2025 CVEs (page 385)
Page 385 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-25042 | Medium | 4.3 | 2025-03-18 | A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploit… |
CVE-2025-25040 | Low | 3.3 | 2025-03-18 | A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects… |
CVE-2025-24801 | High | 8.5 | 2025-03-18 | GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. Th… |
CVE-2025-24799 | High | 7.5 | 2025-03-18 | GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability… |
CVE-2025-21619 | Critical | 9.8 | 2025-03-18 | GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerabi… |
CVE-2025-2487 | Medium | 4.9 | 2025-03-18 | A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return… |
CVE-2025-26138 | Medium | 6.5 | 2025-03-18 | Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible vi… |
CVE-2025-26137 | High | 7.5 | 2025-03-18 | Systemic Risk Value <=2.8.0 is vulnerable to Local File Inclusion via /GetFile.aspx?ReportUrl=. An unauthenticated attacker can exploit this issue to read arbi… |
CVE-2025-25595 | Critical | 9.8 | 2025-03-18 | A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack. |
CVE-2025-27688 | High | 7.8 | 2025-03-18 | Dell ThinOS 2408 and prior, contains an improper permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerab… |
CVE-2025-25589 | High | 8.1 | 2025-03-18 | An XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitr… |
CVE-2025-25586 | Medium | 4.2 | 2025-03-18 | yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml. |
CVE-2025-25582 | Medium | 6.1 | 2025-03-18 | yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.xml. |
CVE-2025-30132 | Critical | 9.1 | 2025-03-18 | An issue was discovered on IROAD Dashcam V devices. It uses an unregistered public domain name as an internal domain, creating a security risk. During analysis… |
CVE-2025-30123 | Critical | 9.8 | 2025-03-18 | An issue was discovered on ROADCAM X3 devices. The mobile app APK (Viidure) contains hardcoded FTP credentials for the FTPX user account, enabling attackers to… |
CVE-2025-30122 | Critical | 9.8 | 2025-03-18 | An issue was discovered on ROADCAM X3 devices. It has a uniform default credential set that cannot be modified by users, making it easy for attackers to gain u… |
CVE-2025-30117 | High | 7.3 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be… |
CVE-2025-30116 | High | 7.5 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Remotely Dumping of Video Footage and the Live Video Stream can occur. It allows rem… |
CVE-2025-30115 | Critical | 9.8 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSID and password ("q… |
CVE-2025-30114 | Critical | 9.1 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Bypassing of Device Pairing can occur. The pairing mechanism relies solely on the co… |
CVE-2025-30113 | Critical | 9.8 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Hardcoded Credentials exist in the APK for Ports 9091 and 9092. The dashcam's Androi… |
CVE-2025-30111 | High | 7.5 | 2025-03-18 | On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. The dashcam exposes endpoints that allow unauthorized users, who gained acc… |
CVE-2025-30110 | Medium | 6.5 | 2025-03-18 | On IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. The dashcam's pairing mechanism relies solely on MAC address verification… |
CVE-2025-30109 | Medium | 6.5 | 2025-03-18 | In the IROAD APK 5.2.5, there are Hardcoded Credentials in the APK for ports 9091 and 9092. The mobile application for the dashcam contains hardcoded credentia… |
CVE-2025-30107 | High | 7.5 | 2025-03-18 | On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. A vulnerability in… |
CVE-2025-2491 | Low | 2.4 | 2025-03-18 | A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com/ujcms/cms/ext/web/… |
CVE-2025-25590 | Medium | 6.1 | 2025-03-18 | yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml. |
CVE-2025-25585 | High | 7.3 | 2025-03-18 | Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbitrarily modify Admin… |
CVE-2025-25580 | Medium | 6.1 | 2025-03-18 | yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml/UserMapper.xml. |
CVE-2025-30106 | High | 8.8 | 2025-03-18 | On IROAD v9 devices, the dashcam has hardcoded default credentials ("qwertyuiop") that cannot be changed by the user. This allows an attacker within Wi-Fi rang… |
CVE-2025-2490 | Low | 2.4 | 2025-03-18 | A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload of the file /main/j… |
CVE-2025-2450 | High | 8.8 | 2025-03-18 | NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2025-2449 | High | 8.8 | 2025-03-18 | NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary f… |
CVE-2025-25500 | High | 7.5 | 2025-03-18 | An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. T… |
CVE-2025-2495 | Medium | 5.4 | 2025-03-18 | Stored Cross-Site Scripting (XSS) in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to upload XML files to the server with JavaScr… |
CVE-2025-2494 | Critical | 9.8 | 2025-03-18 | Unrestricted file upload to Softdial Contact Center of Sytel Ltd. This vulnerability could allow an attacker to upload files to the server via the ‘/softdial/p… |
CVE-2025-2493 | High | 7.5 | 2025-03-18 | Path Traversal vulnerability in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to manipulate the ‘id’ parameter of the ‘/softdial/… |
CVE-2025-2489 | | 2025-03-18 | Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application pass… | |
CVE-2025-1468 | High | 7.5 | 2025-03-18 | An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-… |
CVE-2025-0694 | Medium | 6.6 | 2025-03-18 | Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access. |
CVE-2025-25220 | High | 8.8 | 2025-03-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.1_1101. If this vul… |
CVE-2025-24306 | High | 7.2 | 2025-03-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.0_1101. If this vul… |
CVE-2025-0755 | High | 8.4 | 2025-03-18 | The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final… |
CVE-2025-2262 | High | 7.3 | 2025-03-18 | The The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin for WordPress is vulnerable to arbitrary shortcode executi… |
CVE-2025-2473 | High | 7.3 | 2025-03-18 | A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2025-2472 | High | 7.3 | 2025-03-18 | A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2025-2471 | Medium | 6.3 | 2025-03-18 | A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. Affected is an unknown function of the file /boat-details.p… |
CVE-2025-2420 | Medium | 4.3 | 2025-03-17 | A vulnerability classified as problematic was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. Affected by this vulnerability is an unknown… |
CVE-2025-29913 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29912 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29911 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-2419 | Medium | 6.3 | 2025-03-17 | A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file… |
CVE-2025-2398 | High | 7.2 | 2025-03-17 | A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been rated as critical… |
CVE-2025-29910 | High | 7.5 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29909 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29781 | Medium | 6.5 | 2025-03-17 | The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitra… |
CVE-2025-2397 | Low | 2.4 | 2025-03-17 | A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been declared as proble… |
CVE-2025-2393 | Medium | 4.7 | 2025-03-17 | A vulnerability, which was classified as critical, was found in code-projects Online Class and Exam Scheduling System 1.0. Affected is an unknown function of t… |
CVE-2025-29426 | Medium | 4.6 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/class.php via the id and cys parameters. |
CVE-2025-2392 | Medium | 4.7 | 2025-03-17 | A vulnerability, which was classified as critical, has been found in code-projects Online Class and Exam Scheduling System 1.0. This issue affects some unknown… |
CVE-2025-2391 | High | 7.3 | 2025-03-17 | A vulnerability classified as critical was found in code-projects Blood Bank Management System 1.0. This vulnerability affects unknown code of the file /admin/… |
CVE-2025-26393 | Medium | 5.4 | 2025-03-17 | SolarWinds Service Desk is affected by a broken access control vulnerability. The issue allows authenticated users to escalate privileges, leading to unauthori… |
CVE-2025-25914 | Critical | 9.8 | 2025-03-17 | SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter |
CVE-2025-24185 | Medium | 5.5 | 2025-03-17 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3… |
CVE-2025-0495 | | 2025-03-17 | Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute valu… | |
CVE-2025-2390 | Medium | 6.3 | 2025-03-17 | A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the file /user_dashboa… |
CVE-2025-2389 | Medium | 4.7 | 2025-03-17 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-29427 | Medium | 5.9 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in profile.php via the member_first and member_last para… |
CVE-2025-29425 | Medium | 5.5 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System 1.0 is vulnerable to SQL Injection in exam_save.php via the parameters member and first. |
CVE-2025-26042 | Medium | 6.0 | 2025-03-17 | Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it… |
CVE-2025-2388 | High | 7.3 | 2025-03-17 | A vulnerability was found in Keytop 路内停车收费系统 2.7.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /s… |
CVE-2025-2387 | High | 7.3 | 2025-03-17 | A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file /a… |
CVE-2025-29430 | Medium | 4.1 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/room.php via the id and rome parameters. |
CVE-2025-29429 | Medium | 6.1 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/program.php via the id, code, and name paramet… |
CVE-2025-26125 | High | 7.3 | 2025-03-17 | An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges. |
CVE-2025-22473 | High | 7.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2025-22472 | High | 7.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2025-2386 | High | 7.3 | 2025-03-17 | A vulnerability was found in PHPGurukul Local Services Search Engine Management System 1.0 and classified as critical. This issue affects some unknown processi… |
CVE-2025-2385 | High | 7.3 | 2025-03-17 | A vulnerability has been found in code-projects Modern Bag 1.0 and classified as critical. This vulnerability affects unknown code of the file /login.php. The… |
CVE-2025-2241 | High | 8.2 | 2025-03-17 | A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be e… |
CVE-2025-29431 | Low | 3.2 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/department.php via the id, code, and name para… |
CVE-2025-25685 | High | 7.5 | 2025-03-17 | An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0. Attackers are able to download arbitrary files from the device's file system via adding symbolic… |
CVE-2025-25684 | High | 7.5 | 2025-03-17 | A lack of validation in the path parameter (/download) of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file… |
CVE-2025-22474 | Medium | 6.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) a Server-Side Request Forgery (SSRF) vulnerability. A high privil… |
CVE-2025-30143 | Medium | 5.4 | 2025-03-17 | Rule 3000216 (before version 2) in Akamai App & API Protector (with Akamai ASE) before 2024-12-10 does not properly consider JavaScript variable assignment to… |
CVE-2025-2384 | Medium | 6.3 | 2025-03-17 | A vulnerability, which was classified as critical, was found in code-projects Real Estate Property Management System 1.0. This affects an unknown part of the f… |
CVE-2025-2383 | High | 7.3 | 2025-03-17 | A vulnerability, which was classified as critical, has been found in PHPGurukul Doctor Appointment Management System 1.0. Affected by this issue is some unknow… |
CVE-2025-2382 | High | 7.3 | 2025-03-17 | A vulnerability classified as critical was found in PHPGurukul Online Banquet Booking System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-2381 | High | 7.3 | 2025-03-17 | A vulnerability classified as critical has been found in PHPGurukul Curfew e-Pass Management System 1.0. Affected is an unknown function of the file /admin/sea… |
CVE-2025-27512 | | 2025-03-17 | Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatom… | |
CVE-2025-26127 | Medium | 5.0 | 2025-03-17 | A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbitrary web scripts or… |
CVE-2025-25650 | Critical | 9.1 | 2025-03-17 | An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards to bypass authentica… |
CVE-2025-25621 | Medium | 4.3 | 2025-03-17 | Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers. This affected endpoint is /courses… |
CVE-2025-25618 | Low | 3.3 | 2025-03-17 | Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teachers. |
CVE-2025-25612 | High | 7.1 | 2025-03-17 | FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration functionality of the ad… |
CVE-2025-1774 | | 2025-03-17 | Incorrect string encoding vulnerability in NASK - PIB BotSense allows injection of an additional field separator character or value in the content of some fiel… | |
CVE-2025-1398 | Low | 3.3 | 2025-03-17 | Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency… |
CVE-2025-2380 | High | 7.3 | 2025-03-17 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2025-2379 | High | 7.3 | 2025-03-17 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2025-29788 | Medium | 6.5 | 2025-03-17 | The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. A vulnerability in versions prior to 1.6.1, 1.7.1, and 2.0.1 allows… |