2025 CVEs (page 377)
Page 377 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2849 | Low | 3.3 | 2025-03-27 | A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::un_DT_INIT of the file src/p_lx_el… |
CVE-2025-27793 | | 2025-03-27 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, cor… | |
CVE-2025-26738 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Graham Quick Interest Slider quick-interest-slider allows… |
CVE-2025-26737 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yudleethemes City Store allows DOM-Based XSS.This issue a… |
CVE-2025-26736 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in victortihai MorningTime Lite morningtime-lite allows Stor… |
CVE-2025-26734 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peregrinethemes Hester hester allows Stored XSS.This issu… |
CVE-2025-26732 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware StoreBiz storebiz allows DOM-Based XSS.Thi… |
CVE-2025-26731 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Stored XSS.This… |
CVE-2025-26619 | Medium | 6.1 | 2025-03-27 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In `vega` 5.30.0 and lower and in `v… |
CVE-2025-25100 | High | 7.1 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in victoracano Cazamba cazamba allows Reflected XSS.This issue affects Cazamba: from n/a through <= 1.2. |
CVE-2025-25086 | High | 7.1 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Secret Meta facebook-secret-meta allows Reflected XSS.This issue affects Secret Meta: from n/a t… |
CVE-2025-22816 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetrendy Power Mag power-mag allows DOM-Based XSS.This… |
CVE-2025-22770 | Medium | 5.4 | 2025-03-27 | Missing Authorization vulnerability in EnvoThemes Envo Multipurpose allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-22673 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in WPFactory EAN for WooCommerce ean-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-22672 | Medium | 4.9 | 2025-03-27 | Server-Side Request Forgery (SSRF) vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Server Side Reque… |
CVE-2025-21871 | Medium | 5.5 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix supplicant wait loop OP-TEE supplicant is a user-space daemon and it's po… |
CVE-2025-21870 | High | 7.8 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers Other, non DAI copier w… |
CVE-2025-21869 | High | 7.8 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: powerpc/code-patching: Disable KASAN report during patching via temporary mm Erhard repor… |
CVE-2025-21868 | High | 7.5 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: net: allow small head cache usage with large MAX_SKB_FRAGS values Sabrina reported the fo… |
CVE-2025-21867 | High | 7.8 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN reported a use-after-… |
CVE-2025-2847 | Medium | 6.3 | 2025-03-27 | A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. This issue affects some unknown processing of the file… |
CVE-2025-2846 | High | 7.3 | 2025-03-27 | A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. This vulnerability affects the function registration of the file /o… |
CVE-2025-2255 | High | 8.7 | 2025-03-27 | An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain… |
CVE-2025-2242 | High | 7.5 | 2025-03-27 | An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 all… |
CVE-2025-0811 | High | 8.7 | 2025-03-27 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering o… |
CVE-2025-31141 | Low | 2.7 | 2025-03-27 | In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page |
CVE-2025-31140 | Medium | 4.6 | 2025-03-27 | In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page |
CVE-2025-31139 | Medium | 4.3 | 2025-03-27 | In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log |
CVE-2025-30925 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows… |
CVE-2025-30923 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in powerfulwp Gift Message for WooCommerce gift-message-for-woocommerce allows Cross Site Request Forgery.This… |
CVE-2025-30922 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simplebooklet Simplebooklet PDF Viewer and Embedder simpl… |
CVE-2025-30921 | High | 7.6 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQ… |
CVE-2025-30920 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows S… |
CVE-2025-30919 | High | 7.1 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Store Locator Widgets Store Locator Widget store-locator-widget allows Stored XSS.This issue affects Store L… |
CVE-2025-30918 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme Structured Content structured-content allows… |
CVE-2025-30914 | Medium | 4.4 | 2025-03-27 | Server-Side Request Forgery (SSRF) vulnerability in Roxnor Metform metform allows Server Side Request Forgery.This issue affects Metform: from n/a through <= 3… |
CVE-2025-30912 | Medium | 5.4 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Float menu float-menu allows Cross Site Request Forgery.This issue affects Float menu: from n/a… |
CVE-2025-30909 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-30907 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SecuPress SecuPress Free secupress allows DOM-Based XSS.T… |
CVE-2025-30904 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Chartify chart-builder allows Stored XSS.This iss… |
CVE-2025-30903 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Mills SyntaxHighlighter Evolved syntaxhighlighter al… |
CVE-2025-30900 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing – Embed Payment Form allo… |
CVE-2025-30899 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Stor… |
CVE-2025-30898 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahdi Yousefi [MahdiY] افزونه حمل و نقل ووکامرس (پست پیشت… |
CVE-2025-30897 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-30896 | Medium | 5.4 | 2025-03-27 | Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: fro… |
CVE-2025-30895 | High | 7.5 | 2025-03-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in magepeopleteam WpEvently mage-eventpress allows PHP Local File… |
CVE-2025-30894 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-30893 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeadConnector LeadConnector leadconnector allows DOM-Base… |
CVE-2025-30891 | High | 8.8 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpTravelly tour-booking… |
CVE-2025-30890 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SuitePlugins Login Widget for Ultimate… |
CVE-2025-30888 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Custom Fields Account Registration For Woocommerce custom-fields-account-registration-for-w… |
CVE-2025-30887 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-30885 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Form bit-form allows Phishing.This issue affects Bit Form: from n/a through <… |
CVE-2025-30884 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Integrations bit-integrations allows Phishing.This issue affects Bit Integrat… |
CVE-2025-30883 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in richplugins Trust.Reviews fb-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-30881 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in themehunk Big Store big-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-30879 | High | 7.6 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-f… |
CVE-2025-30877 | Low | 2.7 | 2025-03-27 | Missing Authorization vulnerability in fatcatapps Quiz Cat quiz-cat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-30874 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in Jose Mortellaro Specific Content For Mobile specific-content-for-mobile allows Exploiting Incorrectly Configured Access… |
CVE-2025-30873 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-b… |
CVE-2025-30872 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Nitin Prakash Product Author for WooCommerce wc-product-author allows Cross Site Request Forgery.This issue… |
CVE-2025-30871 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-t… |
CVE-2025-30868 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Maidul Team Manager wp-team-manager al… |
CVE-2025-30867 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SearchIQ SearchIQ searchiq allows Stored XSS.This issue a… |
CVE-2025-30866 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in Giannis Kipouros Terms & Conditions Per Product terms-and-conditions-per-product allows Exploiting Incorrectly Configure… |
CVE-2025-30865 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in fuzzoid 3DPrint Lite 3dprint-lite allows Cross Site Request Forgery.This issue affects 3DPrint Lite: from n/… |
CVE-2025-30864 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in falselight Exchange Rates exchange-rates allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-30863 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms integration-for-… |
CVE-2025-30862 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in sminozzi reCAPTCHA for all recaptcha-for-all allows Cross Site Request Forgery.This issue affects reCAPTCHA… |
CVE-2025-30861 | Medium | 4.9 | 2025-03-27 | Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-30860 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off… |
CVE-2025-30859 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in guru-aliexpress AliNext ali2woo-lite allows Phishing.This issue affects AliNext: from n/a… |
CVE-2025-30857 | High | 7.1 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in PressMaximum Currency Switcher for WooCommerce currency-switcher-for-woocommerce allows Stored XSS.This issu… |
CVE-2025-30856 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in theme funda Custom Field For WP Job Manager custom-field-for-wp-job-manager allows Cross Site Request Forger… |
CVE-2025-30854 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator… |
CVE-2025-30851 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-30850 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sfaerber Dr. Flex dr-flex allows Stored XSS.This issue af… |
CVE-2025-30847 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashley Novelist novelist allows Stored XSS.This issue aff… |
CVE-2025-30846 | High | 8.8 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jetmonsters Restaurant Menu by MotoPre… |
CVE-2025-30845 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in webangon The Pack Elementor addons the… |
CVE-2025-30843 | High | 7.6 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in setriosoft bizcalendar-web bizcalendar-web allows SQL Inj… |
CVE-2025-30842 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in pixolette Christmas Panda christmas-panda allows Cross Site Request Forgery.This issue affects Christmas Pan… |
CVE-2025-30839 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured A… |
CVE-2025-30838 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This… |
CVE-2025-30836 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LatePoint LatePoint latepoint allows Stored XSS.This issu… |
CVE-2025-30833 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through… |
CVE-2025-30832 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows DO… |
CVE-2025-30831 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Event Post themify-e… |
CVE-2025-30830 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in Hossni Mubarak Cool Author Box hm-cool-author-box-widget allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-30829 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics WPCafe wp-cafe allows PHP Lo… |
CVE-2025-30828 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects T… |
CVE-2025-30826 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy IP Locator ip-locator allows DOM-Based XSS… |
CVE-2025-30824 | Medium | 5.4 | 2025-03-27 | Missing Authorization vulnerability in Israpil Textmetrics webtexttool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-30823 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Boone Gorges Anthologize anthologize allows Cross Site Request Forgery.This issue affects Anthologize: from… |
CVE-2025-30822 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Hakik Zaman Custom Login Logo ideal-wp-login-logo-changer allows Cross Site Request Forgery.This issue affec… |
CVE-2025-30821 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in otacke SNORDIAN's H5PxAPIkatchu h5pxapikatchu allows Accessing Functionality Not Properly Constrained by ACLs.This issue… |
CVE-2025-30820 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins WishSuite wishsuite allows… |
CVE-2025-30819 | High | 8.5 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Igor Benic Simple Giveaways giveasap allows SQL Injection… |
CVE-2025-30818 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows DOM-Based XSS.Th… |