2025 CVEs (page 385)
Page 385 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2337 | Medium | 6.3 | 2025-03-16 | A vulnerability, which was classified as critical, has been found in tbeu matio 1.5.28. This issue affects the function Mat_VarPrint of the file src/mat.c. The… |
CVE-2025-1624 | Low | 3.5 | 2025-03-16 | The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2025-1623 | Low | 3.5 | 2025-03-16 | The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2025-1622 | Low | 3.5 | 2025-03-16 | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2025-1621 | Medium | 4.8 | 2025-03-16 | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2025-1620 | Medium | 4.8 | 2025-03-16 | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2025-1619 | Medium | 4.8 | 2025-03-16 | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2025-24856 | Medium | 4.2 | 2025-03-16 | An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking atta… |
CVE-2025-30077 | Medium | 6.2 | 2025-03-16 | Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of numBits. |
CVE-2025-30076 | High | 7.7 | 2025-03-16 | Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter. |
CVE-2025-30074 | High | 7.8 | 2025-03-16 | Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine. |
CVE-2025-2335 | Low | 3.5 | 2025-03-16 | A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/register… |
CVE-2025-2334 | Medium | 5.4 | 2025-03-15 | A vulnerability classified as problematic has been found in 274056675 springboot-openai-chatgpt e84f6f5. This affects the function deleteChat of the file /api/… |
CVE-2025-27281 | High | 8.5 | 2025-03-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cookforweb All In Menu all-in-menu allows Blind SQL Injec… |
CVE-2025-26978 | High | 8.5 | 2025-03-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster… |
CVE-2025-26976 | High | 8.5 | 2025-03-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aldo Latino PrivateContent private-content.This issue aff… |
CVE-2025-26972 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound PrivateContent. This issue affects PrivateConten… |
CVE-2025-26969 | High | 8.3 | 2025-03-15 | Missing Authorization vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5. |
CVE-2025-26961 | High | 8.6 | 2025-03-15 | Missing Authorization vulnerability in FRESHFACE Fresh Framework fresh-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2025-26940 | Medium | 6.3 | 2025-03-15 | Path Traversal vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2. |
CVE-2025-26924 | Medium | 6.5 | 2025-03-15 | Improper Control of Generation of Code ('Code Injection') vulnerability in colabrio Ohio Extra ohio-extra allows Code Injection.This issue affects Ohio Extra… |
CVE-2025-26921 | High | 8.8 | 2025-03-15 | Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection… |
CVE-2025-26899 | Medium | 6.5 | 2025-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Recapture Cart Recovery and Email Marketing Recapture for WooCommerce recapture-for-woocommerce allows Cross… |
CVE-2025-26895 | Medium | 6.5 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows DOM-B… |
CVE-2025-26886 | High | 7.6 | 2025-03-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Authors publishpress-authors al… |
CVE-2025-26875 | Critical | 9.3 | 2025-03-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address Fo… |
CVE-2025-26556 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zzmaster WP AntiDDOS wpantiddos allows Reflected XSS.This… |
CVE-2025-26555 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thorsten Ott Debug-Bar-Extender debug-bar-extender allows… |
CVE-2025-26554 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicola Mustone WP Discord Post wp-discord-post allows Ref… |
CVE-2025-26553 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spring Devs Pre Order Addon for WooCommerce – Advance Ord… |
CVE-2025-26548 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kdmurray Random Image Selector random-image-selector allo… |
CVE-2025-23744 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dvs11 Random Posts, Mp3 Player + ShareButton random-posts… |
CVE-2025-25225 | Medium | 6.5 | 2025-03-15 | A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their… |
CVE-2025-2323 | Medium | 4.3 | 2025-03-15 | A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been declared as problematic. This vulnerability affects the function updateQu… |
CVE-2025-2322 | High | 7.3 | 2025-03-15 | A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been classified as critical. This affects an unknown part of the file /chatgpt… |
CVE-2025-2321 | Medium | 6.3 | 2025-03-15 | A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-2025 | Medium | 6.5 | 2025-03-15 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… |
CVE-2025-1530 | Medium | 4.3 | 2025-03-15 | The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to missing nonce validat… |
CVE-2025-1057 | Medium | 4.3 | 2025-03-15 | A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading databas… |
CVE-2025-2325 | High | 7.2 | 2025-03-15 | The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1.8 due to insuffici… |
CVE-2025-2157 | Low | 3.3 | 2025-03-15 | A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, ex… |
CVE-2025-30066 | High | 8.6 | 2025-03-15 | tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-1… |
CVE-2025-1773 | Medium | 6.1 | 2025-03-15 | The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to ins… |
CVE-2025-1771 | Critical | 9.8 | 2025-03-15 | The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' functio… |
CVE-2025-2267 | Medium | 6.5 | 2025-03-15 | The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insuff… |
CVE-2025-2164 | Medium | 6.1 | 2025-03-15 | The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' and 'sortby' parameters in all versions up to, and includ… |
CVE-2025-2163 | Medium | 6.1 | 2025-03-15 | The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incor… |
CVE-2025-1670 | Medium | 6.5 | 2025-03-15 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including… |
CVE-2025-1669 | Medium | 6.5 | 2025-03-15 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions up to, and includin… |
CVE-2025-1668 | Medium | 4.3 | 2025-03-15 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpsp_Delete… |
CVE-2025-1667 | High | 8.8 | 2025-03-15 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTea… |
CVE-2025-1657 | High | 8.8 | 2025-03-15 | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a mi… |
CVE-2025-1653 | High | 8.8 | 2025-03-15 | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This… |
CVE-2025-2320 | High | 7.3 | 2025-03-14 | A vulnerability has been found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this vulnerability is the function submit… |
CVE-2025-2295 | Low | 3.5 | 2025-03-14 | EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerabilit… |
CVE-2025-2310 | Medium | 5.3 | 2025-03-14 | A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder… |
CVE-2025-2309 | Medium | 5.3 | 2025-03-14 | A vulnerability has been found in HDF5 1.14.6 and classified as critical. This vulnerability affects the function H5T__bit_copy of the component Type Conversio… |
CVE-2025-2308 | Medium | 5.3 | 2025-03-14 | A vulnerability, which was classified as critical, was found in HDF5 1.14.6. This affects the function H5Z__scaleoffset_decompress_one_byte of the component Sc… |
CVE-2025-29782 | Medium | 5.4 | 2025-03-14 | WeGIA is Web manager for charitable institutions A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_docs_atendido.php` end… |
CVE-2025-29771 | | 2025-03-14 | HtmlSanitizer is a client-side HTML Sanitizer. Versions prior to 2.0.3 have a cross-site scripting vulnerability when the sanitizer is used with a `contentEdit… | |
CVE-2025-29780 | | 2025-03-14 | Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0… | |
CVE-2025-29779 | | 2025-03-14 | Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0… | |
CVE-2025-29775 | | 2025-03-14 | xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1… | |
CVE-2025-26312 | | 2025-03-14 | SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter. | |
CVE-2025-29774 | | 2025-03-14 | xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1… | |
CVE-2025-29387 | High | 7.1 | 2025-03-14 | In Tenda AC9 v1.0 V15.03.05.14_multi, the wanSpeed parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary… |
CVE-2025-29386 | Critical | 9.8 | 2025-03-14 | In Tenda AC9 v1.0 V15.03.05.14_multi, the mac parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code… |
CVE-2025-29385 | Critical | 9.8 | 2025-03-14 | In Tenda AC9 v1.0 V15.03.05.14_multi, the cloneType parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary… |
CVE-2025-29384 | Critical | 9.8 | 2025-03-14 | In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary co… |
CVE-2025-27606 | Medium | 5.1 | 2025-03-14 | Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user… |
CVE-2025-1888 | Medium | 4.6 | 2025-03-14 | The Leica Web Viewer within the Aperio Eslide Manager Application is vulnerable to reflected cross-site scripting (XSS). An authenticated user can access the s… |
CVE-2025-25873 | Medium | 5.5 | 2025-03-14 | Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges via the Change Root Password function |
CVE-2025-25872 | Medium | 5.5 | 2025-03-14 | An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function |
CVE-2025-25871 | High | 8.0 | 2025-03-14 | An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function |
CVE-2025-2268 | High | 7.5 | 2025-03-14 | The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Prin… |
CVE-2025-29776 | | 2025-03-14 | Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP. Calling `setTimer` in Azle versions `0.27.0`, `0.28.0`, and `0.29.0` causes an immediate in… | |
CVE-2025-29032 | Medium | 5.9 | 2025-03-14 | Tenda AC9 v15.03.05.19(6318) was discovered to contain a buffer overflow via the formWifiWpsOOB function. |
CVE-2025-29031 | Critical | 9.8 | 2025-03-14 | Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the fromAddressNat function. |
CVE-2025-29030 | Critical | 9.8 | 2025-03-14 | Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function. |
CVE-2025-29029 | Critical | 9.8 | 2025-03-14 | Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formSetSpeedWan function. |
CVE-2025-2304 | | 2025-03-14 | A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersContr… | |
CVE-2025-2000 | Critical | 9.8 | 2025-03-14 | A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A… |
CVE-2025-27595 | Critical | 9.8 | 2025-03-14 | The device uses a weak hashing alghorithm to create the password hash. Hence, a matching password can be easily calculated by an attacker. This impacts the sec… |
CVE-2025-27594 | High | 7.5 | 2025-03-14 | The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is p… |
CVE-2025-27593 | Critical | 9.3 | 2025-03-14 | The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target… |
CVE-2025-26626 | Medium | 6.5 | 2025-03-14 | The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package. Versions prior to 1.5.0 are vul… |
CVE-2025-2232 | Critical | 9.8 | 2025-03-14 | The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, an… |
CVE-2025-1507 | Medium | 5.3 | 2025-03-14 | The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the h… |
CVE-2025-1526 | Medium | 6.4 | 2025-03-14 | The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Display Widget (countdown feature) in all ver… |
CVE-2025-2221 | High | 7.5 | 2025-03-14 | The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and including, 1.7.6 due… |
CVE-2025-2289 | Medium | 4.3 | 2025-03-14 | The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all… |
CVE-2025-2103 | High | 8.8 | 2025-03-14 | The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability c… |
CVE-2025-1764 | High | 7.5 | 2025-03-14 | The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3… |
CVE-2025-0952 | High | 8.1 | 2025-03-14 | The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of serv… |
CVE-2025-2166 | Medium | 6.1 | 2025-03-14 | The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of rem… |
CVE-2025-2056 | High | 7.5 | 2025-03-14 | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the… |
CVE-2025-1528 | Medium | 4.3 | 2025-03-14 | The Search & Filter Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_meta_values' function i… |
CVE-2025-1285 | Medium | 5.3 | 2025-03-14 | The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_api_key and s… |
CVE-2025-0955 | Medium | 5.3 | 2025-03-14 | The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX ac… |
CVE-2025-30022 | Medium | 6.8 | 2025-03-14 | CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter. |