2025 CVEs (page 36)
Page 36 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3839 | High | 8.0 | 2026-01-23 | A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused t… |
CVE-2025-15522 | Medium | 6.4 | 2026-01-23 | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2025-15351 | High | 7.8 | 2026-01-23 | Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2025-15350 | High | 7.8 | 2026-01-23 | Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2025-15349 | High | 7.5 | 2026-01-23 | Anritsu ShockLine SCPI Race Condition Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on af… |
CVE-2025-15348 | High | 7.8 | 2026-01-23 | Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-15063 | Critical | 9.8 | 2026-01-23 | Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affe… |
CVE-2025-15062 | High | 7.8 | 2026-01-23 | Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2025-15061 | Critical | 9.8 | 2026-01-23 | Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2025-15059 | High | 7.8 | 2026-01-23 | GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2025-11002 | High | 7.8 | 2026-01-23 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2025-9290 | Medium | 5.9 | 2026-01-23 | An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random value… |
CVE-2025-67652 | Medium | 6.1 | 2026-01-22 | An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to syste… |
CVE-2025-55705 | High | 7.3 | 2026-01-22 | This vulnerability occurs when the system permits multiple simultaneous connections to the backend using the same charging station ID. This can result in una… |
CVE-2025-54816 | Critical | 9.4 | 2026-01-22 | This vulnerability occurs when a WebSocket endpoint does not enforce proper authentication mechanisms, allowing unauthorized users to establish connections… |
CVE-2025-53968 | High | 7.5 | 2026-01-22 | This vulnerability arises because there are no limitations on the number of authentication attempts a user can make. An attacker can exploit this weakness by… |
CVE-2025-25051 | Medium | 6.1 | 2026-01-22 | An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks. |
CVE-2025-9289 | Medium | 4.7 | 2026-01-22 | A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advance… |
CVE-2025-14751 | | 2026-01-22 | A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escal… | |
CVE-2025-14750 | | 2026-01-22 | The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can mo… | |
CVE-2025-22234 | Medium | 5.3 | 2026-01-22 | The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer… |
CVE-2025-68609 | Medium | 6.6 | 2026-01-22 | A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default config… |
CVE-2025-66428 | High | 8.8 | 2026-01-22 | An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation. |
CVE-2025-56590 | Critical | 9.8 | 2026-01-22 | An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary… |
CVE-2025-70899 | Medium | 6.5 | 2026-01-22 | PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. An attacker can perform unauthorized… |
CVE-2025-69828 | Critical | 10.0 | 2026-01-22 | File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary code via the Logo… |
CVE-2025-69321 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Spa grandspa allows Reflected XSS.This i… |
CVE-2025-69320 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Magazine grandmagazine allows Reflected… |
CVE-2025-69319 | High | 7.5 | 2026-01-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Code Injection.This… |
CVE-2025-69318 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak JobWP jobwp allows Stored XSS.This issue a… |
CVE-2025-69317 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle CarSpot carspot allows Reflected XSS.This i… |
CVE-2025-69316 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 TableOn posts-table-filterable allows Reflecte… |
CVE-2025-69315 | Medium | 6.5 | 2026-01-22 | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-69314 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes Werkstatt werkstatt allows… |
CVE-2025-69313 | High | 7.5 | 2026-01-22 | Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pos… |
CVE-2025-69312 | Critical | 9.1 | 2026-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Upload a Web Shell to a Web Server.Thi… |
CVE-2025-69311 | High | 7.6 | 2026-01-22 | Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-69300 | Medium | 5.4 | 2026-01-22 | Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-69293 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: from n/a through <=… |
CVE-2025-69292 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins WP Membership wp-membership allows Privilege Escalation.This issue affects WP Membership: from n/a th… |
CVE-2025-69193 | High | 7.3 | 2026-01-22 | Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-69192 | High | 7.3 | 2026-01-22 | Missing Authorization vulnerability in e-plugins Real Estate Pro real-estate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-69191 | High | 7.3 | 2026-01-22 | Missing Authorization vulnerability in e-plugins ListingHub listinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-69190 | High | 7.3 | 2026-01-22 | Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects L… |
CVE-2025-69188 | High | 7.3 | 2026-01-22 | Missing Authorization vulnerability in e-plugins fitness-trainer fitness-trainer allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-69187 | High | 7.3 | 2026-01-22 | Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-69186 | High | 7.3 | 2026-01-22 | Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-69185 | High | 7.3 | 2026-01-22 | Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-69184 | High | 7.3 | 2026-01-22 | Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-69183 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Privilege Escalation.This issue affects Ho… |
CVE-2025-69182 | High | 8.8 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in e-plugins Institutions Directory institutions-directory allows Privilege Escalation.This issue affects Institut… |
CVE-2025-69181 | High | 7.3 | 2026-01-22 | Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-69180 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind… |
CVE-2025-69102 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boopathi Rajan WP Test Email wp-test-email allows Reflect… |
CVE-2025-69101 | Critical | 9.8 | 2026-01-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Workreap Core workreap_core allows Authentication Abuse.This issue affects… |
CVE-2025-69100 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North north-wp allows PHP L… |
CVE-2025-69099 | High | 8.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects North: from n/a through <= 5.7.5. |
CVE-2025-69098 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWave Hide My WP hide_my_wp allows Reflected XSS.This is… |
CVE-2025-69097 | High | 8.6 | 2026-01-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue… |
CVE-2025-69095 | Medium | 6.5 | 2026-01-22 | Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-69079 | Critical | 9.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Soun… |
CVE-2025-69078 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Malta malta allows PHP Lo… |
CVE-2025-69077 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Hobo hobo allows PHP Loca… |
CVE-2025-69076 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Modern Housewife modernho… |
CVE-2025-69075 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Yolox yolox allows PHP Lo… |
CVE-2025-69074 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pearson Specter pearsonsp… |
CVE-2025-69073 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Piqes piqes allows PHP Lo… |
CVE-2025-69072 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Prider prider allows PHP… |
CVE-2025-69071 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes TanTum tantum allows PHP… |
CVE-2025-69070 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tornados tornados allows… |
CVE-2025-69068 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Muji muji allows PHP Loca… |
CVE-2025-69067 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tails tails allows PHP Lo… |
CVE-2025-69066 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Indoor Plants indoor-plan… |
CVE-2025-69065 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Snow Mountain snowmountai… |
CVE-2025-69064 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pets Land petsland allows… |
CVE-2025-69062 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Weedles weedles allows PH… |
CVE-2025-69061 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes MoveMe moveme allows PHP… |
CVE-2025-69060 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes uReach ureach allows PHP… |
CVE-2025-69059 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DiveIt diveit allows PHP… |
CVE-2025-69058 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes PartyMaker partymaker all… |
CVE-2025-69057 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Eldon eldon allows PHP Loc… |
CVE-2025-69056 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Hotel Listing hotel-listing allows Reflected XS… |
CVE-2025-69055 | Medium | 6.5 | 2026-01-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.Th… |
CVE-2025-69054 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Logos Showcase superlogoshowcase-wp allo… |
CVE-2025-69053 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal-video-playe… |
CVE-2025-69052 | Critical | 9.8 | 2026-01-22 | Missing Authorization vulnerability in FmeAddons Registration & Login with Mobile Phone Number for WooCommerce registration-login-with-mobile-phone-number allo… |
CVE-2025-69051 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows… |
CVE-2025-69050 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows… |
CVE-2025-69049 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Töbel tobel allows PHP L… |
CVE-2025-69048 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal-video-playe… |
CVE-2025-69047 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech MaxShop sw_maxshop allows PH… |
CVE-2025-69046 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebGeniusLab iRecco Core irecco-core a… |
CVE-2025-69045 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FooEvents FooEvents for WooCommerce fooevents allows SQL… |
CVE-2025-69044 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Vango vango allows PHP Loca… |
CVE-2025-69043 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Rashy rashy allows PHP Loca… |
CVE-2025-69042 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Lindo lindo allows PHP Loca… |
CVE-2025-69041 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Dekoro dekoro allows PHP Lo… |
CVE-2025-69040 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Bfres bfres allows PHP Loca… |
CVE-2025-69039 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Bailly bailly allows PHP Lo… |
CVE-2025-69038 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Hyori hyori allows PHP Loca… |