2025 CVEs (page 361)
Page 361 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32179 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Maps for WP maps-for-wp allows Stored XSS.This i… |
CVE-2025-32178 | Medium | 5.4 | 2025-04-04 | Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-32177 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pgn4web Embed Chessboard embed-chessboard allows Stored X… |
CVE-2025-32176 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows… |
CVE-2025-32175 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Filter Search vk-filter-search allows Stor… |
CVE-2025-32174 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tockify Tockify Events Calendar tockify-events-calendar a… |
CVE-2025-32173 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue a… |
CVE-2025-32172 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yuri Baranov YaMaps for WordPress yamaps allows Stored XS… |
CVE-2025-32171 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imtiaz Rayhan Table Block by Tableberg tableberg allows S… |
CVE-2025-32170 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Motors motors-car-dealership-classified-listings… |
CVE-2025-32169 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh Prasad Showeblogin Social showeblogin-facebook-pag… |
CVE-2025-32168 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeYatri Gutenify gutenify allows Stored XSS.This issue… |
CVE-2025-32167 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devsoftbaltic SurveyJS surveyjs allows Stored XSS.This is… |
CVE-2025-32166 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John Housholder Emma for WordPress emma-emarketing-plugin… |
CVE-2025-32165 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fromdoppler Doppler Forms doppler-form allows Stored XSS… |
CVE-2025-32163 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows S… |
CVE-2025-32162 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Morgan Kay Chamber Dashboard Business Directory allows DO… |
CVE-2025-32161 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks arkhe-blocks allows Stored XSS.This issu… |
CVE-2025-32159 | High | 7.5 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Radius Blocks radius-block… |
CVE-2025-32157 | High | 7.5 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jakub Glos Sparkle Elementor Kit spark… |
CVE-2025-32156 | High | 7.5 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Prokopenko / JustCoded Just Post… |
CVE-2025-32155 | High | 7.5 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in markkinchin Beds24 Online Booking beds… |
CVE-2025-32154 | High | 7.5 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Catch Themes Catch Dark Mode catch-dar… |
CVE-2025-32153 | High | 7.5 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in vinagecko VG WooCarousel vg-woocarouse… |
CVE-2025-32152 | High | 7.5 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Essential Plugin Slider a SlidersPack… |
CVE-2025-32151 | High | 7.5 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themekraft BuddyForms buddyforms allow… |
CVE-2025-32150 | High | 7.5 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rameez Iqbal Real Estate Manager real-… |
CVE-2025-32149 | High | 8.5 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in winkm89 teachPress teachpress allows SQL Injection.This i… |
CVE-2025-32148 | High | 8.5 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daisycon Daisycon prijsvergelijkers daisycon allows SQL I… |
CVE-2025-32147 | High | 8.8 | 2025-04-04 | Missing Authorization vulnerability in coothemes Easy WP Optimizer easy-wp-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-32146 | High | 8.8 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Job Manager js-jobs allows… |
CVE-2025-32142 | High | 8.8 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix Motors motors-car-dealership-… |
CVE-2025-32141 | High | 8.8 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix MasterStudy LMS masterstudy-l… |
CVE-2025-32138 | Medium | 6.6 | 2025-04-04 | Improper Restriction of XML External Entity Reference vulnerability in supsystic Easy Google Maps google-maps-easy allows XML Injection.This issue affects Easy… |
CVE-2025-32137 | Medium | 4.9 | 2025-04-04 | Relative Path Traversal vulnerability in Cristián Lávaque s2Member s2member allows Path Traversal.This issue affects s2Member: from n/a through <= 250419. |
CVE-2025-32136 | Medium | 5.9 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in activecampaign ActiveCampaign activecampaign-subscription… |
CVE-2025-32135 | Medium | 5.9 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rocketelements Split Test For Elementor split-test-for-el… |
CVE-2025-32134 | Medium | 5.9 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders URL Shortify url-shortify allows Stored XSS… |
CVE-2025-32133 | Medium | 5.9 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Secure Copy Content Protection and Content Lockin… |
CVE-2025-32132 | Medium | 5.9 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelCockpit FunnelCockpit funnelcockpit allows Stored X… |
CVE-2025-32131 | Medium | 5.9 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in socialintents Social Intents live-chat-support-by-social-… |
CVE-2025-32130 | Medium | 5.9 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Posts Footer Manager intell… |
CVE-2025-32129 | Medium | 5.9 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Welcome Bar intelly-welcome… |
CVE-2025-32127 | High | 7.6 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-we… |
CVE-2025-32126 | High | 7.6 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7… |
CVE-2025-32125 | High | 7.6 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silvasoft Silvasoft boekhouden silvasoft-boekhouden allow… |
CVE-2025-32124 | High | 7.6 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powe… |
CVE-2025-32122 | High | 7.6 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows Blind SQL Injection.Thi… |
CVE-2025-32121 | High | 7.6 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member ga… |
CVE-2025-32120 | High | 7.6 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in edanzer Easy Query – WP Query Builder easy-query allows B… |
CVE-2025-32118 | Critical | 9.1 | 2025-04-04 | Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance cmp-coming-soon-maintenance allows Using Malicious… |
CVE-2025-32113 | High | 7.1 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in Renzo Tejada Libro de Reclamaciones y Quejas libro-de-reclamaciones-y-quejas allows Cross Site Request Forge… |
CVE-2025-32112 | High | 7.1 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Sidebar Manager Light sidebar-manager-light allows Cross Site Request Forgery.This issue affects S… |
CVE-2025-25178 | High | 7.8 | 2025-04-04 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption. |
CVE-2025-0468 | High | 7.1 | 2025-04-04 | Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under… |
CVE-2025-3251 | Low | 3.5 | 2025-04-04 | A vulnerability, which was classified as problematic, was found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manip… |
CVE-2025-3250 | Medium | 4.3 | 2025-04-04 | A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Affected by this issue is some unknown functionality of the file /a… |
CVE-2025-31480 | Critical | 9.1 | 2025-04-04 | aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the… |
CVE-2025-31130 | Medium | 6.8 | 2025-04-04 | gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulne… |
CVE-2025-27520 | Critical | 9.8 | 2025-04-04 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused b… |
CVE-2025-3249 | Medium | 6.3 | 2025-04-04 | A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of th… |
CVE-2025-31418 | High | 7.1 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in noonnoo Gravel allows Reflected XSS.This issue affects Gr… |
CVE-2025-31416 | High | 7.1 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking a… |
CVE-2025-31407 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hutsixdigital Tiger allows Stored XSS.This issue affects… |
CVE-2025-31405 | High | 7.5 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zankover Fami WooCommerce Compare fami… |
CVE-2025-31403 | Critical | 9.3 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shiptrack Booking Calendar and Notification booking-calen… |
CVE-2025-31389 | High | 7.1 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Introvoke Inc. dba Sequel.io Sequel sequel allows Reflect… |
CVE-2025-31384 | High | 7.1 | 2025-04-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Aviplugins Videos allows Reflected XSS.This issue affects Videos… |
CVE-2025-31381 | Medium | 6.5 | 2025-04-04 | Missing Authorization vulnerability in shiptrack Booking Calendar and Notification booking-calendar-and-notification allows Exploiting Incorrectly Configured A… |
CVE-2025-2798 | Critical | 9.8 | 2025-04-04 | The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of e… |
CVE-2025-28146 | Critical | 9.8 | 2025-04-04 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefo… |
CVE-2025-22285 | Medium | 6.5 | 2025-04-04 | Missing Authorization vulnerability in enituretechnology Pallet Packaging for WooCommerce pallet-packaging-for-woocommerce allows Exploiting Incorrectly Config… |
CVE-2025-22281 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in joshix Simplish simplish allows Stored XSS.This issue aff… |
CVE-2025-3189 | | 2025-04-04 | Stored Cross-Site Scripting (XSS) in DoWISP in versions prior to 1.16.2.50, which consists of an stored XSS through the upload of a profile picture in SVG form… | |
CVE-2025-31421 | Medium | 5.8 | 2025-04-04 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Oblak Studio Srbtranslatin srbtranslatin allows Retrieve Embed… |
CVE-2025-31420 | High | 7.6 | 2025-04-04 | Incorrect Privilege Assignment vulnerability in Tomdever wpForo Forum wpforo allows Privilege Escalation.This issue affects wpForo Forum: from n/a through <= 2… |
CVE-2025-3245 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in itsourcecode Library Management System 1.0. It has been rated as critical. Affected by this issue is the function Search of the fi… |
CVE-2025-3244 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as critical. Affected by this vulnerability… |
CVE-2025-3243 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. This issue affects some unknown processing of the f… |
CVE-2025-3242 | Medium | 6.3 | 2025-04-04 | A vulnerability has been found in PHPGurukul e-Diary Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /sea… |
CVE-2025-3241 | Medium | 6.3 | 2025-04-04 | A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/c… |
CVE-2025-3240 | High | 7.3 | 2025-04-04 | A vulnerability, which was classified as critical, has been found in PHPGurukul Online Fire Reporting System 1.2. Affected by this issue is some unknown functi… |
CVE-2025-3239 | High | 7.3 | 2025-04-04 | A vulnerability classified as critical was found in PHPGurukul Online Fire Reporting System 1.2. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-22282 | High | 7.1 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keksdieb ez Form Calculator Premium ez-form-calculator-pr… |
CVE-2025-3238 | High | 7.3 | 2025-04-04 | A vulnerability classified as critical has been found in PHPGurukul Online Fire Reporting System 1.2. Affected is an unknown function of the file /search-reque… |
CVE-2025-3237 | Medium | 5.3 | 2025-04-04 | A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the file /goform/wrlwpsse… |
CVE-2025-3236 | Medium | 5.3 | 2025-04-04 | A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects unknown code of the file /goform/VirSerDM… |
CVE-2025-3235 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin… |
CVE-2025-2245 | Medium | 5.3 | 2025-04-04 | A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component o… |
CVE-2025-2244 | Critical | 9.8 | 2025-04-04 | A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-suppli… |
CVE-2025-2243 | High | 7.3 | 2025-04-04 | A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading charact… |
CVE-2025-1865 | High | 7.8 | 2025-04-04 | The kernel driver, accessible to low-privileged users, exposes a function that fails to properly validate the privileges of the calling process. This allows cr… |
CVE-2025-3231 | High | 7.3 | 2025-04-04 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /about… |
CVE-2025-3229 | Medium | 4.7 | 2025-04-04 | A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been declared as critical. This vulnerability affects unknown code of the f… |
CVE-2025-3220 | High | 7.3 | 2025-04-04 | A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2025-3219 | Low | 3.5 | 2025-04-04 | A vulnerability was found in CodeCanyon Perfex CRM 3.2.1. It has been classified as problematic. Affected is an unknown function of the file /perfex/clients/pr… |
CVE-2025-3105 | High | 8.8 | 2025-04-04 | The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, a… |
CVE-2025-3217 | High | 7.3 | 2025-04-04 | A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /r… |
CVE-2025-3216 | High | 7.3 | 2025-04-04 | A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been classified as critical. This affects an unknown part of the file /password-r… |
CVE-2025-3215 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |