2025 CVEs (page 356)
Page 356 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31401 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in mmetrodw MMX – Make Me Christmas mmx-make-me-christmas allows Stored XSS.This issue affects MMX – Make Me Ch… |
CVE-2025-31400 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a throu… |
CVE-2025-31399 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Chandan Garg CG Scroll To Top cg-scroll-to-top allows Stored XSS.This issue affects CG Scroll To Top: from n… |
CVE-2025-31395 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in a.ankit Easy Custom CSS easy-custom-css allows Stored XSS.This issue affects Easy Custom CSS: from n/a throu… |
CVE-2025-31394 | High | 7.1 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey (trepmal) More Mime Type Filters more-mime-type-fi… |
CVE-2025-31393 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in vfvalent Social Bookmarking RELOADED social-bookmarking-reloaded allows Stored XSS.This issue affects Social… |
CVE-2025-31392 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Shameem Reza Smart Product Gallery Slider smart-product-gallery-slider allows Cross Site Request Forgery.Thi… |
CVE-2025-31391 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in regen Script Compressor script-compressor allows Stored XSS.This issue affects Script Compressor: from n/a t… |
CVE-2025-31390 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in bdoga Social Crowd social-crowd allows Stored XSS.This issue affects Social Crowd: from n/a through <= 0.9.6… |
CVE-2025-31388 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in doa The World the-world allows Stored XSS.This issue affects The World: from n/a through <= 0.4. |
CVE-2025-31385 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in intelcaprep Site Table of Contents site-table-of-contents allows Stored XSS.This issue affects Site Table of… |
CVE-2025-31383 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in sodena FrescoChat Live Chat flexytalk-widget allows Stored XSS.This issue affects FrescoChat Live Chat: from… |
CVE-2025-31382 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in theode Language Field language-field allows Stored XSS.This issue affects Language Field: from n/a through <… |
CVE-2025-31377 | High | 7.5 | 2025-04-09 | Missing Authorization vulnerability in Asaquzzaman mishu Woo Product Feed For Marketing Channels woocommerce-to-google-merchant-center allows Exploiting Incorr… |
CVE-2025-31375 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in bhoogterp Scheduled scheduled allows Stored XSS.This issue affects Scheduled: from n/a through <= 1.0. |
CVE-2025-31042 | Medium | 5.3 | 2025-04-09 | Missing Authorization vulnerability in rtakao Sandwich Adsense firsth3tagadsense allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-31038 | High | 8.8 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Essential Marketer Essential Breadcrumbs essential-breadcrumbs allows Privilege Escalation.This issue affect… |
CVE-2025-31036 | High | 8.8 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in WPSOLR WPSolr wpsolr-free allows Privilege Escalation.This issue affects WPSolr: from n/a through <= 24.0. |
CVE-2025-31035 | Medium | 5.9 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Chris WP Editor.md – The Perfect WordPress Markd… |
CVE-2025-31034 | Medium | 4.3 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in AboZain Albanna Customize Login Page customize-login-page allows Cross Site Request Forgery.This issue affec… |
CVE-2025-31033 | Critical | 9.8 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Adam Nowak Buddypress Humanity buddypress-humanity allows Cross Site Request Forgery.This issue affects Budd… |
CVE-2025-31032 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Pagopar - Grupo M S.A. Pagopar – WooCommerce Gateway pagopar-woocommerce-gateway allows Stored XSS.This issu… |
CVE-2025-31026 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Austin Comment Validation Reloaded comment-validation-reloaded allows Stored XSS.This issue affects Comment… |
CVE-2025-31023 | High | 8.8 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Purab Seo Meta Tags seo-meta-tags allows Cross Site Request Forgery.This issue affects Seo Meta Tags: from n… |
CVE-2025-31020 | Medium | 6.5 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webliberty Simple Spoiler simple-spoiler allows Stored XS… |
CVE-2025-31017 | Medium | 6.5 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Noakes Nav Menu Manager noakes-menu-manager allows… |
CVE-2025-31012 | Medium | 5.3 | 2025-04-09 | Missing Authorization vulnerability in Phil Age Gate age-gate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Age Gate: from… |
CVE-2025-31009 | Medium | 5.4 | 2025-04-09 | Server-Side Request Forgery (SSRF) vulnerability in Jan Boddez IndieBlocks indieblocks allows Server Side Request Forgery.This issue affects IndieBlocks: from… |
CVE-2025-31008 | Medium | 5.9 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-e… |
CVE-2025-31005 | Medium | 4.3 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Uzair Easyfonts easyfonts allows Cross Site Request Forgery.This issue affects Easyfonts: from n/a through <… |
CVE-2025-31004 | Medium | 4.3 | 2025-04-09 | Missing Authorization vulnerability in Croover.inc Rich Table of Contents rich-table-of-content allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-31003 | Low | 2.7 | 2025-04-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze squeeze allows Retrieve Embedded Sensitiv… |
CVE-2025-31002 | Critical | 9.1 | 2025-04-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze squeeze allows Using Malicious Files.This issue affects Squeeze: fro… |
CVE-2025-32381 | Medium | 6.5 | 2025-04-09 | XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache for compiled grammar… |
CVE-2025-32380 | High | 7.5 | 2025-04-09 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerab… |
CVE-2025-32379 | Medium | 5.0 | 2025-04-09 | Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even… |
CVE-2025-32378 | Medium | 5.3 | 2025-04-09 | Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsl… |
CVE-2025-32375 | Critical | 9.8 | 2025-04-09 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserializatio… |
CVE-2025-32374 | Medium | 5.9 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted… |
CVE-2025-32373 | Medium | 6.5 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In limited configurations, registered users may b… |
CVE-2025-32372 | Medium | 6.5 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously k… |
CVE-2025-32371 | Medium | 4.3 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to… |
CVE-2025-32016 | Medium | 4.7 | 2025-04-09 | Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity… |
CVE-2025-29394 | High | 8.1 | 2025-04-09 | An insecure permissions vulnerability in verydows v2.0 allows a remote attacker to execute arbitrary code by uploading a file type. |
CVE-2025-29391 | High | 7.2 | 2025-04-09 | horvey Library-Manager v1.0 is vulnerable to SQL Injection in Admin/Controller/BookController.class.php. |
CVE-2025-29390 | High | 8.8 | 2025-04-09 | jerryhanjj ERP 1.0 is vulnerable to SQL Injection in the set_password function in application/controllers/home.php. |
CVE-2025-29389 | Medium | 6.1 | 2025-04-09 | PbootCMS v3.2.9 contains a XSS vulnerability in admin.php?p=/Content/index/mcode/2#tab=t2. |
CVE-2025-27391 | Medium | 6.5 | 2025-04-09 | Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apac… |
CVE-2025-25023 | Medium | 4.9 | 2025-04-09 | IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment. |
CVE-2025-1968 | High | 7.7 | 2025-04-09 | Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session… |
CVE-2025-31672 | Medium | 5.3 | 2025-04-09 | Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are bas… |
CVE-2025-30677 | Medium | 6.5 | 2025-04-09 | Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Ad… |
CVE-2025-29189 | High | 7.6 | 2025-04-09 | Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores. |
CVE-2025-2442 | Medium | 6.8 | 2025-04-09 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in t… |
CVE-2025-2441 | Medium | 4.6 | 2025-04-09 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having p… |
CVE-2025-2440 | Medium | 4.2 | 2025-04-09 | CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a maliciou… |
CVE-2025-2223 | High | 7.8 | 2025-04-09 | CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when a… |
CVE-2025-2222 | High | 7.8 | 2025-04-09 | CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privilege escalation fol… |
CVE-2025-29870 | High | 7.5 | 2025-04-09 | Missing authentication for critical function vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may ob… |
CVE-2025-27934 | High | 7.5 | 2025-04-09 | Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote… |
CVE-2025-27797 | Critical | 9.8 | 2025-04-09 | OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed… |
CVE-2025-27722 | Medium | 5.9 | 2025-04-09 | Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a man-in-the-middle attack may allow a remote… |
CVE-2025-25213 | Medium | 6.5 | 2025-04-09 | Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views and clicks on the content on the malic… |
CVE-2025-25056 | Medium | 4.3 | 2025-04-09 | Cross-site request forgery vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views a malicious page while logged in, unintended operations… |
CVE-2025-25053 | High | 8.8 | 2025-04-09 | OS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be… |
CVE-2025-23407 | Medium | 4.3 | 2025-04-09 | Incorrect privilege assignment vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote attacker who… |
CVE-2025-20952 | Medium | 5.5 | 2025-04-09 | Improper access control in Mdecservice prior to SMR Apr-2025 Release 1 allows local attackers to access arbitrary files with system privilege. |
CVE-2025-3442 | | 2025-04-09 | This vulnerability exists in TP-Link Tapo H200 V1 IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with… | |
CVE-2025-3100 | Medium | 6.4 | 2025-04-09 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-S… |
CVE-2025-32464 | Medium | 6.8 | 2025-04-09 | HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of… |
CVE-2025-29988 | Medium | 6.9 | 2025-04-09 | Dell Client Platform BIOS contains a Stack-based Buffer Overflow Vulnerability. A high privileged attacker with local access could potentially exploit this vul… |
CVE-2025-32461 | Critical | 9.9 | 2025-04-09 | wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2… |
CVE-2025-32460 | Medium | 4.0 | 2025-04-09 | GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call. |
CVE-2025-25013 | Medium | 6.5 | 2025-04-08 | Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmi… |
CVE-2025-27192 | Low | 2.7 | 2025-04-08 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability… |
CVE-2025-27191 | Medium | 5.3 | 2025-04-08 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-27190 | Medium | 5.3 | 2025-04-08 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-27189 | Medium | 4.3 | 2025-04-08 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability tha… |
CVE-2025-27188 | Medium | 4.3 | 2025-04-08 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could re… |
CVE-2025-30294 | Medium | 6.8 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature byp… |
CVE-2025-30293 | Medium | 6.8 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature byp… |
CVE-2025-30292 | Medium | 6.1 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convin… |
CVE-2025-30291 | Medium | 5.5 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass… |
CVE-2025-30290 | High | 8.7 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vuln… |
CVE-2025-30289 | High | 8.2 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inje… |
CVE-2025-30288 | High | 8.2 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypas… |
CVE-2025-30287 | High | 8.2 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution… |
CVE-2025-30286 | High | 8.4 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inje… |
CVE-2025-30285 | High | 8.4 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code… |
CVE-2025-30284 | High | 8.4 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code… |
CVE-2025-30282 | Critical | 9.1 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution… |
CVE-2025-30281 | Critical | 9.1 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution… |
CVE-2025-24447 | Critical | 9.1 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code… |
CVE-2025-24446 | Critical | 9.1 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code executi… |
CVE-2025-22871 | Critical | 9.1 | 2025-04-08 | The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server… |
CVE-2025-3416 | Low | 3.7 | 2025-04-08 | A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may res… |
CVE-2025-30309 | Medium | 5.5 | 2025-04-08 | XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker cou… |
CVE-2025-30308 | Medium | 5.5 | 2025-04-08 | XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker cou… |
CVE-2025-30307 | Medium | 5.5 | 2025-04-08 | XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker cou… |
CVE-2025-30306 | Medium | 5.5 | 2025-04-08 | XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker cou… |