2025 CVEs (page 380)
Page 380 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2009 | High | 7.2 | 2025-03-26 | The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logging functionality in all versions up to, and including, 4.9.9.7 d… |
CVE-2025-1514 | High | 7.3 | 2025-03-26 | The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insuffici… |
CVE-2025-1784 | Medium | 6.4 | 2025-03-26 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb block in all versions up to, and includ… |
CVE-2025-30742 | Medium | 5.3 | 2025-03-26 | httpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not have a final '\0' cha… |
CVE-2025-2576 | Medium | 6.4 | 2025-03-26 | The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ… |
CVE-2025-2573 | Medium | 6.4 | 2025-03-26 | The Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG F… |
CVE-2025-2165 | Medium | 6.1 | 2025-03-26 | The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due t… |
CVE-2025-1490 | Medium | 6.1 | 2025-03-26 | The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and includ… |
CVE-2025-2302 | Medium | 6.4 | 2025-03-26 | The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aws_search_terms shortcode in all versions up to, an… |
CVE-2025-2276 | Medium | 4.3 | 2025-03-26 | The Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2025-30222 | | 2025-03-25 | Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows wit… | |
CVE-2025-30219 | Medium | 6.1 | 2025-03-25 | RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and… |
CVE-2025-30741 | Medium | 4.3 | 2025-03-25 | Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse… |
CVE-2025-29789 | High | 7.5 | 2025-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.3.0 are vulnerable to Directory Tr… |
CVE-2025-27837 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for… |
CVE-2025-27836 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c. |
CVE-2025-27835 | High | 7.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c. |
CVE-2025-27834 | High | 7.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c. |
CVE-2025-27833 | High | 7.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c. |
CVE-2025-27832 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c. |
CVE-2025-27831 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/d… |
CVE-2025-27830 | High | 7.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and… |
CVE-2025-25374 | High | 7.5 | 2025-03-25 | In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causin… |
CVE-2025-25373 | Critical | 9.8 | 2025-03-25 | The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform. |
CVE-2025-25372 | High | 7.5 | 2025-03-25 | NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module. |
CVE-2025-25371 | High | 7.5 | 2025-03-25 | NASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing the override of any arbitrary file on the system. |
CVE-2025-30216 | Critical | 9.4 | 2025-03-25 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-30118 | High | 7.5 | 2025-03-25 | An issue was discovered on the Audi Universal Traffic Recorder 2.88. It has Susceptibility to denial of service. It uses the same default credentials for all d… |
CVE-2025-30567 | High | 7.5 | 2025-03-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP01 WP01 wp01 allows Path Traversal.This issue affects WP01: f… |
CVE-2025-28904 | Critical | 9.3 | 2025-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shamalli Web Directory Free web-directory-free allows Bli… |
CVE-2025-2312 | Medium | 5.9 | 2025-03-25 | A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong na… |
CVE-2025-30214 | High | 7.5 | 2025-03-25 | Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that coul… |
CVE-2025-30213 | High | 8.8 | 2025-03-25 | Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way t… |
CVE-2025-30212 | High | 7.5 | 2025-03-25 | Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0… |
CVE-2025-2532 | High | 7.8 | 2025-03-25 | Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af… |
CVE-2025-2531 | High | 7.8 | 2025-03-25 | Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2025-2530 | High | 7.8 | 2025-03-25 | Luxion KeyShot DAE File Parsing Access of Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2025-27147 | High | 8.2 | 2025-03-25 | The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX hos… |
CVE-2025-26742 | Medium | 6.5 | 2025-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery for Social Photo feed-instagram-lite all… |
CVE-2025-30091 | | 2025-03-25 | In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject… | |
CVE-2025-29635 | High | 7.2 | 2025-03-25 | A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending… |
CVE-2025-22230 | High | 7.8 | 2025-03-25 | VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges o… |
CVE-2025-29932 | Medium | 4.1 | 2025-03-25 | In JetBrains GoLand before 2025.1 an XXE during debugging was possible |
CVE-2025-27633 | Medium | 6.1 | 2025-03-25 | The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-side code injection that might be used to… |
CVE-2025-27632 | Medium | 6.1 | 2025-03-25 | A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multipl… |
CVE-2025-27631 | Medium | 6.5 | 2025-03-25 | The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands… |
CVE-2025-1445 | High | 7.5 | 2025-03-25 | A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection… |
CVE-2025-2109 | Medium | 5.8 | 2025-03-25 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includi… |
CVE-2025-2757 | Medium | 6.3 | 2025-03-25 | A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOT… |
CVE-2025-2756 | Medium | 6.3 | 2025-03-25 | A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectS… |
CVE-2025-2635 | Medium | 6.1 | 2025-03-25 | The Digital License Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg() function without appropri… |
CVE-2025-2542 | Medium | 6.4 | 2025-03-25 | The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1… |
CVE-2025-2755 | Medium | 6.3 | 2025-03-25 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter… |
CVE-2025-2754 | Medium | 6.3 | 2025-03-25 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::A… |
CVE-2025-2753 | Medium | 6.3 | 2025-03-25 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of… |
CVE-2025-2559 | Medium | 4.9 | 2025-03-25 | A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens wi… |
CVE-2025-2510 | Medium | 5.5 | 2025-03-25 | The Frndzk Expandable Bottom Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text' parameter in all versions up to, and including, 1… |
CVE-2025-2319 | High | 8.8 | 2025-03-25 | The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.11.13 to 5.25.08. This is due… |
CVE-2025-2752 | Medium | 4.3 | 2025-03-25 | A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the lib… |
CVE-2025-2751 | Medium | 4.3 | 2025-03-25 | A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImpo… |
CVE-2025-2750 | Medium | 6.3 | 2025-03-25 | A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternRe… |
CVE-2025-2744 | Medium | 5.4 | 2025-03-25 | A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/mp/ma… |
CVE-2025-2743 | Medium | 4.3 | 2025-03-25 | A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown processing of the fi… |
CVE-2025-2742 | Medium | 5.4 | 2025-03-25 | A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. This vulnerability affects unknown code of the file /admin-api/mp/materi… |
CVE-2025-2740 | High | 7.3 | 2025-03-25 | A vulnerability classified as critical has been found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/elig… |
CVE-2025-2252 | Medium | 5.3 | 2025-03-25 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all version… |
CVE-2025-1320 | Medium | 4.3 | 2025-03-25 | The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.9. This is due to missing or incorrec… |
CVE-2025-2739 | High | 7.3 | 2025-03-25 | A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fi… |
CVE-2025-2738 | High | 7.3 | 2025-03-25 | A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fi… |
CVE-2025-2737 | High | 7.3 | 2025-03-25 | A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin… |
CVE-2025-2224 | Medium | 5.3 | 2025-03-25 | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification… |
CVE-2025-27810 | Medium | 5.4 | 2025-03-25 | Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS… |
CVE-2025-27809 | Medium | 5.4 | 2025-03-25 | Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client… |
CVE-2025-1798 | Medium | 6.1 | 2025-03-25 | The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site… |
CVE-2025-1452 | Low | 3.5 | 2025-03-25 | The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2025-0845 | Medium | 6.4 | 2025-03-25 | The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to in… |
CVE-2025-0717 | Low | 3.5 | 2025-03-25 | To exploit the vulnerability, it is necessary: |
CVE-2025-2736 | High | 7.3 | 2025-03-25 | A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-2735 | High | 7.3 | 2025-03-25 | A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2025-2734 | High | 7.3 | 2025-03-25 | A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /adm… |
CVE-2025-2733 | Medium | 6.3 | 2025-03-25 | A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execu… |
CVE-2025-2732 | High | 8.0 | 2025-03-25 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been rated as critical. Affected… |
CVE-2025-2731 | High | 8.0 | 2025-03-25 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affec… |
CVE-2025-2730 | High | 8.0 | 2025-03-25 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Aff… |
CVE-2025-2729 | High | 8.0 | 2025-03-25 | A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue a… |
CVE-2025-2728 | High | 8.0 | 2025-03-25 | A vulnerability has been found in H3C Magic NX30 Pro and Magic NX400 up to V100R014 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2025-2727 | High | 8.0 | 2025-03-25 | A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetw… |
CVE-2025-2726 | High | 8.0 | 2025-03-25 | A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014… |
CVE-2025-2725 | High | 8.0 | 2025-03-25 | A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this… |
CVE-2025-2717 | Medium | 4.7 | 2025-03-25 | A vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub_41710C of the file /gof… |
CVE-2025-24514 | High | 8.8 | 2025-03-25 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject co… |
CVE-2025-24513 | Medium | 4.8 | 2025-03-25 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the i… |
CVE-2025-1974 | Critical | 9.8 | 2025-03-25 | A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary… |
CVE-2025-1098 | High | 8.8 | 2025-03-25 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations… |
CVE-2025-1097 | High | 8.8 | 2025-03-25 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to… |
CVE-2025-2716 | Low | 2.7 | 2025-03-24 | A vulnerability classified as problematic was found in China Mobile P22g-CIac 1.0.00.488. This vulnerability affects unknown code of the component Samba Path H… |
CVE-2025-2715 | Low | 3.5 | 2025-03-24 | A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatch_Inv… |
CVE-2025-2714 | Medium | 4.3 | 2025-03-24 | A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file… |
CVE-2025-2712 | Medium | 4.3 | 2025-03-24 | A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-26512 | Critical | 9.9 | 2025-03-24 | SnapCenter versions prior to 6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin… |