2025 CVEs (page 378)
Page 378 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30817 | Medium | 5.4 | 2025-03-27 | Missing Authorization vulnerability in wpzita Z Companion z-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-30816 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Nks publish post email notification publish-post-email-notification allows Cross Site Request Forgery.This i… |
CVE-2025-30815 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Cross Site Request Forgery.This issue affec… |
CVE-2025-30814 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme The Post Grid the-post-gri… |
CVE-2025-30813 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in listamester Listamester listamester allows Stored XSS.Thi… |
CVE-2025-30812 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Addons for Elementor skt-addons-for-elem… |
CVE-2025-30811 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue a… |
CVE-2025-30810 | High | 8.5 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-lea… |
CVE-2025-30809 | Medium | 5.4 | 2025-03-27 | Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-30806 | High | 8.5 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-p… |
CVE-2025-30805 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible Cookies flexible-cookies allows Cross Site Request Forgery.This issue affects Flexible Cooki… |
CVE-2025-30804 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in maennchen1.de wpShopGermany IT-RECHT KANZLEI wpshopgermany-it-recht-kanzlei allows Cross Site Request Forger… |
CVE-2025-30803 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in Greg Ross Just Writing Statistics just-writing-statistics allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-30801 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Abu Bakar TWB Woocommerce Reviews twb-woocommerce-reviews allows Cross Site Request Forgery.This issue affec… |
CVE-2025-30800 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Sto… |
CVE-2025-30799 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup WP Google Street View wp-google-street-view allows… |
CVE-2025-30795 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects Fun… |
CVE-2025-30792 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ufukart Comment Approved Notifier Extended comment-approv… |
CVE-2025-30791 | High | 7.6 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdever Cart tracking for WooCommerce cart-tracking-for-w… |
CVE-2025-30790 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue af… |
CVE-2025-30789 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in clearoutio Clearout Email Validator clearout-email-valida… |
CVE-2025-30788 | High | 8.2 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows SQL Injection.This issue affects EZ S… |
CVE-2025-30787 | High | 7.1 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL… |
CVE-2025-30786 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows DOM-Based XSS.T… |
CVE-2025-30785 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Download Lite… |
CVE-2025-30784 | High | 8.5 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms al… |
CVE-2025-30783 | High | 8.2 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows SQL Injection.This issue affects WP… |
CVE-2025-30781 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules… |
CVE-2025-30780 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cubecolour Audio Album audio-album allows Stored XSS.This… |
CVE-2025-30779 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick van Wobbie Doneren met Mollie doneren-met-mollie all… |
CVE-2025-30777 | Medium | 4.3 | 2025-03-27 | Authorization Bypass Through User-Controlled Key vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-30776 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue af… |
CVE-2025-30775 | High | 8.5 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows SQ… |
CVE-2025-30773 | High | 7.2 | 2025-03-27 | Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePr… |
CVE-2025-30772 | High | 8.8 | 2025-03-27 | Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects… |
CVE-2025-30771 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alain-Aymerick FRANCOIS WP Cassify wp-cassify allows DOM-… |
CVE-2025-30770 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Charitable charitable allows DOM-Based XSS.Th… |
CVE-2025-30769 | High | 7.1 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in alexvtn WIP WooCarousel Lite wip-woocarousel-lite allows Stored XSS.This issue affects WIP WooCarousel Lite… |
CVE-2025-30768 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows Stored XSS.This… |
CVE-2025-30767 | Medium | 5.4 | 2025-03-27 | Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-30766 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-a… |
CVE-2025-30765 | High | 7.6 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPPOOL FlexStock stock-sync-with-google-sheet-for-woocomm… |
CVE-2025-30764 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in AntoineH Football Pool football-pool allows Cross Site Request Forgery.This issue affects Football Pool: fro… |
CVE-2025-30763 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer EO4WP fw-integration-for-emailoctopus allows… |
CVE-2025-29993 | Medium | 5.3 | 2025-03-27 | The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered… |
CVE-2025-2685 | Medium | 6.4 | 2025-03-27 | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘table-name’ parameter in all versions… |
CVE-2025-2332 | Critical | 9.8 | 2025-03-27 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.13 v… |
CVE-2025-0273 | Medium | 5.5 | 2025-03-27 | HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user. |
CVE-2025-31165 | | 2025-03-27 | Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through th… | |
CVE-2025-2835 | Medium | 4.3 | 2025-03-27 | A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the… |
CVE-2025-2833 | Medium | 5.3 | 2025-03-27 | A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header… |
CVE-2025-2832 | Medium | 4.3 | 2025-03-27 | A vulnerability was found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as problematic. This issue… |
CVE-2025-2831 | Medium | 6.3 | 2025-03-27 | A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. This vul… |
CVE-2025-2481 | Medium | 6.1 | 2025-03-27 | The MediaView plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id' parameter in all versions up to, and including, 1.1.2 due to in… |
CVE-2025-30355 | High | 7.1 | 2025-03-27 | Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 fro… |
CVE-2025-20230 | Medium | 4.3 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platf… |
CVE-2025-30407 | Medium | 6.3 | 2025-03-26 | Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before bui… |
CVE-2025-2838 | Medium | 6.5 | 2025-03-26 | Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a d… |
CVE-2025-2837 | High | 8.8 | 2025-03-26 | Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attacke… |
CVE-2025-20233 | Low | 2.5 | 2025-03-26 | In the Splunk App for Lookup File Editing versions below 4.0.5, a script in the app used the `chmod` and `makedirs` Python functions in a way that resulted in… |
CVE-2025-20232 | Medium | 5.7 | 2025-03-26 | In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and… |
CVE-2025-20231 | High | 7.1 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platf… |
CVE-2025-20229 | High | 8.0 | 2025-03-26 | In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.2… |
CVE-2025-20228 | Medium | 6.5 | 2025-03-26 | In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that… |
CVE-2025-20227 | Medium | 4.3 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312… |
CVE-2025-20226 | Medium | 5.7 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low… |
CVE-2025-31160 | Low | 2.9 | 2025-03-26 | atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecified other impact by… |
CVE-2025-2787 | High | 8.8 | 2025-03-26 | KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the wo… |
CVE-2025-30073 | High | 7.5 | 2025-03-26 | An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to transactions can be reused. When completing a payment, the first… |
CVE-2025-28361 | High | 7.5 | 2025-03-26 | Unauthorized stack overflow vulnerability in Telesquare TLR-2005KSH v.1.1.4 allows a remote attacker to obtain sensitive information via the systemutil.cgi com… |
CVE-2025-26011 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setUsernamePassword. |
CVE-2025-26010 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting the admin.cgi parameter with setUserNamePassword. |
CVE-2025-26009 | High | 7.5 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 has an Information Disclosure vulnerability when requesting systemutilit.cgi. |
CVE-2025-26008 | Critical | 9.8 | 2025-03-26 | In Telesquare TLR-2005KSH 1.1.4, an unauthorized stack overflow vulnerability exists when requesting admin.cgi parameter with setSyncTimeHost. |
CVE-2025-26007 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability in the login interface when requesting systemtil.cgi. |
CVE-2025-26006 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setAutorest. |
CVE-2025-26005 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack overflow vulnerability when requesting admin.cgi parameter with setNtp. |
CVE-2025-29322 | Medium | 4.6 | 2025-03-26 | A cross-site scripting (XSS) vulnerability in ScriptCase before v1.0.003 - Build 3 allows attackers to execute arbitrary code via a crafted payload to the "Con… |
CVE-2025-26004 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack buffer overflow vulnerability when requesting admin.cgi parameter with setDdns. |
CVE-2025-26003 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with setAutorest. |
CVE-2025-26002 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyncTimeHost. |
CVE-2025-26001 | High | 7.5 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 is vulnerable to Information Disclosure via the parameter getUserNamePassword. |
CVE-2025-25535 | Critical | 9.8 | 2025-03-26 | HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request. |
CVE-2025-30353 | High | 8.6 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "… |
CVE-2025-30352 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the `search` qu… |
CVE-2025-30351 | Low | 3.5 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can… |
CVE-2025-2600 | Medium | 6.8 | 2025-03-26 | Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD var… |
CVE-2025-2562 | Medium | 5.4 | 2025-03-26 | Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without g… |
CVE-2025-2528 | Low | 3.6 | 2025-03-26 | Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration dif… |
CVE-2025-2499 | Medium | 5.4 | 2025-03-26 | Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to… |
CVE-2025-30350 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior… |
CVE-2025-30225 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior… |
CVE-2025-30217 | High | 7.5 | 2025-03-26 | Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework… |
CVE-2025-30164 | Medium | 4.1 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerab… |
CVE-2025-27609 | Medium | 5.4 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows a… |
CVE-2025-2783 | High | 8.3 | 2025-03-26 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandb… |
CVE-2025-2098 | | 2025-03-26 | Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security p… | |
CVE-2025-27406 | High | 7.6 | 2025-03-26 | Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability presen… |
CVE-2025-27405 | High | 7.6 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows a… |
CVE-2025-30524 | Critical | 9.3 | 2025-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog displayproduct allows SQL Inje… |