2025 CVEs (page 359)
Page 359 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-29986 | High | 8.3 | 2025-04-08 | Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Commo… |
CVE-2025-29985 | Medium | 6.5 | 2025-04-08 | Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Initialization of a Resource with an Insecure Default vulnerability in the Common Anti-Virus A… |
CVE-2025-3437 | Medium | 4.3 | 2025-04-08 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch… |
CVE-2025-2883 | Medium | 5.3 | 2025-04-08 | The Accept SagePay Payments Using Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0… |
CVE-2025-2808 | Medium | 5.4 | 2025-04-08 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Phone Number parameter in al… |
CVE-2025-2807 | High | 8.8 | 2025-04-08 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check… |
CVE-2025-3436 | Medium | 6.5 | 2025-04-08 | The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'order' and 'orderby' parameters in all versions u… |
CVE-2025-3433 | Medium | 6.1 | 2025-04-08 | The Advanced Advertising System plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.3.1. This is due to insufficient va… |
CVE-2025-3432 | Medium | 6.4 | 2025-04-08 | The AAWP Obfuscator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-aawp-web' parameter in all versions up to, and including, 1… |
CVE-2025-3064 | High | 8.8 | 2025-04-08 | The WPFront User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.1. This is due to missi… |
CVE-2025-30280 | Medium | 5.3 | 2025-04-08 | A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), Mendix Runtime V10.18 (A… |
CVE-2025-30000 | Medium | 6.7 | 2025-04-08 | A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application does not properly restrict permissions of t… |
CVE-2025-29999 | Medium | 6.7 | 2025-04-08 | A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application searches for executable files in the applic… |
CVE-2025-22017 | Medium | 5.5 | 2025-04-08 | In the Linux kernel, the following vulnerability has been resolved: devlink: fix xa_alloc_cyclic() error handling In case of returning 1 from xa_alloc_cyclic… |
CVE-2025-22016 | Medium | 5.5 | 2025-04-08 | In the Linux kernel, the following vulnerability has been resolved: dpll: fix xa_alloc_cyclic() error handling In case of returning 1 from xa_alloc_cyclic()… |
CVE-2025-22015 | High | 7.8 | 2025-04-08 | In the Linux kernel, the following vulnerability has been resolved: mm/migrate: fix shmem xarray update during migration A shmem folio can be either in page… |
CVE-2025-22014 | Medium | 5.5 | 2025-04-08 | In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pdr: Fix the potential deadlock When some client process A call pdr_add_lookup… |
CVE-2025-22013 | High | 7.3 | 2025-04-08 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state There are several proble… |
CVE-2025-22012 | High | 8.8 | 2025-04-08 | In the Linux kernel, the following vulnerability has been resolved: Revert "arm64: dts: qcom: sdm845: Affirm IDR0.CCTW on apps_smmu" There are reports that t… |
CVE-2025-22011 | Medium | 5.5 | 2025-04-08 | In the Linux kernel, the following vulnerability has been resolved: ARM: dts: bcm2711: Fix xHCI power-domain During s2idle tests on the Raspberry CM4 the VPU… |
CVE-2025-22010 | Medium | 5.5 | 2025-04-08 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix soft lockup during bt pages loop Driver runs a for-loop when allocating bt… |
CVE-2025-22009 | Medium | 5.5 | 2025-04-08 | In the Linux kernel, the following vulnerability has been resolved: regulator: dummy: force synchronous probing Sometimes I get a NULL pointer dereference at… |
CVE-2025-22008 | Medium | 5.5 | 2025-04-08 | In the Linux kernel, the following vulnerability has been resolved: regulator: check that dummy regulator has been probed before using it Due to asynchronous… |
CVE-2025-3431 | High | 7.5 | 2025-04-08 | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91… |
CVE-2025-31333 | Medium | 4.3 | 2025-04-08 | SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker causing low impact on… |
CVE-2025-31332 | Medium | 6.6 | 2025-04-08 | Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files poten… |
CVE-2025-31331 | Medium | 4.3 | 2025-04-08 | SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation… |
CVE-2025-31330 | Critical | 9.9 | 2025-04-08 | SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables… |
CVE-2025-30017 | Medium | 4.4 | 2025-04-08 | Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After… |
CVE-2025-30016 | Critical | 9.8 | 2025-04-08 | SAP Financial Consolidation allows an unauthenticated attacker to gain unauthorized access to the Admin account. The vulnerability arises due to improper authe… |
CVE-2025-30015 | Medium | 4.1 | 2025-04-08 | Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileg… |
CVE-2025-30014 | High | 7.7 | 2025-04-08 | SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to… |
CVE-2025-30013 | Medium | 6.7 | 2025-04-08 | SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privile… |
CVE-2025-2882 | Medium | 5.3 | 2025-04-08 | The GreenPay(tm) by Green.Money plugin for WordPress is vulnerable to Sensitive Information Exposure in versions between 3.0.0 and 3.0.9 through the publicly a… |
CVE-2025-27437 | Medium | 4.3 | 2025-04-08 | A Missing Authorization Check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application Server ABAP. Because of this, an attacker authen… |
CVE-2025-27435 | Medium | 4.2 | 2025-04-08 | Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaig… |
CVE-2025-27429 | Critical | 9.9 | 2025-04-08 | SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbit… |
CVE-2025-27428 | High | 7.7 | 2025-04-08 | Due to directory traversal vulnerability, an authorized attacker could gain access to some critical information by using RFC enabled function module. Upon succ… |
CVE-2025-26657 | Medium | 5.3 | 2025-04-08 | SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low… |
CVE-2025-26654 | Medium | 6.8 | 2025-04-08 | SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 to 443 (HTTPS). As… |
CVE-2025-26653 | Medium | 4.7 | 2025-04-08 | SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This ena… |
CVE-2025-23186 | High | 8.5 | 2025-04-08 | In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted desti… |
CVE-2025-3430 | Medium | 4.9 | 2025-04-08 | The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'printer_text' parameter in all versions up to, and including, 2.1.3.6 due to insu… |
CVE-2025-3429 | Medium | 4.9 | 2025-04-08 | The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'material_text' parameter in all versions up to, and including, 2.1.3.6 due to ins… |
CVE-2025-3428 | Medium | 4.9 | 2025-04-08 | The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'coating_text' parameter in all versions up to, and including, 2.1.3.6 due to insu… |
CVE-2025-3427 | Medium | 4.9 | 2025-04-08 | The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'infill_text' parameter in all versions up to, and including, 2.1.3.6 due to insuf… |
CVE-2025-3413 | Medium | 6.3 | 2025-04-08 | A vulnerability has been found in opplus springboot-admin up to a2d5310f44fd46780a8686456cf2f9001ab8f024 and classified as critical. Affected by this vulnerabi… |
CVE-2025-3412 | Medium | 6.3 | 2025-04-08 | A vulnerability, which was classified as critical, was found in mymagicpower AIAS 20250308. Affected is an unknown function of the file 2_training_platform/tra… |
CVE-2025-0361 | Medium | 4.3 | 2025-04-08 | During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowe… |
CVE-2025-3411 | Medium | 6.3 | 2025-04-08 | A vulnerability, which was classified as critical, has been found in mymagicpower AIAS 20250308. This issue affects some unknown processing of the file 3_api_p… |
CVE-2025-3410 | Medium | 6.3 | 2025-04-08 | A vulnerability classified as critical was found in mymagicpower AIAS 20250308. This vulnerability affects unknown code of the file training_platform/train-pla… |
CVE-2025-3409 | Medium | 6.3 | 2025-04-08 | A vulnerability classified as critical has been found in Nothings stb up to f056911. This affects the function stb_include_string. The manipulation of the argu… |
CVE-2025-2004 | Critical | 9.1 | 2025-04-08 | The Simple WP Events plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpe_delete_file AJAX action… |
CVE-2025-20951 | Medium | 5.1 | 2025-04-08 | Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.90.7 allows local attackers to write arbitrary files w… |
CVE-2025-20950 | Medium | 4.0 | 2025-04-08 | Use of implicit intent for sensitive communication in SamsungNotes prior to version 4.4.26.45 allows local attackers to access sensitive information. |
CVE-2025-20948 | Medium | 5.5 | 2025-04-08 | Out-of-bounds read in enrollment with cdsp frame secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to read out-of-bounds memory. |
CVE-2025-20947 | Medium | 5.5 | 2025-04-08 | Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to access image files acr… |
CVE-2025-20946 | High | 8.8 | 2025-04-08 | Improper handling of exceptional conditions in pairing specific bluetooth devices in Galaxy Watch Bluetooth pairing prior to SMR Apr-2025 Release 1 allows loca… |
CVE-2025-20945 | Medium | 4.0 | 2025-04-08 | Improper access control in Galaxy Watch prior to SMR Apr-2025 Release 1 allows local attackers to access sensitive information of Galaxy watch. |
CVE-2025-20944 | Medium | 6.2 | 2025-04-08 | Out-of-bounds read in parsing audio data in libsavsac.so prior to SMR Apr-2025 Release 1 allows local attackers to read out-of-bounds memory. |
CVE-2025-20943 | Medium | 6.4 | 2025-04-08 | Out-of-bounds write in secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to cause memory corruption. |
CVE-2025-20942 | Medium | 4.4 | 2025-04-08 | Improper Verification of Intent by Broadcast Receiver in DeviceIdService prior to SMR Apr-2025 Release 1 allows local attackers to reset OAID. |
CVE-2025-20941 | Medium | 6.2 | 2025-04-08 | Improper access control in InputManager to SMR Apr-2025 Release 1 allows local attackers to access the scancode of specific input device. |
CVE-2025-20940 | Medium | 4.0 | 2025-04-08 | Improper handling of insufficient permission in Samsung Device Health Manager Service prior to SMR Apr-2025 Release 1 allows local attackers to access provider… |
CVE-2025-20939 | Medium | 5.4 | 2025-04-08 | Improper authorization in wireless download protocol in Galaxy Watch prior to SMR Apr-2025 Release 1 allows physical attackers to update device unique identifi… |
CVE-2025-20938 | Medium | 5.5 | 2025-04-08 | Improper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers to access protected data in SamsungContacts. |
CVE-2025-20936 | High | 8.8 | 2025-04-08 | Improper access control in HDCP trustlet prior to SMR Apr-2025 Release 1 allows local attackers with shell privilege to escalate their privileges to root. |
CVE-2025-20935 | Medium | 5.5 | 2025-04-08 | Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to access files with syst… |
CVE-2025-20934 | Medium | 5.5 | 2025-04-08 | Improper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilege. |
CVE-2025-3408 | Medium | 6.3 | 2025-04-08 | A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stb_dupreplace. The manipulation… |
CVE-2025-3407 | Medium | 6.3 | 2025-04-08 | A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhw_build_tileset_f… |
CVE-2025-3406 | Medium | 4.3 | 2025-04-08 | A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the… |
CVE-2025-3405 | Medium | 4.3 | 2025-04-08 | A vulnerability was found in FCJ Venture Builder appclientefiel 3.0.27. It has been declared as problematic. Affected by this vulnerability is an unknown funct… |
CVE-2025-3403 | Low | 2.7 | 2025-04-08 | A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is… |
CVE-2025-3402 | Medium | 6.3 | 2025-04-08 | A vulnerability was found in Seeyon Zhiyuan Interconnect FE Collaborative Office Platform 5.5.2 and classified as critical. This issue affects some unknown pro… |
CVE-2025-3401 | High | 7.3 | 2025-04-08 | A vulnerability has been found in ESAFENET CDG 5.6.3.154.205_20250114 and classified as critical. This vulnerability affects unknown code of the file /paramete… |
CVE-2025-3364 | Medium | 6.7 | 2025-04-08 | The SSH service of PowerStation from HGiga has a Chroot Escape vulnerability, allowing attackers with root privileges to bypass chroot restrictions and access… |
CVE-2025-32414 | Medium | 5.6 | 2025-04-08 | In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return val… |
CVE-2025-32413 | Medium | 6.4 | 2025-04-08 | Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py. |
CVE-2025-3400 | High | 7.3 | 2025-04-08 | A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. This affects an unknown part of the file /client/UnChkMail… |
CVE-2025-3399 | High | 7.3 | 2025-04-08 | A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5.6.3.154.205_20250114. Affected by this issue is some unknown functionality… |
CVE-2025-3398 | Medium | 6.3 | 2025-04-08 | A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/sr… |
CVE-2025-3397 | Medium | 4.3 | 2025-04-08 | A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argume… |
CVE-2025-3393 | Low | 3.5 | 2025-04-08 | A vulnerability was found in mrcen springboot-ucan-admin up to 5f35162032cbe9288a04e429ef35301545143509. It has been classified as problematic. This affects an… |
CVE-2025-3392 | Low | 3.5 | 2025-04-08 | A vulnerability was found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this issue is the function Save of the file cn/gso… |
CVE-2025-3363 | Critical | 9.8 | 2025-04-08 | The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands an… |
CVE-2025-3362 | Critical | 9.8 | 2025-04-08 | The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands an… |
CVE-2025-3361 | Critical | 9.8 | 2025-04-08 | The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands an… |
CVE-2025-2526 | High | 8.8 | 2025-04-08 | The Streamit theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.2. This is due to the plu… |
CVE-2025-2525 | High | 8.8 | 2025-04-08 | The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'st_Authentication_Controller::edit_profile… |
CVE-2025-2519 | Medium | 6.5 | 2025-04-08 | The Sreamit theme for WordPress is vulnerable to arbitrary file downloads in all versions up to, and including, 4.0.1. This is due to insufficient file validat… |
CVE-2025-3391 | Low | 3.5 | 2025-04-08 | A vulnerability has been found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this vulnerability is the function outAddress… |
CVE-2025-3390 | Low | 3.5 | 2025-04-08 | A vulnerability, which was classified as problematic, was found in hailey888 oa_system up to 2025.01.01. Affected is the function addandchangeday of the file c… |
CVE-2025-3389 | Low | 3.5 | 2025-04-08 | A vulnerability, which was classified as problematic, has been found in hailey888 oa_system up to 2025.01.01. This issue affects the function testMess of the f… |
CVE-2025-3388 | Medium | 4.3 | 2025-04-07 | A vulnerability classified as problematic was found in hailey888 oa_system up to 2025.01.01. This vulnerability affects the function loginCheck of the file cn/… |
CVE-2025-3387 | Low | 3.5 | 2025-04-07 | A vulnerability classified as problematic has been found in renrenio renren-security up to 5.4.0. This affects an unknown part of the component JSON Handler. T… |
CVE-2025-3386 | Low | 2.4 | 2025-04-07 | A vulnerability was found in LinZhaoguan pb-cms 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin#… |
CVE-2025-3385 | Low | 2.4 | 2025-04-07 | A vulnerability was found in LinZhaoguan pb-cms 2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the com… |
CVE-2025-32409 | High | 8.1 | 2025-04-07 | Ratta SuperNote A6 X2 Nomad before December 2024 allows remote code execution because an arbitrary firmware image (signed with debug keys) can be sent to TCP p… |
CVE-2025-0942 | High | 8.6 | 2025-04-07 | The DB chooser functionality in Jalios JPlatform 10 SP6 before 10.0.6 improperly neutralizes special elements used in an SQL command allows for unauthenticated… |