2025 CVEs (page 375)
Page 375 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2860 | Medium | 5.3 | 2025-03-28 | SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web (.xml fil… |
CVE-2025-2859 | Critical | 9.8 | 2025-03-28 | An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the… |
CVE-2025-2858 | High | 8.8 | 2025-03-28 | Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use of the nice comman… |
CVE-2025-28221 | High | 7.5 | 2025-03-28 | Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the set_local_time function, which allows remote attackers to cause web server crash via paramet… |
CVE-2025-28220 | High | 7.5 | 2025-03-28 | Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash via parameter funcp… |
CVE-2025-28219 | Critical | 9.8 | 2025-03-28 | Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usb_adv.cgi, which allows remote attackers to execute arbitrary commands via paramete… |
CVE-2025-1781 | Medium | 6.5 | 2025-03-28 | There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request fo… |
CVE-2025-0986 | Medium | 4.5 | 2025-03-28 | IBM PowerVM Hypervisor FW1050.00 through FW1050.30 and FW1060.00 through FW1060.20 could allow a local user, under certain Linux processor combability mode con… |
CVE-2025-2911 | | 2025-03-28 | Unauthorised access to the call forwarding service system in MeetMe products in versions prior to 2024-09 allows an attacker to identify multiple users and per… | |
CVE-2025-2910 | | 2025-03-28 | User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an emai… | |
CVE-2025-2909 | | 2025-03-28 | The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised acce… | |
CVE-2025-2908 | | 2025-03-28 | The exposure of credentials in the call forwarding configuration module in MeetMe products in versions prior to 2024-09 allows an attacker to gain access to so… | |
CVE-2025-31474 | Medium | 4.3 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Cross Site Request Forgery.This issue af… |
CVE-2025-31473 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimi… |
CVE-2025-31472 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michele Marri Flatty flatty-flat-admin-theme allows Store… |
CVE-2025-31471 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Falcon Solutions Duplicate Page and Post duplicate-post-a… |
CVE-2025-31470 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Page Takeover page-takeover allows Stored XSS… |
CVE-2025-31469 | Medium | 5.3 | 2025-03-28 | Missing Authorization vulnerability in webrangers Clear Sucuri Cache clear-sucuri-cache allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-31466 | High | 8.5 | 2025-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Falcon Solutions Duplicate Page and Post duplicate-post-a… |
CVE-2025-31465 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cornershop Better Section Navigation Widget better-sectio… |
CVE-2025-31464 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nazmur Rahman Text Selection Color text-selection-color a… |
CVE-2025-31463 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in preetindersodhi TGG WP Optimizer tgg-wp-optimizer allows… |
CVE-2025-31460 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in danielmuldernl OmniLeads Scripts and Tags Manager omnileads-scripts-and-tags-manager allows Stored XSS.This… |
CVE-2025-31459 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in PasqualePuzio Login Alert login-alert allows Stored XSS.This issue affects Login Alert: from n/a through <=… |
CVE-2025-31458 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in forsgren Video Embedder video-embedder allows Stored XSS.This issue affects Video Embedder: from n/a through… |
CVE-2025-31457 | Medium | 5.4 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Aurélien LWS LWS SMS lws-sms allows Cross Site Request Forgery.This issue affects LWS SMS: from n/a through… |
CVE-2025-31456 | Medium | 4.3 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in bsndev Ultimate Security Checker ultimate-security-checker allows Cross Site Request Forgery.This issue affe… |
CVE-2025-31453 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stian Andreassen YouTube SimpleGallery youtube-simplegall… |
CVE-2025-31452 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mindshare Labs, Inc. WP Ultimate Search wp-ultimate-searc… |
CVE-2025-31451 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevinweber wBounce wbounce allows Stored XSS.This issue a… |
CVE-2025-31450 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phantom.omaga Toggle Box toggle-box allows Stored XSS.Thi… |
CVE-2025-31449 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in EricH The Visitor Counter the-visitor-counter allows Stored XSS.This issue affects The Visitor Counter: from… |
CVE-2025-31448 | Medium | 5.4 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in misteraon Simple Trackback Disabler simple-trackback-disabler allows Cross Site Request Forgery.This issue a… |
CVE-2025-31447 | Medium | 5.4 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in nertworks NertWorks All in One Social Share Tools nertworks-all-in-one-social-share-tools allows Cross Site… |
CVE-2025-31444 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in youtag ShowTime Slideshow showtime-slideshow allows Stored XSS.This issue affects ShowTime Slideshow: from n… |
CVE-2025-31443 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Krzysztof Furtak KK I Like It kk-i-like-it allows Stored XSS.This issue affects KK I Like It: from n/a throu… |
CVE-2025-31440 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Team Terms of Use terms-of-use-2 allows Stored XSS.This issue affects Terms of Use: from n/a thro… |
CVE-2025-31439 | Medium | 5.4 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in tobias_.MerZ Browser Caching with .htaccess allows Cross Site Request Forgery. This issue affects Browser Ca… |
CVE-2025-31438 | Medium | 4.3 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Benoit De Boeck WP Supersized wp-supersized allows Cross Site Request Forgery.This issue affects WP Supersiz… |
CVE-2025-31437 | Medium | 5.9 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Miller WP-OGP wp-ogp allows Stored XSS.This issue a… |
CVE-2025-31435 | High | 7.1 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Efficient Scripts Microblog Poster microblog-poster allows Stored XSS.This issue affects Microblog Poster: f… |
CVE-2025-31434 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms formlift… |
CVE-2025-31433 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Miguel Sirvent Magic Embeds wp-embed-facebook allows Stor… |
CVE-2025-31432 | High | 7.5 | 2025-03-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Chop Chop Pop-Up Chop Chop pop-up allo… |
CVE-2025-2815 | High | 8.8 | 2025-03-28 | The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability c… |
CVE-2025-2870 | Medium | 6.1 | 2025-03-28 | Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScrip… |
CVE-2025-2869 | Medium | 6.1 | 2025-03-28 | Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScrip… |
CVE-2025-2868 | Medium | 6.1 | 2025-03-28 | Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScrip… |
CVE-2025-31102 | High | 7.1 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects… |
CVE-2025-31099 | High | 7.6 | 2025-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bestweblayout Slider by BestWebSoft slider-bws allows SQL… |
CVE-2025-31096 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue… |
CVE-2025-31094 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows S… |
CVE-2025-31093 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redpixelstudios RPS Include Content rps-include-content a… |
CVE-2025-31090 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alordiel Dropdown Multisite selector dropdown-multisite-s… |
CVE-2025-31088 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscrip… |
CVE-2025-31083 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Stored XSS.Thi… |
CVE-2025-31079 | Medium | 4.3 | 2025-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in usermaven Usermaven usermaven allows Cross Site Request Forgery.This issue affects Usermaven: from n/a throu… |
CVE-2025-31077 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DO… |
CVE-2025-31076 | Medium | 4.9 | 2025-03-28 | Server-Side Request Forgery (SSRF) vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Server Side Request Forgery.This issue affects… |
CVE-2025-31075 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in videowhisper MicroPayments paid-membership allows Stored XSS.Thi… |
CVE-2025-31073 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bensibley Unlimited unlimited allows Stored XSS.This issu… |
CVE-2025-27001 | Medium | 6.5 | 2025-03-28 | Insertion of Sensitive Information Into Sent Data vulnerability in Shipmondo Shipmondo – A complete shipping solution for WooCommerce pakkelabels-for-woocommer… |
CVE-2025-27932 | High | 8.1 | 2025-03-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file deletion process of the USB storage file-sharing functi… |
CVE-2025-27726 | Low | 2.1 | 2025-03-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file download process of the USB storage file-sharing functi… |
CVE-2025-27718 | High | 8.8 | 2025-03-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file upload process of the USB storage file-sharing function… |
CVE-2025-27716 | Medium | 6.5 | 2025-03-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file/folder listing process of the USB storage file-sharing… |
CVE-2025-27574 | Low | 3.6 | 2025-03-28 | Cross-site scripting vulnerability exists in the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploi… |
CVE-2025-27567 | Medium | 5.4 | 2025-03-28 | Cross-site scripting vulnerability exists in the NickName registration screen of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited… |
CVE-2025-1705 | Medium | 6.1 | 2025-03-28 | The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incor… |
CVE-2025-2578 | Medium | 5.3 | 2025-03-28 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including… |
CVE-2025-2074 | Medium | 5.3 | 2025-03-28 | The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to generic SQL Injection via the ‘sSearch’ parameter in all versions up to, and including, 1.2… |
CVE-2025-2485 | High | 7.5 | 2025-03-28 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3… |
CVE-2025-2328 | High | 8.8 | 2025-03-28 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validatio… |
CVE-2025-31335 | Medium | 4.0 | 2025-03-28 | The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatur… |
CVE-2025-2804 | Medium | 6.1 | 2025-03-28 | The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_userna… |
CVE-2025-2027 | | 2025-03-28 | A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered by sending specially crafted local RPC… | |
CVE-2025-1762 | Medium | 4.3 | 2025-03-28 | The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers t… |
CVE-2025-2294 | Critical | 9.8 | 2025-03-28 | The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load… |
CVE-2025-2894 | Medium | 6.6 | 2025-03-28 | The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable th… |
CVE-2025-24386 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24385 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24381 | High | 8.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote… |
CVE-2025-24380 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24379 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24378 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24377 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-23383 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24383 | Critical | 9.1 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-24382 | High | 7.3 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-22398 | Critical | 9.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-1860 | High | 7.7 | 2025-03-28 | Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic fun… |
CVE-2025-31092 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating… |
CVE-2025-30232 | High | 8.1 | 2025-03-28 | A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges. |
CVE-2025-31101 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vault Group Pty Ltd VaultRE Contact Form 7 allows Stored… |
CVE-2025-31031 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Job Colors for WP Job Manager wp-job-manager-c… |
CVE-2025-2888 | Medium | 4.5 | 2025-03-27 | During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, th… |
CVE-2025-2887 | Medium | 4.5 | 2025-03-27 | During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source… |
CVE-2025-2886 | Medium | 4.5 | 2025-03-27 | Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation… |
CVE-2025-2885 | Medium | 4.5 | 2025-03-27 | Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended versio… |
CVE-2025-2878 | Low | 2.4 | 2025-03-27 | A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |