2025 CVEs (page 383)
Page 383 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30196 | Medium | 6.5 | 2025-03-19 | Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` scheme, resulting in a st… |
CVE-2025-30154 | High | 8.6 | 2025-03-19 | reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with… |
CVE-2025-30153 | High | 7.5 | 2025-03-19 | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema al… |
CVE-2025-30152 | Medium | 6.5 | 2025-03-19 | The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. Prior to 1.6.2, 1.7.2, and 2.0.2, a discovered vulnerability allows… |
CVE-2025-30144 | Medium | 6.5 | 2025-03-19 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519… |
CVE-2025-2324 | Medium | 5.9 | 2025-03-19 | Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This… |
CVE-2025-29783 | Critical | 9.0 | 2025-03-19 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed d… |
CVE-2025-29770 | Medium | 6.5 | 2025-03-19 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines library is one of the backends used by vLLM to support struc… |
CVE-2025-29401 | Critical | 9.8 | 2025-03-19 | An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2025-29137 | Critical | 9.8 | 2025-03-19 | Tenda AC7 V1.0 V15.03.06.44 found a buffer overflow caused by the timeZone parameter in the form_fast_setting_wifi_set function, which can cause RCE. |
CVE-2025-26486 | Medium | 6.0 | 2025-03-19 | Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way Hash with a Predicta… |
CVE-2025-26485 | Medium | 5.8 | 2025-03-19 | A vulnerability in Beta80 Life 1st enables the retrieval of different error messages for failed authentication attempts (in case of the usage of a wrong passw… |
CVE-2025-26475 | Medium | 5.5 | 2025-03-19 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, Enables Live-Restore setting which enhances security by keeping containers running duri… |
CVE-2025-23382 | Medium | 5.5 | 2025-03-19 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, contain(s) an Exposure of Sensitive System Information to an Unauthorized Control Spher… |
CVE-2025-1758 | Medium | 4.3 | 2025-03-19 | Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versio… |
CVE-2025-1472 | Medium | 4.3 | 2025-03-19 | Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No… |
CVE-2025-2512 | Critical | 9.8 | 2025-03-19 | The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload() f… |
CVE-2025-2511 | Medium | 4.9 | 2025-03-19 | The AHAthat Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.6 due to insuf… |
CVE-2025-27018 | Medium | 6.3 | 2025-03-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG… |
CVE-2025-30236 | High | 8.6 | 2025-03-19 | Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST req… |
CVE-2025-30235 | Low | 3.5 | 2025-03-19 | Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication attempts, but instead a… |
CVE-2025-1232 | High | 8.8 | 2025-03-19 | The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perf… |
CVE-2025-30234 | High | 8.3 | 2025-03-19 | SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a Debian 12 LX zone imag… |
CVE-2025-2290 | Medium | 5.3 | 2025-03-19 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability… |
CVE-2025-30140 | High | 7.5 | 2025-03-18 | An issue was discovered on G-Net Dashcam BB GONX devices. A Public Domain name is Used for the Internal Domain Name. It uses an unregistered public domain name… |
CVE-2025-30142 | High | 8.1 | 2025-03-18 | An issue was discovered on G-Net Dashcam BB GONX devices. Bypassing of Device Pairing can occur. It uses MAC address verification as the sole mechanism for rec… |
CVE-2025-30141 | High | 7.5 | 2025-03-18 | An issue was discovered on G-Net Dashcam BB GONX devices. One can Remotely Dump Video Footage and the Live Video Stream. It exposes API endpoints on ports 9091… |
CVE-2025-30139 | Critical | 9.8 | 2025-03-18 | An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with default credentials t… |
CVE-2025-30138 | Medium | 4.6 | 2025-03-18 | An issue was discovered on G-Net Dashcam BB GONX devices. Managing Settings and Obtaining Sensitive Data and Sabotaging Car Battery can be performed by unautho… |
CVE-2025-30137 | Critical | 9.8 | 2025-03-18 | An issue was discovered in the G-Net GNET APK 2.6.2. Hardcoded credentials exist in in APK for ports 9091 and 9092. The GNET mobile application contains hardco… |
CVE-2025-29930 | | 2025-03-18 | imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $_GET['seoOp'] parameter is manipulated to include maliciou… | |
CVE-2025-29907 | High | 7.5 | 2025-03-18 | jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and den… |
CVE-2025-29790 | Medium | 5.4 | 2025-03-18 | Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fi… |
CVE-2025-27080 | Medium | 6.0 | 2025-03-18 | Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation c… |
CVE-2025-25042 | Medium | 4.3 | 2025-03-18 | A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploit… |
CVE-2025-25040 | Low | 3.3 | 2025-03-18 | A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects… |
CVE-2025-24801 | High | 8.5 | 2025-03-18 | GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. Th… |
CVE-2025-24799 | High | 7.5 | 2025-03-18 | GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability… |
CVE-2025-21619 | Critical | 9.8 | 2025-03-18 | GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerabi… |
CVE-2025-2487 | Medium | 4.9 | 2025-03-18 | A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return… |
CVE-2025-26138 | Medium | 6.5 | 2025-03-18 | Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible vi… |
CVE-2025-26137 | High | 7.5 | 2025-03-18 | Systemic Risk Value <=2.8.0 is vulnerable to Local File Inclusion via /GetFile.aspx?ReportUrl=. An unauthenticated attacker can exploit this issue to read arbi… |
CVE-2025-25595 | Critical | 9.8 | 2025-03-18 | A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack. |
CVE-2025-27688 | High | 7.8 | 2025-03-18 | Dell ThinOS 2408 and prior, contains an improper permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerab… |
CVE-2025-25589 | High | 8.1 | 2025-03-18 | An XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitr… |
CVE-2025-25586 | Medium | 4.2 | 2025-03-18 | yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml. |
CVE-2025-25582 | Medium | 6.1 | 2025-03-18 | yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.xml. |
CVE-2025-30132 | Critical | 9.1 | 2025-03-18 | An issue was discovered on IROAD Dashcam V devices. It uses an unregistered public domain name as an internal domain, creating a security risk. During analysis… |
CVE-2025-30123 | Critical | 9.8 | 2025-03-18 | An issue was discovered on ROADCAM X3 devices. The mobile app APK (Viidure) contains hardcoded FTP credentials for the FTPX user account, enabling attackers to… |
CVE-2025-30122 | Critical | 9.8 | 2025-03-18 | An issue was discovered on ROADCAM X3 devices. It has a uniform default credential set that cannot be modified by users, making it easy for attackers to gain u… |
CVE-2025-30117 | High | 7.3 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be… |
CVE-2025-30116 | High | 7.5 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Remotely Dumping of Video Footage and the Live Video Stream can occur. It allows rem… |
CVE-2025-30115 | Critical | 9.8 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSID and password ("q… |
CVE-2025-30114 | Critical | 9.1 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Bypassing of Device Pairing can occur. The pairing mechanism relies solely on the co… |
CVE-2025-30113 | Critical | 9.8 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Hardcoded Credentials exist in the APK for Ports 9091 and 9092. The dashcam's Androi… |
CVE-2025-30111 | High | 7.5 | 2025-03-18 | On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. The dashcam exposes endpoints that allow unauthorized users, who gained acc… |
CVE-2025-30110 | Medium | 6.5 | 2025-03-18 | On IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. The dashcam's pairing mechanism relies solely on MAC address verification… |
CVE-2025-30109 | Medium | 6.5 | 2025-03-18 | In the IROAD APK 5.2.5, there are Hardcoded Credentials in the APK for ports 9091 and 9092. The mobile application for the dashcam contains hardcoded credentia… |
CVE-2025-30107 | High | 7.5 | 2025-03-18 | On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. A vulnerability in… |
CVE-2025-2491 | Low | 2.4 | 2025-03-18 | A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com/ujcms/cms/ext/web/… |
CVE-2025-25590 | Medium | 6.1 | 2025-03-18 | yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml. |
CVE-2025-25585 | High | 7.3 | 2025-03-18 | Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbitrarily modify Admin… |
CVE-2025-25580 | Medium | 6.1 | 2025-03-18 | yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml/UserMapper.xml. |
CVE-2025-30106 | High | 8.8 | 2025-03-18 | On IROAD v9 devices, the dashcam has hardcoded default credentials ("qwertyuiop") that cannot be changed by the user. This allows an attacker within Wi-Fi rang… |
CVE-2025-2490 | Low | 2.4 | 2025-03-18 | A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload of the file /main/j… |
CVE-2025-2450 | High | 8.8 | 2025-03-18 | NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2025-2449 | High | 8.8 | 2025-03-18 | NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary f… |
CVE-2025-25500 | High | 7.5 | 2025-03-18 | An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. T… |
CVE-2025-2495 | Medium | 5.4 | 2025-03-18 | Stored Cross-Site Scripting (XSS) in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to upload XML files to the server with JavaScr… |
CVE-2025-2494 | Critical | 9.8 | 2025-03-18 | Unrestricted file upload to Softdial Contact Center of Sytel Ltd. This vulnerability could allow an attacker to upload files to the server via the ‘/softdial/p… |
CVE-2025-2493 | High | 7.5 | 2025-03-18 | Path Traversal vulnerability in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to manipulate the ‘id’ parameter of the ‘/softdial/… |
CVE-2025-2489 | | 2025-03-18 | Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application pass… | |
CVE-2025-1468 | High | 7.5 | 2025-03-18 | An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-… |
CVE-2025-0694 | Medium | 6.6 | 2025-03-18 | Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access. |
CVE-2025-25220 | High | 8.8 | 2025-03-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.1_1101. If this vul… |
CVE-2025-24306 | High | 7.2 | 2025-03-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.0_1101. If this vul… |
CVE-2025-0755 | High | 8.4 | 2025-03-18 | The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final… |
CVE-2025-2262 | High | 7.3 | 2025-03-18 | The The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin for WordPress is vulnerable to arbitrary shortcode executi… |
CVE-2025-2473 | High | 7.3 | 2025-03-18 | A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2025-2472 | High | 7.3 | 2025-03-18 | A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2025-2471 | Medium | 6.3 | 2025-03-18 | A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. Affected is an unknown function of the file /boat-details.p… |
CVE-2025-2420 | Medium | 4.3 | 2025-03-17 | A vulnerability classified as problematic was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. Affected by this vulnerability is an unknown… |
CVE-2025-29913 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29912 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29911 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-2419 | Medium | 6.3 | 2025-03-17 | A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file… |
CVE-2025-2398 | High | 7.2 | 2025-03-17 | A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been rated as critical… |
CVE-2025-29910 | High | 7.5 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29909 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29781 | Medium | 6.5 | 2025-03-17 | The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitra… |
CVE-2025-2397 | Low | 2.4 | 2025-03-17 | A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been declared as proble… |
CVE-2025-2393 | Medium | 4.7 | 2025-03-17 | A vulnerability, which was classified as critical, was found in code-projects Online Class and Exam Scheduling System 1.0. Affected is an unknown function of t… |
CVE-2025-29426 | Medium | 4.6 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/class.php via the id and cys parameters. |
CVE-2025-2392 | Medium | 4.7 | 2025-03-17 | A vulnerability, which was classified as critical, has been found in code-projects Online Class and Exam Scheduling System 1.0. This issue affects some unknown… |
CVE-2025-2391 | High | 7.3 | 2025-03-17 | A vulnerability classified as critical was found in code-projects Blood Bank Management System 1.0. This vulnerability affects unknown code of the file /admin/… |
CVE-2025-26393 | Medium | 5.4 | 2025-03-17 | SolarWinds Service Desk is affected by a broken access control vulnerability. The issue allows authenticated users to escalate privileges, leading to unauthori… |
CVE-2025-25914 | Critical | 9.8 | 2025-03-17 | SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter |
CVE-2025-24185 | Medium | 5.5 | 2025-03-17 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3… |
CVE-2025-0495 | | 2025-03-17 | Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute valu… | |
CVE-2025-2390 | Medium | 6.3 | 2025-03-17 | A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the file /user_dashboa… |