2025 CVEs (page 378)
Page 378 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-23704 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Reuven Karasik Your Lightbox your-lightbox allows Reflect… |
CVE-2025-23680 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Narnoo Narnoo Operator narnoo-shortcodes allows Reflected… |
CVE-2025-23666 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cxc-sawa Management-screen-droptiles cxc-sawa allows Refl… |
CVE-2025-23638 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Umesh Ghimire Frontend Post Submission frontend-post-subm… |
CVE-2025-23633 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khanhtruong WP Database Audit database-audit allows Refle… |
CVE-2025-23632 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhizome Networks CG Button content-glass-button allows Re… |
CVE-2025-23612 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixobe Pixobe Cartography pixobe-cartography allows Refle… |
CVE-2025-23546 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert D Payne RDP inGroups+ rdp-ingroups allows Reflecte… |
CVE-2025-23543 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fomopay FOMO Pay Chinese Payment Solution fomo-payment-ga… |
CVE-2025-23542 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert D Payne RDP Linkedin Login rdp-linkedin-login allo… |
CVE-2025-23466 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsiteeditor Site Editor Google Map site-editor-google-ma… |
CVE-2025-23460 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rhizomaticweb RWS Enquiry And Lead Follow-up rws-enquiry… |
CVE-2025-23459 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NsThemes NS Simple Intro Loader ns-simple-intro-loader al… |
CVE-2025-22283 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riyaz GetSocial getsocial allows Reflected XSS.This issue… |
CVE-2025-24808 | Medium | 4.3 | 2025-03-26 | Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, someone who is about… |
CVE-2025-23203 | Medium | 5.5 | 2025-03-26 | Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.4 and 1.11.4 on severa… |
CVE-2025-2228 | Medium | 5.7 | 2025-03-26 | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive Information Exposure… |
CVE-2025-2110 | High | 8.8 | 2025-03-26 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to mis… |
CVE-2025-1913 | High | 7.2 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, a… |
CVE-2025-1912 | High | 7.6 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions u… |
CVE-2025-1911 | Low | 2.7 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f… |
CVE-2025-1769 | Medium | 4.9 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, an… |
CVE-2025-1312 | Medium | 6.4 | 2025-03-26 | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor’ parameter in all vers… |
CVE-2025-2596 | Medium | 5.3 | 2025-03-26 | Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL) |
CVE-2025-27552 | Medium | 4.0 | 2025-03-26 | DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with progr… |
CVE-2025-27551 | Medium | 4.0 | 2025-03-26 | DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with progr… |
CVE-2025-1542 | | 2025-03-26 | Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivileged account to gain… | |
CVE-2025-1703 | Medium | 6.4 | 2025-03-26 | The Ultimate Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 3.2.7 d… |
CVE-2025-1440 | Medium | 5.3 | 2025-03-26 | The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up… |
CVE-2025-1439 | Medium | 6.4 | 2025-03-26 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and i… |
CVE-2025-1437 | Medium | 6.4 | 2025-03-26 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and i… |
CVE-2025-1310 | Medium | 6.5 | 2025-03-26 | The Jobs for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.11 via the 'job_postings_get_file' p… |
CVE-2025-2257 | High | 7.2 | 2025-03-26 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to… |
CVE-2025-2167 | Medium | 5.4 | 2025-03-26 | The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list' shortcodes in all versions up to, and including… |
CVE-2025-2009 | High | 7.2 | 2025-03-26 | The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logging functionality in all versions up to, and including, 4.9.9.7 d… |
CVE-2025-1514 | High | 7.3 | 2025-03-26 | The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insuffici… |
CVE-2025-1784 | Medium | 6.4 | 2025-03-26 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb block in all versions up to, and includ… |
CVE-2025-30742 | Medium | 5.3 | 2025-03-26 | httpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not have a final '\0' cha… |
CVE-2025-2576 | Medium | 6.4 | 2025-03-26 | The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ… |
CVE-2025-2573 | Medium | 6.4 | 2025-03-26 | The Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG F… |
CVE-2025-2165 | Medium | 6.1 | 2025-03-26 | The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due t… |
CVE-2025-1490 | Medium | 6.1 | 2025-03-26 | The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and includ… |
CVE-2025-2302 | Medium | 6.4 | 2025-03-26 | The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aws_search_terms shortcode in all versions up to, an… |
CVE-2025-2276 | Medium | 4.3 | 2025-03-26 | The Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2025-30222 | | 2025-03-25 | Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows wit… | |
CVE-2025-30219 | Medium | 6.1 | 2025-03-25 | RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and… |
CVE-2025-30741 | Medium | 4.3 | 2025-03-25 | Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse… |
CVE-2025-29789 | High | 7.5 | 2025-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.3.0 are vulnerable to Directory Tr… |
CVE-2025-27837 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for… |
CVE-2025-27836 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c. |
CVE-2025-27835 | High | 7.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c. |
CVE-2025-27834 | High | 7.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c. |
CVE-2025-27833 | High | 7.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c. |
CVE-2025-27832 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c. |
CVE-2025-27831 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/d… |
CVE-2025-27830 | High | 7.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and… |
CVE-2025-25374 | High | 7.5 | 2025-03-25 | In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causin… |
CVE-2025-25373 | Critical | 9.8 | 2025-03-25 | The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform. |
CVE-2025-25372 | High | 7.5 | 2025-03-25 | NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module. |
CVE-2025-25371 | High | 7.5 | 2025-03-25 | NASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing the override of any arbitrary file on the system. |
CVE-2025-30216 | Critical | 9.4 | 2025-03-25 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-30118 | High | 7.5 | 2025-03-25 | An issue was discovered on the Audi Universal Traffic Recorder 2.88. It has Susceptibility to denial of service. It uses the same default credentials for all d… |
CVE-2025-30567 | High | 7.5 | 2025-03-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP01 WP01 wp01 allows Path Traversal.This issue affects WP01: f… |
CVE-2025-28904 | Critical | 9.3 | 2025-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shamalli Web Directory Free web-directory-free allows Bli… |
CVE-2025-2312 | Medium | 5.9 | 2025-03-25 | A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong na… |
CVE-2025-30214 | High | 7.5 | 2025-03-25 | Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that coul… |
CVE-2025-30213 | High | 8.8 | 2025-03-25 | Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way t… |
CVE-2025-30212 | High | 7.5 | 2025-03-25 | Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0… |
CVE-2025-2532 | High | 7.8 | 2025-03-25 | Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af… |
CVE-2025-2531 | High | 7.8 | 2025-03-25 | Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2025-2530 | High | 7.8 | 2025-03-25 | Luxion KeyShot DAE File Parsing Access of Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2025-27147 | High | 8.2 | 2025-03-25 | The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX hos… |
CVE-2025-26742 | Medium | 6.5 | 2025-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery for Social Photo feed-instagram-lite all… |
CVE-2025-30091 | | 2025-03-25 | In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject… | |
CVE-2025-29635 | High | 7.2 | 2025-03-25 | A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending… |
CVE-2025-22230 | High | 7.8 | 2025-03-25 | VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges o… |
CVE-2025-29932 | Medium | 4.1 | 2025-03-25 | In JetBrains GoLand before 2025.1 an XXE during debugging was possible |
CVE-2025-27633 | Medium | 6.1 | 2025-03-25 | The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-side code injection that might be used to… |
CVE-2025-27632 | Medium | 6.1 | 2025-03-25 | A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multipl… |
CVE-2025-27631 | Medium | 6.5 | 2025-03-25 | The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands… |
CVE-2025-1445 | High | 7.5 | 2025-03-25 | A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection… |
CVE-2025-2109 | Medium | 5.8 | 2025-03-25 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includi… |
CVE-2025-2757 | Medium | 6.3 | 2025-03-25 | A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOT… |
CVE-2025-2756 | Medium | 6.3 | 2025-03-25 | A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectS… |
CVE-2025-2635 | Medium | 6.1 | 2025-03-25 | The Digital License Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg() function without appropri… |
CVE-2025-2542 | Medium | 6.4 | 2025-03-25 | The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1… |
CVE-2025-2755 | Medium | 6.3 | 2025-03-25 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter… |
CVE-2025-2754 | Medium | 6.3 | 2025-03-25 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::A… |
CVE-2025-2753 | Medium | 6.3 | 2025-03-25 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of… |
CVE-2025-2559 | Medium | 4.9 | 2025-03-25 | A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens wi… |
CVE-2025-2510 | Medium | 5.5 | 2025-03-25 | The Frndzk Expandable Bottom Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text' parameter in all versions up to, and including, 1… |
CVE-2025-2319 | High | 8.8 | 2025-03-25 | The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.11.13 to 5.25.08. This is due… |
CVE-2025-2752 | Medium | 4.3 | 2025-03-25 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the lib… |
CVE-2025-2751 | Medium | 4.3 | 2025-03-25 | A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImpo… |
CVE-2025-2750 | Medium | 6.3 | 2025-03-25 | A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternRe… |
CVE-2025-2744 | Medium | 5.4 | 2025-03-25 | A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/mp/ma… |
CVE-2025-2743 | Medium | 4.3 | 2025-03-25 | A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown processing of the fi… |
CVE-2025-2742 | Medium | 5.4 | 2025-03-25 | A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. This vulnerability affects unknown code of the file /admin-api/mp/materi… |
CVE-2025-2740 | High | 7.3 | 2025-03-25 | A vulnerability classified as critical has been found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/elig… |
CVE-2025-2252 | Medium | 5.3 | 2025-03-25 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all version… |