2025 CVEs (page 351)
Page 351 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2814 | Medium | 4.0 | 2025-04-13 | Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cry… |
CVE-2025-1456 | Medium | 6.4 | 2025-04-12 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widget… |
CVE-2025-1455 | Medium | 6.4 | 2025-04-12 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all versions up to, and i… |
CVE-2025-3418 | High | 8.8 | 2025-04-12 | The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting… |
CVE-2025-3292 | Medium | 4.3 | 2025-04-12 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Refere… |
CVE-2025-3282 | Medium | 5.3 | 2025-04-12 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Refere… |
CVE-2025-3276 | Medium | 6.4 | 2025-04-12 | The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Carousel block in all versions up… |
CVE-2025-2871 | Medium | 4.3 | 2025-04-12 | The WordPress Mega Menu – QuadMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to… |
CVE-2025-2881 | Medium | 5.3 | 2025-04-12 | The Developer Toolbar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 through the publicly acc… |
CVE-2025-2841 | Medium | 5.3 | 2025-04-12 | The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessib… |
CVE-2025-32726 | Medium | 6.8 | 2025-04-12 | Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally. |
CVE-2025-29834 | High | 7.5 | 2025-04-12 | Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2025-29803 | High | 7.3 | 2025-04-12 | Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges l… |
CVE-2025-2269 | Medium | 6.1 | 2025-04-12 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in… |
CVE-2025-0129 | | 2025-04-11 | An improper exception check in Palo Alto Networks Prisma Access Browser allows a low privileged user to prevent Prisma Access Browser from applying it's Policy… | |
CVE-2025-0123 | | 2025-04-11 | A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature… | |
CVE-2025-0119 | | 2025-04-11 | A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS commands with root privi… | |
CVE-2025-32367 | High | 8.6 | 2025-04-11 | The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the numbe… |
CVE-2025-32080 | | 2025-04-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resour… | |
CVE-2025-32079 | Medium | 6.5 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments allows HTTP DoS.This issue affects Mediawiki - GrowthExperime… |
CVE-2025-32078 | | 2025-04-11 | Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This… | |
CVE-2025-32077 | | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects M… | |
CVE-2025-32076 | | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Dat… | |
CVE-2025-32075 | | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extens… | |
CVE-2025-32074 | Medium | 5.4 | 2025-04-11 | Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Confirm Account Extension allows Cross-Site Scripting (XSS).This… |
CVE-2025-32073 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - HTML Tags allows Cross-Site Scripting (XSS).This issue affects Mediawiki - HTML… |
CVE-2025-32072 | | 2025-04-11 | Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Media… | |
CVE-2025-32071 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikidata Extension allows Cross-Site Scripting (XSS) from widthheight message v… |
CVE-2025-32070 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting (XSS).This issue affects Mediaw… |
CVE-2025-32069 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting (XSS).This issue affe… |
CVE-2025-32068 | Medium | 5.4 | 2025-04-11 | Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth… |
CVE-2025-32067 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Growth Experiments Extension allows Cross-Site Scripting (XSS).This issue affec… |
CVE-2025-31935 | Medium | 6.2 | 2025-04-11 | Subnet Solutions PowerSYSTEM Center is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the API may trigger… |
CVE-2025-31354 | Medium | 4.3 | 2025-04-11 | Subnet Solutions PowerSYSTEM Center's SMTPS notification service can be affected by importing an EC certificate with crafted F2m parameters, which can lead to… |
CVE-2025-32427 | Medium | 5.4 | 2025-04-11 | Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, th… |
CVE-2025-32426 | Medium | 4.6 | 2025-04-11 | Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notificatio… |
CVE-2025-3439 | Critical | 9.8 | 2025-04-11 | The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in a… |
CVE-2025-3422 | Medium | 5.4 | 2025-04-11 | The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode e… |
CVE-2025-3421 | Medium | 6.1 | 2025-04-11 | The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scri… |
CVE-2025-2575 | Medium | 6.4 | 2025-04-11 | The Z Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.1 due to insuf… |
CVE-2025-2541 | Medium | 6.4 | 2025-04-11 | The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due… |
CVE-2025-23391 | Critical | 9.1 | 2025-04-11 | A Incorrect Privilege Assignment vulnerability in SUSE rancher allows a Restricted Administrator to change the password of Administrators and take over their a… |
CVE-2025-23389 | High | 8.4 | 2025-04-11 | A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This is… |
CVE-2025-23388 | High | 8.2 | 2025-04-11 | A Stack-based Buffer Overflow vulnerability in SUSE rancher allows for denial of service.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 befor… |
CVE-2025-23387 | Medium | 5.3 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens… |
CVE-2025-31932 | High | 8.8 | 2025-04-11 | Deserialization of untrusted data issue exists in BizRobo! all versions. If this vulnerability is exploited, an arbitrary code is executed on the Management Co… |
CVE-2025-31362 | Low | 3.7 | 2025-04-11 | Use of hard-coded cryptographic key issue exists in BizRobo! all versions. Credentials inside robot files may be obtained if the encryption key is available. … |
CVE-2025-2128 | Medium | 6.5 | 2025-04-11 | The Cost Calculator Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_ids’ parameter in all versions up to, and including… |
CVE-2025-3434 | High | 7.2 | 2025-04-11 | The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.8 du… |
CVE-2025-32681 | High | 8.5 | 2025-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Guru Error Log Viewer error-log-viewer-wp allows Blind… |
CVE-2025-32672 | High | 8.1 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Ultimate Bootstrap Elements fo… |
CVE-2025-32671 | High | 7.5 | 2025-04-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in John Weissberg Print Science Designer print-science-designer al… |
CVE-2025-32663 | High | 8.1 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Cooming Soon fat-coming-so… |
CVE-2025-32656 | High | 8.1 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Testimonial Slider And Sho… |
CVE-2025-32654 | High | 8.1 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix Motors motors-car-dealership-… |
CVE-2025-32650 | High | 8.5 | 2025-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ability, Inc Accessibility Suite online-accessibility all… |
CVE-2025-32633 | High | 8.6 | 2025-04-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in neoslab Database Toolset database-toolset allows Path Traversal… |
CVE-2025-32632 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders Automatic Ban IP automatic-ban-ip allows Ref… |
CVE-2025-32631 | High | 8.6 | 2025-04-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in oxygensuite Oxygen MyData for WooCommerce oxygen-mydata allows… |
CVE-2025-32629 | High | 8.6 | 2025-04-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDir… |
CVE-2025-32627 | High | 8.1 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Job Manager js-jobs allows… |
CVE-2025-32618 | High | 8.5 | 2025-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This i… |
CVE-2025-32614 | High | 8.8 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON eventon-lite allo… |
CVE-2025-32607 | Critical | 9.8 | 2025-04-11 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpBookingly service-booking-manager allows Object Injection.This issue affects WpBookingly: f… |
CVE-2025-32603 | Critical | 9.3 | 2025-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK WP Online Users Stats wp-online-users-stats allows Bli… |
CVE-2025-32601 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in twispay Twispay Credit Card Payments twispay allows Refle… |
CVE-2025-32600 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tournamatch Tournamatch tournamatch allows Reflected XSS… |
CVE-2025-32599 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miunosoft Task Scheduler task-scheduler allows Reflected… |
CVE-2025-32598 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder wp-table-builder allows… |
CVE-2025-32589 | High | 8.1 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in odude Flexi – Guest Submit flexi allow… |
CVE-2025-32587 | High | 8.1 | 2025-04-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pickupp WooCommerce Pickupp wc-pickupp allows PHP Local File In… |
CVE-2025-32586 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABA Bank ABA PayWay Payment Gateway for WooCommerce aba-p… |
CVE-2025-32585 | High | 7.5 | 2025-04-11 | Path Traversal: '.../...//' vulnerability in Trusty Plugins Shop Products Filter trusty-woo-products-filter allows PHP Local File Inclusion.This issue affects… |
CVE-2025-32579 | Critical | 9.9 | 2025-04-11 | Unrestricted Upload of File with Dangerous Type vulnerability in SoftClever Limited Sync Posts sync-posts allows Upload a Web Shell to a Web Server.This issue… |
CVE-2025-32577 | Critical | 9.8 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-… |
CVE-2025-32569 | Critical | 9.8 | 2025-04-11 | Deserialization of Untrusted Data vulnerability in RealMag777 TableOn posts-table-filterable allows Object Injection.This issue affects TableOn: from n/a throu… |
CVE-2025-32568 | Critical | 9.8 | 2025-04-11 | Deserialization of Untrusted Data vulnerability in empik EmpikPlace for Woocommerce empik-for-woocommerce allows Object Injection.This issue affects EmpikPlace… |
CVE-2025-32567 | High | 8.5 | 2025-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in dev02ali Easy Post Duplicator easy-post-duplicator allows… |
CVE-2025-32565 | Critical | 9.3 | 2025-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vertim Neon Product Designer neon-product-designer-for-wo… |
CVE-2025-32558 | High | 8.5 | 2025-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ketanajani Duplicate Title Checker duplicate-title-checke… |
CVE-2025-32553 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Reflected XSS.T… |
CVE-2025-32551 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace conn… |
CVE-2025-32542 | High | 8.8 | 2025-04-11 | Missing Authorization vulnerability in EazyPlugins Eazy Plugin Manager plugins-on-steroids allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-32541 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin WooCommerce Sales MIS Report woocommerce-m… |
CVE-2025-32539 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Store Exporter woocommerce-exporter allows… |
CVE-2025-32538 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dev02ali Easy Post Duplicator easy-post-duplicator allows… |
CVE-2025-32537 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Lock Your Updates lock-your-updates allows… |
CVE-2025-32536 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandeep Verma HTML5 Video Player with Playlist html5-vide… |
CVE-2025-32534 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Workbox Workbox Video from Vimeo & Youtube workbox-video-… |
CVE-2025-32525 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MapGeo Interactive Geo Maps interactive-geo-maps allows R… |
CVE-2025-32524 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyWorks MyWorks WooCommerce Sync for QuickBooks Online my… |
CVE-2025-32523 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce – Payphone Gateway wc-payphone-gatew… |
CVE-2025-32519 | High | 8.1 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Foysal Imran IDonate idonate allows PH… |
CVE-2025-32517 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SCAND MultiMailer scand-multi-mailer allows Reflected XSS… |
CVE-2025-32509 | High | 7.5 | 2025-04-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMinds Simple WP Events simple-wp-events allows Path Traversal… |
CVE-2025-32491 | Critical | 9.8 | 2025-04-11 | Incorrect Privilege Assignment vulnerability in Rankology Rankology SEO – On-site SEO rankology-seo-all-in-one-seo-analytics allows Privilege Escalation.This i… |
CVE-2025-32144 | High | 8.8 | 2025-04-11 | Deserialization of Untrusted Data vulnerability in PickPlugins Job Board Manager job-board-manager allows Object Injection.This issue affects Job Board Manager… |
CVE-2025-32143 | High | 8.8 | 2025-04-11 | Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through <= 2… |
CVE-2025-32107 | High | 8.0 | 2025-04-11 | OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 Pro(JP)_V1_1.1.2 Build 20250123". If this vulnerability is exp… |
CVE-2025-31599 | Critical | 9.3 | 2025-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N-Media Bulk Product Sync sync-wc-google allows SQL Injec… |