2025 CVEs (page 386)
Page 386 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-29787 | | 2025-03-17 | `zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the `zip` cra… | |
CVE-2025-29786 | High | 7.5 | 2025-03-17 | Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it… |
CVE-2025-27102 | | 2025-03-17 | Agate is central authentication server software for OBiBa epidemiology applications. Prior to version 3.3.0, when registering for an Agate account, arbitrary H… | |
CVE-2025-0833 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting Route Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x throug… |
CVE-2025-0832 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through R… |
CVE-2025-0830 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting Meeting Management in ENOVIA Change Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPE… |
CVE-2025-0829 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Relea… |
CVE-2025-0828 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting Engineering Release in ENOVIA Product Engineering Specialist from Release 3DEXPERIENCE R2022x throu… |
CVE-2025-0827 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DPlay in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an a… |
CVE-2025-0826 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting 3D Navigate in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Rel… |
CVE-2025-0601 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x throug… |
CVE-2025-0600 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows a… |
CVE-2025-0599 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allow… |
CVE-2025-0598 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Relea… |
CVE-2025-0596 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an… |
CVE-2025-0595 | High | 8.7 | 2025-03-17 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows… |
CVE-2025-2401 | | 2025-03-17 | Buffer overflow vulnerability in Immunity Debugger affecting version 1.85, its exploitation could allow a local attacker to execute arbitrary code, due to the… | |
CVE-2025-2378 | High | 7.3 | 2025-03-17 | A vulnerability was found in PHPGurukul Medical Card Generation System 1.0. It has been classified as critical. This affects an unknown part of the file /downl… |
CVE-2025-2377 | Low | 3.5 | 2025-03-17 | A vulnerability was found in SourceCodester Vehicle Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality o… |
CVE-2025-2376 | High | 7.3 | 2025-03-17 | A vulnerability has been found in viames Pair Framework up to 1.9.11 and classified as critical. Affected by this vulnerability is the function getCookieConten… |
CVE-2025-2375 | Low | 3.5 | 2025-03-17 | A vulnerability, which was classified as problematic, was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected is an unknown funct… |
CVE-2025-2374 | Medium | 6.3 | 2025-03-17 | A vulnerability, which was classified as critical, has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This issue affects some un… |
CVE-2025-2373 | Medium | 6.3 | 2025-03-17 | A vulnerability classified as critical was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This vulnerability affects unknown code of… |
CVE-2025-2202 | | 2025-03-17 | Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain sen… | |
CVE-2025-2372 | High | 7.3 | 2025-03-17 | A vulnerability classified as critical has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This affects an unknown part of the fi… |
CVE-2025-2371 | Low | 3.5 | 2025-03-17 | A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been rated as problematic. Affected by this issue is some u… |
CVE-2025-2201 | | 2025-03-17 | Broken access control vulnerability in the IcProgress Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain sensitive information… | |
CVE-2025-2200 | | 2025-03-17 | SQL injection vulnerability in the IcProgreso Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain, update and delete data from t… | |
CVE-2025-2199 | | 2025-03-17 | SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain, update and… | |
CVE-2025-2370 | High | 8.8 | 2025-03-17 | A vulnerability was found in TOTOLINK EX1800T up to 9.1.0cu.2112_B20220316. It has been declared as critical. Affected by this vulnerability is the function se… |
CVE-2025-2369 | High | 8.8 | 2025-03-17 | A vulnerability was found in TOTOLINK EX1800T up to 9.1.0cu.2112_B20220316. It has been classified as critical. Affected is the function setPasswordCfg of the… |
CVE-2025-2368 | Medium | 6.3 | 2025-03-17 | A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryRea… |
CVE-2025-2367 | Medium | 6.3 | 2025-03-17 | A vulnerability has been found in Oiwtech OIW-2431APGN-HP 2.5.3-B20131128 and classified as critical. This vulnerability affects unknown code of the file /boaf… |
CVE-2025-2366 | Low | 2.4 | 2025-03-17 | A vulnerability, which was classified as problematic, was found in gougucms 4.08.18. This affects the function add of the file /admin/department/add of the com… |
CVE-2025-2365 | Medium | 6.3 | 2025-03-17 | A vulnerability, which was classified as problematic, has been found in crmeb_java up to 1.3.4. Affected by this issue is the function webHook of the file WeCh… |
CVE-2025-1724 | High | 7.4 | 2025-03-17 | Zohocorp's ManageEngine Analytics Plus and Zoho Analytics on-premise versions older than 6130 are vulnerable to an AD only account takeover because of a hardco… |
CVE-2025-2396 | High | 8.8 | 2025-03-17 | The U-Office Force from e-Excellence has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and execute web sh… |
CVE-2025-2395 | Critical | 9.8 | 2025-03-17 | The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter… |
CVE-2025-2364 | Low | 3.5 | 2025-03-17 | A vulnerability classified as problematic was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function addNewArticle of the file blogse… |
CVE-2025-2363 | Medium | 6.3 | 2025-03-17 | A vulnerability classified as critical has been found in lenve VBlog up to 1.0.0. Affected is the function uploadImg of the file blogserver/src/main/java/org/s… |
CVE-2025-2362 | High | 7.3 | 2025-03-17 | A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-2361 | Medium | 4.3 | 2025-03-17 | A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component W… |
CVE-2025-2360 | High | 7.3 | 2025-03-17 | A vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is the function SetUpnpSettings of the fi… |
CVE-2025-2359 | High | 7.3 | 2025-03-17 | A vulnerability classified as critical has been found in D-Link DIR-823G 1.0.2B05_20181207. Affected is the function SetDDNSSettings of the file /HNAP1/ of the… |
CVE-2025-2358 | Medium | 6.3 | 2025-03-17 | A vulnerability was found in Shenzhen Mingyuan Cloud Technology Mingyuan Real Estate ERP System 1.0. It has been rated as critical. This issue affects some unk… |
CVE-2025-2357 | Medium | 6.3 | 2025-03-17 | A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. T… |
CVE-2025-2356 | Low | 3.7 | 2025-03-17 | A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API H… |
CVE-2025-2355 | Low | 3.3 | 2025-03-17 | A vulnerability was found in BlackVue App 3.65 on Android and classified as problematic. Affected by this issue is some unknown functionality of the component… |
CVE-2025-30089 | Medium | 5.4 | 2025-03-17 | gurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences. |
CVE-2025-2354 | Medium | 4.3 | 2025-03-17 | A vulnerability has been found in VAM Virtual Airlines Manager 2.6.2 and classified as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2025-2353 | High | 7.3 | 2025-03-17 | A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/inde… |
CVE-2025-2352 | Low | 2.4 | 2025-03-16 | A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /adm… |
CVE-2025-2351 | High | 7.3 | 2025-03-16 | A vulnerability classified as critical was found in DayCloud StudentManage 1.0. This vulnerability affects unknown code of the file /admin/adminScoreUrl of the… |
CVE-2025-2350 | Medium | 6.3 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-2349 | Low | 3.1 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2025-2348 | Medium | 4.3 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been classified as problematic. Affected is an unknown function of the file /mnt/extsd/e… |
CVE-2025-2347 | Medium | 6.3 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam FX2 up to 20250308 and classified as problematic. This issue affects some unknown processing of the component Devic… |
CVE-2025-2346 | Medium | 5.6 | 2025-03-16 | A vulnerability has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308 and classified as problematic. This vulnerability affects unknown code of th… |
CVE-2025-2345 | Critical | 9.8 | 2025-03-16 | A vulnerability, which was classified as very critical, was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. This affects an unknown part. The manipu… |
CVE-2025-2344 | Medium | 5.3 | 2025-03-16 | A vulnerability, which was classified as critical, has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this issue is some unknown f… |
CVE-2025-2343 | High | 7.5 | 2025-03-16 | A vulnerability classified as critical was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-2342 | Medium | 5.3 | 2025-03-16 | A vulnerability classified as critical has been found in IROAD X5 Mobile App up to 5.2.5 on Android. Affected is an unknown function of the component API Endpo… |
CVE-2025-2341 | Low | 3.1 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam X5 up to 20250203. It has been rated as problematic. This issue affects some unknown processing of the component SS… |
CVE-2025-2340 | Low | 2.4 | 2025-03-16 | A vulnerability was found in otale Tale Blog 2.0.5. It has been declared as problematic. This vulnerability affects the function saveOptions of the file /optio… |
CVE-2025-2339 | Medium | 5.3 | 2025-03-16 | A vulnerability was found in otale Tale Blog 2.0.5. It has been classified as problematic. This affects an unknown part of the file /%61dmin/api/logs. The mani… |
CVE-2025-2338 | Medium | 6.3 | 2025-03-16 | A vulnerability, which was classified as critical, was found in tbeu matio 1.5.28. Affected is the function strdup_vprintf of the file src/io.c. The manipulati… |
CVE-2025-2337 | Medium | 6.3 | 2025-03-16 | A vulnerability, which was classified as critical, has been found in tbeu matio 1.5.28. This issue affects the function Mat_VarPrint of the file src/mat.c. The… |
CVE-2025-1624 | Low | 3.5 | 2025-03-16 | The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2025-1623 | Low | 3.5 | 2025-03-16 | The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2025-1622 | Low | 3.5 | 2025-03-16 | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2025-1621 | Medium | 4.8 | 2025-03-16 | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2025-1620 | Medium | 4.8 | 2025-03-16 | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2025-1619 | Medium | 4.8 | 2025-03-16 | The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2025-24856 | Medium | 4.2 | 2025-03-16 | An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking atta… |
CVE-2025-30077 | Medium | 6.2 | 2025-03-16 | Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of numBits. |
CVE-2025-30076 | High | 7.7 | 2025-03-16 | Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter. |
CVE-2025-30074 | High | 7.8 | 2025-03-16 | Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine. |
CVE-2025-2335 | Low | 3.5 | 2025-03-16 | A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/register… |
CVE-2025-2334 | Medium | 5.4 | 2025-03-15 | A vulnerability classified as problematic has been found in 274056675 springboot-openai-chatgpt e84f6f5. This affects the function deleteChat of the file /api/… |
CVE-2025-27281 | High | 8.5 | 2025-03-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cookforweb All In Menu all-in-menu allows Blind SQL Injec… |
CVE-2025-26978 | High | 8.5 | 2025-03-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster… |
CVE-2025-26976 | High | 8.5 | 2025-03-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aldo Latino PrivateContent private-content.This issue aff… |
CVE-2025-26972 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound PrivateContent. This issue affects PrivateConten… |
CVE-2025-26969 | High | 8.3 | 2025-03-15 | Missing Authorization vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5. |
CVE-2025-26961 | High | 8.6 | 2025-03-15 | Missing Authorization vulnerability in FRESHFACE Fresh Framework fresh-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2025-26940 | Medium | 6.3 | 2025-03-15 | Path Traversal vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2. |
CVE-2025-26924 | Medium | 6.5 | 2025-03-15 | Improper Control of Generation of Code ('Code Injection') vulnerability in colabrio Ohio Extra ohio-extra allows Code Injection.This issue affects Ohio Extra… |
CVE-2025-26921 | High | 8.8 | 2025-03-15 | Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection… |
CVE-2025-26899 | Medium | 6.5 | 2025-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Recapture Cart Recovery and Email Marketing Recapture for WooCommerce recapture-for-woocommerce allows Cross… |
CVE-2025-26895 | Medium | 6.5 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows DOM-B… |
CVE-2025-26886 | High | 7.6 | 2025-03-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Authors publishpress-authors al… |
CVE-2025-26875 | Critical | 9.3 | 2025-03-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address Fo… |
CVE-2025-26556 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zzmaster WP AntiDDOS wpantiddos allows Reflected XSS.This… |
CVE-2025-26555 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thorsten Ott Debug-Bar-Extender debug-bar-extender allows… |
CVE-2025-26554 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicola Mustone WP Discord Post wp-discord-post allows Ref… |
CVE-2025-26553 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spring Devs Pre Order Addon for WooCommerce – Advance Ord… |
CVE-2025-26548 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kdmurray Random Image Selector random-image-selector allo… |
CVE-2025-23744 | High | 7.1 | 2025-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dvs11 Random Posts, Mp3 Player + ShareButton random-posts… |
CVE-2025-25225 | Medium | 6.5 | 2025-03-15 | A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their… |
CVE-2025-2323 | Medium | 4.3 | 2025-03-15 | A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been declared as problematic. This vulnerability affects the function updateQu… |