5 | 2025-04-13 | A vulnerability was found in Tutorials-Website Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2025-3423 | Medium | 5.4 | 2025-04-13 | IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript cod… |
CVE-2025-3535 | Medium | 4.3 | 2025-04-13 | A vulnerability has been found in shuanx BurpAPIFinder up to 2.0.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-3534 | Medium | 6.3 | 2025-04-13 | A vulnerability, which was classified as critical, was found in PowerCreator CMS 1.0. Affected is an unknown function of the file /OpenPublicCourse.aspx. The m… |
CVE-2025-3533 | Medium | 4.3 | 2025-04-13 | A vulnerability, which was classified as problematic, has been found in YouDianCMS 9.5.21. This issue affects some unknown processing of the file /App/Tpl/Admi… |
CVE-2025-3532 | Medium | 4.3 | 2025-04-13 | A vulnerability classified as problematic was found in YouDianCMS 9.5.21. This vulnerability affects unknown code of the file /App/Tpl/Member/Default/Order/ind… |
CVE-2025-3531 | Medium | 4.3 | 2025-04-13 | A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Default/Log/index.html… |