2025 CVEs (page 353)
Page 353 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32128 | High | 7.6 | 2025-04-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aaronfrey Nearby Locations nearby-locations allows SQL In… |
CVE-2025-32119 | High | 8.2 | 2025-04-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CardGate CardGate Payments for WooCommerce cardgate allow… |
CVE-2025-32116 | High | 7.1 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Studi7 QR Master qr-master allows Reflected XSS.This issu… |
CVE-2025-32115 | High | 7.1 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Content Light popping-content-light all… |
CVE-2025-32114 | High | 7.1 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 5sterrenspecialist WordPress 5sterrenspecialist Plugin 5-… |
CVE-2025-31524 | High | 8.8 | 2025-04-10 | Incorrect Privilege Assignment vulnerability in John James Jacoby WP User Profiles wp-users-profiles allows Privilege Escalation.This issue affects WP User Pro… |
CVE-2025-30582 | High | 8.1 | 2025-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aytechnet DyaPress ERP/CRM dyapress allows PHP Local File Inclu… |
CVE-2025-3417 | High | 8.8 | 2025-04-10 | The Embedder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on… |
CVE-2025-2809 | High | 7.3 | 2025-04-10 | The azurecurve Shortcodes in Comments plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is… |
CVE-2025-2805 | High | 7.3 | 2025-04-10 | The ORDER POST plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software all… |
CVE-2025-2719 | Medium | 6.5 | 2025-04-10 | The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerabl… |
CVE-2025-0539 | High | 8.8 | 2025-04-10 | In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allo… |
CVE-2025-3102 | High | 8.1 | 2025-04-10 | The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due… |
CVE-2025-3489 | Medium | 4.3 | 2025-04-10 | A vulnerability was found in Nababur Simple-User-Management-System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality… |
CVE-2025-27690 | Critical | 9.8 | 2025-04-10 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. An unauthenticated attacker with remote access coul… |
CVE-2025-26480 | Medium | 5.3 | 2025-04-10 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.0, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote… |
CVE-2025-26479 | Low | 3.1 | 2025-04-10 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0, contains an out-of-bounds write vulnerability. An attacker could potentially exploit this vulnerabili… |
CVE-2025-26330 | High | 7.0 | 2025-04-10 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an incorrect authorization vulnerability. An unauthenticated attacker with local access coul… |
CVE-2025-23378 | Low | 3.3 | 2025-04-10 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0, contains an exposure of information through directory listing vulnerability. A low privileged attacke… |
CVE-2025-22471 | Medium | 6.5 | 2025-04-10 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an integer overflow or wraparound vulnerability. An unauthenticated attacker with remote acc… |
CVE-2025-32728 | Medium | 4.3 | 2025-04-10 | In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding. |
CVE-2025-29989 | Low | 3.1 | 2025-04-10 | Dell Client Platform BIOS contains a Security Version Number Mutable to Older Versions vulnerability. A high privileged attacker with local access could potent… |
CVE-2025-32387 | Medium | 6.5 | 2025-04-09 | Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to pars… |
CVE-2025-32386 | Medium | 6.5 | 2025-04-09 | Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e… |
CVE-2025-24375 | Medium | 5.0 | 2025-04-09 | Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-s… |
CVE-2025-29018 | Medium | 4.8 | 2025-04-09 | A Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking System 2.0.0. |
CVE-2025-30660 | High | 7.5 | 2025-04-09 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an… |
CVE-2025-30659 | High | 7.5 | 2025-04-09 | An Improper Handling of Length Parameter Inconsistency vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an… |
CVE-2025-30658 | High | 7.5 | 2025-04-09 | A Missing Release of Memory after Effective Lifetime vulnerability in the Anti-Virus processing of Juniper Networks Junos OS on SRX Series allows an unauthen… |
CVE-2025-30657 | Medium | 5.3 | 2025-04-09 | An Improper Encoding or Escaping of Output vulnerability in the Sampling Route Record Daemon (SRRD) of Juniper Networks Junos OS allows an unauthenticated, net… |
CVE-2025-30656 | High | 7.5 | 2025-04-09 | An Improper Handling of Additional Special Element vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with MS-MPC, M… |
CVE-2025-30655 | Medium | 5.5 | 2025-04-09 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2025-30654 | Medium | 5.5 | 2025-04-09 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows… |
CVE-2025-30653 | Medium | 6.5 | 2025-04-09 | An Expired Pointer Dereference vulnerability in Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adja… |
CVE-2025-30652 | Medium | 5.5 | 2025-04-09 | An Improper Handling of Exceptional Conditions vulnerability in routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local… |
CVE-2025-30651 | High | 7.5 | 2025-04-09 | A Buffer Access with Incorrect Length Value vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unau… |
CVE-2025-30649 | High | 7.5 | 2025-04-09 | An Improper Input Validation vulnerability in the syslog stream TCP transport of Juniper Networks Junos OS on MX240, MX480 and MX960 devices with MX-SPC3 Secur… |
CVE-2025-30648 | High | 7.4 | 2025-04-09 | An Improper Input Validation vulnerability in the Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adj… |
CVE-2025-30647 | Medium | 6.5 | 2025-04-09 | A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows an un… |
CVE-2025-30646 | Medium | 6.5 | 2025-04-09 | A Signed to Unsigned Conversion Error vulnerability in the Layer 2 Control Protocol daemon (l2cpd) of Juniper Networks Junos OS and Juniper Networks Junos OS E… |
CVE-2025-30645 | High | 7.5 | 2025-04-09 | A NULL Pointer Dereference vulnerability in the flow daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an attacker causing specific, valid contr… |
CVE-2025-30644 | High | 7.5 | 2025-04-09 | A Heap-based Buffer Overflow vulnerability in the flexible PIC concentrator (FPC) of Juniper Networks Junos OS on EX2300, EX3400, EX4100, EX4300, EX4300MP, EX4… |
CVE-2025-2632 | High | 7.8 | 2025-04-09 | Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW reading CPU info from cache that may result in information disclosure or arbitr… |
CVE-2025-2631 | High | 7.8 | 2025-04-09 | Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW in InitCPUInformation() that may result in information disclosure or arbitrary… |
CVE-2025-26902 | Medium | 4.3 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Brizy Brizy Pro allows Cross Site Request Forgery.This issue affects Brizy Pro: from n/a through 2.6.1. |
CVE-2025-26901 | Medium | 4.3 | 2025-04-09 | Missing Authorization vulnerability in Brizy Brizy Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy Pro: fr… |
CVE-2025-26888 | Medium | 5.3 | 2025-04-09 | Missing Authorization vulnerability in Amir Helzer WooCommerce Multilingual & Multicurrency woocommerce-multilingual allows Exploiting Incorrectly Configured A… |
CVE-2025-21601 | High | 7.5 | 2025-04-09 | An Improper Following of Specification by Caller vulnerability in web management (J-Web, Captive Portal, 802.1X, Juniper Secure Connect (JSC) of Juniper Networ… |
CVE-2025-21597 | Medium | 5.3 | 2025-04-09 | An Improper Check for Unusual or Exceptional Conditions vulnerability in routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows… |
CVE-2025-21595 | Medium | 6.5 | 2025-04-09 | A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allo… |
CVE-2025-21594 | High | 7.5 | 2025-04-09 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the pfe (packet forwarding engine) of Juniper Networks Junos OS on MX Series causes a… |
CVE-2025-21591 | High | 7.4 | 2025-04-09 | A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS, when DHCP snooping is enabled, allows an unauthent… |
CVE-2025-2630 | High | 7.3 | 2025-04-09 | There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW. This vulnerability may result in arbitrary code execution… |
CVE-2025-2629 | High | 7.3 | 2025-04-09 | There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW when loading NI Error Reporting. This vulnerability may re… |
CVE-2025-3475 | Medium | 6.5 | 2025-04-09 | Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This… |
CVE-2025-3474 | Medium | 6.5 | 2025-04-09 | Missing Authentication for Critical Function vulnerability in Drupal Panels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-3131 | Medium | 5.4 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Con… |
CVE-2025-3115 | Critical | 9.8 | 2025-04-09 | Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficie… |
CVE-2025-3114 | | 2025-04-09 | Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, pote… | |
CVE-2025-32695 | Critical | 9.8 | 2025-04-09 | Incorrect Privilege Assignment vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Privilege Escalation.This issue affects Checkout M… |
CVE-2025-32694 | Medium | 4.7 | 2025-04-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Phishing.This issue affects Ultimate W… |
CVE-2025-32693 | Medium | 4.7 | 2025-04-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Phishing.This issue affects WebinarPr… |
CVE-2025-32692 | High | 7.5 | 2025-04-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle WP Subscription Forms wp-su… |
CVE-2025-32691 | Medium | 4.9 | 2025-04-09 | Server-Side Request Forgery (SSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress P… |
CVE-2025-32690 | Medium | 6.5 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blubrry PowerPress Podcasting powerpress allows DOM-Based… |
CVE-2025-32685 | High | 7.6 | 2025-04-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aristo Rinjuang WP Inquiries wp-inquiries allows SQL Inje… |
CVE-2025-32684 | Medium | 5.0 | 2025-04-09 | Missing Authorization vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-32683 | Medium | 6.5 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allo… |
CVE-2025-32680 | Medium | 5.9 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Grade Us, Inc. Review Stream review-stream allows Stored… |
CVE-2025-32679 | Medium | 5.4 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in ZealousWeb User Registration Using Contact Form 7 user-registration-using-contact-form-7 allows Cross Site R… |
CVE-2025-32678 | Medium | 4.3 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Ashish Ajani WP Show Stats wp-show-stats allows Cross Site Request Forgery.This issue affects WP Show Stats… |
CVE-2025-32677 | High | 7.6 | 2025-04-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in solwininfotech WP Social Stream Designer social-stream-de… |
CVE-2025-32676 | High | 7.6 | 2025-04-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows… |
CVE-2025-32675 | Medium | 6.8 | 2025-04-09 | Server-Side Request Forgery (SSRF) vulnerability in QuantumCloud SEO Help seo-help allows Server Side Request Forgery.This issue affects SEO Help: from n/a thr… |
CVE-2025-32673 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in epeken Epeken All Kurir epeken-all-kurir allows Stored XSS.This issue affects Epeken All Kurir: from n/a thr… |
CVE-2025-32669 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in MERGADO Mergado Pack mergado-marketing-pack allows Stored XSS.This issue affects Mergado Pack: from n/a thro… |
CVE-2025-32667 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in fromdoppler Doppler Forms doppler-form allows Stored XSS.This issue affects Doppler Forms: from n/a through… |
CVE-2025-32664 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in ashokbasnet Nepali Date Utilities nepali-date-utilities allows Stored XSS.This issue affects Nepali Date Uti… |
CVE-2025-32661 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive US Map interactive-us-map allows Stored XSS.This issue affects Interactive US Map… |
CVE-2025-32659 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in fraudlabspro FraudLabs Pro for WooCommerce fraudlabs-pro-for-woocommerce allows Stored XSS.This issue affect… |
CVE-2025-32645 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Hiren Patel Custom Posts Order custom-posts-order allows Stored XSS.This issue affects Custom Posts Order: f… |
CVE-2025-32644 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in IP2Location IP2Location World Clock ip2location-world-clock allows Stored XSS.This issue affects IP2Location… |
CVE-2025-32642 | Critical | 10.0 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This issue affects Vite Coupon: from n/a through… |
CVE-2025-32641 | Critical | 9.6 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in anantaddons Anant Addons for Elementor anant-addons-for-elementor allows Cross Site Request Forgery.This iss… |
CVE-2025-32640 | Medium | 5.9 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Ally pojo-accessibility allows Stored XSS.This… |
CVE-2025-32624 | High | 7.1 | 2025-04-09 | Missing Authorization vulnerability in czater Czater.pl – live chat i telefon czater allows Cross Site Request Forgery.This issue affects Czater.pl – live chat… |
CVE-2025-32623 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in plainware PlainInventory z-inventory-manager allows Stored XSS.This issue affects PlainInventory: from n/a t… |
CVE-2025-32621 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Vsourz Digital WP Map Route Planner wp-map-route-planner allows Cross Site Request Forgery.This issue affect… |
CVE-2025-32619 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in KeyCAPTCHA KeyCAPTCHA keycaptcha allows Stored XSS.This issue affects KeyCAPTCHA: from n/a through <= 2.5.1. |
CVE-2025-32617 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Ydesignservices Multiple Location Google Map multiple-location-google-map allows Stored XSS.This issue affec… |
CVE-2025-32616 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in nimbata Nimbata Call Tracking nimbata-call-tracking allows Stored XSS.This issue affects Nimbata Call Tracki… |
CVE-2025-32612 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in rafasashi User Session Synchronizer user-session-synchronizer allows Stored XSS.This issue affects User Sess… |
CVE-2025-32610 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in FolioVision Foliopress WYSIWYG foliopress-wysiwyg allows Cross Site Request Forgery.This issue affects Folio… |
CVE-2025-32597 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily connect-daily-web-calendar allows Cross-Site S… |
CVE-2025-32591 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Cross Site Request Forgery.This issue affe… |
CVE-2025-32584 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Chat2 Chat2 chat2 allows Cross Site Request Forgery.This issue affects Chat2: from n/a through <= 4.0. |
CVE-2025-32581 | High | 7.1 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ankit Singla WordPress Spam Blocker cf7-manual-spam-block… |
CVE-2025-32580 | High | 7.1 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in debounce DeBounce Email Validator debounce-io-email-valid… |
CVE-2025-32576 | Critical | 9.6 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Agence web Eoxia - Montpellier WP shop wpshop allows Upload a Web Shell to a Web Server.This issue affects W… |
CVE-2025-32575 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Reflected XSS.This issue affects WP w3all phpBB: from… |