2025 CVEs (page 374)
Page 374 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27574 | Low | 3.6 | 2025-03-28 | Cross-site scripting vulnerability exists in the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploi… |
CVE-2025-27567 | Medium | 5.4 | 2025-03-28 | Cross-site scripting vulnerability exists in the NickName registration screen of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited… |
CVE-2025-1705 | Medium | 6.1 | 2025-03-28 | The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incor… |
CVE-2025-2578 | Medium | 5.3 | 2025-03-28 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including… |
CVE-2025-2074 | Medium | 5.3 | 2025-03-28 | The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to generic SQL Injection via the ‘sSearch’ parameter in all versions up to, and including, 1.2… |
CVE-2025-2485 | High | 7.5 | 2025-03-28 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3… |
CVE-2025-2328 | High | 8.8 | 2025-03-28 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validatio… |
CVE-2025-31335 | Medium | 4.0 | 2025-03-28 | The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatur… |
CVE-2025-2804 | Medium | 6.1 | 2025-03-28 | The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_userna… |
CVE-2025-2027 | | 2025-03-28 | A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered by sending specially crafted local RPC… | |
CVE-2025-1762 | Medium | 4.3 | 2025-03-28 | The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers t… |
CVE-2025-2294 | Critical | 9.8 | 2025-03-28 | The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load… |
CVE-2025-2894 | Medium | 6.6 | 2025-03-28 | The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable th… |
CVE-2025-24386 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24385 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24381 | High | 8.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote… |
CVE-2025-24380 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24379 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24378 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24377 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-23383 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24383 | Critical | 9.1 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24382 | High | 7.3 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-22398 | Critical | 9.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-1860 | High | 7.7 | 2025-03-28 | Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic fun… |
CVE-2025-31092 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating… |
CVE-2025-30232 | High | 8.1 | 2025-03-28 | A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges. |
CVE-2025-31101 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vault Group Pty Ltd VaultRE Contact Form 7 allows Stored… |
CVE-2025-31031 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Job Colors for WP Job Manager wp-job-manager-c… |
CVE-2025-2888 | Medium | 4.5 | 2025-03-27 | During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, th… |
CVE-2025-2887 | Medium | 4.5 | 2025-03-27 | During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source… |
CVE-2025-2886 | Medium | 4.5 | 2025-03-27 | Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation… |
CVE-2025-2885 | Medium | 4.5 | 2025-03-27 | Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended versio… |
CVE-2025-2878 | Low | 2.4 | 2025-03-27 | A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-26956 | High | 7.6 | 2025-03-27 | Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1. |
CVE-2025-26898 | Critical | 9.3 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler.This issue affects Traveler… |
CVE-2025-26890 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-… |
CVE-2025-26874 | High | 7.1 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in memberspace MemberSpace memberspace allows Reflected XSS… |
CVE-2025-26873 | Critical | 9.0 | 2025-03-27 | Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1. |
CVE-2025-26733 | High | 8.2 | 2025-03-27 | Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1. |
CVE-2025-22740 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in Automattic Sensei LMS sensei-lms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-22739 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-30093 | High | 8.1 | 2025-03-27 | HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to bypass authorization… |
CVE-2025-29306 | Critical | 9.8 | 2025-03-27 | An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. |
CVE-2025-30367 | Critical | 9.8 | 2025-03-27 | WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /W… |
CVE-2025-30366 | Medium | 5.4 | 2025-03-27 | WeGIA is a Web manager for charitable institutions. Versions prior to 3.2.8 are vulnerable to stored cross-site scripting. This vulnerability allows unauthoriz… |
CVE-2025-30365 | Critical | 9.8 | 2025-03-27 | WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/socio/s… |
CVE-2025-30364 | Critical | 9.8 | 2025-03-27 | WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/funcion… |
CVE-2025-30363 | Medium | 5.4 | 2025-03-27 | WeGIA is a Web manager for charitable institutions. A stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.2.6. This vulnerabi… |
CVE-2025-30362 | Medium | 5.4 | 2025-03-27 | WeGIA is a Web manager for charitable institutions. A stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.2.8. This vulnerabi… |
CVE-2025-30361 | Critical | 9.8 | 2025-03-27 | WeGIA is a Web manager for charitable institutions. A security vulnerability was identified in versions prior to 3.2.6, where it is possible to change a user's… |
CVE-2025-2855 | Medium | 4.7 | 2025-03-27 | A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function checkFile of the file… |
CVE-2025-29072 | High | 7.5 | 2025-03-27 | An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could all… |
CVE-2025-28138 | Critical | 9.8 | 2025-03-27 | The TOTOLINK A800R V4.1.2cu.5137_B20200730 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the Not… |
CVE-2025-28135 | High | 7.5 | 2025-03-27 | TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi. |
CVE-2025-26909 | Critical | 9.6 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost hide-my-w… |
CVE-2025-26762 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This… |
CVE-2025-26265 | Medium | 6.5 | 2025-03-27 | A segmentation fault in openairinterface5g v2.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted UE Context Modification response. |
CVE-2025-25686 | Critical | 9.8 | 2025-03-27 | semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php. |
CVE-2025-22783 | High | 8.5 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO squirrly-seo allo… |
CVE-2025-22640 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in integrationdevpaytm Paytm Payment Donation paytm-donation… |
CVE-2025-22638 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in acowebs Product Table For WooCommerce product-table-for-w… |
CVE-2025-22637 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedia allows Cross Site Request Forgery.This issue affe… |
CVE-2025-22634 | Medium | 5.4 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in MD Abu Jubayer Hossain Easy Booked – Appointment Booking and Scheduling Management System for WordPress easy… |
CVE-2025-22629 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iNET Web… |
CVE-2025-22628 | High | 7.1 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision Filled In filled-in allows Stored XSS.This is… |
CVE-2025-22497 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bramwaas Simple Google Calendar Outlook Events Block Widg… |
CVE-2025-22496 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MarMar8x Notif Bell notif-bell allows Stored XSS.This iss… |
CVE-2025-22278 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yudleethemes Whitish Lite allows Stored XSS.This issue af… |
CVE-2025-31181 | Medium | 6.2 | 2025-03-27 | A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash. |
CVE-2025-31180 | Medium | 6.2 | 2025-03-27 | A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash. |
CVE-2025-31179 | Medium | 6.2 | 2025-03-27 | A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash. |
CVE-2025-31178 | Medium | 6.2 | 2025-03-27 | A flaw was found in gnuplot. The GetAnnotateString() function may lead to a segmentation fault and cause a system crash. |
CVE-2025-31176 | Medium | 6.2 | 2025-03-27 | A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash. |
CVE-2025-30358 | High | 8.1 | 2025-03-27 | Mesop is a Python-based UI framework that allows users to build web applications. A class pollution vulnerability in Mesop prior to version 0.14.1 allows attac… |
CVE-2025-30221 | Medium | 4.3 | 2025-03-27 | Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction… |
CVE-2025-30067 | High | 7.2 | 2025-03-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permiss… |
CVE-2025-2854 | Medium | 6.3 | 2025-03-27 | A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-2516 | | 2025-03-27 | The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovere… | |
CVE-2025-29497 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHFILLSTYLES function. |
CVE-2025-29496 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a segmentation fault via the decompileDUPLICATECLIP function. This vulnerability allows attackers to cause a Denial of… |
CVE-2025-29494 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a segmentation fault via the decompileGETMEMBER function. This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2025-29493 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a segmentation fault via the decompileGETPROPERTY function. This vulnerability allows attackers to cause a Denial of S… |
CVE-2025-29492 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a segmentation fault via the decompileSETVARIABLE function. |
CVE-2025-29491 | Medium | 6.5 | 2025-03-27 | An allocation-size-too-big error in the parseSWF_DEFINEBINARYDATA function of libming v0.48 allows attackers to cause a Denial of Service (DoS) via supplying a… |
CVE-2025-29490 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a segmentation fault via the decompileCALLMETHOD function. This vulnerability allows attackers to cause a Denial of Se… |
CVE-2025-29489 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHLINESTYLES function. |
CVE-2025-29488 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a memory leak via the parseSWF_INITACTION function. |
CVE-2025-29487 | High | 7.5 | 2025-03-27 | An out-of-memory error in the parseABC_STRING_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to allocator exhaustion. |
CVE-2025-29486 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a memory leak via the parseSWF_PLACEOBJECT3 function. |
CVE-2025-29485 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a segmentation fault via the decompileRETURN function. This vulnerability allows attackers to cause a Denial of Servic… |
CVE-2025-29484 | High | 7.5 | 2025-03-27 | An out-of-memory error in the parseABC_NS_SET_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to allocator exhaustion. |
CVE-2025-29483 | Medium | 6.5 | 2025-03-27 | libming v0.4.8 was discovered to contain a memory leak via the parseSWF_ENABLEDEBUGGER2 function. |
CVE-2025-22671 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in Leap13 Disable Elementor Editor Translation disable-elementor-editor-translation allows Exploiting Incorrectly Configure… |
CVE-2025-22670 | Medium | 6.5 | 2025-03-27 | Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-22669 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Cross Site Request Forgery.This issue affects… |
CVE-2025-22668 | Medium | 6.5 | 2025-03-27 | Missing Authorization vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-22667 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in Creative Werk Designs Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets wpsyncsheets-woocommerce… |
CVE-2025-22665 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in Shakeeb Sadikeen RapidLoad unusedcss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-22660 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wolfgang Include Mastodon Feed include-mastodon-feed allo… |