2025 CVEs (page 352)
Page 352 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22373 | | 2025-04-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SicommNet BASEC on SaaS allows Reflected XSS, XSS… | |
CVE-2025-22372 | | 2025-04-14 | Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversi… | |
CVE-2025-22371 | | 2025-04-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unaut… | |
CVE-2025-3571 | Medium | 6.3 | 2025-04-14 | A vulnerability was found in Fannuo Enterprise Content Management System 凡诺企业网站管理系统 1.1/4.0. It has been declared as critical. This vulnerability affects unkno… |
CVE-2025-3570 | Low | 3.5 | 2025-04-14 | A vulnerability was found in JamesZBL/code-projects db-hospital-drug 1.0. It has been classified as problematic. This affects the function Save of the file Con… |
CVE-2025-32914 | High | 7.4 | 2025-04-14 | A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP cli… |
CVE-2025-32912 | Medium | 6.5 | 2025-04-14 | A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash. |
CVE-2025-32910 | Medium | 6.5 | 2025-04-14 | A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to cras… |
CVE-2025-32909 | Medium | 5.3 | 2025-04-14 | A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniff_mp4 function. The HTTP server may cause the libsou… |
CVE-2025-2475 | Medium | 5.4 | 2025-04-14 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an… |
CVE-2025-2424 | Low | 3.1 | 2025-04-14 | Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the… |
CVE-2025-2161 | High | 7.1 | 2025-04-14 | Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup |
CVE-2025-2160 | High | 8.1 | 2025-04-14 | Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup |
CVE-2025-3569 | Medium | 6.3 | 2025-04-14 | A vulnerability was found in JamesZBL/code-projects db-hospital-drug 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-3568 | Low | 3.5 | 2025-04-14 | A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-32913 | High | 7.5 | 2025-04-14 | A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a… |
CVE-2025-32908 | High | 7.5 | 2025-04-14 | A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a… |
CVE-2025-32907 | Medium | 5.3 | 2025-04-14 | A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to r… |
CVE-2025-32906 | High | 7.5 | 2025-04-14 | A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to us… |
CVE-2025-3567 | Medium | 4.3 | 2025-04-14 | A vulnerability, which was classified as problematic, was found in veal98 小牛肉 Echo 开源社区系统 4.2. Affected is the function preHandle of the file src/main/java/com… |
CVE-2025-3566 | High | 7.3 | 2025-04-14 | A vulnerability, which was classified as critical, has been found in veal98 小牛肉 Echo 开源社区系统 4.2. This issue affects the function uploadMdPic of the file /discu… |
CVE-2025-3565 | Medium | 4.7 | 2025-04-14 | A vulnerability classified as critical was found in huanfenz/code-projects StudentManager 1.0. This vulnerability affects unknown code of the file /upload/uplo… |
CVE-2025-3564 | Medium | 4.3 | 2025-04-14 | A vulnerability classified as problematic has been found in huanfenz/code-projects StudentManager up to 1.0. This affects an unknown part of the component Teac… |
CVE-2025-3563 | Medium | 4.7 | 2025-04-14 | A vulnerability was found in WuzhiCMS 4.1. It has been rated as critical. Affected by this issue is the function Set of the file /index.php?m=attachment&f=inde… |
CVE-2025-3562 | Medium | 4.3 | 2025-04-14 | A vulnerability was found in Yonyou YonBIP MA2.7. It has been declared as problematic. Affected by this vulnerability is the function FileInputStream of the fi… |
CVE-2025-27009 | High | 7.1 | 2025-04-14 | Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auction… |
CVE-2025-3561 | Medium | 4.3 | 2025-04-14 | A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cro… |
CVE-2025-3560 | Low | 3.5 | 2025-04-14 | A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /product. The ma… |
CVE-2025-3559 | Medium | 6.3 | 2025-04-14 | A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical. This vulnerability affects the function ForeProductListController of… |
CVE-2025-3558 | Medium | 6.3 | 2025-04-14 | A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHead… |
CVE-2025-24859 | High | 8.8 | 2025-04-14 | A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes… |
CVE-2025-3557 | Medium | 4.3 | 2025-04-14 | A vulnerability, which was classified as problematic, has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this issue is some unknown fun… |
CVE-2025-3556 | Low | 3.7 | 2025-04-14 | A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality… |
CVE-2025-31344 | High | 7.3 | 2025-04-14 | Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects gifli… |
CVE-2025-3555 | Low | 3.7 | 2025-04-14 | A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php… |
CVE-2025-3554 | Medium | 4.3 | 2025-04-14 | A vulnerability was found in phpshe 1.8. It has been rated as problematic. This issue affects some unknown processing of the file api.php?mod=cron&act=buyer. T… |
CVE-2025-32093 | Medium | 4.7 | 2025-04-14 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, whic… |
CVE-2025-30516 | Low | 2.0 | 2025-04-14 | Mattermost Mobile Apps versions <=2.25.0 fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized use… |
CVE-2025-3553 | Medium | 6.3 | 2025-04-14 | A vulnerability was found in phpshe 1.8. It has been declared as critical. This vulnerability affects the function pe_delete of the file /admin.php?mod=brand&a… |
CVE-2025-2563 | High | 8.1 | 2025-04-14 | The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leadin… |
CVE-2025-3550 | Medium | 4.3 | 2025-04-14 | A vulnerability has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by this vulnerability is… |
CVE-2025-3572 | High | 7.5 | 2025-04-14 | SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access ar… |
CVE-2025-3549 | Medium | 5.3 | 2025-04-14 | A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD3Importer::ValidateS… |
CVE-2025-3548 | Medium | 5.3 | 2025-04-14 | A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the function aiString::Se… |
CVE-2025-3547 | Medium | 6.3 | 2025-04-14 | A vulnerability classified as critical was found in frdel Agent-Zero 0.8.1.2. This vulnerability affects unknown code of the file /get_work_dir_files. The mani… |
CVE-2025-3546 | High | 8.0 | 2025-04-14 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affec… |
CVE-2025-3545 | High | 8.0 | 2025-04-14 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Aff… |
CVE-2025-3544 | High | 8.0 | 2025-04-14 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue a… |
CVE-2025-3543 | High | 8.0 | 2025-04-14 | A vulnerability has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014 and classified as critical. This vulnerability aff… |
CVE-2025-3542 | High | 8.0 | 2025-04-14 | A vulnerability, which was classified as critical, was found in H3C Magic NX15, Magic NX400 and Magic R3010 up to V100R014. This affects the function FCGI_Wiza… |
CVE-2025-3541 | High | 8.0 | 2025-04-13 | A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by th… |
CVE-2025-3540 | High | 8.0 | 2025-04-13 | A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability… |
CVE-2025-3539 | High | 8.0 | 2025-04-13 | A vulnerability classified as critical has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected is… |
CVE-2025-3445 | High | 8.1 | 2025-04-13 | A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path trave… |
CVE-2025-3538 | High | 8.8 | 2025-04-13 | A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function auth_asp of the file /auth.asp of the co… |
CVE-2025-3537 | Medium | 5.3 | 2025-04-13 | A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /ad… |
CVE-2025-3536 | Medium | 6.5 | 2025-04-13 | A vulnerability was found in Tutorials-Website Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2025-3423 | Medium | 5.4 | 2025-04-13 | IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript cod… |
CVE-2025-3535 | Medium | 4.3 | 2025-04-13 | A vulnerability has been found in shuanx BurpAPIFinder up to 2.0.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-3534 | Medium | 6.3 | 2025-04-13 | A vulnerability, which was classified as critical, was found in PowerCreator CMS 1.0. Affected is an unknown function of the file /OpenPublicCourse.aspx. The m… |
CVE-2025-3533 | Medium | 4.3 | 2025-04-13 | A vulnerability, which was classified as problematic, has been found in YouDianCMS 9.5.21. This issue affects some unknown processing of the file /App/Tpl/Admi… |
CVE-2025-3532 | Medium | 4.3 | 2025-04-13 | A vulnerability classified as problematic was found in YouDianCMS 9.5.21. This vulnerability affects unknown code of the file /App/Tpl/Member/Default/Order/ind… |
CVE-2025-3531 | Medium | 4.3 | 2025-04-13 | A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Default/Log/index.html… |
CVE-2025-2814 | Medium | 4.0 | 2025-04-13 | Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cry… |
CVE-2025-1456 | Medium | 6.4 | 2025-04-12 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widget… |
CVE-2025-1455 | Medium | 6.4 | 2025-04-12 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all versions up to, and i… |
CVE-2025-3418 | High | 8.8 | 2025-04-12 | The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting… |
CVE-2025-3292 | Medium | 4.3 | 2025-04-12 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Refere… |
CVE-2025-3282 | Medium | 5.3 | 2025-04-12 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Refere… |
CVE-2025-3276 | Medium | 6.4 | 2025-04-12 | The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Carousel block in all versions up… |
CVE-2025-2871 | Medium | 4.3 | 2025-04-12 | The WordPress Mega Menu – QuadMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to… |
CVE-2025-2881 | Medium | 5.3 | 2025-04-12 | The Developer Toolbar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 through the publicly acc… |
CVE-2025-2841 | Medium | 5.3 | 2025-04-12 | The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessib… |
CVE-2025-32726 | Medium | 6.8 | 2025-04-12 | Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally. |
CVE-2025-29834 | High | 7.5 | 2025-04-12 | Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2025-29803 | High | 7.3 | 2025-04-12 | Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges l… |
CVE-2025-2269 | Medium | 6.1 | 2025-04-12 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in… |
CVE-2025-0129 | | 2025-04-11 | An improper exception check in Palo Alto Networks Prisma Access Browser allows a low privileged user to prevent Prisma Access Browser from applying it's Policy… | |
CVE-2025-0123 | | 2025-04-11 | A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature… | |
CVE-2025-0119 | | 2025-04-11 | A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS commands with root privi… | |
CVE-2025-32367 | High | 8.6 | 2025-04-11 | The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the numbe… |
CVE-2025-32080 | | 2025-04-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resour… | |
CVE-2025-32079 | Medium | 6.5 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments allows HTTP DoS.This issue affects Mediawiki - GrowthExperime… |
CVE-2025-32078 | | 2025-04-11 | Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This… | |
CVE-2025-32077 | | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects M… | |
CVE-2025-32076 | | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Dat… | |
CVE-2025-32075 | | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extens… | |
CVE-2025-32074 | Medium | 5.4 | 2025-04-11 | Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Confirm Account Extension allows Cross-Site Scripting (XSS).This… |
CVE-2025-32073 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - HTML Tags allows Cross-Site Scripting (XSS).This issue affects Mediawiki - HTML… |
CVE-2025-32072 | | 2025-04-11 | Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Media… | |
CVE-2025-32071 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikidata Extension allows Cross-Site Scripting (XSS) from widthheight message v… |
CVE-2025-32070 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting (XSS).This issue affects Mediaw… |
CVE-2025-32069 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting (XSS).This issue affe… |
CVE-2025-32068 | Medium | 5.4 | 2025-04-11 | Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth… |
CVE-2025-32067 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Growth Experiments Extension allows Cross-Site Scripting (XSS).This issue affec… |
CVE-2025-31935 | Medium | 6.2 | 2025-04-11 | Subnet Solutions PowerSYSTEM Center is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the API may trigger… |
CVE-2025-31354 | Medium | 4.3 | 2025-04-11 | Subnet Solutions PowerSYSTEM Center's SMTPS notification service can be affected by importing an EC certificate with crafted F2m parameters, which can lead to… |
CVE-2025-32427 | Medium | 5.4 | 2025-04-11 | Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, th… |
CVE-2025-32426 | Medium | 4.6 | 2025-04-11 | Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notificatio… |
CVE-2025-3439 | Critical | 9.8 | 2025-04-11 | The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in a… |