2025 CVEs (page 381)
Page 381 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2643 | High | 7.3 | 2025-03-23 | A vulnerability has been found in PHPGurukul Art Gallery Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-2642 | High | 7.3 | 2025-03-23 | A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.0. This affects an unknown part of the file /admin/e… |
CVE-2025-1446 | Critical | 9.8 | 2025-03-23 | The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection… |
CVE-2025-0718 | Medium | 4.8 | 2025-03-23 | The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors… |
CVE-2025-2641 | High | 7.3 | 2025-03-23 | A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.0. Affected by this issue is some unknown funct… |
CVE-2025-2640 | High | 7.3 | 2025-03-23 | A vulnerability was found in PHPGurukul Doctor Appointment Management System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2025-2639 | Medium | 4.3 | 2025-03-23 | A vulnerability has been found in JIZHICMS up to 1.7.0 and classified as problematic. This vulnerability affects unknown code of the file /user/release.html of… |
CVE-2025-2638 | Medium | 4.3 | 2025-03-23 | A vulnerability, which was classified as problematic, was found in JIZHICMS up to 1.7.0. This affects an unknown part of the file /user/release.html of the com… |
CVE-2025-2637 | Medium | 4.3 | 2025-03-23 | A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0. Affected by this issue is some unknown functionality of the file… |
CVE-2025-2628 | Medium | 6.3 | 2025-03-22 | A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.1. Affected is an unknown function of the file /art-… |
CVE-2025-2627 | Medium | 6.3 | 2025-03-22 | A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.0. This issue affects some unknown processing o… |
CVE-2025-2626 | Medium | 6.3 | 2025-03-22 | A vulnerability classified as critical was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This vulnerability affects unknown code o… |
CVE-2025-2625 | Medium | 6.3 | 2025-03-22 | A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /system/cms/content/page. The manipul… |
CVE-2025-2624 | Medium | 6.3 | 2025-03-22 | A vulnerability was found in westboy CicadasCMS 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /system/cm… |
CVE-2025-2623 | Low | 3.5 | 2025-03-22 | A vulnerability was found in westboy CicadasCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-2622 | Medium | 6.3 | 2025-03-22 | A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/ch… |
CVE-2025-2621 | Critical | 9.8 | 2025-03-22 | A vulnerability was found in D-Link DAP-1620 1.03 and classified as critical. This issue affects the function check_dws_cookie of the file /storage. The manipu… |
CVE-2025-2620 | Critical | 9.8 | 2025-03-22 | A vulnerability has been found in D-Link DAP-1620 1.03 and classified as critical. This vulnerability affects the function mod_graph_auth_uri_handler of the fi… |
CVE-2025-2619 | Critical | 9.8 | 2025-03-22 | A vulnerability, which was classified as critical, was found in D-Link DAP-1620 1.03. This affects the function check_dws_cookie of the file /storage of the co… |
CVE-2025-2618 | Critical | 9.8 | 2025-03-22 | A vulnerability, which was classified as critical, has been found in D-Link DAP-1620 1.03. Affected by this issue is the function set_ws_action of the file /dw… |
CVE-2025-2617 | Low | 2.4 | 2025-03-22 | A vulnerability classified as problematic was found in yangyouwang 杨有旺 crud 简约后台管理系统 1.0.0. Affected by this vulnerability is an unknown functionality of the c… |
CVE-2025-2186 | High | 7.5 | 2025-03-22 | The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to SQL Injection vi… |
CVE-2025-26796 | Medium | 5.4 | 2025-03-22 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Oozie. This issue… |
CVE-2025-2577 | Medium | 6.4 | 2025-03-22 | The Bitspecter Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to… |
CVE-2025-2331 | Medium | 5.3 | 2025-03-22 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-1973 | Medium | 4.9 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_fil… |
CVE-2025-1972 | Low | 2.7 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_l… |
CVE-2025-1971 | High | 7.2 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserializ… |
CVE-2025-1970 | High | 7.6 | 2025-03-22 | The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the… |
CVE-2025-2616 | Low | 2.4 | 2025-03-22 | A vulnerability classified as problematic has been found in yangyouwang 杨有旺 crud 简约后台管理系统 1.0.0. Affected is an unknown function of the component Role Manageme… |
CVE-2025-2484 | Medium | 6.1 | 2025-03-22 | The Multi Video Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'video_id' and 'group_id' parameters in all versions up to, an… |
CVE-2025-2482 | Medium | 6.1 | 2025-03-22 | The Gotcha | Gesture-based Captcha plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menu' parameter in all versions up to, and inc… |
CVE-2025-2479 | Medium | 6.1 | 2025-03-22 | The Easy Custom Admin Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 1… |
CVE-2025-2478 | Medium | 4.9 | 2025-03-22 | The Code Clone plugin for WordPress is vulnerable to time-based SQL Injection via the ‘snippetId’ parameter in all versions up to, and including, 0.9 due to in… |
CVE-2025-2477 | Medium | 4.7 | 2025-03-22 | The CryoKey plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ckemail’ parameter in all versions up to, and including, 2.4 due to i… |
CVE-2025-2303 | High | 8.8 | 2025-03-22 | The Block Logic – Full Gutenberg Block Display Control plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.8… |
CVE-2025-1311 | Medium | 6.5 | 2025-03-22 | The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in the update_delivery_status() f… |
CVE-2025-0807 | Medium | 4.3 | 2025-03-22 | The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2025-1408 | Medium | 4.3 | 2025-03-22 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-0724 | High | 8.8 | 2025-03-22 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.4… |
CVE-2025-0723 | Medium | 6.5 | 2025-03-22 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the rid and search parame… |
CVE-2025-30472 | Critical | 9.0 | 2025-03-22 | Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in ex… |
CVE-2025-2610 | High | 7.6 | 2025-03-21 | Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cr… |
CVE-2025-2609 | High | 8.2 | 2025-03-21 | Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store H… |
CVE-2025-26500 | Medium | 4.6 | 2025-03-21 | : Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation. Specifically crafted USB packets m… |
CVE-2025-30204 | High | 7.5 | 2025-03-21 | golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified split… |
CVE-2025-2608 | Medium | 6.3 | 2025-03-21 | A vulnerability classified as critical has been found in PHPGurukul Banquet Booking System 1.2. This affects an unknown part of the file /admin/view-user-queri… |
CVE-2025-2607 | Medium | 6.3 | 2025-03-21 | A vulnerability was found in phplaozhang LzCMS-LaoZhangBoKeXiTong up to 1.1.4. It has been rated as critical. Affected by this issue is some unknown functional… |
CVE-2025-2606 | Medium | 6.3 | 2025-03-21 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2025-2604 | Medium | 6.3 | 2025-03-21 | A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been classified as critical. Affected is an unknown funct… |
CVE-2025-2603 | Medium | 6.3 | 2025-03-21 | A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This issue affects some unknown proce… |
CVE-2025-2602 | Medium | 6.3 | 2025-03-21 | A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This vulnerability affects unkno… |
CVE-2025-2601 | Medium | 6.3 | 2025-03-21 | A vulnerability, which was classified as critical, was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This affects an unknown part… |
CVE-2025-25036 | Medium | 6.8 | 2025-03-21 | Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 be… |
CVE-2025-25035 | High | 7.3 | 2025-03-21 | Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.T… |
CVE-2025-30349 | High | 7.2 | 2025-03-21 | Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail mes… |
CVE-2025-29230 | High | 8.6 | 2025-03-21 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via th… |
CVE-2025-29227 | Medium | 6.3 | 2025-03-21 | In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["pkgsize… |
CVE-2025-29226 | Medium | 6.3 | 2025-03-21 | In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["count"]… |
CVE-2025-29223 | Medium | 6.3 | 2025-03-21 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the pt parameter in the traceRoute function. |
CVE-2025-30168 | Medium | 6.9 | 2025-03-21 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication… |
CVE-2025-30157 | Medium | 6.5 | 2025-03-21 | Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of cr… |
CVE-2025-2598 | Medium | 5.5 | 2025-03-21 | When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with th… |
CVE-2025-2593 | Medium | 6.3 | 2025-03-21 | A vulnerability has been found in FastCMS up to 0.1.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/c… |
CVE-2025-29927 | Critical | 9.1 | 2025-03-21 | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it… |
CVE-2025-29641 | High | 7.3 | 2025-03-21 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to SQL Injection in /index.php via the 'searchinputdata' parameter. |
CVE-2025-29640 | Medium | 5.4 | 2025-03-21 | Phpgurukul Human Metapneumovirus (HMPV) – Testing Management System v1.0 is vulnerable to SQL Injection in /patient-report.php via the parameter searchdata.. |
CVE-2025-27612 | Medium | 5.9 | 2025-03-21 | libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilit… |
CVE-2025-24915 | High | 7.8 | 2025-03-21 | When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permissions for sub-dire… |
CVE-2025-2592 | Medium | 6.3 | 2025-03-21 | A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::Inter… |
CVE-2025-2591 | Medium | 4.3 | 2025-03-21 | A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadF… |
CVE-2025-2590 | Low | 2.4 | 2025-03-21 | A vulnerability was found in code-projects Human Resource Management System 1.0.1. It has been classified as problematic. Affected is the function UpdateRecrui… |
CVE-2025-2589 | Medium | 5.5 | 2025-03-21 | A vulnerability was found in code-projects Human Resource Management System 1.0.1 and classified as critical. This issue affects the function Index of the file… |
CVE-2025-2597 | Medium | 6.1 | 2025-03-21 | Reflected Cross-Site Scripting (XSS) in ITIUM 6050 version 5.5.5.2-b3526 from Impact Technologies. This vulnerability could allow an attacker to execute malici… |
CVE-2025-2588 | Low | 3.3 | 2025-03-21 | A vulnerability has been found in Hercules Augeas 1.14.1 and classified as problematic. This vulnerability affects the function re_case_expand of the file src/… |
CVE-2025-2587 | Medium | 6.3 | 2025-03-21 | A vulnerability, which was classified as critical, was found in Jinher OA C6 1.0. This affects an unknown part of the file IncentivePlanFulfillAppprove.aspx. T… |
CVE-2025-30179 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to by… |
CVE-2025-27933 | Medium | 5.4 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with per… |
CVE-2025-27715 | Low | 3.3 | 2025-03-21 | Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private… |
CVE-2025-25274 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated us… |
CVE-2025-25068 | High | 7.5 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated… |
CVE-2025-24920 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels… |
CVE-2025-2584 | Medium | 5.0 | 2025-03-21 | A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCa… |
CVE-2025-30348 | Medium | 5.8 | 2025-03-21 | encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later d… |
CVE-2025-30347 | Medium | 4.0 | 2025-03-21 | Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral MSE4 stev… |
CVE-2025-30346 | Medium | 5.4 | 2025-03-21 | Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests. |
CVE-2025-2583 | Low | 3.5 | 2025-03-21 | A vulnerability was found in SimpleMachines SMF 2.1.4. It has been classified as problematic. This affects an unknown part of the file ManageNews.php. The mani… |
CVE-2025-2582 | Low | 3.5 | 2025-03-21 | A vulnerability was found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the file ManageAtt… |
CVE-2025-30345 | Low | 3.5 | 2025-03-21 | An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat… |
CVE-2025-30344 | Medium | 5.3 | 2025-03-21 | An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a… |
CVE-2025-30343 | Low | 3.0 | 2025-03-21 | A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface all… |
CVE-2025-30342 | Medium | 5.4 | 2025-03-21 | An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows o… |
CVE-2025-2581 | Medium | 4.3 | 2025-03-21 | A vulnerability has been found in xmedcon 0.25.0 and classified as problematic. Affected by this vulnerability is the function malloc of the component DICOM Fi… |
CVE-2025-26336 | High | 8.3 | 2025-03-21 | Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40.200.202101130302, and Dell Chassis Management Controller Firmware… |
CVE-2025-2585 | High | 8.8 | 2025-03-21 | EBM Maintenance Center From EBM Technologies has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL comma… |
CVE-2025-29814 | Critical | 9.3 | 2025-03-21 | Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network. |
CVE-2025-29807 | High | 8.7 | 2025-03-21 | Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. |
CVE-2025-30334 | Medium | 6.5 | 2025-03-20 | In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash. |
CVE-2025-2574 | | 2025-03-20 | Out-of-bounds array write in Xpdf 4.05 and earlier, due to incorrect integer overflow checking in the PostScript function interpreter code. | |
CVE-2025-2538 | Critical | 9.8 | 2025-03-20 | A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthe… |