2025 CVEs (page 372)
Page 372 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31527 | Medium | 6.4 | 2025-03-31 | Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview wp-link-preview allows Server Side Request Forgery.This issue affects WP Link Previe… |
CVE-2025-31526 | High | 8.5 | 2025-03-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powe… |
CVE-2025-2996 | Medium | 5.3 | 2025-03-31 | A vulnerability was found in Tenda FH1202 1.2.0.14(408) and classified as critical. This issue affects some unknown processing of the file /goform/SysToolDDNS… |
CVE-2025-2995 | Medium | 5.3 | 2025-03-31 | A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. This vulnerability affects unknown code of the file /goform/SysToolCha… |
CVE-2025-29266 | Critical | 9.6 | 2025-03-31 | Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host netw… |
CVE-2025-3022 | | 2025-03-31 | Os command injection vulnerability in e-solutions e-management. This vulnerability allows an attacker to execute arbitrary commands on the server via the ‘clie… | |
CVE-2025-2994 | Medium | 5.3 | 2025-03-31 | A vulnerability, which was classified as critical, was found in Tenda FH1202 1.2.0.14(408). This affects an unknown part of the file /goform/qossetting of the… |
CVE-2025-2993 | Medium | 5.3 | 2025-03-31 | A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408). Affected by this issue is some unknown functionality of the fi… |
CVE-2025-2586 | High | 7.5 | 2025-03-31 | A flaw was found in the OpenShift Lightspeed Service, which is vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints i… |
CVE-2025-3027 | Medium | 6.1 | 2025-03-31 | The vulnerability exists in the EJBCA service, version 8.0 Enterprise. By making a small change to the PATH of the URL associated with the service, the server… |
CVE-2025-3026 | Medium | 6.1 | 2025-03-31 | The vulnerability exists in the EJBCA service, version 8.0 Enterprise. Not tested in higher versions. By modifying the ‘Host’ header in an HTTP request, it is… |
CVE-2025-3021 | | 2025-03-31 | Path Traversal vulnerability in e-solutions e-management. This vulnerability could allow an attacker to access confidential files outside the expected scope vi… | |
CVE-2025-31419 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeix Churel allows DOM-Based XSS.This issue affects Ch… |
CVE-2025-30963 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows DOM-B… |
CVE-2025-2992 | Medium | 5.3 | 2025-03-31 | A vulnerability classified as critical was found in Tenda FH1202 1.2.0.14(408). Affected by this vulnerability is an unknown functionality of the file /goform/… |
CVE-2025-2991 | Medium | 5.3 | 2025-03-31 | A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408). Affected is an unknown function of the file /goform/AdvSetWrlmacfilter of… |
CVE-2025-23995 | High | 7.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ta2g Tantyyellow allows Reflected XSS.This issue affects… |
CVE-2025-31386 | Medium | 5.3 | 2025-03-31 | Missing Authorization vulnerability in simplepress Simple:Press simplepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-31376 | Medium | 4.3 | 2025-03-31 | Missing Authorization vulnerability in Mayeenul Islam NanoSupport nanosupport allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-2990 | Medium | 5.3 | 2025-03-31 | A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the file /goform/AdvSetWr… |
CVE-2025-2989 | Medium | 5.3 | 2025-03-31 | A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects unknown code of the file /goform/AdvSetWr… |
CVE-2025-31410 | Medium | 4.3 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Ashish Ajani WP Church Donation wp-church-donation allows Cross Site Request Forgery.This issue affects WP C… |
CVE-2025-31406 | Medium | 4.3 | 2025-03-31 | Missing Authorization vulnerability in ELEXtensions ELEX WooCommerce Request a Quote elex-request-a-quote allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-30961 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tinuzz Trackserver trackserver allows DOM-Based XSS.This… |
CVE-2025-2985 | Medium | 6.3 | 2025-03-31 | A vulnerability was found in code-projects Payroll Management System 1.0. It has been classified as critical. This affects an unknown part of the file update_a… |
CVE-2025-2984 | Medium | 6.3 | 2025-03-31 | A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-2072 | | 2025-03-31 | A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attackers to inject malicious JavaScript code… | |
CVE-2025-2071 | | 2025-03-31 | A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating… | |
CVE-2025-2983 | Medium | 5.5 | 2025-03-31 | A vulnerability has been found in Legrand SMS PowerView 1.x and classified as critical. Affected by this vulnerability is an unknown functionality. The manipul… |
CVE-2025-2982 | Medium | 6.3 | 2025-03-31 | A vulnerability, which was classified as critical, was found in Legrand SMS PowerView 1.x. Affected is an unknown function. The manipulation of the argument re… |
CVE-2025-3019 | High | 7.2 | 2025-03-31 | KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web… |
CVE-2025-2981 | Low | 3.5 | 2025-03-31 | A vulnerability, which was classified as problematic, has been found in Legrand SMS PowerView 1.x. This issue affects some unknown processing. The manipulation… |
CVE-2025-2980 | Low | 3.5 | 2025-03-31 | A vulnerability classified as problematic was found in Legrand SMS PowerView 1.x. This vulnerability affects unknown code. The manipulation of the argument red… |
CVE-2025-2402 | High | 8.6 | 2025-03-31 | A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated rem… |
CVE-2025-31417 | Medium | 4.3 | 2025-03-31 | Missing Authorization vulnerability in Fahad Mahmood WP Docs wp-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-31414 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder… |
CVE-2025-31412 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery jet-woo-product-gallery allo… |
CVE-2025-31387 | High | 7.5 | 2025-03-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InstaWP InstaWP Connect instawp-connec… |
CVE-2025-31043 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This… |
CVE-2025-31016 | High | 7.5 | 2025-03-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetWooBuilder jet-woo-build… |
CVE-2025-30987 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stor… |
CVE-2025-30855 | High | 7.5 | 2025-03-31 | Missing Authorization vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-30835 | High | 7.5 | 2025-03-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bastien Ho Accounting for WooCommerce… |
CVE-2025-2979 | Low | 2.4 | 2025-03-31 | A vulnerability classified as problematic has been found in WCMS 11. This affects an unknown part of the file /index.php?anonymous/setregister of the component… |
CVE-2025-2978 | Medium | 6.3 | 2025-03-31 | A vulnerability was found in WCMS 11. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?articleadmin/u… |
CVE-2025-0613 | Medium | 6.1 | 2025-03-31 | The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unaut… |
CVE-2025-31103 | High | 7.5 | 2025-03-31 | Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the pro… |
CVE-2025-2977 | Low | 3.5 | 2025-03-31 | A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2025-2976 | Low | 3.5 | 2025-03-31 | A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the component File Upload. The… |
CVE-2025-26689 | Critical | 9.8 | 2025-03-31 | Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request… |
CVE-2025-25211 | Critical | 9.8 | 2025-03-31 | Weak password requirements issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a brute-force attack may allow an attac… |
CVE-2025-24852 | Medium | 4.6 | 2025-03-31 | Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, an attacker who can acce… |
CVE-2025-24517 | High | 7.5 | 2025-03-31 | Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a remote attacker may obtain the… |
CVE-2025-3014 | | 2025-03-31 | Insecure Direct Object References (IDOR) in access control in Tracking 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating req… | |
CVE-2025-3013 | | 2025-03-31 | Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf Penetration Testing allows an attacker to access via ma… | |
CVE-2025-3011 | Critical | 9.8 | 2025-03-31 | SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and dele… |
CVE-2025-2975 | Low | 3.5 | 2025-03-31 | A vulnerability was found in GFI KerioConnect 10.0.6 and classified as problematic. This issue affects some unknown processing of the file Settings/Email/Signa… |
CVE-2025-2974 | Low | 3.5 | 2025-03-31 | A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code of the file /contrac… |
CVE-2025-2973 | Medium | 6.3 | 2025-03-31 | A vulnerability, which was classified as critical, was found in code-projects College Management System 1.0. This affects an unknown part of the file /Admin/st… |
CVE-2025-1268 | Critical | 9.4 | 2025-03-31 | Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driv… |
CVE-2025-2961 | Medium | 4.3 | 2025-03-30 | A vulnerability classified as problematic was found in opensolon up to 3.1.0. This vulnerability affects the function render_mav of the file /aa of the compone… |
CVE-2025-2960 | Medium | 6.5 | 2025-03-30 | A vulnerability classified as problematic has been found in TRENDnet TEW-637AP and TEW-638APB 1.2.7/1.3.0.106. This affects the function sub_41DED0 of the file… |
CVE-2025-2959 | Medium | 6.5 | 2025-03-30 | A vulnerability was found in TRENDnet TEW-410APB 1.3.06b. It has been rated as problematic. Affected by this issue is the function sub_4019A0 of the file /usr/… |
CVE-2025-2958 | Medium | 6.5 | 2025-03-30 | A vulnerability was found in TRENDnet TEW-818DRU 1.0.14.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-2957 | Medium | 6.5 | 2025-03-30 | A vulnerability was found in TRENDnet TEW-411BRP+ 2.07. It has been classified as problematic. Affected is the function sub_401DB0 of the file /usr/sbin/httpd… |
CVE-2025-2956 | Medium | 6.5 | 2025-03-30 | A vulnerability was found in TRENDnet TI-G102i 1.0.7.S0_ /1.0.8.S0_ and classified as problematic. This issue affects the function plugins_call_handle_uri_raw… |
CVE-2025-2955 | Medium | 5.3 | 2025-03-30 | A vulnerability has been found in TOTOLINK A3000RU up to 5.9c.5185 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/… |
CVE-2025-2954 | Low | 3.3 | 2025-03-30 | A vulnerability, which was classified as problematic, was found in mannaandpoem OpenManus up to 2025.3.13. This affects the function execute of the file app/to… |
CVE-2025-2953 | Low | 3.3 | 2025-03-30 | A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. Th… |
CVE-2025-2952 | Medium | 6.3 | 2025-03-30 | A vulnerability classified as critical was found in Bluestar Micro Mall 1.0. Affected by this vulnerability is an unknown functionality of the file /api/api.ph… |
CVE-2025-2951 | Medium | 6.3 | 2025-03-30 | A vulnerability classified as critical has been found in Bluestar Micro Mall 1.0. Affected is an unknown function of the file /api/data.php. The manipulation o… |
CVE-2025-1861 | Critical | 9.8 | 2025-03-30 | In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an… |
CVE-2025-1736 | High | 7.3 | 2025-03-30 | In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insuffic… |
CVE-2025-1734 | Medium | 5.3 | 2025-03-30 | In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the head… |
CVE-2025-1219 | Medium | 5.3 | 2025-03-30 | In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or… |
CVE-2025-2840 | Medium | 5.3 | 2025-03-29 | The DAP to Autoresponders Email Syncing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0 through… |
CVE-2025-2803 | High | 7.3 | 2025-03-29 | The So-Called Air Quotes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.1. This is due to the soft… |
CVE-2025-2266 | Critical | 9.8 | 2025-03-29 | The Checkout Mestres do WP for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to… |
CVE-2025-2249 | High | 8.8 | 2025-03-29 | The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_options_subpanel()… |
CVE-2025-2006 | High | 8.8 | 2025-03-29 | The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the file uploading… |
CVE-2025-1217 | Low | 3.1 | 2025-03-29 | In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obt… |
CVE-2025-2782 | | 2025-03-28 | The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow… | |
CVE-2025-2781 | | 2025-03-28 | The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. This could al… | |
CVE-2025-28097 | Medium | 5.5 | 2025-03-28 | OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers. |
CVE-2025-28096 | Medium | 5.4 | 2025-03-28 | OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers. |
CVE-2025-28094 | Medium | 6.5 | 2025-03-28 | shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places. |
CVE-2025-28093 | Medium | 6.3 | 2025-03-28 | ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings. |
CVE-2025-28092 | Medium | 6.3 | 2025-03-28 | ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function. |
CVE-2025-28091 | Critical | 9.1 | 2025-03-28 | maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article. |
CVE-2025-28090 | Critical | 9.1 | 2025-03-28 | maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature. |
CVE-2025-28089 | Critical | 9.1 | 2025-03-28 | maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function. |
CVE-2025-28087 | Critical | 9.8 | 2025-03-28 | Sourcecodester Online Exam System 1.0 is vulnerable to SQL Injection via dash.php. |
CVE-2025-25579 | Critical | 9.8 | 2025-03-28 | TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. |
CVE-2025-2927 | High | 7.3 | 2025-03-28 | A vulnerability was found in ESAFENET CDG 5.6.3.154.205. It has been classified as critical. Affected is an unknown function of the file /parameter/getFileType… |
CVE-2025-28256 | Critical | 9.8 | 2025-03-28 | An issue in TOTOLINK A3100R V4.1.2cu.5247_B20211129 allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /lib/cste_modules/wire… |
CVE-2025-28254 | Medium | 5.4 | 2025-03-28 | Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information vi… |
CVE-2025-22953 | Critical | 9.8 | 2025-03-28 | A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The inje… |
CVE-2025-2926 | Low | 3.3 | 2025-03-28 | A vulnerability was found in HDF5 up to 1.14.6 and classified as problematic. This issue affects the function H5O__cache_chk_serialize of the file src/H5Ocache… |
CVE-2025-2925 | Low | 3.3 | 2025-03-28 | A vulnerability has been found in HDF5 up to 1.14.6 and classified as problematic. This vulnerability affects the function H5MM_realloc of the file src/H5MM.c… |
CVE-2025-2924 | Low | 3.3 | 2025-03-28 | A vulnerability, which was classified as problematic, was found in HDF5 up to 1.14.6. This affects the function H5HL__fl_deserialize of the file src/H5HLcache… |