2025 CVEs (page 363)
Page 363 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32050 | Medium | 5.9 | 2025-04-03 | A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read. |
CVE-2025-32049 | High | 7.5 | 2025-04-03 | A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial… |
CVE-2025-31911 | Critical | 9.3 | 2025-04-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems Social Share And Social Locker social-s… |
CVE-2025-31909 | High | 7.5 | 2025-04-03 | Missing Authorization vulnerability in Apptivo Apptivo Business Site CRM apptivo-business-site allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-31907 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labib Ahmed Team Builder team-display allows Reflected XS… |
CVE-2025-31905 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O'Donnell Team Rosters team-rosters allows Reflected… |
CVE-2025-31903 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xavi Ivars XV Random Quotes xv-random-quotes allows Refle… |
CVE-2025-31902 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems Social Share And Social Locker social-s… |
CVE-2025-31901 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digihood Digihood HTML Sitemap wedesin-html-sitemap allow… |
CVE-2025-31900 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lexicata Lexicata lexicata allows Reflected XSS.This issu… |
CVE-2025-31899 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpshopee Awesome Logos awesome-logos allows Reflected XSS… |
CVE-2025-31898 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dustinscarberry MediaView mediaview allows Reflected XSS… |
CVE-2025-31896 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in istmoplugins GetBookingsWP get-bookings-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-31893 | Medium | 6.5 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker… |
CVE-2025-31876 | Medium | 5.8 | 2025-04-03 | Missing Authorization vulnerability in gunnarpayday Payday payday allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pa… |
CVE-2025-31858 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in matthewrubin Local Magic local-magic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-31841 | Medium | 6.3 | 2025-04-03 | Missing Authorization vulnerability in Frank P. Walentynowicz FPW Category Thumbnails fpw-category-thumbnails allows Exploiting Incorrectly Configured Access C… |
CVE-2025-31827 | Medium | 4.9 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vlad.olaru Fonto fonto allows Path Traversal.This issue affects… |
CVE-2025-31825 | Medium | 4.9 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pixelgrade Category Icon category-icon allows Path Traversal.Th… |
CVE-2025-31800 | Medium | 6.5 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in publitio Publitio publitio allows Path Traversal.This issue aff… |
CVE-2025-31795 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in Plugin Devs Shopify to WooCommerce Migration migrate-shopify-to-woocommerce allows Exploiting Incorrectly Configured Acc… |
CVE-2025-31794 | Medium | 5.4 | 2025-04-03 | Missing Authorization vulnerability in Web Ready Now WR Price List Manager For Woocommerce wr-price-list-for-woocommerce allows Exploiting Incorrectly Configur… |
CVE-2025-31789 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in Matat Technologies TextMe SMS textme-sms-integration allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-31768 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in OTWthemes Widget Manager Light widget-manager-light allows Accessing Functionality Not Properly Constrained by ACLs.This… |
CVE-2025-31758 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View free-product-table-for-woocommerce allows Exploiting Incorrectly Con… |
CVE-2025-31746 | Medium | 6.4 | 2025-04-03 | Missing Authorization vulnerability in Think201 Clients clients allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clie… |
CVE-2025-31739 | Medium | 6.4 | 2025-04-03 | Missing Authorization vulnerability in Manuel Schmalstieg Minimalistic Event Manager minimalistic-event-manager allows Exploiting Incorrectly Configured Access… |
CVE-2025-31736 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in richtexteditor Rich Text Editor richtexteditor allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-31729 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in jeffikus WooTumblog woo-tumblog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-31626 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M. Ali Saleem Support Helpdesk Ticket System Lite ticket-… |
CVE-2025-31622 | Medium | 6.5 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Utkarsh Kukreti Advanced Typekit advanced-typekit allows… |
CVE-2025-31582 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani Contact Form vCard Generator contact-form-vc… |
CVE-2025-31581 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in Sandeep Kumar WP Video Playlist wp-video-playlist allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-31573 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev CF7 Database pepro-cf7-database… |
CVE-2025-31558 | Medium | 5.8 | 2025-04-03 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Greg TailPress tailpress allows Retrieve Embedded Sensitive Da… |
CVE-2025-31554 | Medium | 5.9 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in docxpresso Docxpresso docxpresso allows Absolute Path Traversal… |
CVE-2025-31541 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-31536 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Reflec… |
CVE-2025-31468 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scottsm WP_Identicon wp-identicon allows Reflected XSS.Th… |
CVE-2025-31467 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miro.mannino Flickr Photostream flickr-photostream allows… |
CVE-2025-31442 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e1tekoap42 Search engine keywords highlighter keywords-hi… |
CVE-2025-31436 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Angelo Mandato Blubrry PowerPress Podcasting plugin Multi… |
CVE-2025-31098 | High | 7.5 | 2025-04-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in debounce DeBounce Email Validator debo… |
CVE-2025-31091 | Medium | 6.5 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Header and Footer cm-header-foo… |
CVE-2025-30916 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Exploiting Incorrectly Configured A… |
CVE-2025-30915 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Exploiting In… |
CVE-2025-30908 | High | 7.1 | 2025-04-03 | Cross-Site Request Forgery (CSRF) vulnerability in Shamalli Web Directory Free web-directory-free allows Stored XSS.This issue affects Web Directory Free: from… |
CVE-2025-30889 | High | 8.8 | 2025-04-03 | Deserialization of Untrusted Data vulnerability in PickPlugins Testimonial Slider testimonial allows Object Injection.This issue affects Testimonial Slider: fr… |
CVE-2025-30858 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Snow Storm snow-storm allows Reflected… |
CVE-2025-30616 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Wood Latest Custom Post Type Updates latest-custom-… |
CVE-2025-30611 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wptobe Wptobe-signinup wptobe-signinup allows Reflected X… |
CVE-2025-30596 | Medium | 6.5 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in tstafford include-file include-file allows Path Traversal.This… |
CVE-2025-29369 | Critical | 9.8 | 2025-04-03 | Code-Projects Matrimonial Site V1.0 is vulnerable to SQL Injection in /view_profile.php?id=1. |
CVE-2025-22931 | High | 7.5 | 2025-04-03 | An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files u… |
CVE-2025-22930 | Critical | 9.8 | 2025-04-03 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php. |
CVE-2025-22929 | Critical | 9.8 | 2025-04-03 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php. |
CVE-2025-22926 | Critical | 9.8 | 2025-04-03 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messagi… |
CVE-2025-2946 | Critical | 9.1 | 2025-04-03 | pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser t… |
CVE-2025-2945 | Critical | 9.9 | 2025-04-03 | Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoint… |
CVE-2025-22928 | Critical | 9.8 | 2025-04-03 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php. |
CVE-2025-22927 | Critical | 9.1 | 2025-04-03 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messagi… |
CVE-2025-2299 | Medium | 6.1 | 2025-04-03 | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. This is due to mis… |
CVE-2025-3152 | Low | 3.5 | 2025-04-03 | A vulnerability classified as problematic has been found in caipeichao ThinkOX 1.0. This affects an unknown part of the file /ThinkOX-master/index.php?s=/Weibo… |
CVE-2025-3151 | High | 7.3 | 2025-04-03 | A vulnerability was found in SourceCodester Gym Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2025-3150 | Medium | 4.3 | 2025-04-03 | A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been declared as problematic. Affected by this vulnerability is an u… |
CVE-2025-3149 | Low | 2.4 | 2025-04-03 | A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been classified as problematic. Affected is an unknown function of t… |
CVE-2025-2874 | Medium | 4.4 | 2025-04-03 | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings… |
CVE-2025-22007 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix error code in chan_alloc_skb_cb() The chan_alloc_skb_cb() function is supp… |
CVE-2025-22006 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence Registering the interrupts f… |
CVE-2025-22005 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). fib_check_nh_v6_gw() ex… |
CVE-2025-22004 | High | 8.6 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the l… |
CVE-2025-22003 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix out of bound read in strscpy() source Commit 7fdaf8966aae ("can: ucan: use… |
CVE-2025-22002 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: netfs: Call `invalidate_cache` only if implemented Many filesystems such as NFS and Ceph… |
CVE-2025-22001 | High | 7.8 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix integer overflow in qaic_validate_req() These are u64 variables that come… |
CVE-2025-22000 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: drop beyond-EOF folios with the right number of refs When an after-split… |
CVE-2025-21999 | High | 7.8 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/XXX's inode instantiat… |
CVE-2025-21998 | Medium | 4.7 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using t… |
CVE-2025-21997 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: xsk: fix an integer overflow in xp_create_and_assign_umem() Since the i and pool->chunk_s… |
CVE-2025-21996 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that… |
CVE-2025-21995 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix fence reference count leak The last_scheduled fence leaks when an entity i… |
CVE-2025-1663 | Medium | 6.4 | 2025-04-03 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including… |
CVE-2025-3148 | Low | 3.3 | 2025-04-03 | A vulnerability was found in codeprojects Product Management System 1.0 and classified as problematic. This issue affects some unknown processing of the compon… |
CVE-2025-3147 | High | 7.3 | 2025-04-03 | A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-subad… |
CVE-2025-3146 | High | 7.3 | 2025-04-03 | A vulnerability, which was classified as critical, was found in PHPGurukul Bus Pass Management System 1.0. This affects an unknown part of the file /view-pass-… |
CVE-2025-3145 | Low | 3.3 | 2025-04-03 | A vulnerability, which was classified as problematic, has been found in MindSpore 2.5.0. Affected by this issue is the function mindspore.numpy.fft.rfft2. The… |
CVE-2025-30485 | Medium | 6.2 | 2025-04-03 | UNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected product an external s… |
CVE-2025-3144 | Low | 3.3 | 2025-04-03 | A vulnerability classified as problematic was found in MindSpore 2.5.0. Affected by this vulnerability is the function mindspore.numpy.fft.hfftn. The manipulat… |
CVE-2025-3143 | Medium | 6.3 | 2025-04-03 | A vulnerability classified as critical has been found in SourceCodester Apartment Visitor Management System 1.0. Affected is an unknown function of the file /v… |
CVE-2025-3142 | Medium | 6.3 | 2025-04-03 | A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been rated as critical. This issue affects some unknown processing… |
CVE-2025-31334 | Medium | 6.8 | 2025-04-03 | Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR v… |
CVE-2025-2055 | Medium | 6.8 | 2025-04-03 | The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with… |
CVE-2025-3141 | Medium | 6.3 | 2025-04-03 | A vulnerability was found in SourceCodester Online Medicine Ordering System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2025-3140 | Medium | 6.3 | 2025-04-03 | A vulnerability was found in SourceCodester Online Medicine Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /… |
CVE-2025-3139 | Medium | 5.3 | 2025-04-03 | A vulnerability was found in code-projects Bus Reservation System 1.0 and classified as critical. Affected by this issue is the function Login of the component… |
CVE-2025-3138 | High | 7.3 | 2025-04-03 | A vulnerability has been found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2025-3137 | High | 7.3 | 2025-04-03 | A vulnerability, which was classified as critical, was found in PHPGurukul Online Security Guards Hiring System 1.0. Affected is an unknown function of the fil… |
CVE-2025-3136 | Low | 3.3 | 2025-04-03 | A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory.caching_allocator_dele… |
CVE-2025-2784 | High | 7.0 | 2025-04-03 | A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup cli… |
CVE-2025-29991 | Low | 2.2 | 2025-04-03 | Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/… |
CVE-2025-3153 | Medium | 6.5 | 2025-04-03 | Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not… |