2025 CVEs (page 391)
Page 391 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2126 | Medium | 6.3 | 2025-03-09 | A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /exten… |
CVE-2025-2125 | Medium | 4.3 | 2025-03-09 | A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the file /v2/report.svc/… |
CVE-2025-2124 | Low | 3.5 | 2025-03-09 | A vulnerability, which was classified as problematic, was found in Control iD RH iD 25.2.25.0. This affects an unknown part of the file /v2/customerdb/person.s… |
CVE-2025-2123 | Low | 3.5 | 2025-03-09 | A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affected by this issue is the function get_var of the file /contri… |
CVE-2025-2122 | Low | 3.1 | 2025-03-09 | A vulnerability classified as problematic was found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-27636 | Medium | 5.6 | 2025-03-09 | Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4… |
CVE-2025-2121 | Medium | 6.3 | 2025-03-09 | A vulnerability classified as critical has been found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected is an unknown function of the component File S… |
CVE-2025-2120 | Low | 2.1 | 2025-03-09 | A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been rated as problematic. This issue affects some unknown processing of the… |
CVE-2025-2119 | Low | 2.0 | 2025-03-09 | A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been declared as problematic. This vulnerability affects unknown code of the… |
CVE-2025-2118 | High | 7.3 | 2025-03-09 | A vulnerability was found in Quantico Tecnologia PRMV 6.48. It has been classified as critical. This affects an unknown part of the file /admin/login.php of th… |
CVE-2025-2117 | Medium | 6.3 | 2025-03-09 | A vulnerability was found in Beijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System 3.0 and classified as critical. Affected by th… |
CVE-2025-2116 | Medium | 4.3 | 2025-03-09 | A vulnerability has been found in Beijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System 3.0 and classified as problematic. Affect… |
CVE-2025-2115 | Medium | 6.3 | 2025-03-09 | A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1. Affected is the function ProcessRequest of t… |
CVE-2025-1382 | Medium | 6.1 | 2025-03-09 | The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could… |
CVE-2025-1363 | Low | 3.5 | 2025-03-09 | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its settings, which co… |
CVE-2025-1362 | Medium | 4.3 | 2025-03-09 | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could… |
CVE-2025-2114 | Low | 3.7 | 2025-03-09 | A vulnerability, which was classified as problematic, has been found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This issue a… |
CVE-2025-2113 | High | 7.3 | 2025-03-09 | A vulnerability was found in AT Software Solutions ATSVD up to 3.4.1. It has been rated as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-2112 | Medium | 6.3 | 2025-03-08 | A vulnerability was found in user-xiangpeng yaoqishan up to a47fec4a31cbd13698c592dfdc938c8824dd25e4. It has been declared as critical. Affected by this vulner… |
CVE-2025-27840 | Medium | 6.8 | 2025-03-08 | Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory). |
CVE-2025-1664 | Medium | 6.4 | 2025-03-08 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Parallax s… |
CVE-2025-1783 | Medium | 6.4 | 2025-03-08 | The Gallery Styles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery Block in all versions up to, and including, 1.3.4 due to i… |
CVE-2025-1325 | Medium | 6.3 | 2025-03-08 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing capability check on… |
CVE-2025-1324 | Medium | 6.4 | 2025-03-08 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'public-form' shortco… |
CVE-2025-1323 | High | 7.5 | 2025-03-08 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to… |
CVE-2025-1322 | Medium | 4.3 | 2025-03-08 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.1… |
CVE-2025-1287 | Medium | 6.4 | 2025-03-08 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2025-0177 | Critical | 9.8 | 2025-03-08 | The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the plugin allowing us… |
CVE-2025-1504 | Medium | 4.3 | 2025-03-08 | The Post Lockdown plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.0.2 via the 'pl_autocomplete' AJAX action… |
CVE-2025-1481 | Medium | 6.5 | 2025-03-08 | The Shortcode Cleaner Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_backup() functio… |
CVE-2025-1261 | Medium | 6.4 | 2025-03-08 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Countdown widget in al… |
CVE-2025-27839 | Low | 3.2 | 2025-03-08 | operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that c… |
CVE-2025-2097 | High | 8.8 | 2025-03-07 | A vulnerability, which was classified as critical, has been found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This issue affects the function setRptWizardCfg o… |
CVE-2025-2096 | Medium | 6.3 | 2025-03-07 | A vulnerability classified as critical was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function setRebootScheCfg of the fi… |
CVE-2025-2095 | Medium | 6.3 | 2025-03-07 | A vulnerability classified as critical has been found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This affects the function setDmzCfg of the file /cgi-bin/cste… |
CVE-2025-2094 | Medium | 6.3 | 2025-03-07 | A vulnerability was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. It has been rated as critical. Affected by this issue is the function setWiFiExtenderConf… |
CVE-2025-2093 | Low | 3.1 | 2025-03-07 | A vulnerability was found in PHPGurukul Online Library Management System 3.0. It has been declared as problematic. Affected by this vulnerability is an unknown… |
CVE-2025-27826 | Medium | 6.4 | 2025-03-07 | An XSS issue was discovered in the Bootstrap Lite theme before 1.x-1.4.5 for Backdrop CMS. It doesn't sufficiently sanitize certain class names. |
CVE-2025-27825 | Medium | 6.4 | 2025-03-07 | An XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS. It doesn't sufficiently sanitize certain class names. |
CVE-2025-27824 | Medium | 6.4 | 2025-03-07 | An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying res… |
CVE-2025-27823 | Medium | 6.4 | 2025-03-07 | An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS. It enables a website to obfuscate email addresses, and should prevent sp… |
CVE-2025-27822 | High | 7.5 | 2025-03-07 | An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module… |
CVE-2025-2024 | High | 7.8 | 2025-03-07 | Trimble SketchUp SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2025-26643 | Medium | 5.4 | 2025-03-07 | The UI performs the wrong action in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-27607 | High | 8.8 | 2025-03-07 | Python JSON Logger is a JSON Formatter for Python Logging. Between 30 December 2024 and 4 March 2025 Python JSON Logger was vulnerable to RCE through a missing… |
CVE-2025-27604 | High | 7.5 | 2025-03-07 | XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a g… |
CVE-2025-0162 | High | 7.1 | 2025-03-07 | IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated atta… |
CVE-2025-27603 | Critical | 9.1 | 2025-03-07 | XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arb… |
CVE-2025-27597 | | 2025-03-07 | Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pollution through the… | |
CVE-2025-27519 | | 2025-03-07 | Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. A path traversal issu… | |
CVE-2025-27518 | | 2025-03-07 | Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. An insecure CORS conf… | |
CVE-2025-27152 | Medium | 5.3 | 2025-03-07 | axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even… |
CVE-2025-25617 | Medium | 4.3 | 2025-03-07 | Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus. |
CVE-2025-2090 | Medium | 4.7 | 2025-03-07 | A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-2089 | Medium | 5.4 | 2025-03-07 | A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of t… |
CVE-2025-2088 | High | 7.3 | 2025-03-07 | A vulnerability, which was classified as critical, was found in PHPGurukul Pre-School Enrollment System up to 1.0. Affected is an unknown function of the file… |
CVE-2025-2087 | Low | 3.5 | 2025-03-07 | A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /adm… |
CVE-2025-2086 | Low | 3.5 | 2025-03-07 | A vulnerability classified as problematic was found in StarSea99 starsea-mall 1.0. This vulnerability affects unknown code of the file /admin/indexConfigs/upda… |
CVE-2025-2085 | Low | 3.5 | 2025-03-07 | A vulnerability classified as problematic has been found in StarSea99 starsea-mall 1.0. This affects an unknown part of the file /admin/carousels/save. The man… |
CVE-2025-2084 | Low | 3.5 | 2025-03-07 | A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been classified as problematic. Affected is an unknown func… |
CVE-2025-1887 | | 2025-03-07 | SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administra… | |
CVE-2025-1886 | | 2025-03-07 | Pass-Back vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges t… | |
CVE-2025-1768 | Medium | 6.5 | 2025-03-07 | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, and including, 12.4… |
CVE-2025-21843 | Medium | 5.5 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: avoid garbage value in panthor_ioctl_dev_query() 'priorities_info' is uninit… |
CVE-2025-21842 | High | 7.8 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: amdkfd: properly free gang_ctx_bo when failed to init user queue The destructor of a gtt… |
CVE-2025-21841 | Medium | 5.5 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: Fix cpufreq_policy ref counting amd_pstate_update_limits() takes a cp… |
CVE-2025-21840 | Medium | 5.5 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header The intel-… |
CVE-2025-21839 | High | 7.3 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop Move the condit… |
CVE-2025-21838 | Medium | 5.5 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: flush gadget workqueue after device removal device_del() can lead to n… |
CVE-2025-21836 | High | 7.8 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: reallocate buf lists on upgrade IORING_REGISTER_PBUF_RING can reuse an old… |
CVE-2025-21835 | Medium | 5.5 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths While the MIDI jacks are confi… |
CVE-2025-1315 | Critical | 9.8 | 2025-03-07 | The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. This is due to the p… |
CVE-2025-0959 | High | 8.8 | 2025-03-07 | The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and… |
CVE-2025-27816 | Critical | 9.8 | 2025-03-07 | A vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting endpoint can be exploited due to the insecure deserialization o… |
CVE-2025-26331 | High | 7.8 | 2025-03-07 | Dell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged att… |
CVE-2025-1309 | High | 8.8 | 2025-03-07 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead t… |
CVE-2025-0863 | Medium | 6.4 | 2025-03-07 | The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idx_frame' shortcode in all versions up to, and inc… |
CVE-2025-1475 | Critical | 9.8 | 2025-03-07 | The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verificat… |
CVE-2025-27796 | Medium | 4.5 | 2025-03-07 | ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob. |
CVE-2025-27795 | Medium | 4.3 | 2025-03-07 | ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits. |
CVE-2025-2067 | High | 7.3 | 2025-03-07 | A vulnerability was found in projectworlds Life Insurance Management System 1.0 and classified as critical. This issue affects some unknown processing of the f… |
CVE-2025-2066 | High | 7.3 | 2025-03-07 | A vulnerability has been found in projectworlds Life Insurance Management System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2025-2065 | High | 7.3 | 2025-03-07 | A vulnerability, which was classified as critical, was found in projectworlds Life Insurance Management System 1.0. This affects an unknown part of the file /e… |
CVE-2025-2064 | High | 7.3 | 2025-03-07 | A vulnerability, which was classified as critical, has been found in projectworlds Life Insurance Management System 1.0. Affected by this issue is some unknown… |
CVE-2025-2063 | High | 7.3 | 2025-03-07 | A vulnerability classified as critical was found in projectworlds Life Insurance Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-2062 | High | 7.3 | 2025-03-07 | A vulnerability classified as critical has been found in projectworlds Life Insurance Management System 1.0. Affected is an unknown function of the file /clien… |
CVE-2025-2061 | Medium | 4.3 | 2025-03-07 | A vulnerability was found in code-projects Online Ticket Reservation System 1.0. It has been declared as problematic. This vulnerability affects unknown code o… |
CVE-2025-2060 | High | 7.3 | 2025-03-07 | A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been classified as critical. This affects an unknown part of the file /ad… |
CVE-2025-26708 | Medium | 4.2 | 2025-03-07 | There is a configuration defect vulnerability in ZTELink 5.4.9 for iOS. This vulnerability is caused by a flaw in the WiFi parameter configuration of the ZTELi… |
CVE-2025-2059 | High | 7.3 | 2025-03-07 | A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2025-2058 | High | 7.3 | 2025-03-07 | A vulnerability has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-2057 | High | 7.3 | 2025-03-07 | A vulnerability, which was classified as critical, was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /… |
CVE-2025-2054 | Medium | 4.7 | 2025-03-07 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-0749 | High | 8.1 | 2025-03-07 | The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verification_id' value being… |
CVE-2025-0748 | Medium | 4.3 | 2025-03-07 | The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce va… |
CVE-2025-2053 | Medium | 6.3 | 2025-03-07 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been classified as critical. Affected is an unknown function of the fi… |
CVE-2025-2052 | Medium | 6.3 | 2025-03-07 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2025-2051 | Medium | 6.3 | 2025-03-07 | A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. This vulnerability affects unknown code of th… |
CVE-2025-2050 | High | 7.3 | 2025-03-07 | A vulnerability classified as critical was found in PHPGurukul User Registration & Login and User Management System 3.3. Affected by this vulnerability is an u… |
CVE-2025-1121 | Medium | 6.8 | 2025-03-07 | Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physical access to gain r… |