2025 CVEs (page 352)
Page 352 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31565 | Critical | 9.3 | 2025-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisandro Martinez WPSmartContracts wp-smart-contracts all… |
CVE-2025-31379 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in programphases Insert HTML Here insert-html-here allows Re… |
CVE-2025-31378 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in danbwb Oppso Unit Converter oppso-unit-converter allows R… |
CVE-2025-31041 | High | 7.5 | 2025-04-11 | Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access… |
CVE-2025-31040 | High | 8.1 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Exthemes WP Food ordering and Restaura… |
CVE-2025-31028 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Huseyin Berberoglu WP Hide Categories wp-hide-categories… |
CVE-2025-31021 | High | 7.1 | 2025-04-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dolby_uk Mobile Smart mobile-smart allows Reflected XSS.T… |
CVE-2025-31015 | High | 7.5 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Adrian Tobey WordPress SMTP Service, E… |
CVE-2025-31014 | High | 7.5 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-da… |
CVE-2025-3512 | | 2025-04-11 | There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdow… | |
CVE-2025-2636 | High | 8.1 | 2025-04-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85… |
CVE-2025-1386 | Medium | 4.9 | 2025-04-11 | When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker… |
CVE-2025-32816 | Low | 3.1 | 2025-04-11 | CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity. |
CVE-2025-26335 | Medium | 5.8 | 2025-04-11 | Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent Data vulnerability. A high privileged a… |
CVE-2025-0128 | | 2025-04-11 | A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enab… | |
CVE-2025-0127 | | 2025-04-11 | A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary… | |
CVE-2025-0126 | | 2025-04-11 | When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and pe… | |
CVE-2025-0125 | | 2025-04-11 | An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated rea… | |
CVE-2025-0124 | Low | 3.8 | 2025-04-11 | An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management… |
CVE-2025-0122 | | 2025-04-11 | A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma… | |
CVE-2025-0121 | | 2025-04-11 | A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the… | |
CVE-2025-0120 | High | 7.0 | 2025-04-11 | A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-admini… |
CVE-2025-32809 | Medium | 6.4 | 2025-04-11 | W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choice_fb[], or q… |
CVE-2025-32808 | High | 7.7 | 2025-04-11 | W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side ac… |
CVE-2025-32807 | Medium | 5.3 | 2025-04-11 | A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (and .svg or .xpm f… |
CVE-2025-29918 | Medium | 6.2 | 2025-04-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A PCRE rule can be written that leads to… |
CVE-2025-29917 | Medium | 6.2 | 2025-04-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The bytes setting in the decode_base64 ke… |
CVE-2025-29916 | Medium | 6.2 | 2025-04-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option… |
CVE-2025-29915 | High | 7.5 | 2025-04-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by… |
CVE-2025-3469 | | 2025-04-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… | |
CVE-2025-32700 | | 2025-04-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program fil… | |
CVE-2025-32699 | | 2025-04-10 | Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.1… | |
CVE-2025-32698 | | 2025-04-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files… | |
CVE-2025-32697 | | 2025-04-10 | Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/editpage/Int… | |
CVE-2025-32696 | | 2025-04-10 | Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/actions/Reve… | |
CVE-2025-23010 | High | 7.2 | 2025-04-10 | An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacke… |
CVE-2025-23009 | High | 7.2 | 2025-04-10 | A local privilege escalation vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to trigger an arbitrary file deleti… |
CVE-2025-23008 | High | 7.2 | 2025-04-10 | An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker to modify configura… |
CVE-2025-22232 | Medium | 5.3 | 2025-04-10 | Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affecte… |
CVE-2025-24866 | Low | 2.7 | 2025-04-10 | Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administrat… |
CVE-2025-32382 | | 2025-04-10 | Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a pa… | |
CVE-2025-32027 | Medium | 6.1 | 2025-04-10 | Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is… |
CVE-2025-29150 | Medium | 4.3 | 2025-04-10 | BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request. |
CVE-2025-0362 | Medium | 6.4 | 2025-04-10 | An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditi… |
CVE-2025-32743 | Critical | 9.0 | 2025-04-10 | In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a DNS response. This… |
CVE-2025-32395 | | 2025-04-10 | Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the… | |
CVE-2025-32391 | Medium | 6.4 | 2025-04-10 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.3, a malicious SVG file uploaded to HedgeDoc results in the pos… |
CVE-2025-32383 | Medium | 4.3 | 2025-04-10 | MaxKB (Max Knowledge Base) is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG)… |
CVE-2025-2469 | Low | 3.7 | 2025-04-10 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.9.6, and 17.10 before 17.10.4. The runtime profiling data of a specific… |
CVE-2025-29088 | Medium | 5.6 | 2025-04-10 | In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*n… |
CVE-2025-29017 | High | 8.8 | 2025-04-10 | A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parame… |
CVE-2025-30148 | Medium | 5.4 | 2025-04-10 | Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a spe… |
CVE-2025-2408 | Medium | 5.3 | 2025-04-10 | An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain condi… |
CVE-2025-27813 | High | 8.1 | 2025-04-10 | MSI Center before 2.0.52.0 has Missing PE Signature Validation. |
CVE-2025-27812 | High | 8.1 | 2025-04-10 | MSI Center before 2.0.52.0 allows TOCTOU Local Privilege Escalation. |
CVE-2025-25197 | Medium | 5.4 | 2025-04-10 | Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field… |
CVE-2025-1677 | Medium | 6.5 | 2025-04-10 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of ser… |
CVE-2025-32755 | Critical | 9.1 | 2025-04-10 | In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on i… |
CVE-2025-32754 | Critical | 9.1 | 2025-04-10 | In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based o… |
CVE-2025-1073 | High | 7.5 | 2025-04-10 | Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device. |
CVE-2025-31411 | Medium | 5.9 | 2025-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerc… |
CVE-2025-27350 | High | 7.1 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hugh Mungus Vice Versa vice-versa allows Reflected XSS.Th… |
CVE-2025-22375 | | 2025-04-10 | An authentication bypass vulnerability was found in Videx's CyberAudit-Web. Through the exploitation of a logic flaw, an attacker could create a valid session… | |
CVE-2025-22374 | | 2025-04-10 | A Server-Side Request Forgery (SSRF) vulnerability was discovered in the videx-legacy-ssl web service of Videx’s CyberAudit-Web, affecting versions prior to 1… | |
CVE-2025-23386 | High | 7.8 | 2025-04-10 | A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera to escalate to root.,This issue affect… |
CVE-2025-27081 | Medium | 6.8 | 2025-04-10 | A potential security vulnerability in HPE NonStop OSM Service Connection Suite could potentially be exploited to allow a local Denial of Service. |
CVE-2025-22279 | High | 7.5 | 2025-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetCompareWishlist jet-comp… |
CVE-2025-32687 | High | 8.5 | 2025-04-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magnigenie Review Stars Count For WooCommerce review-star… |
CVE-2025-32668 | High | 8.1 | 2025-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rameez Iqbal Real Estate Manager real-… |
CVE-2025-32282 | Medium | 4.3 | 2025-04-10 | Cross-Site Request Forgery (CSRF) vulnerability in ShareThis ShareThis Dashboard for Google Analytics googleanalytics.This issue affects ShareThis Dashboard fo… |
CVE-2025-32275 | Medium | 4.3 | 2025-04-10 | Authentication Bypass by Spoofing vulnerability in Ays Pro Survey Maker survey-maker allows Identity Spoofing.This issue affects Survey Maker: from n/a through… |
CVE-2025-32260 | Medium | 5.3 | 2025-04-10 | Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor.This issue affects DethemeKit For Elementor: from n/a through… |
CVE-2025-32259 | Medium | 5.3 | 2025-04-10 | Missing Authorization vulnerability in Alimir WP ULike wp-ulike.This issue affects WP ULike: from n/a through <= 4.7.9.1. |
CVE-2025-32244 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in QuantumCloud SEO Help seo-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-32243 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in Toast Plugins Internal Link Optimiser internal-link-finder allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-32242 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in Hive Support Hive Support hive-support allows Accessing Functionality Not Properly Constrained by ACLs.This issue affect… |
CVE-2025-32240 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in wpvsingh Site Notify site-notify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-32236 | Medium | 4.3 | 2025-04-10 | Missing Authorization vulnerability in Vagonic Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic vagonic-sortable.Thi… |
CVE-2025-32230 | Medium | 4.3 | 2025-04-10 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a t… |
CVE-2025-32228 | Medium | 4.3 | 2025-04-10 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-gen… |
CVE-2025-32227 | Medium | 4.3 | 2025-04-10 | Authentication Bypass by Spoofing vulnerability in Asgaros Asgaros Forum asgaros-forum allows Identity Spoofing.This issue affects Asgaros Forum: from n/a thro… |
CVE-2025-32221 | Medium | 5.4 | 2025-04-10 | Missing Authorization vulnerability in Spider Themes EazyDocs eazydocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-32216 | Medium | 6.4 | 2025-04-10 | Missing Authorization vulnerability in Spider Themes Spider Elements spider-elements allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-32215 | Medium | 6.5 | 2025-04-10 | Unrestricted Upload of File with Dangerous Type vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Stored XSS.This issue affects Acc… |
CVE-2025-32214 | Medium | 6.5 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hive Support Hive Support hive-support allows Stored XSS… |
CVE-2025-32213 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in flothemesplugins Flo Forms flo-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-32212 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in Specia Theme Specia Companion specia-companion allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-32210 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in CreativeMindsSolutions CM Registration and Invitation Codes cm-invitation-codes allows Exploiting Incorrectly Configured… |
CVE-2025-32209 | Medium | 6.5 | 2025-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocess… |
CVE-2025-32208 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in Hive Support Hive Support hive-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-32206 | Critical | 9.1 | 2025-04-10 | Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects processing-projects allows Upload a Web Shell to a Web Server.This… |
CVE-2025-32205 | Low | 2.7 | 2025-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in piotnetdotcom Piotnet Forms piotnetforms.This issue affects Pio… |
CVE-2025-32202 | Critical | 9.1 | 2025-04-10 | Unrestricted Upload of File with Dangerous Type vulnerability in Brian Batt - elearningfreak.com Insert or Embed Articulate Content into WordPress insert-or-em… |
CVE-2025-32199 | Medium | 6.5 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyale-vc Contact Form Builder by vcita contact-form-with-… |
CVE-2025-32198 | Medium | 6.5 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefusecom Brizy brizy.This issue affects Brizy: from n… |
CVE-2025-32160 | High | 7.5 | 2025-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON eventon-lite.This… |
CVE-2025-32158 | High | 7.5 | 2025-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Syed Balkhi aThemes Addons for Element… |
CVE-2025-32145 | High | 8.8 | 2025-04-10 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a thro… |
CVE-2025-32140 | Critical | 9.9 | 2025-04-10 | Unrestricted Upload of File with Dangerous Type vulnerability in Nirmal Kumar Ram WP Remote Thumbnail wp-remote-thumbnail allows Upload a Web Shell to a Web Se… |
CVE-2025-32139 | Medium | 5.9 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooBox Image Lightbox foobox-image-lightbox.T… |