2025 CVEs (page 379)
Page 379 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1320 | Medium | 4.3 | 2025-03-25 | The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.9. This is due to missing or incorrec… |
CVE-2025-2739 | High | 7.3 | 2025-03-25 | A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fi… |
CVE-2025-2738 | High | 7.3 | 2025-03-25 | A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fi… |
CVE-2025-2737 | High | 7.3 | 2025-03-25 | A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin… |
CVE-2025-2224 | Medium | 5.3 | 2025-03-25 | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification… |
CVE-2025-27810 | Medium | 5.4 | 2025-03-25 | Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS… |
CVE-2025-27809 | Medium | 5.4 | 2025-03-25 | Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client… |
CVE-2025-1798 | Medium | 6.1 | 2025-03-25 | The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site… |
CVE-2025-1452 | Low | 3.5 | 2025-03-25 | The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2025-0845 | Medium | 6.4 | 2025-03-25 | The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to in… |
CVE-2025-0717 | Low | 3.5 | 2025-03-25 | To exploit the vulnerability, it is necessary: |
CVE-2025-2736 | High | 7.3 | 2025-03-25 | A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-2735 | High | 7.3 | 2025-03-25 | A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2025-2734 | High | 7.3 | 2025-03-25 | A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /adm… |
CVE-2025-2733 | Medium | 6.3 | 2025-03-25 | A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execu… |
CVE-2025-2732 | High | 8.0 | 2025-03-25 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been rated as critical. Affected… |
CVE-2025-2731 | High | 8.0 | 2025-03-25 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affec… |
CVE-2025-2730 | High | 8.0 | 2025-03-25 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Aff… |
CVE-2025-2729 | High | 8.0 | 2025-03-25 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue a… |
CVE-2025-2728 | High | 8.0 | 2025-03-25 | A vulnerability has been found in H3C Magic NX30 Pro and Magic NX400 up to V100R014 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2025-2727 | High | 8.0 | 2025-03-25 | A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetw… |
CVE-2025-2726 | High | 8.0 | 2025-03-25 | A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014… |
CVE-2025-2725 | High | 8.0 | 2025-03-25 | A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this… |
CVE-2025-2717 | Medium | 4.7 | 2025-03-25 | A vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub_41710C of the file /gof… |
CVE-2025-24514 | High | 8.8 | 2025-03-25 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject co… |
CVE-2025-24513 | Medium | 4.8 | 2025-03-25 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the i… |
CVE-2025-1974 | Critical | 9.8 | 2025-03-25 | A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary… |
CVE-2025-1098 | High | 8.8 | 2025-03-25 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations… |
CVE-2025-1097 | High | 8.8 | 2025-03-25 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to… |
CVE-2025-2716 | Low | 2.7 | 2025-03-24 | A vulnerability classified as problematic was found in China Mobile P22g-CIac 1.0.00.488. This vulnerability affects unknown code of the component Samba Path H… |
CVE-2025-2715 | Low | 3.5 | 2025-03-24 | A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatch_Inv… |
CVE-2025-2714 | Medium | 4.3 | 2025-03-24 | A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file… |
CVE-2025-2712 | Medium | 4.3 | 2025-03-24 | A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-26512 | Critical | 9.9 | 2025-03-24 | SnapCenter versions prior to 6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin… |
CVE-2025-2711 | Medium | 4.3 | 2025-03-24 | A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been classified as problematic. Affected is an unknown function of the file /help/systop.jsp. The… |
CVE-2025-2710 | Medium | 4.3 | 2025-03-24 | A vulnerability was found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This issue affects some unknown processing of the file /menu.jsp. The manip… |
CVE-2025-29315 | Critical | 9.8 | 2025-03-24 | An issue in the Shiro-based RBAC (Role-based Access Control) mechanism of OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allo… |
CVE-2025-29314 | High | 8.1 | 2025-03-24 | Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allow attackers to access sensitive in… |
CVE-2025-29313 | High | 7.5 | 2025-03-24 | Use of incorrectly resolved name or reference in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attackers to cause a D… |
CVE-2025-29312 | Critical | 9.1 | 2025-03-24 | An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link type from indirect t… |
CVE-2025-29311 | High | 7.5 | 2025-03-24 | Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are able to leverage thi… |
CVE-2025-29310 | Critical | 9.8 | 2025-03-24 | An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers… |
CVE-2025-29135 | Critical | 9.8 | 2025-03-24 | A stack-based buffer overflow vulnerability in Tenda AC7 V15.03.06.44 allows a remote attacker to execute arbitrary code through a stack overflow attack using… |
CVE-2025-29100 | Critical | 9.8 | 2025-03-24 | Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the fromSetRouteStatic function via the parameter list. |
CVE-2025-2709 | Medium | 4.3 | 2025-03-24 | A vulnerability has been found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This vulnerability affects unknown code of the file /login.jsp. The ma… |
CVE-2025-2708 | Medium | 5.4 | 2025-03-24 | A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. This affects an unknown part of the file /admin-api/infra/fi… |
CVE-2025-2231 | High | 7.8 | 2025-03-24 | PDF-XChange Editor RTF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2025-30163 | Low | 3.4 | 2025-03-24 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies (`fromNodes` and `toNodes`) will incorre… |
CVE-2025-30162 | Low | 3.2 | 2025-03-24 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services a… |
CVE-2025-2749 | High | 7.2 | 2025-03-24 | An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations… |
CVE-2025-2748 | Medium | 6.1 | 2025-03-24 | The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This… |
CVE-2025-2747 | Critical | 9.8 | 2025-03-24 | An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server… |
CVE-2025-2746 | Critical | 9.8 | 2025-03-24 | An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames… |
CVE-2025-2707 | Medium | 5.4 | 2025-03-24 | A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of… |
CVE-2025-2706 | Medium | 6.3 | 2025-03-24 | A vulnerability classified as critical was found in Digiwin ERP 5.0.1. Affected by this vulnerability is an unknown functionality of the file /Api/TinyMce/Uplo… |
CVE-2025-22223 | Medium | 5.3 | 2025-03-24 | Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. … |
CVE-2025-30208 | Medium | 5.3 | 2025-03-24 | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to fil… |
CVE-2025-30205 | High | 7.6 | 2025-03-24 | kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrument… |
CVE-2025-30112 | High | 7.1 | 2025-03-24 | On 70mai Dash Cam 1S devices, by connecting directly to the dashcam's network and accessing the API on port 80 and RTSP on port 554, an attacker can bypass the… |
CVE-2025-29778 | Medium | 5.8 | 2025-03-24 | Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegEx… |
CVE-2025-0255 | High | 7.2 | 2025-03-24 | HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted… |
CVE-2025-2705 | High | 7.3 | 2025-03-24 | A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. Th… |
CVE-2025-23204 | Medium | 4.4 | 2025-03-24 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl res… |
CVE-2025-0256 | Medium | 4.3 | 2025-03-24 | HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization f… |
CVE-2025-1558 | Medium | 6.5 | 2025-03-24 | Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application… |
CVE-2025-30623 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry wA11y – The Web Accessibility Toolbox wa11y… |
CVE-2025-30621 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in kornelly Translator translator allows Stored XSS.This issue affects Translator: from n/a through <= 0.3. |
CVE-2025-30620 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in coderscom WP Odoo Form Integrator wp-odoo-form-integrator allows Stored XSS.This issue affects WP Odoo Form… |
CVE-2025-30619 | Medium | 5.4 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in SpeakPipe SpeakPipe speakpipe-voicemail-for-websites allows Cross Site Request Forgery.This issue affects Sp… |
CVE-2025-30617 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in takien Rewrite rewrite allows Cross Site Request Forgery.This issue affects Rewrite: from n/a through <= 0.2… |
CVE-2025-30615 | Critical | 9.6 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Code Injection.This issue affects… |
CVE-2025-30612 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in mandegarweb Replace Default Words replace-default-words allows Stored XSS.This issue affects Replace Default… |
CVE-2025-30610 | Medium | 6.5 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stor… |
CVE-2025-30609 | Medium | 5.3 | 2025-03-24 | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2025-30608 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in Anthony WordPress SQL Backup wordpress-sql-backup allows Stored XSS.This issue affects WordPress SQL Backup… |
CVE-2025-30606 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Logan Carlile Easy Page Transition easy-page-transition a… |
CVE-2025-30605 | Medium | 4.3 | 2025-03-24 | Missing Authorization vulnerability in ldwin79 sourceplay-navermap sourceplay-navermap allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-30604 | High | 7.6 | 2025-03-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jiangqie JiangQie Official Website Mini Program jiangqie-… |
CVE-2025-30603 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in DEJAN CopyLink copy-link allows Stored XSS.This issue affects CopyLink: from n/a through <= 1.1. |
CVE-2025-30602 | High | 7.1 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alphasis Related Posts via Categories related-posts-via-c… |
CVE-2025-30601 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in flipdish Flipdish Ordering System flipdish-ordering-system allows Cross Site Request Forgery.This issue affe… |
CVE-2025-30600 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thiagogsrwp WP Hotjar wp-hotjar allows Stored XSS.This is… |
CVE-2025-30599 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp-maverick WP Parallax Content Slider wp-parallax-conten… |
CVE-2025-30598 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in Link OSS Upload oss-upload allows Cross Site Request Forgery.This issue affects OSS Upload: from n/a through… |
CVE-2025-30597 | Medium | 6.5 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iografica IG Shortcodes ig-shortcodes allows DOM-Based XS… |
CVE-2025-30595 | Medium | 6.5 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tstafford include-file include-file allows Stored XSS.Thi… |
CVE-2025-30593 | Medium | 6.5 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk Include URL include-url allows Stored XSS.This issu… |
CVE-2025-30592 | Medium | 5.3 | 2025-03-24 | Missing Authorization vulnerability in WesternDeal Advanced Dewplayer advanced-dewplayer allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-30591 | Medium | 5.3 | 2025-03-24 | Missing Authorization vulnerability in tuyennv Music Press Pro music-press-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-30590 | High | 8.5 | 2025-03-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows… |
CVE-2025-30588 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in ryan_xantoo Map Contact map-contact allows Stored XSS.This issue affects Map Contact: from n/a through <= 3… |
CVE-2025-30587 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in shawfactor LH OGP Meta lh-ogp-meta-tags allows Stored XSS.This issue affects LH OGP Meta: from n/a through <… |
CVE-2025-30586 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in bbodine1 cTabs ctabs allows Stored XSS.This issue affects cTabs: from n/a through <= 1.3. |
CVE-2025-30585 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in marynixie Generate Post Thumbnails generate-post-thumbnails allows Cross Site Request Forgery.This issue aff… |
CVE-2025-30584 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter alphaomega-captcha-anti-spam allows Stored XSS.This… |
CVE-2025-30583 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in ProRankTracker Pro Rank Tracker proranktracker allows Stored XSS.This issue affects Pro Rank Tracker: from n… |
CVE-2025-30581 | Medium | 5.3 | 2025-03-24 | Missing Authorization vulnerability in PluginOps Top Bar ultimate-bar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-30578 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in hotvanrod AdSense Privacy Policy adsense-privacy-policy allows Stored XSS.This issue affects AdSense Privacy… |
CVE-2025-30577 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in mendibass Browser Address Bar Color browser-address-bar-color allows Stored XSS.This issue affects Browser A… |
CVE-2025-30576 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Image Autosave hacklog-remote-image-autosave allows Cross Site Request Forgery… |