2025 CVEs (page 364)
Page 364 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-29815 | High | 7.6 | 2025-04-04 | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. |
CVE-2025-29796 | Medium | 4.7 | 2025-04-04 | User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-25001 | Medium | 4.3 | 2025-04-04 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2025-25000 | High | 8.8 | 2025-04-04 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2025-3186 | High | 7.3 | 2025-04-04 | A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been declared as critical. Affected by this vulnerability is an… |
CVE-2025-3185 | High | 7.3 | 2025-04-03 | A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been classified as critical. Affected is an unknown function of… |
CVE-2025-3184 | High | 7.3 | 2025-04-03 | A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0 and classified as critical. This issue affects some unknown processing… |
CVE-2025-3183 | High | 7.3 | 2025-04-03 | A vulnerability has been found in projectworlds Online Doctor Appointment Booking System 1.0 and classified as critical. This vulnerability affects unknown cod… |
CVE-2025-3182 | High | 7.3 | 2025-04-03 | A vulnerability, which was classified as critical, was found in projectworlds Online Doctor Appointment Booking System 1.0. This affects an unknown part of the… |
CVE-2025-3181 | High | 7.3 | 2025-04-03 | A vulnerability, which was classified as critical, has been found in projectworlds Online Doctor Appointment Booking System 1.0. Affected by this issue is some… |
CVE-2025-30370 | High | 7.4 | 2025-04-03 | jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes… |
CVE-2025-0279 | Medium | 4.3 | 2025-04-03 | HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, c… |
CVE-2025-0278 | Medium | 4.3 | 2025-04-03 | HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messa… |
CVE-2025-3180 | High | 7.3 | 2025-04-03 | A vulnerability classified as critical was found in projectworlds Online Doctor Appointment Booking System 1.0. Affected by this vulnerability is an unknown fu… |
CVE-2025-3179 | High | 7.3 | 2025-04-03 | A vulnerability classified as critical has been found in projectworlds Online Doctor Appointment Booking System 1.0. Affected is an unknown function of the fil… |
CVE-2025-3178 | High | 7.3 | 2025-04-03 | A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been rated as critical. This issue affects some unknown process… |
CVE-2025-3177 | Medium | 5.0 | 2025-04-03 | A vulnerability was found in FastCMS 0.1.5. It has been declared as critical. This vulnerability affects unknown code of the component JWT Handler. The manipul… |
CVE-2025-3176 | High | 7.3 | 2025-04-03 | A vulnerability was found in Project Worlds Online Lawyer Management System 1.0. It has been classified as critical. This affects an unknown part of the file /… |
CVE-2025-31489 | | 2025-04-03 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid… | |
CVE-2025-31485 | High | 7.5 | 2025-04-03 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with… |
CVE-2025-31481 | High | 7.5 | 2025-04-03 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an… |
CVE-2025-31161 | Critical | 9.8 | 2025-04-03 | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as ex… |
CVE-2025-31119 | High | 7.6 | 2025-04-03 | generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe r… |
CVE-2025-30406 | Critical | 9.0 | 2025-04-03 | Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machine… |
CVE-2025-29570 | High | 7.8 | 2025-04-03 | An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftp_image_check of a binar… |
CVE-2025-29504 | High | 7.8 | 2025-04-03 | Insecure Permission vulnerability in student-manage 1 allows a local attacker to escalate privileges via the Unsafe permission verification. |
CVE-2025-29462 | Critical | 9.8 | 2025-04-03 | A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13. The vulnerability occurs when the webCgiGetUploadFile function calls the socket… |
CVE-2025-29064 | Critical | 9.8 | 2025-04-03 | An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi. |
CVE-2025-26818 | Critical | 9.8 | 2025-04-03 | Netwrix Password Secure through 9.2 allows command injection. |
CVE-2025-26817 | Critical | 9.8 | 2025-04-03 | Netwrix Password Secure 9.2.0.32454 allows OS command injection. |
CVE-2025-3175 | High | 7.3 | 2025-04-03 | A vulnerability was found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-3174 | High | 7.3 | 2025-04-03 | A vulnerability has been found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown f… |
CVE-2025-3173 | High | 7.3 | 2025-04-03 | A vulnerability, which was classified as critical, was found in Project Worlds Online Lawyer Management System 1.0. Affected is an unknown function of the file… |
CVE-2025-31487 | High | 7.7 | 2025-04-03 | The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged i… |
CVE-2025-31486 | Medium | 5.3 | 2025-04-03 | Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with s… |
CVE-2025-29647 | Critical | 9.8 | 2025-04-03 | SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php. |
CVE-2025-3172 | High | 7.3 | 2025-04-03 | A vulnerability, which was classified as critical, has been found in Project Worlds Online Lawyer Management System 1.0. This issue affects some unknown proces… |
CVE-2025-3171 | High | 7.3 | 2025-04-03 | A vulnerability classified as critical was found in Project Worlds Online Lawyer Management System 1.0. This vulnerability affects unknown code of the file /ap… |
CVE-2025-3170 | High | 7.3 | 2025-04-03 | A vulnerability classified as critical has been found in Project Worlds Online Lawyer Management System 1.0. This affects an unknown part of the file /admin_us… |
CVE-2025-31483 | | 2025-04-03 | Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-sit… | |
CVE-2025-31127 | Medium | 5.3 | 2025-04-03 | Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the ele… |
CVE-2025-31126 | Medium | 5.3 | 2025-04-03 | Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-k… |
CVE-2025-3169 | Medium | 5.0 | 2025-04-03 | A vulnerability was found in Projeqtor up to 12.0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tool/save… |
CVE-2025-3168 | High | 7.3 | 2025-04-03 | A vulnerability was found in PHPGurukul Time Table Generator System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functio… |
CVE-2025-3167 | Medium | 6.5 | 2025-04-03 | A vulnerability, which was classified as problematic, has been found in Tenda AC23 16.03.07.52. This issue affects some unknown processing of the file /goform/… |
CVE-2025-3166 | Medium | 5.3 | 2025-04-03 | A vulnerability classified as critical was found in code-projects Product Management System 1.0. This vulnerability affects the function search_item of the com… |
CVE-2025-32054 | Low | 3.3 | 2025-04-03 | In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file |
CVE-2025-31115 | | 2025-04-03 | XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma… | |
CVE-2025-3165 | Medium | 5.3 | 2025-04-03 | A vulnerability classified as critical has been found in thu-pacman chitu 0.1.0. This affects the function torch.load of the file chitu/chitu/backend.py. The m… |
CVE-2025-3164 | Medium | 4.7 | 2025-04-03 | A vulnerability was found in Tencent Music Entertainment SuperSonic up to 0.9.8. It has been rated as critical. Affected by this issue is some unknown function… |
CVE-2025-3163 | Medium | 5.3 | 2025-04-03 | A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file l… |
CVE-2025-29987 | High | 8.8 | 2025-04-03 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulner… |
CVE-2025-22457 | Critical | 9.0 | 2025-04-03 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before ve… |
CVE-2025-3162 | Medium | 5.3 | 2025-04-03 | A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been classified as critical. Affected is the function load_weight_ckpt of the file lmdeploy/… |
CVE-2025-3161 | High | 8.8 | 2025-04-03 | A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. This issue affects the function ShutdownSetAdd of the file /goform/ShutdownSetA… |
CVE-2025-3160 | Low | 3.3 | 2025-04-03 | A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCo… |
CVE-2025-0272 | Medium | 5.4 | 2025-04-03 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially lead… |
CVE-2025-3159 | Medium | 5.3 | 2025-04-03 | A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4… |
CVE-2025-3158 | Medium | 5.3 | 2025-04-03 | A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO… |
CVE-2025-3157 | Low | 2.4 | 2025-04-03 | A vulnerability was found in Intelbras WRN 150 1.0.15_pt_ITB01. It has been rated as problematic. This issue affects some unknown processing of the component W… |
CVE-2025-3155 | High | 7.4 | 2025-04-03 | A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to i… |
CVE-2025-32053 | Medium | 6.5 | 2025-04-03 | A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read. |
CVE-2025-32052 | Medium | 6.5 | 2025-04-03 | A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read. |
CVE-2025-32051 | Medium | 5.9 | 2025-04-03 | A flaw was found in libsoup. The libsoup soup_uri_decode_data_uri() function may crash when processing malformed data URI. This flaw allows an attacker to caus… |
CVE-2025-32050 | Medium | 5.9 | 2025-04-03 | A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read. |
CVE-2025-32049 | High | 7.5 | 2025-04-03 | A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial… |
CVE-2025-31911 | Critical | 9.3 | 2025-04-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems Social Share And Social Locker social-s… |
CVE-2025-31909 | High | 7.5 | 2025-04-03 | Missing Authorization vulnerability in Apptivo Apptivo Business Site CRM apptivo-business-site allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-31907 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labib Ahmed Team Builder team-display allows Reflected XS… |
CVE-2025-31905 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O'Donnell Team Rosters team-rosters allows Reflected… |
CVE-2025-31903 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xavi Ivars XV Random Quotes xv-random-quotes allows Refle… |
CVE-2025-31902 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems Social Share And Social Locker social-s… |
CVE-2025-31901 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digihood Digihood HTML Sitemap wedesin-html-sitemap allow… |
CVE-2025-31900 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lexicata Lexicata lexicata allows Reflected XSS.This issu… |
CVE-2025-31899 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpshopee Awesome Logos awesome-logos allows Reflected XSS… |
CVE-2025-31898 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dustinscarberry MediaView mediaview allows Reflected XSS… |
CVE-2025-31896 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in istmoplugins GetBookingsWP get-bookings-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-31893 | Medium | 6.5 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker… |
CVE-2025-31876 | Medium | 5.8 | 2025-04-03 | Missing Authorization vulnerability in gunnarpayday Payday payday allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pa… |
CVE-2025-31858 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in matthewrubin Local Magic local-magic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-31841 | Medium | 6.3 | 2025-04-03 | Missing Authorization vulnerability in Frank P. Walentynowicz FPW Category Thumbnails fpw-category-thumbnails allows Exploiting Incorrectly Configured Access C… |
CVE-2025-31827 | Medium | 4.9 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vlad.olaru Fonto fonto allows Path Traversal.This issue affects… |
CVE-2025-31825 | Medium | 4.9 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pixelgrade Category Icon category-icon allows Path Traversal.Th… |
CVE-2025-31800 | Medium | 6.5 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in publitio Publitio publitio allows Path Traversal.This issue aff… |
CVE-2025-31795 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in Plugin Devs Shopify to WooCommerce Migration migrate-shopify-to-woocommerce allows Exploiting Incorrectly Configured Acc… |
CVE-2025-31794 | Medium | 5.4 | 2025-04-03 | Missing Authorization vulnerability in Web Ready Now WR Price List Manager For Woocommerce wr-price-list-for-woocommerce allows Exploiting Incorrectly Configur… |
CVE-2025-31789 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in Matat Technologies TextMe SMS textme-sms-integration allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-31768 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in OTWthemes Widget Manager Light widget-manager-light allows Accessing Functionality Not Properly Constrained by ACLs.This… |
CVE-2025-31758 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View free-product-table-for-woocommerce allows Exploiting Incorrectly Con… |
CVE-2025-31746 | Medium | 6.4 | 2025-04-03 | Missing Authorization vulnerability in Think201 Clients clients allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clie… |
CVE-2025-31739 | Medium | 6.4 | 2025-04-03 | Missing Authorization vulnerability in Manuel Schmalstieg Minimalistic Event Manager minimalistic-event-manager allows Exploiting Incorrectly Configured Access… |
CVE-2025-31736 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in richtexteditor Rich Text Editor richtexteditor allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-31729 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in jeffikus WooTumblog woo-tumblog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-31626 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M. Ali Saleem Support Helpdesk Ticket System Lite ticket-… |
CVE-2025-31622 | Medium | 6.5 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Utkarsh Kukreti Advanced Typekit advanced-typekit allows… |
CVE-2025-31582 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani Contact Form vCard Generator contact-form-vc… |
CVE-2025-31581 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in Sandeep Kumar WP Video Playlist wp-video-playlist allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-31573 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev CF7 Database pepro-cf7-database… |
CVE-2025-31558 | Medium | 5.8 | 2025-04-03 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Greg TailPress tailpress allows Retrieve Embedded Sensitive Da… |
CVE-2025-31554 | Medium | 5.9 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in docxpresso Docxpresso docxpresso allows Absolute Path Traversal… |