2025 CVEs (page 365)
Page 365 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31541 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-31536 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Reflec… |
CVE-2025-31468 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scottsm WP_Identicon wp-identicon allows Reflected XSS.Th… |
CVE-2025-31467 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miro.mannino Flickr Photostream flickr-photostream allows… |
CVE-2025-31442 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e1tekoap42 Search engine keywords highlighter keywords-hi… |
CVE-2025-31436 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Angelo Mandato Blubrry PowerPress Podcasting plugin Multi… |
CVE-2025-31098 | High | 7.5 | 2025-04-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in debounce DeBounce Email Validator debo… |
CVE-2025-31091 | Medium | 6.5 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Header and Footer cm-header-foo… |
CVE-2025-30916 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Exploiting Incorrectly Configured A… |
CVE-2025-30915 | Medium | 6.5 | 2025-04-03 | Missing Authorization vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Exploiting In… |
CVE-2025-30908 | High | 7.1 | 2025-04-03 | Cross-Site Request Forgery (CSRF) vulnerability in Shamalli Web Directory Free web-directory-free allows Stored XSS.This issue affects Web Directory Free: from… |
CVE-2025-30889 | High | 8.8 | 2025-04-03 | Deserialization of Untrusted Data vulnerability in PickPlugins Testimonial Slider testimonial allows Object Injection.This issue affects Testimonial Slider: fr… |
CVE-2025-30858 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Snow Storm snow-storm allows Reflected… |
CVE-2025-30616 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Wood Latest Custom Post Type Updates latest-custom-… |
CVE-2025-30611 | High | 7.1 | 2025-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wptobe Wptobe-signinup wptobe-signinup allows Reflected X… |
CVE-2025-30596 | Medium | 6.5 | 2025-04-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in tstafford include-file include-file allows Path Traversal.This… |
CVE-2025-29369 | Critical | 9.8 | 2025-04-03 | Code-Projects Matrimonial Site V1.0 is vulnerable to SQL Injection in /view_profile.php?id=1. |
CVE-2025-22931 | High | 7.5 | 2025-04-03 | An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files u… |
CVE-2025-22930 | Critical | 9.8 | 2025-04-03 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php. |
CVE-2025-22929 | Critical | 9.8 | 2025-04-03 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php. |
CVE-2025-22926 | Critical | 9.8 | 2025-04-03 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messagi… |
CVE-2025-2946 | Critical | 9.1 | 2025-04-03 | pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser t… |
CVE-2025-2945 | Critical | 9.9 | 2025-04-03 | Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoint… |
CVE-2025-22928 | Critical | 9.8 | 2025-04-03 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php. |
CVE-2025-22927 | Critical | 9.1 | 2025-04-03 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messagi… |
CVE-2025-2299 | Medium | 6.1 | 2025-04-03 | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. This is due to mis… |
CVE-2025-3152 | Low | 3.5 | 2025-04-03 | A vulnerability classified as problematic has been found in caipeichao ThinkOX 1.0. This affects an unknown part of the file /ThinkOX-master/index.php?s=/Weibo… |
CVE-2025-3151 | High | 7.3 | 2025-04-03 | A vulnerability was found in SourceCodester Gym Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2025-3150 | Medium | 4.3 | 2025-04-03 | A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been declared as problematic. Affected by this vulnerability is an u… |
CVE-2025-3149 | Low | 2.4 | 2025-04-03 | A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been classified as problematic. Affected is an unknown function of t… |
CVE-2025-2874 | Medium | 4.4 | 2025-04-03 | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings… |
CVE-2025-22007 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix error code in chan_alloc_skb_cb() The chan_alloc_skb_cb() function is supp… |
CVE-2025-22006 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence Registering the interrupts f… |
CVE-2025-22005 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). fib_check_nh_v6_gw() ex… |
CVE-2025-22004 | High | 8.6 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the l… |
CVE-2025-22003 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix out of bound read in strscpy() source Commit 7fdaf8966aae ("can: ucan: use… |
CVE-2025-22002 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: netfs: Call `invalidate_cache` only if implemented Many filesystems such as NFS and Ceph… |
CVE-2025-22001 | High | 7.8 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix integer overflow in qaic_validate_req() These are u64 variables that come… |
CVE-2025-22000 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: drop beyond-EOF folios with the right number of refs When an after-split… |
CVE-2025-21999 | High | 7.8 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/XXX's inode instantiat… |
CVE-2025-21998 | Medium | 4.7 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using t… |
CVE-2025-21997 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: xsk: fix an integer overflow in xp_create_and_assign_umem() Since the i and pool->chunk_s… |
CVE-2025-21996 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that… |
CVE-2025-21995 | Medium | 5.5 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix fence reference count leak The last_scheduled fence leaks when an entity i… |
CVE-2025-1663 | Medium | 6.4 | 2025-04-03 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including… |
CVE-2025-3148 | Low | 3.3 | 2025-04-03 | A vulnerability was found in codeprojects Product Management System 1.0 and classified as problematic. This issue affects some unknown processing of the compon… |
CVE-2025-3147 | High | 7.3 | 2025-04-03 | A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-subad… |
CVE-2025-3146 | High | 7.3 | 2025-04-03 | A vulnerability, which was classified as critical, was found in PHPGurukul Bus Pass Management System 1.0. This affects an unknown part of the file /view-pass-… |
CVE-2025-3145 | Low | 3.3 | 2025-04-03 | A vulnerability, which was classified as problematic, has been found in MindSpore 2.5.0. Affected by this issue is the function mindspore.numpy.fft.rfft2. The… |
CVE-2025-30485 | Medium | 6.2 | 2025-04-03 | UNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected product an external s… |
CVE-2025-3144 | Low | 3.3 | 2025-04-03 | A vulnerability classified as problematic was found in MindSpore 2.5.0. Affected by this vulnerability is the function mindspore.numpy.fft.hfftn. The manipulat… |
CVE-2025-3143 | Medium | 6.3 | 2025-04-03 | A vulnerability classified as critical has been found in SourceCodester Apartment Visitor Management System 1.0. Affected is an unknown function of the file /v… |
CVE-2025-3142 | Medium | 6.3 | 2025-04-03 | A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been rated as critical. This issue affects some unknown processing… |
CVE-2025-31334 | Medium | 6.8 | 2025-04-03 | Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR v… |
CVE-2025-2055 | Medium | 6.8 | 2025-04-03 | The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with… |
CVE-2025-3141 | Medium | 6.3 | 2025-04-03 | A vulnerability was found in SourceCodester Online Medicine Ordering System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2025-3140 | Medium | 6.3 | 2025-04-03 | A vulnerability was found in SourceCodester Online Medicine Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /… |
CVE-2025-3139 | Medium | 5.3 | 2025-04-03 | A vulnerability was found in code-projects Bus Reservation System 1.0 and classified as critical. Affected by this issue is the function Login of the component… |
CVE-2025-3138 | High | 7.3 | 2025-04-03 | A vulnerability has been found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2025-3137 | High | 7.3 | 2025-04-03 | A vulnerability, which was classified as critical, was found in PHPGurukul Online Security Guards Hiring System 1.0. Affected is an unknown function of the fil… |
CVE-2025-3136 | Low | 3.3 | 2025-04-03 | A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory.caching_allocator_dele… |
CVE-2025-2784 | High | 7.0 | 2025-04-03 | A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup cli… |
CVE-2025-29991 | Low | 2.2 | 2025-04-03 | Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/… |
CVE-2025-3153 | Medium | 6.5 | 2025-04-03 | Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not… |
CVE-2025-3135 | Medium | 6.3 | 2025-04-03 | A vulnerability classified as critical was found in fcba_zzm ics-park Smart Park Management System 2.1. This vulnerability affects unknown code of the file /ap… |
CVE-2025-3134 | Medium | 6.3 | 2025-04-03 | A vulnerability classified as critical has been found in code-projects Payroll Management System 1.0. This affects an unknown part of the file /add_overtime.ph… |
CVE-2025-3154 | | 2025-04-02 | Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid VerticesPerRow value in a PDF shading dictionary. | |
CVE-2025-3123 | Medium | 4.7 | 2025-04-02 | A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the c… |
CVE-2025-3130 | Medium | 5.4 | 2025-04-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obf… |
CVE-2025-3129 | Medium | 4.8 | 2025-04-02 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 bef… |
CVE-2025-3122 | Low | 3.1 | 2025-04-02 | A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36. Affected by this vulnerability is the function BinaryReaderInterp::BeginFunctio… |
CVE-2025-3121 | Low | 3.3 | 2025-04-02 | A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jit_module_from_flatbuffer. The manipulation lead… |
CVE-2025-3120 | Medium | 6.3 | 2025-04-02 | A vulnerability was found in SourceCodester Apartment Visitors Management System 1.0. It has been rated as critical. This issue affects some unknown processing… |
CVE-2025-3119 | Medium | 6.3 | 2025-04-02 | A vulnerability was found in SourceCodester Online Tutor Portal 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /tut… |
CVE-2025-31484 | | 2025-04-02 | conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-… | |
CVE-2025-31479 | High | 8.2 | 2025-04-02 | canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if… |
CVE-2025-31477 | Critical | 9.8 | 2025-04-02 | The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the… |
CVE-2025-30218 | Medium | 5.9 | 2025-04-02 | Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persi… |
CVE-2025-27608 | | 2025-04-02 | Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron. A Self Cross-Site Scripting (XSS) vulnerability has been identified within… | |
CVE-2025-0257 | Medium | 6.3 | 2025-04-02 | HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its A… |
CVE-2025-3118 | Medium | 6.3 | 2025-04-02 | A vulnerability was found in SourceCodester Online Tutor Portal 1.0. It has been classified as critical. This affects an unknown part of the file /tutor/course… |
CVE-2025-30080 | High | 7.5 | 2025-04-02 | Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary denial of service (s… |
CVE-2025-2704 | High | 7.5 | 2025-04-02 | OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying netwo… |
CVE-2025-29719 | Medium | 6.1 | 2025-04-02 | SourceCodester (rems) Employee Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add_employee.php via the First Name and Address text fields. |
CVE-2025-29085 | Critical | 9.8 | 2025-04-02 | SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClus… |
CVE-2025-29063 | Critical | 9.8 | 2025-04-02 | An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hidessid_cfg is not h… |
CVE-2025-29062 | Critical | 9.8 | 2025-04-02 | An issue in BL-AC2100 <=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in the set_LimitClient_cfg of the goahead… |
CVE-2025-22925 | High | 7.5 | 2025-04-02 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php. The remote, auth… |
CVE-2025-22924 | High | 8.8 | 2025-04-02 | OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php. |
CVE-2025-22923 | High | 8.8 | 2025-04-02 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.ph… |
CVE-2025-31286 | Medium | 4.6 | 2025-04-02 | An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code. Please note: this i… |
CVE-2025-31285 | Medium | 4.6 | 2025-04-02 | A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who… |
CVE-2025-31284 | Medium | 4.6 | 2025-04-02 | A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who co… |
CVE-2025-31283 | Medium | 4.6 | 2025-04-02 | A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator to create users wh… |
CVE-2025-31282 | Medium | 4.6 | 2025-04-02 | A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users… |
CVE-2025-20212 | High | 7.7 | 2025-04-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series devices could allow an authenticated, remote attacker to cause… |
CVE-2025-20203 | Medium | 4.8 | 2025-04-02 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authen… |
CVE-2025-20139 | High | 7.5 | 2025-04-02 | A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of servic… |
CVE-2025-20120 | Medium | 6.1 | 2025-04-02 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an unauth… |
CVE-2025-0014 | High | 7.3 | 2025-04-02 | Incorrect default permissions on the AMD Ryzen(TM) AI installation folder could allow an attacker to achieve privilege escalation, potentially resulting in arb… |