2025 CVEs (page 383)
Page 383 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2477 | Medium | 4.7 | 2025-03-22 | The CryoKey plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ckemail’ parameter in all versions up to, and including, 2.4 due to i… |
CVE-2025-2303 | High | 8.8 | 2025-03-22 | The Block Logic – Full Gutenberg Block Display Control plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.8… |
CVE-2025-1311 | Medium | 6.5 | 2025-03-22 | The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in the update_delivery_status() f… |
CVE-2025-0807 | Medium | 4.3 | 2025-03-22 | The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2025-1408 | Medium | 4.3 | 2025-03-22 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-0724 | High | 8.8 | 2025-03-22 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.4… |
CVE-2025-0723 | Medium | 6.5 | 2025-03-22 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the rid and search parame… |
CVE-2025-30472 | Critical | 9.0 | 2025-03-22 | Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in ex… |
CVE-2025-2610 | High | 7.6 | 2025-03-21 | Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cr… |
CVE-2025-2609 | High | 8.2 | 2025-03-21 | Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store H… |
CVE-2025-26500 | Medium | 4.6 | 2025-03-21 | : Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation. Specifically crafted USB packets m… |
CVE-2025-30204 | High | 7.5 | 2025-03-21 | golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified split… |
CVE-2025-2608 | Medium | 6.3 | 2025-03-21 | A vulnerability classified as critical has been found in PHPGurukul Banquet Booking System 1.2. This affects an unknown part of the file /admin/view-user-queri… |
CVE-2025-2607 | Medium | 6.3 | 2025-03-21 | A vulnerability was found in phplaozhang LzCMS-LaoZhangBoKeXiTong up to 1.1.4. It has been rated as critical. Affected by this issue is some unknown functional… |
CVE-2025-2606 | Medium | 6.3 | 2025-03-21 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2025-2604 | Medium | 6.3 | 2025-03-21 | A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been classified as critical. Affected is an unknown funct… |
CVE-2025-2603 | Medium | 6.3 | 2025-03-21 | A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This issue affects some unknown proce… |
CVE-2025-2602 | Medium | 6.3 | 2025-03-21 | A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This vulnerability affects unkno… |
CVE-2025-2601 | Medium | 6.3 | 2025-03-21 | A vulnerability, which was classified as critical, was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This affects an unknown part… |
CVE-2025-25036 | Medium | 6.8 | 2025-03-21 | Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 be… |
CVE-2025-25035 | High | 7.3 | 2025-03-21 | Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.T… |
CVE-2025-30349 | High | 7.2 | 2025-03-21 | Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail mes… |
CVE-2025-29230 | High | 8.6 | 2025-03-21 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via th… |
CVE-2025-29227 | Medium | 6.3 | 2025-03-21 | In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["pkgsize… |
CVE-2025-29226 | Medium | 6.3 | 2025-03-21 | In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["count"]… |
CVE-2025-29223 | Medium | 6.3 | 2025-03-21 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the pt parameter in the traceRoute function. |
CVE-2025-30168 | Medium | 6.9 | 2025-03-21 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication… |
CVE-2025-30157 | Medium | 6.5 | 2025-03-21 | Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of cr… |
CVE-2025-2598 | Medium | 5.5 | 2025-03-21 | When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with th… |
CVE-2025-2593 | Medium | 6.3 | 2025-03-21 | A vulnerability has been found in FastCMS up to 0.1.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/c… |
CVE-2025-29927 | Critical | 9.1 | 2025-03-21 | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it… |
CVE-2025-29641 | High | 7.3 | 2025-03-21 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to SQL Injection in /index.php via the 'searchinputdata' parameter. |
CVE-2025-29640 | Medium | 5.4 | 2025-03-21 | Phpgurukul Human Metapneumovirus (HMPV) – Testing Management System v1.0 is vulnerable to SQL Injection in /patient-report.php via the parameter searchdata.. |
CVE-2025-27612 | Medium | 5.9 | 2025-03-21 | libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilit… |
CVE-2025-24915 | High | 7.8 | 2025-03-21 | When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permissions for sub-dire… |
CVE-2025-2592 | Medium | 6.3 | 2025-03-21 | A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::Inter… |
CVE-2025-2591 | Medium | 4.3 | 2025-03-21 | A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadF… |
CVE-2025-2590 | Low | 2.4 | 2025-03-21 | A vulnerability was found in code-projects Human Resource Management System 1.0.1. It has been classified as problematic. Affected is the function UpdateRecrui… |
CVE-2025-2589 | Medium | 5.5 | 2025-03-21 | A vulnerability was found in code-projects Human Resource Management System 1.0.1 and classified as critical. This issue affects the function Index of the file… |
CVE-2025-2597 | Medium | 6.1 | 2025-03-21 | Reflected Cross-Site Scripting (XSS) in ITIUM 6050 version 5.5.5.2-b3526 from Impact Technologies. This vulnerability could allow an attacker to execute malici… |
CVE-2025-2588 | Low | 3.3 | 2025-03-21 | A vulnerability has been found in Hercules Augeas 1.14.1 and classified as problematic. This vulnerability affects the function re_case_expand of the file src/… |
CVE-2025-2587 | Medium | 6.3 | 2025-03-21 | A vulnerability, which was classified as critical, was found in Jinher OA C6 1.0. This affects an unknown part of the file IncentivePlanFulfillAppprove.aspx. T… |
CVE-2025-30179 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to by… |
CVE-2025-27933 | Medium | 5.4 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with per… |
CVE-2025-27715 | Low | 3.3 | 2025-03-21 | Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private… |
CVE-2025-25274 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated us… |
CVE-2025-25068 | High | 7.5 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated… |
CVE-2025-24920 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels… |
CVE-2025-2584 | Medium | 5.0 | 2025-03-21 | A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCa… |
CVE-2025-30348 | Medium | 5.8 | 2025-03-21 | encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later d… |
CVE-2025-30347 | Medium | 4.0 | 2025-03-21 | Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral MSE4 stev… |
CVE-2025-30346 | Medium | 5.4 | 2025-03-21 | Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests. |
CVE-2025-2583 | Low | 3.5 | 2025-03-21 | A vulnerability was found in SimpleMachines SMF 2.1.4. It has been classified as problematic. This affects an unknown part of the file ManageNews.php. The mani… |
CVE-2025-2582 | Low | 3.5 | 2025-03-21 | A vulnerability was found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the file ManageAtt… |
CVE-2025-30345 | Low | 3.5 | 2025-03-21 | An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat… |
CVE-2025-30344 | Medium | 5.3 | 2025-03-21 | An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a… |
CVE-2025-30343 | Low | 3.0 | 2025-03-21 | A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface all… |
CVE-2025-30342 | Medium | 5.4 | 2025-03-21 | An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows o… |
CVE-2025-2581 | Medium | 4.3 | 2025-03-21 | A vulnerability has been found in xmedcon 0.25.0 and classified as problematic. Affected by this vulnerability is the function malloc of the component DICOM Fi… |
CVE-2025-26336 | High | 8.3 | 2025-03-21 | Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40.200.202101130302, and Dell Chassis Management Controller Firmware… |
CVE-2025-2585 | High | 8.8 | 2025-03-21 | EBM Maintenance Center From EBM Technologies has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL comma… |
CVE-2025-29814 | Critical | 9.3 | 2025-03-21 | Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network. |
CVE-2025-29807 | High | 8.7 | 2025-03-21 | Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. |
CVE-2025-30334 | Medium | 6.5 | 2025-03-20 | In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash. |
CVE-2025-2574 | | 2025-03-20 | Out-of-bounds array write in Xpdf 4.05 and earlier, due to incorrect integer overflow checking in the PostScript function interpreter code. | |
CVE-2025-2538 | Critical | 9.8 | 2025-03-20 | A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthe… |
CVE-2025-25758 | High | 7.5 | 2025-03-20 | An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml |
CVE-2025-26853 | Critical | 10.0 | 2025-03-20 | DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema. |
CVE-2025-26852 | Critical | 10.0 | 2025-03-20 | DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection. |
CVE-2025-30160 | High | 7.5 | 2025-03-20 | Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condi… |
CVE-2025-2557 | Medium | 5.5 | 2025-03-20 | A vulnerability, which was classified as critical, has been found in Audi UTR Dashcam 2.0. Affected by this issue is some unknown functionality of the componen… |
CVE-2025-29980 | Critical | 9.8 | 2025-03-20 | A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrar… |
CVE-2025-29218 | Medium | 6.5 | 2025-03-20 | Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiPwd parameter at /goform/setModules. This vulnerability allows attackers to c… |
CVE-2025-29217 | Medium | 6.5 | 2025-03-20 | Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter at /goform/setModules. This vulnerability allows attackers to… |
CVE-2025-2556 | Medium | 4.3 | 2025-03-20 | A vulnerability classified as problematic was found in Audi UTR Dashcam 2.0. Affected by this vulnerability is an unknown functionality of the component Video… |
CVE-2025-2555 | Low | 2.9 | 2025-03-20 | A vulnerability classified as problematic has been found in Audi Universal Traffic Recorder App 2.0. Affected is an unknown function of the component FTP Crede… |
CVE-2025-2553 | Medium | 4.3 | 2025-03-20 | A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been rated as problematic. This issue affects some unknown processing of the file /g… |
CVE-2025-29923 | Low | 3.7 | 2025-03-20 | go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order whe… |
CVE-2025-29922 | Critical | 9.6 | 2025-03-20 | kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability… |
CVE-2025-29914 | Medium | 5.4 | 2025-03-20 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza w… |
CVE-2025-29215 | Medium | 6.5 | 2025-03-20 | Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_43fdcc function at /goform/SetNetControlList. |
CVE-2025-2565 | Medium | 4.3 | 2025-03-20 | The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.1… |
CVE-2025-2552 | Medium | 4.3 | 2025-03-20 | A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been declared as problematic. This vulnerability affects unknown code of the file /g… |
CVE-2025-2551 | Medium | 4.3 | 2025-03-20 | A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been classified as problematic. This affects an unknown part of the file /goform/for… |
CVE-2025-2550 | Medium | 4.3 | 2025-03-20 | A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-2549 | Medium | 4.3 | 2025-03-20 | A vulnerability has been found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2025-2480 | High | 7.8 | 2025-03-20 | Santesoft Sante DICOM Viewer Pro is vulnerable to an out-of-bounds write, which requires a user to open a malicious DCM file, resulting in execution of arbitra… |
CVE-2025-29149 | High | 7.5 | 2025-03-20 | Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function. |
CVE-2025-29121 | High | 7.5 | 2025-03-20 | A vulnerability was found in Tenda AC6 V15.03.05.16. The vulnerability affects the functionality of the /goform/fast_setting_wifi_set file form_fast_setting_wi… |
CVE-2025-2548 | Medium | 4.3 | 2025-03-20 | A vulnerability, which was classified as problematic, was found in D-Link DIR-618 and DIR-605L 2.02/3.02. Affected is an unknown function of the file /goform/f… |
CVE-2025-2547 | Medium | 4.3 | 2025-03-20 | A vulnerability, which was classified as problematic, has been found in D-Link DIR-618 and DIR-605L 2.02/3.02. This issue affects some unknown processing of th… |
CVE-2025-29214 | High | 7.5 | 2025-03-20 | Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function at /goform/setMacFilterCfg. |
CVE-2025-23120 | High | 8.8 | 2025-03-20 | A vulnerability allowing remote code execution (RCE) for domain users. |
CVE-2025-2546 | Medium | 4.3 | 2025-03-20 | A vulnerability classified as problematic was found in D-Link DIR-618 and DIR-605L 2.02/3.02. This vulnerability affects unknown code of the file /goform/formA… |
CVE-2025-29411 | Critical | 9.8 | 2025-03-20 | An arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary code via u… |
CVE-2025-29412 | Medium | 4.8 | 2025-03-20 | A cross-site scripting (XSS) vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary web sc… |
CVE-2025-29410 | Medium | 6.1 | 2025-03-20 | A cross-site scripting (XSS) vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbitrary web scripts o… |
CVE-2025-1496 | Medium | 6.5 | 2025-03-20 | Improper Restriction of Excessive Authentication Attempts vulnerability in BG-TEK Coslat Hotspot allows Password Brute Forcing, Authentication Abuse. This iss… |
CVE-2025-0254 | Medium | 5.9 | 2025-03-20 | HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. An attacker could intercept… |
CVE-2025-29101 | High | 7.5 | 2025-03-20 | Tenda AC8V4.0 V16.03.34.06 was discovered to contain a stack overflow via the deviceid parameter in the get_parentControl_list_Info function. |