2025 CVEs (page 371)
Page 371 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30368 | Low | 2.7 | 2025-03-31 | Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but i… |
CVE-2025-30223 | Critical | 9.3 | 2025-03-31 | Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm(… |
CVE-2025-30006 | Medium | 6.1 | 2025-03-31 | Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel. This issue affects CompletePBX: all version… |
CVE-2025-30005 | High | 8.3 | 2025-03-31 | Xorcom CompletePBX is vulnerable to a path traversal via the Diagnostics reporting module, which will allow reading of arbitrary files and additionally delete… |
CVE-2025-30004 | High | 8.8 | 2025-03-31 | Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands a… |
CVE-2025-2794 | | 2025-03-31 | An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service conditio… | |
CVE-2025-2292 | Medium | 6.5 | 2025-03-31 | Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affe… |
CVE-2025-3048 | Medium | 6.5 | 2025-03-31 | After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copie… |
CVE-2025-3047 | Medium | 6.5 | 2025-03-31 | When running the AWS Serverless Application Model Command Line Interface (SAM CLI) build process with Docker and symlinks are included in the build files, the… |
CVE-2025-3002 | High | 7.3 | 2025-03-31 | A vulnerability, which was classified as critical, has been found in Digital China DCME-520 up to 20250320. This issue affects some unknown processing of the f… |
CVE-2025-3001 | Medium | 5.3 | 2025-03-31 | A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory co… |
CVE-2025-30209 | Medium | 5.3 | 2025-03-31 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes content or information vi… |
CVE-2025-30203 | Medium | 4.8 | 2025-03-31 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the content of RS… |
CVE-2025-30161 | Medium | 5.4 | 2025-03-31 | OpenEMR is a free and open source electronic health records and medical practice management application. A stored XSS vulnerability in the Bronchitis form comp… |
CVE-2025-30155 | Medium | 4.3 | 2025-03-31 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on parent trackers in… |
CVE-2025-30149 | Medium | 6.4 | 2025-03-31 | OpenEMR is a free and open source electronic health records and medical practice management application. OpenEMR allows reflected cross-site scripting (XSS) in… |
CVE-2025-29929 | Medium | 4.6 | 2025-03-31 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy adminis… |
CVE-2025-29772 | Medium | 6.1 | 2025-03-31 | OpenEMR is a free and open source electronic health records and medical practice management application. The POST parameter hidden_subcategory is output to the… |
CVE-2025-29766 | Medium | 4.6 | 2025-03-31 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on artifact submission & e… |
CVE-2025-27149 | Low | 2.7 | 2025-03-31 | Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feat… |
CVE-2025-27095 | Medium | 4.3 | 2025-03-31 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.8.0 and 3.10.18, an attacker with a low-privileged… |
CVE-2025-1449 | | 2025-03-31 | A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing. A portion of the administrative web interface fo… | |
CVE-2025-3000 | Medium | 5.3 | 2025-03-31 | A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption… |
CVE-2025-30095 | Critical | 9.0 | 2025-03-31 | VyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across d… |
CVE-2025-2999 | Medium | 5.3 | 2025-03-31 | A vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_sequence. The manip… |
CVE-2025-22941 | Critical | 9.8 | 2025-03-31 | A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary c… |
CVE-2025-22940 | Critical | 9.1 | 2025-03-31 | Incorrect access control in Adtran 411 ONT L80.00.0011.M2 allows unauthorized attackers to arbitrarily set the admin password. |
CVE-2025-22939 | Critical | 9.8 | 2025-03-31 | A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary… |
CVE-2025-22938 | Critical | 9.8 | 2025-03-31 | Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords. |
CVE-2025-22937 | Critical | 9.8 | 2025-03-31 | An issue in Adtran 411 ONT vL80.00.0011.M2 allows attackers to escalate privileges via unspecified vectors. |
CVE-2025-2998 | Medium | 5.3 | 2025-03-31 | A vulnerability was found in PyTorch 2.6.0. It has been declared as critical. Affected by this vulnerability is the function torch.nn.utils.rnn.pad_packed_sequ… |
CVE-2025-2997 | Medium | 6.3 | 2025-03-31 | A vulnerability was found in zhangyanbo2007 youkefu 4.2.0. It has been classified as critical. Affected is an unknown function of the file /res/url. The manipu… |
CVE-2025-31629 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob Allred Infusionsoft Web Form JavaScript infusionsof… |
CVE-2025-31627 | Medium | 5.9 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assis… |
CVE-2025-31625 | High | 7.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ramanparashar Useinfluence useinfluence allows Stored XSS… |
CVE-2025-31624 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LABCAT Processing Projects processing-projects allows DOM… |
CVE-2025-31623 | High | 7.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in richtexteditor Rich Text Editor richtexteditor allows Stored XSS.This issue affects Rich Text Editor: from n… |
CVE-2025-31621 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidpaulsson byBrick Accordion bybrick-accordion allows… |
CVE-2025-31620 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in carperfer CoverManager covermanager allows Stored XSS.Thi… |
CVE-2025-31618 | Medium | 5.3 | 2025-03-31 | Missing Authorization vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace connector-civicrm-mcrestface allows Exploiting Incorrectly Configur… |
CVE-2025-31617 | High | 7.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Cross Site Request Forgery… |
CVE-2025-31616 | High | 7.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in AdminGeekZ Varnish WordPress varnish-wp allows Cross Site Request Forgery.This issue affects Varnish WordPre… |
CVE-2025-31615 | High | 7.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in owenr88 Simple Contact Forms simple-contact-forms allows… |
CVE-2025-31614 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hiroprot Terms Before Download terms-before-download allo… |
CVE-2025-31613 | High | 7.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Aboobacker. AB Google Map Travel ab-google-map-travel allows Cross Site Request Forgery.This issue affects… |
CVE-2025-31611 | Medium | 4.3 | 2025-03-31 | Missing Authorization vulnerability in Shaharia Azam Auto Post After Image Upload auto-post-after-image-upload allows Exploiting Incorrectly Configured Access… |
CVE-2025-31610 | Medium | 5.9 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gingerplugins Notification Bar, Sticky Notification Bar… |
CVE-2025-31609 | Medium | 4.3 | 2025-03-31 | Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-31608 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reDim GmbH CookieHint WP cookiehint-wp allows Stored XSS… |
CVE-2025-31607 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flomei Simple-Audioplayer simple-audioplayer allows Store… |
CVE-2025-31606 | Medium | 4.8 | 2025-03-31 | Missing Authorization vulnerability in softpulseinfotech SP Blog Designer sp-blog-designer allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-31605 | Medium | 5.9 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WeblineIndia Welcome Popup welcome-popup allows Stored XS… |
CVE-2025-31604 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cal.com Cal.com cal-com allows Stored XSS.This issue affects Cal… |
CVE-2025-31603 | Medium | 5.4 | 2025-03-31 | Missing Authorization vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-31602 | Medium | 4.3 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Proptech Plugin Apimo Connector apimo allows Cross Site Request Forgery.This issue affects Apimo Connector… |
CVE-2025-31601 | Medium | 6.5 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in appointy Appointy Appointment Scheduler appointy-appointment-scheduler allows Cross Site Request Forgery.Thi… |
CVE-2025-31600 | Medium | 4.3 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in designnbuy DesignO designo allows Cross Site Request Forgery.This issue affects DesignO: from n/a through <=… |
CVE-2025-31598 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Quantity Dynamic Pricing & Bulk Discounts for W… |
CVE-2025-31597 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazycric Ultimate Live Cricket WordPress Lite ultimate-l… |
CVE-2025-31596 | Medium | 4.3 | 2025-03-31 | Missing Authorization vulnerability in Chatwee Chat by Chatwee chatwee allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-31595 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Timeline Event History timeline-event-history… |
CVE-2025-31593 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OpenMenu OpenMenu allows Stored XSS. This issue affects O… |
CVE-2025-31592 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo Melchiorre Send E-mail send-e-mail allows Stored XS… |
CVE-2025-31591 | Medium | 5.9 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in promoz73 Exit Popup Free exit-popup-free allows Stored XS… |
CVE-2025-31590 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denra.com WP Date and Time Shortcode wp-date-and-time-sho… |
CVE-2025-31589 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kibru Demeke Ethiopian Calendar ethiopian-calendar allows… |
CVE-2025-31588 | Medium | 5.4 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Cross Site Request Forgery.This is… |
CVE-2025-31587 | Medium | 5.9 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonia… |
CVE-2025-31586 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery – Photo Albums Plugin easy-media-gallery… |
CVE-2025-31585 | High | 7.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in leadfox Leadfox for WordPress leadfox allows Cross Site Request Forgery.This issue affects Leadfox for WordP… |
CVE-2025-31584 | Medium | 5.4 | 2025-03-31 | Missing Authorization vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-31583 | High | 7.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Ashish Ajani WP Copy Media URL wp-copy-media-url allows Stored XSS.This issue affects WP Copy Media URL: fro… |
CVE-2025-31577 | Medium | 6.6 | 2025-03-31 | Unrestricted Upload of File with Dangerous Type vulnerability in appointify Appointify appointify allows Upload a Web Shell to a Web Server.This issue affects… |
CVE-2025-31576 | Medium | 4.3 | 2025-03-31 | Missing Authorization vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Exploiting Incorrectly Configured Acce… |
CVE-2025-31575 | Medium | 5.9 | 2025-03-31 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vasilis Triantafyllou Flag Icons language-icons-flags-switcher a… |
CVE-2025-31574 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftHopper Custom Content Scrollbar custom-content-scroll… |
CVE-2025-31572 | Medium | 4.3 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in v20202020 Multi Days Events and Multi Events in One Day Calendar dragon-calendar-free-version allows Cross S… |
CVE-2025-31570 | High | 7.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in wp-buy Related Posts Widget with Thumbnails advanced-css3-related-posts-widget allows Stored XSS.This issue… |
CVE-2025-31569 | High | 7.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in wp-buy wordpress related Posts with thumbnails related-posts-list-grid-and-slider-all-in-one allows Stored X… |
CVE-2025-31567 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-add… |
CVE-2025-31566 | High | 7.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in riosisgroup Rio Video Gallery rio-video-gallery allows Stored XSS.This issue affects Rio Video Gallery: from… |
CVE-2025-31562 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-m… |
CVE-2025-31559 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caspio Bridge Custom Database Applications by Caspio cust… |
CVE-2025-31557 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MiKa OSM osm allows DOM-Based XSS.This issue affects OSM… |
CVE-2025-31556 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum all… |
CVE-2025-31555 | Medium | 5.4 | 2025-03-31 | Missing Authorization vulnerability in ContentMX ContentMX Content Publisher contentmx-content-publisher allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-31549 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Inc. Fusion fusion allows DOM-Based XSS.T… |
CVE-2025-31547 | High | 8.5 | 2025-03-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-m… |
CVE-2025-31546 | Medium | 4.3 | 2025-03-31 | Missing Authorization vulnerability in WP Messiah Swiss Toolkit For WP swiss-toolkit-for-wp allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-31545 | Medium | 5.4 | 2025-03-31 | Missing Authorization vulnerability in WP Messiah Safe Ai Malware Protection for WP safe-ai-malware-protection-for-wp allows Exploiting Incorrectly Configured… |
CVE-2025-31544 | Medium | 4.3 | 2025-03-31 | Missing Authorization vulnerability in WP Messiah Swiss Toolkit For WP swiss-toolkit-for-wp allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-31543 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twice Commerce Twice Commerce embed-rentle allows DOM-Bas… |
CVE-2025-31542 | High | 8.5 | 2025-03-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edit… |
CVE-2025-31540 | Medium | 4.3 | 2025-03-31 | Missing Authorization vulnerability in acmemediakits ACME Divi Modules acme-divi-modules allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-31539 | Medium | 6.5 | 2025-03-31 | Missing Authorization vulnerability in Blocksera Cryptocurrency Widgets Pack cryptocurrency-widgets-pack allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-31538 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in checklistcom Checklist checklist allows Stored XSS.This i… |
CVE-2025-31535 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Owl Carousel simple-owl-carousel allow… |
CVE-2025-31533 | Medium | 5.3 | 2025-03-31 | Missing Authorization vulnerability in Salesmate.io Salesmate Add-On for Gravity Forms gf-salesmate-add-on allows Accessing Functionality Not Properly Constrai… |
CVE-2025-31532 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team AtomChat AtomChat atomchat allows Stored XSS.This is… |
CVE-2025-31530 | Medium | 4.3 | 2025-03-31 | Missing Authorization vulnerability in Smackcoders Inc., Google SEO Pressor Snippet google-seo-author-snippets allows Exploiting Incorrectly Configured Access… |