2025 CVEs (page 392)
Page 392 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-25245 | Medium | 5.4 | 2025-03-11 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured. An attacker… |
CVE-2025-25244 | Medium | 5.7 | 2025-03-11 | SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display aut… |
CVE-2025-25242 | Medium | 6.1 | 2025-03-11 | SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerabi… |
CVE-2025-23194 | Medium | 5.3 | 2025-03-11 | SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-authenticated user ca… |
CVE-2025-23188 | Medium | 4.3 | 2025-03-11 | An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access to perform actions… |
CVE-2025-23185 | Medium | 4.1 | 2025-03-11 | Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown t… |
CVE-2025-0071 | Medium | 4.9 | 2025-03-11 | SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter… |
CVE-2025-0062 | Medium | 4.7 | 2025-03-11 | SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the… |
CVE-2025-1828 | High | 8.8 | 2025-03-11 | Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is n… |
CVE-2025-27926 | Medium | 4.3 | 2025-03-10 | In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by u… |
CVE-2025-27925 | High | 8.5 | 2025-03-10 | Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input. |
CVE-2025-27924 | Medium | 5.4 | 2025-03-10 | Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action. |
CVE-2025-27610 | High | 7.5 | 2025-03-10 | Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the spec… |
CVE-2025-27910 | High | 8.0 | 2025-03-10 | tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/status. This vulnerability allows attackers to execu… |
CVE-2025-25908 | Medium | 5.4 | 2025-03-10 | A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into… |
CVE-2025-25907 | High | 8.8 | 2025-03-10 | tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. This vulnerability allows attackers to execute arb… |
CVE-2025-2137 | High | 8.8 | 2025-03-10 | Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chr… |
CVE-2025-2136 | High | 8.8 | 2025-03-10 | Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2025-2135 | High | 8.8 | 2025-03-10 | Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-1920 | High | 8.8 | 2025-03-10 | Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-0660 | Medium | 4.8 | 2025-03-10 | Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a r… |
CVE-2025-27913 | High | 7.5 | 2025-03-10 | Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email message… |
CVE-2025-27616 | High | 8.5 | 2025-03-10 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webho… |
CVE-2025-27615 | High | 8.2 | 2025-03-10 | umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be public… |
CVE-2025-27136 | | 2025-03-10 | LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to… | |
CVE-2025-26696 | High | 7.0 | 2025-03-10 | Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown… |
CVE-2025-26695 | Medium | 5.3 | 2025-03-10 | When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested emai… |
CVE-2025-25306 | Critical | 9.3 | 2025-03-10 | Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url`… |
CVE-2025-22603 | High | 8.1 | 2025-03-10 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Versions prior… |
CVE-2025-1296 | Medium | 6.5 | 2025-03-10 | Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. T… |
CVE-2025-24813 | Critical | 9.8 | 2025-03-10 | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files vi… |
CVE-2025-25977 | Critical | 9.8 | 2025-03-10 | An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement. |
CVE-2025-25940 | Critical | 9.8 | 2025-03-10 | VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java. |
CVE-2025-25382 | High | 7.5 | 2025-03-10 | An issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows attackers to arbitrarily modify payment amounts via a crafted… |
CVE-2025-26936 | Critical | 10.0 | 2025-03-10 | Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects F… |
CVE-2025-26933 | High | 7.5 | 2025-03-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without P… |
CVE-2025-26916 | Critical | 9.0 | 2025-03-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Pixflow Massive Dynamic massive-dynami… |
CVE-2025-26910 | High | 7.1 | 2025-03-10 | Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design WPBookit wpbookit allows Stored XSS.This issue affects WPBookit: from n/a through <= 1.0.1. |
CVE-2025-25620 | Medium | 5.4 | 2025-03-10 | Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function. |
CVE-2025-25614 | High | 8.8 | 2025-03-10 | Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers. |
CVE-2025-2153 | Medium | 5.0 | 2025-03-10 | A vulnerability, which was classified as critical, was found in HDF5 1.14.6. Affected is the function H5SM_delete of the file H5SM.c of the component h5 File H… |
CVE-2025-2152 | Medium | 6.3 | 2025-03-10 | A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImport… |
CVE-2025-26865 | Low | 3.5 | 2025-03-10 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18… |
CVE-2025-25616 | Medium | 4.3 | 2025-03-10 | Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?exam… |
CVE-2025-25615 | Low | 2.7 | 2025-03-10 | Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections. |
CVE-2025-1497 | Critical | 9.8 | 2025-03-10 | A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to exec… |
CVE-2025-2151 | Medium | 6.3 | 2025-03-10 | A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the… |
CVE-2025-2149 | Low | 2.5 | 2025-03-10 | A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantiz… |
CVE-2025-2148 | Medium | 5.0 | 2025-03-10 | A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end… |
CVE-2025-1945 | Critical | 9.8 | 2025-03-10 | picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specifi… |
CVE-2025-1944 | Medium | 6.5 | 2025-03-10 | picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives… |
CVE-2025-2147 | Medium | 5.3 | 2025-03-10 | A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as prob… |
CVE-2025-24387 | Medium | 4.8 | 2025-03-10 | A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an… |
CVE-2025-27257 | Medium | 6.1 | 2025-03-10 | Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. T… |
CVE-2025-27256 | High | 8.3 | 2025-03-10 | Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH serve… |
CVE-2025-27255 | High | 8.0 | 2025-03-10 | Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. The local user database is encrypted using an hardcod… |
CVE-2025-27254 | High | 8.0 | 2025-03-10 | CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authentication can be disabled b… |
CVE-2025-27253 | Medium | 6.1 | 2025-03-10 | A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide in… |
CVE-2025-2150 | Medium | 5.4 | 2025-03-10 | The C&Cm@il from HGiga has a Stored Cross-Site Scripting (XSS) vulnerability, allowing remote attackers with regular privileges to send emails containing malic… |
CVE-2025-1926 | Medium | 4.3 | 2025-03-10 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2025-2133 | Low | 2.4 | 2025-03-10 | A vulnerability classified as problematic was found in ftcms 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/index.php/news/… |
CVE-2025-2132 | Medium | 4.7 | 2025-03-09 | A vulnerability classified as critical has been found in ftcms 2.1. Affected is an unknown function of the file /admin/index.php/web/ajax_all_lists of the comp… |
CVE-2025-2131 | Low | 2.4 | 2025-03-09 | A vulnerability was found in dayrui XunRuiCMS up to 4.6.3. It has been rated as problematic. This issue affects some unknown processing of the component Friend… |
CVE-2025-2130 | Low | 3.5 | 2025-03-09 | A vulnerability was found in OpenXE up to 1.12. It has been declared as problematic. This vulnerability affects unknown code of the component Ticket Bearbeiten… |
CVE-2025-2129 | Medium | 5.6 | 2025-03-09 | A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default in… |
CVE-2025-2127 | Medium | 4.3 | 2025-03-09 | A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /exte… |
CVE-2025-2126 | Medium | 6.3 | 2025-03-09 | A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /exten… |
CVE-2025-2125 | Medium | 4.3 | 2025-03-09 | A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the file /v2/report.svc/… |
CVE-2025-2124 | Low | 3.5 | 2025-03-09 | A vulnerability, which was classified as problematic, was found in Control iD RH iD 25.2.25.0. This affects an unknown part of the file /v2/customerdb/person.s… |
CVE-2025-2123 | Low | 3.5 | 2025-03-09 | A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affected by this issue is the function get_var of the file /contri… |
CVE-2025-2122 | Low | 3.1 | 2025-03-09 | A vulnerability classified as problematic was found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-27636 | Medium | 5.6 | 2025-03-09 | Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4… |
CVE-2025-2121 | Medium | 6.3 | 2025-03-09 | A vulnerability classified as critical has been found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected is an unknown function of the component File S… |
CVE-2025-2120 | Low | 2.1 | 2025-03-09 | A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been rated as problematic. This issue affects some unknown processing of the… |
CVE-2025-2119 | Low | 2.0 | 2025-03-09 | A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been declared as problematic. This vulnerability affects unknown code of the… |
CVE-2025-2118 | High | 7.3 | 2025-03-09 | A vulnerability was found in Quantico Tecnologia PRMV 6.48. It has been classified as critical. This affects an unknown part of the file /admin/login.php of th… |
CVE-2025-2117 | Medium | 6.3 | 2025-03-09 | A vulnerability was found in Beijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System 3.0 and classified as critical. Affected by th… |
CVE-2025-2116 | Medium | 4.3 | 2025-03-09 | A vulnerability has been found in Beijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System 3.0 and classified as problematic. Affect… |
CVE-2025-2115 | Medium | 6.3 | 2025-03-09 | A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1. Affected is the function ProcessRequest of t… |
CVE-2025-1382 | Medium | 6.1 | 2025-03-09 | The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could… |
CVE-2025-1363 | Low | 3.5 | 2025-03-09 | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its settings, which co… |
CVE-2025-1362 | Medium | 4.3 | 2025-03-09 | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could… |
CVE-2025-2114 | Low | 3.7 | 2025-03-09 | A vulnerability, which was classified as problematic, has been found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This issue a… |
CVE-2025-2113 | High | 7.3 | 2025-03-09 | A vulnerability was found in AT Software Solutions ATSVD up to 3.4.1. It has been rated as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-2112 | Medium | 6.3 | 2025-03-08 | A vulnerability was found in user-xiangpeng yaoqishan up to a47fec4a31cbd13698c592dfdc938c8824dd25e4. It has been declared as critical. Affected by this vulner… |
CVE-2025-27840 | Medium | 6.8 | 2025-03-08 | Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory). |
CVE-2025-1664 | Medium | 6.4 | 2025-03-08 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Parallax s… |
CVE-2025-1783 | Medium | 6.4 | 2025-03-08 | The Gallery Styles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery Block in all versions up to, and including, 1.3.4 due to i… |
CVE-2025-1325 | Medium | 6.3 | 2025-03-08 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing capability check on… |
CVE-2025-1324 | Medium | 6.4 | 2025-03-08 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'public-form' shortco… |
CVE-2025-1323 | High | 7.5 | 2025-03-08 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to… |
CVE-2025-1322 | Medium | 4.3 | 2025-03-08 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.1… |
CVE-2025-1287 | Medium | 6.4 | 2025-03-08 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2025-0177 | Critical | 9.8 | 2025-03-08 | The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the plugin allowing us… |
CVE-2025-1504 | Medium | 4.3 | 2025-03-08 | The Post Lockdown plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.0.2 via the 'pl_autocomplete' AJAX action… |
CVE-2025-1481 | Medium | 6.5 | 2025-03-08 | The Shortcode Cleaner Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_backup() functio… |
CVE-2025-1261 | Medium | 6.4 | 2025-03-08 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Countdown widget in al… |
CVE-2025-27839 | Low | 3.2 | 2025-03-08 | operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that c… |
CVE-2025-2097 | High | 8.8 | 2025-03-07 | A vulnerability, which was classified as critical, has been found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This issue affects the function setRptWizardCfg o… |
CVE-2025-2096 | Medium | 6.3 | 2025-03-07 | A vulnerability classified as critical was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function setRebootScheCfg of the fi… |