2025 CVEs (page 381)
Page 381 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2711 | Medium | 4.3 | 2025-03-24 | A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been classified as problematic. Affected is an unknown function of the file /help/systop.jsp. The… |
CVE-2025-2710 | Medium | 4.3 | 2025-03-24 | A vulnerability was found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This issue affects some unknown processing of the file /menu.jsp. The manip… |
CVE-2025-29315 | Critical | 9.8 | 2025-03-24 | An issue in the Shiro-based RBAC (Role-based Access Control) mechanism of OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allo… |
CVE-2025-29314 | High | 8.1 | 2025-03-24 | Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allow attackers to access sensitive in… |
CVE-2025-29313 | High | 7.5 | 2025-03-24 | Use of incorrectly resolved name or reference in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attackers to cause a D… |
CVE-2025-29312 | Critical | 9.1 | 2025-03-24 | An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link type from indirect t… |
CVE-2025-29311 | High | 7.5 | 2025-03-24 | Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are able to leverage thi… |
CVE-2025-29310 | Critical | 9.8 | 2025-03-24 | An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers… |
CVE-2025-29135 | Critical | 9.8 | 2025-03-24 | A stack-based buffer overflow vulnerability in Tenda AC7 V15.03.06.44 allows a remote attacker to execute arbitrary code through a stack overflow attack using… |
CVE-2025-29100 | Critical | 9.8 | 2025-03-24 | Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the fromSetRouteStatic function via the parameter list. |
CVE-2025-2709 | Medium | 4.3 | 2025-03-24 | A vulnerability has been found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This vulnerability affects unknown code of the file /login.jsp. The ma… |
CVE-2025-2708 | Medium | 5.4 | 2025-03-24 | A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. This affects an unknown part of the file /admin-api/infra/fi… |
CVE-2025-2231 | High | 7.8 | 2025-03-24 | PDF-XChange Editor RTF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2025-30163 | Low | 3.4 | 2025-03-24 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies (`fromNodes` and `toNodes`) will incorre… |
CVE-2025-30162 | Low | 3.2 | 2025-03-24 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services a… |
CVE-2025-2749 | High | 7.2 | 2025-03-24 | An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations… |
CVE-2025-2748 | Medium | 6.1 | 2025-03-24 | The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This… |
CVE-2025-2747 | Critical | 9.8 | 2025-03-24 | An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server… |
CVE-2025-2746 | Critical | 9.8 | 2025-03-24 | An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames… |
CVE-2025-2707 | Medium | 5.4 | 2025-03-24 | A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of… |
CVE-2025-2706 | Medium | 6.3 | 2025-03-24 | A vulnerability classified as critical was found in Digiwin ERP 5.0.1. Affected by this vulnerability is an unknown functionality of the file /Api/TinyMce/Uplo… |
CVE-2025-22223 | Medium | 5.3 | 2025-03-24 | Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. … |
CVE-2025-30208 | Medium | 5.3 | 2025-03-24 | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to fil… |
CVE-2025-30205 | High | 7.6 | 2025-03-24 | kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrument… |
CVE-2025-30112 | High | 7.1 | 2025-03-24 | On 70mai Dash Cam 1S devices, by connecting directly to the dashcam's network and accessing the API on port 80 and RTSP on port 554, an attacker can bypass the… |
CVE-2025-29778 | Medium | 5.8 | 2025-03-24 | Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegEx… |
CVE-2025-0255 | High | 7.2 | 2025-03-24 | HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted… |
CVE-2025-2705 | High | 7.3 | 2025-03-24 | A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. Th… |
CVE-2025-23204 | Medium | 4.4 | 2025-03-24 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl res… |
CVE-2025-0256 | Medium | 4.3 | 2025-03-24 | HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization f… |
CVE-2025-1558 | Medium | 6.5 | 2025-03-24 | Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application… |
CVE-2025-30623 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry wA11y – The Web Accessibility Toolbox wa11y… |
CVE-2025-30621 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in kornelly Translator translator allows Stored XSS.This issue affects Translator: from n/a through <= 0.3. |
CVE-2025-30620 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in coderscom WP Odoo Form Integrator wp-odoo-form-integrator allows Stored XSS.This issue affects WP Odoo Form… |
CVE-2025-30619 | Medium | 5.4 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in SpeakPipe SpeakPipe speakpipe-voicemail-for-websites allows Cross Site Request Forgery.This issue affects Sp… |
CVE-2025-30617 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in takien Rewrite rewrite allows Cross Site Request Forgery.This issue affects Rewrite: from n/a through <= 0.2… |
CVE-2025-30615 | Critical | 9.6 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Code Injection.This issue affects… |
CVE-2025-30612 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in mandegarweb Replace Default Words replace-default-words allows Stored XSS.This issue affects Replace Default… |
CVE-2025-30610 | Medium | 6.5 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stor… |
CVE-2025-30609 | Medium | 5.3 | 2025-03-24 | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2025-30608 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in Anthony WordPress SQL Backup wordpress-sql-backup allows Stored XSS.This issue affects WordPress SQL Backup… |
CVE-2025-30606 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Logan Carlile Easy Page Transition easy-page-transition a… |
CVE-2025-30605 | Medium | 4.3 | 2025-03-24 | Missing Authorization vulnerability in ldwin79 sourceplay-navermap sourceplay-navermap allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-30604 | High | 7.6 | 2025-03-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jiangqie JiangQie Official Website Mini Program jiangqie-… |
CVE-2025-30603 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in DEJAN CopyLink copy-link allows Stored XSS.This issue affects CopyLink: from n/a through <= 1.1. |
CVE-2025-30602 | High | 7.1 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alphasis Related Posts via Categories related-posts-via-c… |
CVE-2025-30601 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in flipdish Flipdish Ordering System flipdish-ordering-system allows Cross Site Request Forgery.This issue affe… |
CVE-2025-30600 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thiagogsrwp WP Hotjar wp-hotjar allows Stored XSS.This is… |
CVE-2025-30599 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp-maverick WP Parallax Content Slider wp-parallax-conten… |
CVE-2025-30598 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in Link OSS Upload oss-upload allows Cross Site Request Forgery.This issue affects OSS Upload: from n/a through… |
CVE-2025-30597 | Medium | 6.5 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iografica IG Shortcodes ig-shortcodes allows DOM-Based XS… |
CVE-2025-30595 | Medium | 6.5 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tstafford include-file include-file allows Stored XSS.Thi… |
CVE-2025-30593 | Medium | 6.5 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk Include URL include-url allows Stored XSS.This issu… |
CVE-2025-30592 | Medium | 5.3 | 2025-03-24 | Missing Authorization vulnerability in WesternDeal Advanced Dewplayer advanced-dewplayer allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-30591 | Medium | 5.3 | 2025-03-24 | Missing Authorization vulnerability in tuyennv Music Press Pro music-press-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-30590 | High | 8.5 | 2025-03-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows… |
CVE-2025-30588 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in ryan_xantoo Map Contact map-contact allows Stored XSS.This issue affects Map Contact: from n/a through <= 3… |
CVE-2025-30587 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in shawfactor LH OGP Meta lh-ogp-meta-tags allows Stored XSS.This issue affects LH OGP Meta: from n/a through <… |
CVE-2025-30586 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in bbodine1 cTabs ctabs allows Stored XSS.This issue affects cTabs: from n/a through <= 1.3. |
CVE-2025-30585 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in marynixie Generate Post Thumbnails generate-post-thumbnails allows Cross Site Request Forgery.This issue aff… |
CVE-2025-30584 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter alphaomega-captcha-anti-spam allows Stored XSS.This… |
CVE-2025-30583 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in ProRankTracker Pro Rank Tracker proranktracker allows Stored XSS.This issue affects Pro Rank Tracker: from n… |
CVE-2025-30581 | Medium | 5.3 | 2025-03-24 | Missing Authorization vulnerability in PluginOps Top Bar ultimate-bar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-30578 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in hotvanrod AdSense Privacy Policy adsense-privacy-policy allows Stored XSS.This issue affects AdSense Privacy… |
CVE-2025-30577 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in mendibass Browser Address Bar Color browser-address-bar-color allows Stored XSS.This issue affects Browser A… |
CVE-2025-30576 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Image Autosave hacklog-remote-image-autosave allows Cross Site Request Forgery… |
CVE-2025-30575 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Login Redirect login-redirect allows Stored XSS.Th… |
CVE-2025-30574 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jenst Mobile Navigation mobile-navigation allows Stored X… |
CVE-2025-30573 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny My Default Post Content my-default-post-content a… |
CVE-2025-30572 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in Igor Yavych Simple Rating simple-rating allows Stored XSS.This issue affects Simple Rating: from n/a through… |
CVE-2025-30571 | High | 7.6 | 2025-03-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in STEdb Corp. STEdb Forms stedb-forms allows SQL Injection… |
CVE-2025-30570 | High | 7.6 | 2025-03-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AliRezaMohammadi دکمه، شبکه اجتماعی خرید dokme allows SQL… |
CVE-2025-30569 | High | 8.5 | 2025-03-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jahertor WP Featured Entries wp-featured-entries allows S… |
CVE-2025-30568 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in hitoy Super Static Cache super-static-cache allows Cross Site Request Forgery.This issue affects Super Stati… |
CVE-2025-30566 | Medium | 6.5 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aryan Themes Clink clink allows DOM-Based XSS.This issue… |
CVE-2025-30565 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in karrikas banner-manager banner-manager allows Stored XSS.This issue affects banner-manager: from n/a through… |
CVE-2025-30564 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in wpwox Custom Script Integration custom-script-integration allows Stored XSS.This issue affects Custom Script… |
CVE-2025-30561 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in Henrique Mouta CAS Maestro cas-maestro allows Stored XSS.This issue affects CAS Maestro: from n/a through <=… |
CVE-2025-30560 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu jquery-drop-down-menu-plugin allows Stored XSS.This issue affects jQuery Dro… |
CVE-2025-30558 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in EnzoCostantini55 ANAC XML Render anac-xml-render allows Stored XSS.This issue affects ANAC XML Render: from… |
CVE-2025-30557 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in odihost Easy 301 Redirects odihost-easy-redirect-301 allows Cross Site Request Forgery.This issue affects Ea… |
CVE-2025-30556 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in flyaga Fix Rss Feeds fix-rss-feed allows Cross Site Request Forgery.This issue affects Fix Rss Feeds: from n… |
CVE-2025-30555 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in iiiryan WordPres 同步微博 wp2wb allows Stored XSS.This issue affects WordPres 同步微博: from n/a through <= 1.1.0. |
CVE-2025-30553 | Medium | 6.5 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Z.com byGMO GMO Font Agent gmo-font-agent allows Stored X… |
CVE-2025-30552 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in Donald Gilbert WordPress Admin Bar Improved wordpress-admin-bar-improved allows Stored XSS.This issue affect… |
CVE-2025-30551 | Medium | 6.5 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartredfox Pretty file links pretty-file-links allows St… |
CVE-2025-30550 | High | 7.1 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in WPShop.ru CallPhone'r callphoner allows Stored XSS.This issue affects CallPhone'r: from n/a through <= 1.1.1. |
CVE-2025-30549 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in Yummly Yummly Rich Recipes yummly-rich-recipes allows Cross Site Request Forgery.This issue affects Yummly R… |
CVE-2025-30546 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in boroV Cackle cackle allows Cross Site Request Forgery.This issue affects Cackle: from n/a through <= 4.33. |
CVE-2025-30545 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline issuuPress issuupress allows Stored XSS.This iss… |
CVE-2025-30543 | Medium | 4.3 | 2025-03-24 | Missing Authorization vulnerability in swayam.tejwani Menu Duplicator copy-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-30542 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in wpsolutions SoundCloud Ultimate soundcloud-ultimate allows Cross Site Request Forgery.This issue affects Sou… |
CVE-2025-30541 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Info Boxes Shortcode and Widget info-boxes-shortcode-and-widget allows Cross Site Request Forgery… |
CVE-2025-30540 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in avaibook AvaiBook avaibook allows Stored XSS.This issue a… |
CVE-2025-30539 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benedikt Mo BMo Expo bmo-expo allows Stored XSS.This issu… |
CVE-2025-30538 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Simple Optimizer simple-optimizer allows Cross Site Request Forgery.This issue affects Simple Opt… |
CVE-2025-30537 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Sarov Upload Quota per User upload-quota-per-use… |
CVE-2025-30536 | Medium | 5.9 | 2025-03-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeitwesentech Beautiful Link Preview beautiful-link-previ… |
CVE-2025-30535 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in muro External image replace external-image-replace allows Cross Site Request Forgery.This issue affects Exte… |
CVE-2025-30534 | Medium | 4.3 | 2025-03-24 | Cross-Site Request Forgery (CSRF) vulnerability in captcha.soft Image Captcha image-captcha allows Cross Site Request Forgery.This issue affects Image Captcha… |