2025 CVEs (page 351)
Page 351 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27791 | | 2025-04-15 | Collabora Online is a collaborative online office suite based on LibreOffice technology. In versions prior to 24.04.12.4, 23.05.19, and 22.05.25, there is a pa… | |
CVE-2025-25456 | Critical | 9.8 | 2025-04-15 | Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via mac2. |
CVE-2025-24358 | | 2025-04-15 | gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validat… | |
CVE-2025-22903 | Medium | 4.6 | 2025-04-15 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the pin parameter in the function setWiFiWpsConfig. |
CVE-2025-22900 | Critical | 9.8 | 2025-04-15 | Totolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macCloneMac parameter in the setWanConfig function. |
CVE-2025-3618 | Medium | 5.5 | 2025-04-15 | A denial-of-service vulnerability exists in the Rockwell Automation ThinManager. The software fails to adequately verify the outcome of memory allocation while… |
CVE-2025-3617 | High | 7.8 | 2025-04-15 | A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder caus… |
CVE-2025-33028 | Medium | 6.1 | 2025-04-15 | In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. This vulnerability allows attackers to… |
CVE-2025-33027 | Medium | 6.1 | 2025-04-15 | In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protecti… |
CVE-2025-33026 | Medium | 6.1 | 2025-04-15 | In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechani… |
CVE-2025-29705 | Medium | 4.3 | 2025-04-15 | code-gen <=2.0.6 is vulnerable to Incorrect Access Control. The project does not have permission control allowing anyone to access such projects. |
CVE-2025-28100 | Critical | 9.8 | 2025-04-15 | A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at the "operateOrder.ph… |
CVE-2025-32780 | High | 7.3 | 2025-04-15 | BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.6.2 is vulnerable to a DLL Hijacking vulnerability. By… |
CVE-2025-32779 | Medium | 6.5 | 2025-04-15 | E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. In versions before 5.5.0, an attacker with access to the `/backu… |
CVE-2025-32776 | Medium | 5.5 | 2025-04-15 | OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to… |
CVE-2025-29817 | Medium | 5.7 | 2025-04-15 | Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network. |
CVE-2025-32911 | Critical | 9.0 | 2025-04-15 | A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP cli… |
CVE-2025-28198 | Medium | 5.9 | 2025-04-15 | A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController… |
CVE-2025-24949 | Medium | 6.5 | 2025-04-15 | In JotUrl 2.0, is possible to bypass security requirements during the password change process. |
CVE-2025-24948 | Medium | 6.5 | 2025-04-15 | In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records. |
CVE-2025-3523 | Medium | 6.4 | 2025-04-15 | When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering ove… |
CVE-2025-3522 | Medium | 6.3 | 2025-04-15 | Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird a… |
CVE-2025-32949 | Medium | 6.5 | 2025-04-15 | This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb. If user import i… |
CVE-2025-32948 | High | 7.5 | 2025-04-15 | The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attac… |
CVE-2025-32947 | High | 7.5 | 2025-04-15 | This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receivi… |
CVE-2025-2830 | Medium | 6.3 | 2025-04-15 | By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when t… |
CVE-2025-29281 | High | 8.8 | 2025-04-15 | In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute… |
CVE-2025-28145 | Medium | 6.5 | 2025-04-15 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition in /boafrm/formDisk… |
CVE-2025-28144 | Medium | 6.5 | 2025-04-15 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin parameter in the formWsc… |
CVE-2025-28143 | Medium | 6.5 | 2025-04-15 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupname at the /boafrm/… |
CVE-2025-28142 | Medium | 6.5 | 2025-04-15 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the foldername in /boafrm/for… |
CVE-2025-27980 | Medium | 6.5 | 2025-04-15 | cashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=. |
CVE-2025-29280 | Medium | 4.8 | 2025-04-15 | Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker t… |
CVE-2025-28137 | Critical | 9.8 | 2025-04-15 | The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the Not… |
CVE-2025-28136 | Medium | 6.5 | 2025-04-15 | TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi. |
CVE-2025-3608 | Medium | 6.5 | 2025-04-15 | A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This… |
CVE-2025-32946 | Medium | 5.3 | 2025-04-15 | This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the… |
CVE-2025-32945 | Medium | 4.3 | 2025-04-15 | The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code sets the owner of the… |
CVE-2025-32944 | Medium | 6.5 | 2025-04-15 | The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is t… |
CVE-2025-32103 | Medium | 5.0 | 2025-04-15 | CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at… |
CVE-2025-32102 | Medium | 5.0 | 2025-04-15 | CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterfac… |
CVE-2025-32929 | High | 7.5 | 2025-04-15 | Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders all… |
CVE-2025-31011 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets a… |
CVE-2025-30985 | Critical | 9.8 | 2025-04-15 | Deserialization of Untrusted Data vulnerability in kagla GNUCommerce gnucommerce allows Object Injection.This issue affects GNUCommerce: from n/a through <= 1… |
CVE-2025-30965 | Medium | 4.3 | 2025-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in NotFound WPJobBoard allows Cross Site Request Forgery. This issue affects WPJobBoard: from n/a through n/a. |
CVE-2025-30964 | Medium | 5.4 | 2025-04-15 | Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods Photography photography allows Server Side Request Forgery.This issue affects Photography: from… |
CVE-2025-30962 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fs-code FS Poster fs-poster allows Reflected XSS.This iss… |
CVE-2025-26992 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Landing Page Cat landing-page-cat allows Refle… |
CVE-2025-26990 | Medium | 4.4 | 2025-04-15 | Server-Side Request Forgery (SSRF) vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Server Side Request Forgery.This issue affect… |
CVE-2025-26982 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric-Oliver Mächler DSGVO Youtube dsgvo-youtube allows DO… |
CVE-2025-26959 | High | 8.8 | 2025-04-15 | Missing Authorization vulnerability in Quý Lê 91 Administrator Z administrator-z allows Privilege Escalation.This issue affects Administrator Z: from n/a throu… |
CVE-2025-26958 | High | 7.5 | 2025-04-15 | Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlog… |
CVE-2025-26955 | Medium | 4.3 | 2025-04-15 | Missing Authorization vulnerability in vowelweb Industrial Lite industrial-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-26954 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 1pluginjquery ZooEffect 1-jquery-photo-gallery-slideshow-… |
CVE-2025-26944 | High | 7.5 | 2025-04-15 | Missing Authorization vulnerability in Crocoblock JetPopup jet-popup allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetPopu… |
CVE-2025-26942 | High | 7.5 | 2025-04-15 | Missing Authorization vulnerability in Crocoblock JetTricks jet-tricks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetTr… |
CVE-2025-26894 | High | 7.5 | 2025-04-15 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mobeen Abdullah Coming Soon, Maintenan… |
CVE-2025-26889 | High | 7.5 | 2025-04-15 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hockeydata hockeydata LOS hockeydata-l… |
CVE-2025-26745 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RSTheme RS Elements Elementor Addon rselements-lite allow… |
CVE-2025-26744 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows DOM-Based XSS.This iss… |
CVE-2025-26743 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TC.K Advance WP Query Search Filter advance-wp-query-sear… |
CVE-2025-26741 | High | 8.8 | 2025-04-15 | Missing Authorization vulnerability in AWEOS GmbH Email Notifications for Updates wp-update-mail-notification allows Privilege Escalation.This issue affects Em… |
CVE-2025-32943 | Low | 3.7 | 2025-04-15 | The vulnerability allows any authenticated user to leak the contents of arbitrary “.m3u8” files from the PeerTube server due to a path traversal in the HLS end… |
CVE-2025-1688 | Medium | 5.5 | 2025-04-15 | Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after the upgrading from ol… |
CVE-2025-2083 | Medium | 6.4 | 2025-04-15 | The Logo Carousel Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sliderId’ parameter in all versions up to, and inc… |
CVE-2025-3579 | | 2025-04-15 | In versions prior to Aidex 1.7, an authenticated malicious user, taking advantage of an open registry, could execute unauthorised commands within the system. T… | |
CVE-2025-3578 | | 2025-04-15 | A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, lis… | |
CVE-2025-3575 | | 2025-04-15 | Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario… | |
CVE-2025-3574 | | 2025-04-15 | Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario… | |
CVE-2025-3622 | Medium | 5.5 | 2025-04-15 | A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference… |
CVE-2025-3576 | Medium | 5.9 | 2025-04-15 | A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum desi… |
CVE-2025-32993 | Medium | 6.5 | 2025-04-15 | Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_username parameter. Authe… |
CVE-2025-2225 | Medium | 6.4 | 2025-04-15 | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2025-3573 | Medium | 6.1 | 2025-04-15 | Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a u… |
CVE-2025-29984 | Medium | 6.7 | 2025-04-15 | Dell Trusted Device, versions prior to 7.0.3.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could pote… |
CVE-2025-29983 | Medium | 6.7 | 2025-04-15 | Dell Trusted Device, versions prior to 7.0.3.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attac… |
CVE-2025-3613 | Low | 3.5 | 2025-04-15 | A vulnerability has been found in Demtec Graphytics 5.0.7 and classified as problematic. This vulnerability affects unknown code of the file /visualization. Th… |
CVE-2025-3612 | Medium | 4.3 | 2025-04-15 | A vulnerability, which was classified as problematic, was found in Demtec Graphytics 5.0.7. This affects an unknown part of the file /visualization of the comp… |
CVE-2025-3470 | Medium | 4.9 | 2025-04-15 | The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the s parameter in all versions up to, and in… |
CVE-2025-32997 | Medium | 4.0 | 2025-04-15 | In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. |
CVE-2025-32996 | Medium | 4.0 | 2025-04-15 | In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. |
CVE-2025-32987 | Medium | 6.0 | 2025-04-15 | Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line in EVSearcher. |
CVE-2025-32428 | | 2025-04-15 | Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by… | |
CVE-2025-31494 | Low | 3.5 | 2025-04-15 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Pl… |
CVE-2025-31491 | High | 8.6 | 2025-04-15 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1… |
CVE-2025-24797 | Critical | 9.4 | 2025-04-15 | Meshtastic is an open source mesh networking solution. A fault in the handling of mesh packets containing invalid protobuf data can result in an attacker-contr… |
CVE-2025-3593 | Medium | 6.3 | 2025-04-14 | A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been declared as critical. This vulnerability affects the function Upload of th… |
CVE-2025-31490 | High | 7.5 | 2025-04-14 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1… |
CVE-2025-3592 | Low | 3.5 | 2025-04-14 | A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been classified as problematic. This affects an unknown part of the file /admin… |
CVE-2025-3591 | Low | 3.5 | 2025-04-14 | A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0 and classified as problematic. Affected by this issue is some unknown functionality of… |
CVE-2025-3590 | Medium | 6.3 | 2025-04-14 | A vulnerability has been found in Adianti Framework up to 8.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manip… |
CVE-2025-3589 | Medium | 6.3 | 2025-04-14 | A vulnerability, which was classified as critical, was found in SourceCodester Music Class Enrollment System 1.0. Affected is an unknown function of the file /… |
CVE-2025-3588 | Medium | 5.3 | 2025-04-14 | A vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1.2.2. This issue affects the function apply of the file… |
CVE-2025-3587 | Medium | 6.3 | 2025-04-14 | A vulnerability classified as critical was found in ZeroWdd/code-projects studentmanager 1.0. This vulnerability affects unknown code of the file /getTeacherLi… |
CVE-2025-1782 | Critical | 9.9 | 2025-04-14 | In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbit… |
CVE-2025-3585 | Medium | 6.3 | 2025-04-14 | A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /upload/ of the component JSP Parser… |
CVE-2025-3277 | Critical | 9.8 | 2025-04-14 | An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then w… |
CVE-2025-29720 | Medium | 4.8 | 2025-04-14 | Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. |
CVE-2025-32931 | Critical | 9.1 | 2025-04-14 | DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php a… |
CVE-2025-2572 | Medium | 5.6 | 2025-04-14 | In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of Whats… |