2025 CVEs (page 387)
Page 387 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2322 | High | 7.3 | 2025-03-15 | A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been classified as critical. This affects an unknown part of the file /chatgpt… |
CVE-2025-2321 | Medium | 6.3 | 2025-03-15 | A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-2025 | Medium | 6.5 | 2025-03-15 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… |
CVE-2025-1530 | Medium | 4.3 | 2025-03-15 | The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to missing nonce validat… |
CVE-2025-1057 | Medium | 4.3 | 2025-03-15 | A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading databas… |
CVE-2025-2325 | High | 7.2 | 2025-03-15 | The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1.8 due to insuffici… |
CVE-2025-2157 | Low | 3.3 | 2025-03-15 | A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, ex… |
CVE-2025-30066 | High | 8.6 | 2025-03-15 | tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-1… |
CVE-2025-1773 | Medium | 6.1 | 2025-03-15 | The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to ins… |
CVE-2025-1771 | Critical | 9.8 | 2025-03-15 | The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' functio… |
CVE-2025-2267 | Medium | 6.5 | 2025-03-15 | The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insuff… |
CVE-2025-2164 | Medium | 6.1 | 2025-03-15 | The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' and 'sortby' parameters in all versions up to, and includ… |
CVE-2025-2163 | Medium | 6.1 | 2025-03-15 | The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incor… |
CVE-2025-1670 | Medium | 6.5 | 2025-03-15 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including… |
CVE-2025-1669 | Medium | 6.5 | 2025-03-15 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions up to, and includin… |
CVE-2025-1668 | Medium | 4.3 | 2025-03-15 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpsp_Delete… |
CVE-2025-1667 | High | 8.8 | 2025-03-15 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTea… |
CVE-2025-1657 | High | 8.8 | 2025-03-15 | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a mi… |
CVE-2025-1653 | High | 8.8 | 2025-03-15 | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This… |
CVE-2025-2320 | High | 7.3 | 2025-03-14 | A vulnerability has been found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this vulnerability is the function submit… |
CVE-2025-2295 | Low | 3.5 | 2025-03-14 | EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerabilit… |
CVE-2025-2310 | Medium | 5.3 | 2025-03-14 | A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder… |
CVE-2025-2309 | Medium | 5.3 | 2025-03-14 | A vulnerability has been found in HDF5 1.14.6 and classified as critical. This vulnerability affects the function H5T__bit_copy of the component Type Conversio… |
CVE-2025-2308 | Medium | 5.3 | 2025-03-14 | A vulnerability, which was classified as critical, was found in HDF5 1.14.6. This affects the function H5Z__scaleoffset_decompress_one_byte of the component Sc… |
CVE-2025-29782 | Medium | 5.4 | 2025-03-14 | WeGIA is Web manager for charitable institutions A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_docs_atendido.php` end… |
CVE-2025-29771 | | 2025-03-14 | HtmlSanitizer is a client-side HTML Sanitizer. Versions prior to 2.0.3 have a cross-site scripting vulnerability when the sanitizer is used with a `contentEdit… | |
CVE-2025-29780 | | 2025-03-14 | Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0… | |
CVE-2025-29779 | | 2025-03-14 | Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0… | |
CVE-2025-29775 | | 2025-03-14 | xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1… | |
CVE-2025-26312 | | 2025-03-14 | SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter. | |
CVE-2025-29774 | | 2025-03-14 | xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1… | |
CVE-2025-29387 | High | 7.1 | 2025-03-14 | In Tenda AC9 v1.0 V15.03.05.14_multi, the wanSpeed parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary… |
CVE-2025-29386 | Critical | 9.8 | 2025-03-14 | In Tenda AC9 v1.0 V15.03.05.14_multi, the mac parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code… |
CVE-2025-29385 | Critical | 9.8 | 2025-03-14 | In Tenda AC9 v1.0 V15.03.05.14_multi, the cloneType parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary… |
CVE-2025-29384 | Critical | 9.8 | 2025-03-14 | In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary co… |
CVE-2025-27606 | Medium | 5.1 | 2025-03-14 | Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user… |
CVE-2025-1888 | Medium | 4.6 | 2025-03-14 | The Leica Web Viewer within the Aperio Eslide Manager Application is vulnerable to reflected cross-site scripting (XSS). An authenticated user can access the s… |
CVE-2025-25873 | Medium | 5.5 | 2025-03-14 | Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges via the Change Root Password function |
CVE-2025-25872 | Medium | 5.5 | 2025-03-14 | An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function |
CVE-2025-25871 | High | 8.0 | 2025-03-14 | An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function |
CVE-2025-2268 | High | 7.5 | 2025-03-14 | The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Prin… |
CVE-2025-29776 | | 2025-03-14 | Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP. Calling `setTimer` in Azle versions `0.27.0`, `0.28.0`, and `0.29.0` causes an immediate in… | |
CVE-2025-29032 | Medium | 5.9 | 2025-03-14 | Tenda AC9 v15.03.05.19(6318) was discovered to contain a buffer overflow via the formWifiWpsOOB function. |
CVE-2025-29031 | Critical | 9.8 | 2025-03-14 | Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the fromAddressNat function. |
CVE-2025-29030 | Critical | 9.8 | 2025-03-14 | Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function. |
CVE-2025-29029 | Critical | 9.8 | 2025-03-14 | Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formSetSpeedWan function. |
CVE-2025-2304 | | 2025-03-14 | A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersContr… | |
CVE-2025-2000 | Critical | 9.8 | 2025-03-14 | A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A… |
CVE-2025-27595 | Critical | 9.8 | 2025-03-14 | The device uses a weak hashing alghorithm to create the password hash. Hence, a matching password can be easily calculated by an attacker. This impacts the sec… |
CVE-2025-27594 | High | 7.5 | 2025-03-14 | The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is p… |
CVE-2025-27593 | Critical | 9.3 | 2025-03-14 | The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target… |
CVE-2025-26626 | Medium | 6.5 | 2025-03-14 | The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package. Versions prior to 1.5.0 are vul… |
CVE-2025-2232 | Critical | 9.8 | 2025-03-14 | The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, an… |
CVE-2025-1507 | Medium | 5.3 | 2025-03-14 | The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the h… |
CVE-2025-1526 | Medium | 6.4 | 2025-03-14 | The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Display Widget (countdown feature) in all ver… |
CVE-2025-2221 | High | 7.5 | 2025-03-14 | The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and including, 1.7.6 due… |
CVE-2025-2289 | Medium | 4.3 | 2025-03-14 | The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all… |
CVE-2025-2103 | High | 8.8 | 2025-03-14 | The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability c… |
CVE-2025-1764 | High | 7.5 | 2025-03-14 | The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3… |
CVE-2025-0952 | High | 8.1 | 2025-03-14 | The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of serv… |
CVE-2025-2166 | Medium | 6.1 | 2025-03-14 | The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of rem… |
CVE-2025-2056 | High | 7.5 | 2025-03-14 | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the… |
CVE-2025-1528 | Medium | 4.3 | 2025-03-14 | The Search & Filter Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_meta_values' function i… |
CVE-2025-1285 | Medium | 5.3 | 2025-03-14 | The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_api_key and s… |
CVE-2025-0955 | Medium | 5.3 | 2025-03-14 | The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX ac… |
CVE-2025-30022 | Medium | 6.8 | 2025-03-14 | CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter. |
CVE-2025-26163 | Critical | 9.8 | 2025-03-14 | CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the CPF parameter. |
CVE-2025-24855 | High | 7.8 | 2025-03-14 | numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is… |
CVE-2025-2230 | High | 7.7 | 2025-03-13 | A flaw exists in the Windows login flow where an AuthContext token can be exploited for replay attacks and authentication bypass. |
CVE-2025-2229 | High | 7.7 | 2025-03-13 | A token is created using the username, current date/time, and a fixed AES-128 encryption key, which is the same across all installations. |
CVE-2025-27496 | Low | 3.3 | 2025-03-13 | Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versi… |
CVE-2025-25598 | High | 8.8 | 2025-03-13 | Incorrect access control in the scheduled tasks console of Inova Logic CUSTOMER MONITOR (CM) v3.1.757.1 allows attackers to escalate privileges via placing a c… |
CVE-2025-25363 | Medium | 6.5 | 2025-03-13 | An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) before v4.1.69-dc all… |
CVE-2025-24053 | High | 7.2 | 2025-03-13 | Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. |
CVE-2025-2284 | High | 7.5 | 2025-03-13 | A denial-of-service vulnerability exists in the "GetWebLoginCredentials" function in "Sante PACS Server.exe". |
CVE-2025-2265 | High | 7.8 | 2025-03-13 | The password of a web user in "Sante PACS Server.exe" is zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and stored in the USER table in the SQLite d… |
CVE-2025-2264 | High | 7.5 | 2025-03-13 | A Path Traversal Information Disclosure vulnerability exists in "Sante PACS Server.exe". An unauthenticated remote attacker can exploit it to download arbitrar… |
CVE-2025-2263 | Critical | 9.8 | 2025-03-13 | During login to the web server in "Sante PACS Server.exe", OpenSSL function EVP_DecryptUpdate is called to decrypt the username and password. A fixed 0x80-byte… |
CVE-2025-2081 | | 2025-03-13 | Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web applic… | |
CVE-2025-2080 | | 2025-03-13 | Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow… | |
CVE-2025-2079 | | 2025-03-13 | Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attac… | |
CVE-2025-29773 | Medium | 5.8 | 2025-03-13 | Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accou… |
CVE-2025-29768 | Medium | 4.4 | 2025-03-13 | Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because… |
CVE-2025-28011 | Medium | 6.1 | 2025-03-13 | A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows remote attackers to… |
CVE-2025-27138 | Critical | 9.8 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease… |
CVE-2025-27107 | | 2025-03-13 | Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior… | |
CVE-2025-27103 | Medium | 6.5 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the patch for CVE-2024-55953 allows authent… |
CVE-2025-24974 | Medium | 6.5 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary f… |
CVE-2025-1767 | Medium | 6.5 | 2025-03-13 | This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-… |
CVE-2025-1652 | High | 7.8 | 2025-03-13 | A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vuln… |
CVE-2025-1651 | High | 7.8 | 2025-03-13 | A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vuln… |
CVE-2025-1650 | High | 7.8 | 2025-03-13 | A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage… |
CVE-2025-1649 | High | 7.8 | 2025-03-13 | A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage… |
CVE-2025-1433 | High | 7.8 | 2025-03-13 | A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vuln… |
CVE-2025-1432 | High | 7.8 | 2025-03-13 | A maliciously crafted 3DM file, when parsed through Autodesk AutoCAD, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerabili… |
CVE-2025-1431 | High | 7.8 | 2025-03-13 | A maliciously crafted SLDPRT file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vul… |
CVE-2025-1430 | High | 7.8 | 2025-03-13 | A maliciously crafted SLDPRT file, when parsed through Autodesk AutoCAD, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulne… |
CVE-2025-1429 | High | 7.8 | 2025-03-13 | A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vuln… |
CVE-2025-1428 | High | 7.8 | 2025-03-13 | A maliciously crafted CATPART file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vu… |
CVE-2025-1427 | High | 7.8 | 2025-03-13 | A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage… |