2025 CVEs (page 373)
Page 373 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2923 | Low | 3.3 | 2025-03-28 | A vulnerability, which was classified as problematic, has been found in HDF5 up to 1.14.6. Affected by this issue is the function H5F_addr_encode_len of the fi… |
CVE-2025-2922 | Low | 2.0 | 2025-03-28 | A vulnerability classified as problematic was found in Netis WF-2404 1.1.124EN. Affected by this vulnerability is an unknown functionality of the component Bus… |
CVE-2025-31164 | Medium | 6.6 | 2025-03-28 | heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline. |
CVE-2025-31163 | Medium | 6.6 | 2025-03-28 | Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_patternarc function. |
CVE-2025-31162 | Medium | 6.6 | 2025-03-28 | Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via get_slope function. |
CVE-2025-2921 | Medium | 6.4 | 2025-03-28 | A vulnerability classified as critical has been found in Netis WF-2404 1.1.124EN. Affected is an unknown function of the file /etc/passwd. The manipulation wit… |
CVE-2025-2920 | Low | 2.0 | 2025-03-28 | A vulnerability was found in Netis WF-2404 1.1.124EN. It has been rated as problematic. This issue affects some unknown processing of the file /еtc/passwd. The… |
CVE-2025-2919 | Medium | 6.8 | 2025-03-28 | A vulnerability was found in Netis WF-2404 1.1.124EN. It has been declared as critical. This vulnerability affects unknown code of the component UART. The mani… |
CVE-2025-2917 | Medium | 4.3 | 2025-03-28 | A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function readFile of the file /dev-api/cms/file/rea… |
CVE-2025-2916 | Medium | 6.3 | 2025-03-28 | A vulnerability, which was classified as critical, has been found in Aishida Call Center System up to 20250314. This issue affects some unknown processing of t… |
CVE-2025-2915 | Low | 3.3 | 2025-03-28 | A vulnerability classified as problematic was found in HDF5 up to 1.14.6. This vulnerability affects the function H5F__accum_free of the file src/H5Faccum.c. T… |
CVE-2025-2914 | Low | 3.3 | 2025-03-28 | A vulnerability classified as problematic has been found in HDF5 up to 1.14.6. This affects the function H5FS__sinfo_Srialize_Sct_cb of the file src/H5FScache… |
CVE-2025-2913 | Low | 3.3 | 2025-03-28 | A vulnerability was found in HDF5 up to 1.14.6. It has been rated as critical. Affected by this issue is the function H5FL__blk_gc_list of the file src/H5FL.c… |
CVE-2025-2912 | Low | 3.3 | 2025-03-28 | A vulnerability was found in HDF5 up to 1.14.6. It has been declared as problematic. Affected by this vulnerability is the function H5O_msg_flush of the file s… |
CVE-2025-2713 | High | 7.8 | 2025-03-28 | Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unpriv… |
CVE-2025-31010 | Medium | 4.3 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Cross Site Request Forgery.This issue affects… |
CVE-2025-30372 | Critical | 9.8 | 2025-03-28 | Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` doe… |
CVE-2025-30371 | | 2025-03-28 | Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention… | |
CVE-2025-30211 | High | 7.5 | 2025-03-28 | Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init mes… |
CVE-2025-29928 | High | 8.0 | 2025-03-28 | authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage… |
CVE-2025-22767 | High | 7.1 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Global Payments GlobalPayments WooCommerce global-payment… |
CVE-2025-22575 | High | 7.1 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendyourweb SUPER RESPONSIVE SLIDER super-slider allows… |
CVE-2025-22566 | High | 7.1 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendyourweb ULTIMATE VIDEO GALLERY ultimate-gallery all… |
CVE-2025-22526 | Critical | 9.8 | 2025-03-28 | Deserialization of Untrusted Data vulnerability in mywebtonet PHP/MySQL CPU performance statistics mywebtonet-performancestats allows Object Injection.This iss… |
CVE-2025-22523 | Critical | 9.3 | 2025-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scheduler Schedule schedule allows Blind SQL Injection.Th… |
CVE-2025-22501 | High | 7.1 | 2025-03-28 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Improve My City Improve My City improve-my-city allows Reflected… |
CVE-2025-22360 | High | 7.1 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in promact WP Azure offload wp-azure-offload allows Reflecte… |
CVE-2025-22356 | High | 7.1 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stencies Stencies stencies allows Reflected XSS.This issu… |
CVE-2025-2877 | Medium | 6.5 | 2025-03-28 | A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are expose… |
CVE-2025-2865 | Medium | 6.1 | 2025-03-28 | SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledg… |
CVE-2025-2864 | Medium | 6.1 | 2025-03-28 | SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is… |
CVE-2025-2863 | High | 7.8 | 2025-03-28 | Cross-site request forgery (CSRF) vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacke… |
CVE-2025-2862 | High | 7.5 | 2025-03-28 | SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain t… |
CVE-2025-2861 | High | 7.5 | 2025-03-28 | SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in… |
CVE-2025-2860 | Medium | 5.3 | 2025-03-28 | SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web (.xml fil… |
CVE-2025-2859 | Critical | 9.8 | 2025-03-28 | An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the… |
CVE-2025-2858 | High | 8.8 | 2025-03-28 | Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use of the nice comman… |
CVE-2025-28221 | High | 7.5 | 2025-03-28 | Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the set_local_time function, which allows remote attackers to cause web server crash via paramet… |
CVE-2025-28220 | High | 7.5 | 2025-03-28 | Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash via parameter funcp… |
CVE-2025-28219 | Critical | 9.8 | 2025-03-28 | Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usb_adv.cgi, which allows remote attackers to execute arbitrary commands via paramete… |
CVE-2025-1781 | Medium | 6.5 | 2025-03-28 | There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request fo… |
CVE-2025-0986 | Medium | 4.5 | 2025-03-28 | IBM PowerVM Hypervisor FW1050.00 through FW1050.30 and FW1060.00 through FW1060.20 could allow a local user, under certain Linux processor combability mode con… |
CVE-2025-2911 | | 2025-03-28 | Unauthorised access to the call forwarding service system in MeetMe products in versions prior to 2024-09 allows an attacker to identify multiple users and per… | |
CVE-2025-2910 | | 2025-03-28 | User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an emai… | |
CVE-2025-2909 | | 2025-03-28 | The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised acce… | |
CVE-2025-2908 | | 2025-03-28 | The exposure of credentials in the call forwarding configuration module in MeetMe products in versions prior to 2024-09 allows an attacker to gain access to so… | |
CVE-2025-31474 | Medium | 4.3 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Cross Site Request Forgery.This issue af… |
CVE-2025-31473 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimi… |
CVE-2025-31472 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michele Marri Flatty flatty-flat-admin-theme allows Store… |
CVE-2025-31471 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Falcon Solutions Duplicate Page and Post duplicate-post-a… |
CVE-2025-31470 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Page Takeover page-takeover allows Stored XSS… |
CVE-2025-31469 | Medium | 5.3 | 2025-03-28 | Missing Authorization vulnerability in webrangers Clear Sucuri Cache clear-sucuri-cache allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-31466 | High | 8.5 | 2025-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Falcon Solutions Duplicate Page and Post duplicate-post-a… |
CVE-2025-31465 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cornershop Better Section Navigation Widget better-sectio… |
CVE-2025-31464 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nazmur Rahman Text Selection Color text-selection-color a… |
CVE-2025-31463 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in preetindersodhi TGG WP Optimizer tgg-wp-optimizer allows… |
CVE-2025-31460 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in danielmuldernl OmniLeads Scripts and Tags Manager omnileads-scripts-and-tags-manager allows Stored XSS.This… |
CVE-2025-31459 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in PasqualePuzio Login Alert login-alert allows Stored XSS.This issue affects Login Alert: from n/a through <=… |
CVE-2025-31458 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in forsgren Video Embedder video-embedder allows Stored XSS.This issue affects Video Embedder: from n/a through… |
CVE-2025-31457 | Medium | 5.4 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Aurélien LWS LWS SMS lws-sms allows Cross Site Request Forgery.This issue affects LWS SMS: from n/a through… |
CVE-2025-31456 | Medium | 4.3 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in bsndev Ultimate Security Checker ultimate-security-checker allows Cross Site Request Forgery.This issue affe… |
CVE-2025-31453 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stian Andreassen YouTube SimpleGallery youtube-simplegall… |
CVE-2025-31452 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mindshare Labs, Inc. WP Ultimate Search wp-ultimate-searc… |
CVE-2025-31451 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevinweber wBounce wbounce allows Stored XSS.This issue a… |
CVE-2025-31450 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phantom.omaga Toggle Box toggle-box allows Stored XSS.Thi… |
CVE-2025-31449 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in EricH The Visitor Counter the-visitor-counter allows Stored XSS.This issue affects The Visitor Counter: from… |
CVE-2025-31448 | Medium | 5.4 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in misteraon Simple Trackback Disabler simple-trackback-disabler allows Cross Site Request Forgery.This issue a… |
CVE-2025-31447 | Medium | 5.4 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in nertworks NertWorks All in One Social Share Tools nertworks-all-in-one-social-share-tools allows Cross Site… |
CVE-2025-31444 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in youtag ShowTime Slideshow showtime-slideshow allows Stored XSS.This issue affects ShowTime Slideshow: from n… |
CVE-2025-31443 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Krzysztof Furtak KK I Like It kk-i-like-it allows Stored XSS.This issue affects KK I Like It: from n/a throu… |
CVE-2025-31440 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Team Terms of Use terms-of-use-2 allows Stored XSS.This issue affects Terms of Use: from n/a thro… |
CVE-2025-31439 | Medium | 5.4 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in tobias_.MerZ Browser Caching with .htaccess allows Cross Site Request Forgery. This issue affects Browser Ca… |
CVE-2025-31438 | Medium | 4.3 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Benoit De Boeck WP Supersized wp-supersized allows Cross Site Request Forgery.This issue affects WP Supersiz… |
CVE-2025-31437 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Miller WP-OGP wp-ogp allows Stored XSS.This issue a… |
CVE-2025-31435 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Efficient Scripts Microblog Poster microblog-poster allows Stored XSS.This issue affects Microblog Poster: f… |
CVE-2025-31434 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms formlift… |
CVE-2025-31433 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Miguel Sirvent Magic Embeds wp-embed-facebook allows Stor… |
CVE-2025-31432 | High | 7.5 | 2025-03-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Chop Chop Pop-Up Chop Chop pop-up allo… |
CVE-2025-2815 | High | 8.8 | 2025-03-28 | The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability c… |
CVE-2025-2870 | Medium | 6.1 | 2025-03-28 | Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScrip… |
CVE-2025-2869 | Medium | 6.1 | 2025-03-28 | Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScrip… |
CVE-2025-2868 | Medium | 6.1 | 2025-03-28 | Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScrip… |
CVE-2025-31102 | High | 7.1 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects… |
CVE-2025-31099 | High | 7.6 | 2025-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bestweblayout Slider by BestWebSoft slider-bws allows SQL… |
CVE-2025-31096 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue… |
CVE-2025-31094 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows S… |
CVE-2025-31093 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redpixelstudios RPS Include Content rps-include-content a… |
CVE-2025-31090 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alordiel Dropdown Multisite selector dropdown-multisite-s… |
CVE-2025-31088 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscrip… |
CVE-2025-31083 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Stored XSS.Thi… |
CVE-2025-31079 | Medium | 4.3 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in usermaven Usermaven usermaven allows Cross Site Request Forgery.This issue affects Usermaven: from n/a throu… |
CVE-2025-31077 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DO… |
CVE-2025-31076 | Medium | 4.9 | 2025-03-28 | Server-Side Request Forgery (SSRF) vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Server Side Request Forgery.This issue affects… |
CVE-2025-31075 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in videowhisper MicroPayments paid-membership allows Stored XSS.Thi… |
CVE-2025-31073 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bensibley Unlimited unlimited allows Stored XSS.This issu… |
CVE-2025-27001 | Medium | 6.5 | 2025-03-28 | Insertion of Sensitive Information Into Sent Data vulnerability in Shipmondo Shipmondo – A complete shipping solution for WooCommerce pakkelabels-for-woocommer… |
CVE-2025-27932 | High | 8.1 | 2025-03-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file deletion process of the USB storage file-sharing functi… |
CVE-2025-27726 | Low | 2.1 | 2025-03-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file download process of the USB storage file-sharing functi… |
CVE-2025-27718 | High | 8.8 | 2025-03-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file upload process of the USB storage file-sharing function… |
CVE-2025-27716 | Medium | 6.5 | 2025-03-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file/folder listing process of the USB storage file-sharing… |