2025 CVEs (page 362)
Page 362 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3087 | Medium | 5.4 | 2025-04-04 | Stored XSS in M-Files Web versions from 25.1.14445.5 to 25.2.14524.4 allows an authenticated user to run scripts |
CVE-2025-3086 | High | 7.1 | 2025-04-04 | Improper isolation of users in M-Files Server version before 25.3.14549 allows anonymous user to affect other anonymous users views and possibly cause a denial… |
CVE-2025-32111 | High | 8.7 | 2025-04-04 | The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout. |
CVE-2025-2797 | Medium | 5.4 | 2025-04-04 | The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due to missing or incor… |
CVE-2025-2780 | High | 8.8 | 2025-04-04 | The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeatu… |
CVE-2025-3214 | Medium | 4.3 | 2025-04-04 | A vulnerability has been found in JFinal CMS up to 5.2.4 and classified as problematic. Affected by this vulnerability is the function engine.getTemplate of th… |
CVE-2025-3213 | High | 7.3 | 2025-04-04 | A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. This vulnerability affects unknown code of the file /view-note.ph… |
CVE-2025-3211 | Medium | 6.3 | 2025-04-04 | A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /birthing… |
CVE-2025-2836 | Medium | 6.4 | 2025-04-04 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-2317 | High | 7.5 | 2025-04-04 | The Product Filter by WBW plugin for WordPress is vulnerable to time-based SQL Injection via the filtersDataBackend parameter in all versions up to, and includ… |
CVE-2025-2279 | Medium | 5.9 | 2025-04-04 | The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the sho… |
CVE-2025-2270 | High | 8.1 | 2025-04-04 | The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2… |
CVE-2025-2159 | | 2025-04-04 | Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI | |
CVE-2025-3210 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in code-projects Patient Record Management System 1.0. It has been rated as critical. Affected by this issue is some unknown function… |
CVE-2025-3209 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in code-projects Patient Record Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2025-3208 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in code-projects Patient Record Management System 1.0. It has been classified as critical. Affected is an unknown function of the fil… |
CVE-2025-3197 | High | 7.3 | 2025-04-04 | Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given st… |
CVE-2025-3194 | High | 7.5 | 2025-04-04 | Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE() function. Attackers can exploit this to crash the applic… |
CVE-2025-3192 | High | 8.2 | 2025-04-04 | Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restrictio… |
CVE-2025-3191 | Medium | 6.1 | 2025-04-04 | All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the paylo… |
CVE-2025-2075 | High | 8.8 | 2025-04-04 | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up… |
CVE-2025-3207 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. This issue affects some unknown processing of the f… |
CVE-2025-3206 | Medium | 6.3 | 2025-04-04 | A vulnerability has been found in code-projects Hospital Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-3205 | Medium | 6.3 | 2025-04-04 | A vulnerability, which was classified as critical, was found in CodeAstro Student Grading System 1.0. This affects an unknown part of the file studentsubject.p… |
CVE-2025-3204 | Medium | 6.3 | 2025-04-04 | A vulnerability, which was classified as critical, has been found in CodeAstro Car Rental System 1.0. Affected by this issue is some unknown functionality of t… |
CVE-2025-3203 | Medium | 4.3 | 2025-04-04 | A vulnerability classified as problematic was found in Tenda W18E 16.01.0.11. Affected by this vulnerability is the function formSetAccountList of the file /go… |
CVE-2025-3202 | High | 7.3 | 2025-04-04 | A vulnerability classified as critical has been found in ageerle ruoyi-ai up to 2.0.0. Affected is an unknown function of the file ruoyi-modules/ruoyi-system/s… |
CVE-2025-3199 | High | 7.3 | 2025-04-04 | A vulnerability was found in ageerle ruoyi-ai up to 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file ruoyi-mo… |
CVE-2025-3198 | Low | 3.3 | 2025-04-04 | A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file… |
CVE-2025-3196 | Medium | 5.3 | 2025-04-04 | A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternRea… |
CVE-2025-3195 | High | 7.3 | 2025-04-04 | A vulnerability, which was classified as critical, has been found in itsourcecode Online Blood Bank Management System 1.0. This issue affects some unknown proc… |
CVE-2025-26401 | Medium | 6.5 | 2025-04-04 | Weak encoding for password vulnerability exists in HMI ViewJet C-more series. If this vulnerability is exploited, authentication information may be obtained by… |
CVE-2025-25061 | Medium | 5.8 | 2025-04-04 | Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated a… |
CVE-2025-24317 | Medium | 5.3 | 2025-04-04 | Allocation of resources without limits or throttling issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated a… |
CVE-2025-24310 | Medium | 4.3 | 2025-04-04 | Improper restriction of rendered UI layers or frames issue exists in HMI ViewJet C-more series, which may allow a remote unauthenticated attacker to trick the… |
CVE-2025-3188 | High | 7.3 | 2025-04-04 | A vulnerability classified as critical has been found in PHPGurukul e-Diary Management System 1.0. This affects an unknown part of the file /add-notes.php. The… |
CVE-2025-3187 | High | 7.3 | 2025-04-04 | A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2025-29815 | High | 7.6 | 2025-04-04 | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. |
CVE-2025-29796 | Medium | 4.7 | 2025-04-04 | User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-25001 | Medium | 4.3 | 2025-04-04 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2025-25000 | High | 8.8 | 2025-04-04 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2025-3186 | High | 7.3 | 2025-04-04 | A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been declared as critical. Affected by this vulnerability is an… |
CVE-2025-3185 | High | 7.3 | 2025-04-03 | A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been classified as critical. Affected is an unknown function of… |
CVE-2025-3184 | High | 7.3 | 2025-04-03 | A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0 and classified as critical. This issue affects some unknown processing… |
CVE-2025-3183 | High | 7.3 | 2025-04-03 | A vulnerability has been found in projectworlds Online Doctor Appointment Booking System 1.0 and classified as critical. This vulnerability affects unknown cod… |
CVE-2025-3182 | High | 7.3 | 2025-04-03 | A vulnerability, which was classified as critical, was found in projectworlds Online Doctor Appointment Booking System 1.0. This affects an unknown part of the… |
CVE-2025-3181 | High | 7.3 | 2025-04-03 | A vulnerability, which was classified as critical, has been found in projectworlds Online Doctor Appointment Booking System 1.0. Affected by this issue is some… |
CVE-2025-30370 | High | 7.4 | 2025-04-03 | jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes… |
CVE-2025-0279 | Medium | 4.3 | 2025-04-03 | HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, c… |
CVE-2025-0278 | Medium | 4.3 | 2025-04-03 | HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messa… |
CVE-2025-3180 | High | 7.3 | 2025-04-03 | A vulnerability classified as critical was found in projectworlds Online Doctor Appointment Booking System 1.0. Affected by this vulnerability is an unknown fu… |
CVE-2025-3179 | High | 7.3 | 2025-04-03 | A vulnerability classified as critical has been found in projectworlds Online Doctor Appointment Booking System 1.0. Affected is an unknown function of the fil… |
CVE-2025-3178 | High | 7.3 | 2025-04-03 | A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been rated as critical. This issue affects some unknown process… |
CVE-2025-3177 | Medium | 5.0 | 2025-04-03 | A vulnerability was found in FastCMS 0.1.5. It has been declared as critical. This vulnerability affects unknown code of the component JWT Handler. The manipul… |
CVE-2025-3176 | High | 7.3 | 2025-04-03 | A vulnerability was found in Project Worlds Online Lawyer Management System 1.0. It has been classified as critical. This affects an unknown part of the file /… |
CVE-2025-31489 | | 2025-04-03 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid… | |
CVE-2025-31485 | High | 7.5 | 2025-04-03 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with… |
CVE-2025-31481 | High | 7.5 | 2025-04-03 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an… |
CVE-2025-31161 | Critical | 9.8 | 2025-04-03 | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as ex… |
CVE-2025-31119 | High | 7.6 | 2025-04-03 | generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe r… |
CVE-2025-30406 | Critical | 9.0 | 2025-04-03 | Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machine… |
CVE-2025-29570 | High | 7.8 | 2025-04-03 | An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftp_image_check of a binar… |
CVE-2025-29504 | High | 7.8 | 2025-04-03 | Insecure Permission vulnerability in student-manage 1 allows a local attacker to escalate privileges via the Unsafe permission verification. |
CVE-2025-29462 | Critical | 9.8 | 2025-04-03 | A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13. The vulnerability occurs when the webCgiGetUploadFile function calls the socket… |
CVE-2025-29064 | Critical | 9.8 | 2025-04-03 | An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi. |
CVE-2025-26818 | Critical | 9.8 | 2025-04-03 | Netwrix Password Secure through 9.2 allows command injection. |
CVE-2025-26817 | Critical | 9.8 | 2025-04-03 | Netwrix Password Secure 9.2.0.32454 allows OS command injection. |
CVE-2025-3175 | High | 7.3 | 2025-04-03 | A vulnerability was found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-3174 | High | 7.3 | 2025-04-03 | A vulnerability has been found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown f… |
CVE-2025-3173 | High | 7.3 | 2025-04-03 | A vulnerability, which was classified as critical, was found in Project Worlds Online Lawyer Management System 1.0. Affected is an unknown function of the file… |
CVE-2025-31487 | High | 7.7 | 2025-04-03 | The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged i… |
CVE-2025-31486 | Medium | 5.3 | 2025-04-03 | Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with s… |
CVE-2025-29647 | Critical | 9.8 | 2025-04-03 | SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php. |
CVE-2025-3172 | High | 7.3 | 2025-04-03 | A vulnerability, which was classified as critical, has been found in Project Worlds Online Lawyer Management System 1.0. This issue affects some unknown proces… |
CVE-2025-3171 | High | 7.3 | 2025-04-03 | A vulnerability classified as critical was found in Project Worlds Online Lawyer Management System 1.0. This vulnerability affects unknown code of the file /ap… |
CVE-2025-3170 | High | 7.3 | 2025-04-03 | A vulnerability classified as critical has been found in Project Worlds Online Lawyer Management System 1.0. This affects an unknown part of the file /admin_us… |
CVE-2025-31483 | | 2025-04-03 | Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-sit… | |
CVE-2025-31127 | Medium | 5.3 | 2025-04-03 | Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the ele… |
CVE-2025-31126 | Medium | 5.3 | 2025-04-03 | Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-k… |
CVE-2025-3169 | Medium | 5.0 | 2025-04-03 | A vulnerability was found in Projeqtor up to 12.0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tool/save… |
CVE-2025-3168 | High | 7.3 | 2025-04-03 | A vulnerability was found in PHPGurukul Time Table Generator System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functio… |
CVE-2025-3167 | Medium | 6.5 | 2025-04-03 | A vulnerability, which was classified as problematic, has been found in Tenda AC23 16.03.07.52. This issue affects some unknown processing of the file /goform/… |
CVE-2025-3166 | Medium | 5.3 | 2025-04-03 | A vulnerability classified as critical was found in code-projects Product Management System 1.0. This vulnerability affects the function search_item of the com… |
CVE-2025-32054 | Low | 3.3 | 2025-04-03 | In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file |
CVE-2025-31115 | | 2025-04-03 | XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma… | |
CVE-2025-3165 | Medium | 5.3 | 2025-04-03 | A vulnerability classified as critical has been found in thu-pacman chitu 0.1.0. This affects the function torch.load of the file chitu/chitu/backend.py. The m… |
CVE-2025-3164 | Medium | 4.7 | 2025-04-03 | A vulnerability was found in Tencent Music Entertainment SuperSonic up to 0.9.8. It has been rated as critical. Affected by this issue is some unknown function… |
CVE-2025-3163 | Medium | 5.3 | 2025-04-03 | A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file l… |
CVE-2025-29987 | High | 8.8 | 2025-04-03 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulner… |
CVE-2025-22457 | Critical | 9.0 | 2025-04-03 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before ve… |
CVE-2025-3162 | Medium | 5.3 | 2025-04-03 | A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been classified as critical. Affected is the function load_weight_ckpt of the file lmdeploy/… |
CVE-2025-3161 | High | 8.8 | 2025-04-03 | A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. This issue affects the function ShutdownSetAdd of the file /goform/ShutdownSetA… |
CVE-2025-3160 | Low | 3.3 | 2025-04-03 | A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCo… |
CVE-2025-0272 | Medium | 5.4 | 2025-04-03 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially lead… |
CVE-2025-3159 | Medium | 5.3 | 2025-04-03 | A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4… |
CVE-2025-3158 | Medium | 5.3 | 2025-04-03 | A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO… |
CVE-2025-3157 | Low | 2.4 | 2025-04-03 | A vulnerability was found in Intelbras WRN 150 1.0.15_pt_ITB01. It has been rated as problematic. This issue affects some unknown processing of the component W… |
CVE-2025-3155 | High | 7.4 | 2025-04-03 | A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to i… |
CVE-2025-32053 | Medium | 6.5 | 2025-04-03 | A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read. |
CVE-2025-32052 | Medium | 6.5 | 2025-04-03 | A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read. |