2025 CVEs (page 377)
Page 377 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31160 | Low | 2.9 | 2025-03-26 | atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecified other impact by… |
CVE-2025-2787 | High | 8.8 | 2025-03-26 | KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the wo… |
CVE-2025-30073 | High | 7.5 | 2025-03-26 | An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to transactions can be reused. When completing a payment, the first… |
CVE-2025-28361 | High | 7.5 | 2025-03-26 | Unauthorized stack overflow vulnerability in Telesquare TLR-2005KSH v.1.1.4 allows a remote attacker to obtain sensitive information via the systemutil.cgi com… |
CVE-2025-26011 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setUsernamePassword. |
CVE-2025-26010 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting the admin.cgi parameter with setUserNamePassword. |
CVE-2025-26009 | High | 7.5 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 has an Information Disclosure vulnerability when requesting systemutilit.cgi. |
CVE-2025-26008 | Critical | 9.8 | 2025-03-26 | In Telesquare TLR-2005KSH 1.1.4, an unauthorized stack overflow vulnerability exists when requesting admin.cgi parameter with setSyncTimeHost. |
CVE-2025-26007 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability in the login interface when requesting systemtil.cgi. |
CVE-2025-26006 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setAutorest. |
CVE-2025-26005 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack overflow vulnerability when requesting admin.cgi parameter with setNtp. |
CVE-2025-29322 | Medium | 4.6 | 2025-03-26 | A cross-site scripting (XSS) vulnerability in ScriptCase before v1.0.003 - Build 3 allows attackers to execute arbitrary code via a crafted payload to the "Con… |
CVE-2025-26004 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack buffer overflow vulnerability when requesting admin.cgi parameter with setDdns. |
CVE-2025-26003 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with setAutorest. |
CVE-2025-26002 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyncTimeHost. |
CVE-2025-26001 | High | 7.5 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 is vulnerable to Information Disclosure via the parameter getUserNamePassword. |
CVE-2025-25535 | Critical | 9.8 | 2025-03-26 | HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request. |
CVE-2025-30353 | High | 8.6 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "… |
CVE-2025-30352 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the `search` qu… |
CVE-2025-30351 | Low | 3.5 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can… |
CVE-2025-2600 | Medium | 6.8 | 2025-03-26 | Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD var… |
CVE-2025-2562 | Medium | 5.4 | 2025-03-26 | Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without g… |
CVE-2025-2528 | Low | 3.6 | 2025-03-26 | Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration dif… |
CVE-2025-2499 | Medium | 5.4 | 2025-03-26 | Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to… |
CVE-2025-30350 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior… |
CVE-2025-30225 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior… |
CVE-2025-30217 | High | 7.5 | 2025-03-26 | Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework… |
CVE-2025-30164 | Medium | 4.1 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerab… |
CVE-2025-27609 | Medium | 5.4 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows a… |
CVE-2025-2783 | High | 8.3 | 2025-03-26 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandb… |
CVE-2025-2098 | | 2025-03-26 | Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security p… | |
CVE-2025-27406 | High | 7.6 | 2025-03-26 | Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability presen… |
CVE-2025-27405 | High | 7.6 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows a… |
CVE-2025-30524 | Critical | 9.3 | 2025-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog displayproduct allows SQL Inje… |
CVE-2025-2820 | Medium | 6.5 | 2025-03-26 | An authenticated attacker can compromise the availability of the device via the network |
CVE-2025-2819 | Medium | 6.6 | 2025-03-26 | There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This… |
CVE-2025-28942 | Critical | 9.3 | 2025-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Trust Payments Trust Payments Gateway for WooCommerce tru… |
CVE-2025-28939 | High | 8.5 | 2025-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in EuroCizia WP Google Calendar Manager wp-gcalendar allows… |
CVE-2025-28935 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Fancybox Plus fancybox-plus allows Reflected XSS.T… |
CVE-2025-28934 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaozh Simple Post Series simple-post-series allows Refle… |
CVE-2025-28928 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Are you robot google recaptcha for wordpress ar… |
CVE-2025-28924 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simbul ZenphotoPress zenphotopress allows Reflected XSS.T… |
CVE-2025-28921 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in homejunction SpatialMatch IDX spatialmatch-free-lifestyle… |
CVE-2025-28917 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazyloong Custom Smilies custom-smilies-se allows Stored… |
CVE-2025-28916 | Critical | 9.8 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rashid Docpro docpro allows PHP Local… |
CVE-2025-28911 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gravity2pdf Gravity 2 PDF gf2pdf allows Reflected XSS.Thi… |
CVE-2025-28903 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hectorgarrofe Driving Directions ddirections allows Refle… |
CVE-2025-28899 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toddhuish WP Event Ticketing wpeventticketing allows Refl… |
CVE-2025-28898 | Critical | 9.3 | 2025-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator… |
CVE-2025-28893 | Critical | 9.9 | 2025-03-26 | Improper Control of Generation of Code ('Code Injection') vulnerability in Govind Visual Text Editor visual-text-editor allows Remote Code Inclusion.This issue… |
CVE-2025-28890 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Lightview Plus lightview-plus allows Reflected XSS… |
CVE-2025-28889 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in starblank Custom Product Stickers for Woocommerce custom-… |
CVE-2025-28885 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fiverraffiliates Fiverr.com Official Search Box fiverr-of… |
CVE-2025-28882 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omnify, Inc. Omnify omnify-widget allows Reflected XSS.Th… |
CVE-2025-28880 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jotis Blue Captcha blue-captcha allows Reflected XSS.This… |
CVE-2025-28877 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in m.tiggelaar Key4ce osTicket Bridge key4ce-osticket-bridge… |
CVE-2025-28873 | High | 8.5 | 2025-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Scott Taylor Shuffle shuffle allows Blind SQL Injection.T… |
CVE-2025-28869 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shauno NextGEN Gallery Voting nextgen-gallery-voting allo… |
CVE-2025-28865 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lionelroux WP Colorful Tag Cloud wp-colorful-tag-cloud al… |
CVE-2025-28858 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Maps ap-google-maps allows Reflected… |
CVE-2025-28855 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in srcoley Teleport teleport allows Reflected XSS.This issue… |
CVE-2025-27404 | High | 7.6 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows a… |
CVE-2025-27267 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in srcoley Random Quotes random-quotes allows Reflected XSS… |
CVE-2025-27015 | High | 7.5 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designingmedia Hostiko hostiko allows… |
CVE-2025-27014 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designingmedia Hostiko hostiko allows Reflected XSS.This… |
CVE-2025-26986 | High | 8.1 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Pearl - Corporate Busin… |
CVE-2025-26941 | Critical | 9.3 | 2025-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin allows SQL Injection… |
CVE-2025-26929 | Medium | 5.9 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Accounting for WooCommerce accounting-for-wooc… |
CVE-2025-26923 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This i… |
CVE-2025-26922 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techthemes AuraMart auramart allows Stored XSS.This issue… |
CVE-2025-26869 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Build allows Stored XSS.This issue affects Build: from n/… |
CVE-2025-26747 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 99colorthemes RainbowNews allows Stored XSS.This issue af… |
CVE-2025-26739 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefunction newseqo allows Stored XSS.This issue affect… |
CVE-2025-26584 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Travis Ballard TBTestimonials tb-testimonials allows Refl… |
CVE-2025-26583 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper Video Share VOD video-share-vod allows Refle… |
CVE-2025-26581 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper Picture Gallery picture-gallery allows Refle… |
CVE-2025-26579 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper MicroPayments paid-membership allows Reflect… |
CVE-2025-26576 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in takumin WP Simple Slideshow wp-simple-slideshow allows Re… |
CVE-2025-26575 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Maurer Display Post Meta display-post-meta allows Re… |
CVE-2025-26573 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JamRizzi Technologies Rizzi Guestbook rizzi-guestbook all… |
CVE-2025-26566 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frank In Stock Mailer for WooCommerce in-stock-mailer-for… |
CVE-2025-26565 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kagla GNUPress gnupress allows Reflected XSS.This issue a… |
CVE-2025-26564 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kagla GNUCommerce gnucommerce allows Reflected XSS.This i… |
CVE-2025-26560 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KKWangen WP Contact Form III wp-contact-form-iii allows R… |
CVE-2025-26559 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor Secure Invites wordpress-mu-secure-invites a… |
CVE-2025-26546 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelpro Cookies Pro cookies-pro allows Reflected XSS.Thi… |
CVE-2025-26544 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max K UTM tags tracking for Contact Form 7 cf7-utm-tracki… |
CVE-2025-26542 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dang Ngoc Binh Zalo Live Chat zalo-live-chat allows Refle… |
CVE-2025-26541 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerc… |
CVE-2025-26537 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rolomak GDPR Tools gdpr-tools allows Stored XSS.This issu… |
CVE-2025-26536 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yendif Player Another Events Calendar another-events-cale… |
CVE-2025-25134 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zenverse Theme Demo Bar wordpress-theme-demo-bar allows R… |
CVE-2025-24972 | Medium | 4.3 | 2025-03-26 | Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumsta… |
CVE-2025-24690 | High | 8.1 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality all… |
CVE-2025-23964 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ajitae Google Plus google-plus-google allows Reflected XS… |
CVE-2025-23952 | High | 8.1 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ntm custom-field-list-widget custom-fi… |
CVE-2025-23937 | High | 8.1 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Furr LinkedIn Lite linkedin-lite… |
CVE-2025-23735 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cosmin Schiopu Infugrator infugrator allows Reflected XSS… |
CVE-2025-23728 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in atelierhyper AuMenu aumenu allows Reflected XSS.This issu… |
CVE-2025-23714 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in podspod AppReview appreview allows Reflected XSS.This iss… |