2025 CVEs (page 393)
Page 393 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2095 | Medium | 6.3 | 2025-03-07 | A vulnerability classified as critical has been found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This affects the function setDmzCfg of the file /cgi-bin/cste… |
CVE-2025-2094 | Medium | 6.3 | 2025-03-07 | A vulnerability was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. It has been rated as critical. Affected by this issue is the function setWiFiExtenderConf… |
CVE-2025-2093 | Low | 3.1 | 2025-03-07 | A vulnerability was found in PHPGurukul Online Library Management System 3.0. It has been declared as problematic. Affected by this vulnerability is an unknown… |
CVE-2025-27826 | Medium | 6.4 | 2025-03-07 | An XSS issue was discovered in the Bootstrap Lite theme before 1.x-1.4.5 for Backdrop CMS. It doesn't sufficiently sanitize certain class names. |
CVE-2025-27825 | Medium | 6.4 | 2025-03-07 | An XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS. It doesn't sufficiently sanitize certain class names. |
CVE-2025-27824 | Medium | 6.4 | 2025-03-07 | An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying res… |
CVE-2025-27823 | Medium | 6.4 | 2025-03-07 | An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS. It enables a website to obfuscate email addresses, and should prevent sp… |
CVE-2025-27822 | High | 7.5 | 2025-03-07 | An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module… |
CVE-2025-2024 | High | 7.8 | 2025-03-07 | Trimble SketchUp SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2025-26643 | Medium | 5.4 | 2025-03-07 | The UI performs the wrong action in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-27607 | High | 8.8 | 2025-03-07 | Python JSON Logger is a JSON Formatter for Python Logging. Between 30 December 2024 and 4 March 2025 Python JSON Logger was vulnerable to RCE through a missing… |
CVE-2025-27604 | High | 7.5 | 2025-03-07 | XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a g… |
CVE-2025-0162 | High | 7.1 | 2025-03-07 | IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated atta… |
CVE-2025-27603 | Critical | 9.1 | 2025-03-07 | XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arb… |
CVE-2025-27597 | | 2025-03-07 | Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pollution through the… | |
CVE-2025-27519 | | 2025-03-07 | Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. A path traversal issu… | |
CVE-2025-27518 | | 2025-03-07 | Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. An insecure CORS conf… | |
CVE-2025-27152 | Medium | 5.3 | 2025-03-07 | axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even… |
CVE-2025-25617 | Medium | 4.3 | 2025-03-07 | Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus. |
CVE-2025-2090 | Medium | 4.7 | 2025-03-07 | A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-2089 | Medium | 5.4 | 2025-03-07 | A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of t… |
CVE-2025-2088 | High | 7.3 | 2025-03-07 | A vulnerability, which was classified as critical, was found in PHPGurukul Pre-School Enrollment System up to 1.0. Affected is an unknown function of the file… |
CVE-2025-2087 | Low | 3.5 | 2025-03-07 | A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /adm… |
CVE-2025-2086 | Low | 3.5 | 2025-03-07 | A vulnerability classified as problematic was found in StarSea99 starsea-mall 1.0. This vulnerability affects unknown code of the file /admin/indexConfigs/upda… |
CVE-2025-2085 | Low | 3.5 | 2025-03-07 | A vulnerability classified as problematic has been found in StarSea99 starsea-mall 1.0. This affects an unknown part of the file /admin/carousels/save. The man… |
CVE-2025-2084 | Low | 3.5 | 2025-03-07 | A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been classified as problematic. Affected is an unknown func… |
CVE-2025-1887 | | 2025-03-07 | SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administra… | |
CVE-2025-1886 | | 2025-03-07 | Pass-Back vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges t… | |
CVE-2025-1768 | Medium | 6.5 | 2025-03-07 | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, and including, 12.4… |
CVE-2025-21843 | Medium | 5.5 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: avoid garbage value in panthor_ioctl_dev_query() 'priorities_info' is uninit… |
CVE-2025-21842 | High | 7.8 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: amdkfd: properly free gang_ctx_bo when failed to init user queue The destructor of a gtt… |
CVE-2025-21841 | Medium | 5.5 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: Fix cpufreq_policy ref counting amd_pstate_update_limits() takes a cp… |
CVE-2025-21840 | Medium | 5.5 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header The intel-… |
CVE-2025-21839 | High | 7.3 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop Move the condit… |
CVE-2025-21838 | Medium | 5.5 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: flush gadget workqueue after device removal device_del() can lead to n… |
CVE-2025-21836 | High | 7.8 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: reallocate buf lists on upgrade IORING_REGISTER_PBUF_RING can reuse an old… |
CVE-2025-21835 | Medium | 5.5 | 2025-03-07 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths While the MIDI jacks are confi… |
CVE-2025-1315 | Critical | 9.8 | 2025-03-07 | The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. This is due to the p… |
CVE-2025-0959 | High | 8.8 | 2025-03-07 | The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and… |
CVE-2025-27816 | Critical | 9.8 | 2025-03-07 | A vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting endpoint can be exploited due to the insecure deserialization o… |
CVE-2025-26331 | High | 7.8 | 2025-03-07 | Dell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged att… |
CVE-2025-1309 | High | 8.8 | 2025-03-07 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead t… |
CVE-2025-0863 | Medium | 6.4 | 2025-03-07 | The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idx_frame' shortcode in all versions up to, and inc… |
CVE-2025-1475 | Critical | 9.8 | 2025-03-07 | The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verificat… |
CVE-2025-27796 | Medium | 4.5 | 2025-03-07 | ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob. |
CVE-2025-27795 | Medium | 4.3 | 2025-03-07 | ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits. |
CVE-2025-2067 | High | 7.3 | 2025-03-07 | A vulnerability was found in projectworlds Life Insurance Management System 1.0 and classified as critical. This issue affects some unknown processing of the f… |
CVE-2025-2066 | High | 7.3 | 2025-03-07 | A vulnerability has been found in projectworlds Life Insurance Management System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2025-2065 | High | 7.3 | 2025-03-07 | A vulnerability, which was classified as critical, was found in projectworlds Life Insurance Management System 1.0. This affects an unknown part of the file /e… |
CVE-2025-2064 | High | 7.3 | 2025-03-07 | A vulnerability, which was classified as critical, has been found in projectworlds Life Insurance Management System 1.0. Affected by this issue is some unknown… |
CVE-2025-2063 | High | 7.3 | 2025-03-07 | A vulnerability classified as critical was found in projectworlds Life Insurance Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-2062 | High | 7.3 | 2025-03-07 | A vulnerability classified as critical has been found in projectworlds Life Insurance Management System 1.0. Affected is an unknown function of the file /clien… |
CVE-2025-2061 | Medium | 4.3 | 2025-03-07 | A vulnerability was found in code-projects Online Ticket Reservation System 1.0. It has been declared as problematic. This vulnerability affects unknown code o… |
CVE-2025-2060 | High | 7.3 | 2025-03-07 | A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been classified as critical. This affects an unknown part of the file /ad… |
CVE-2025-26708 | Medium | 4.2 | 2025-03-07 | There is a configuration defect vulnerability in ZTELink 5.4.9 for iOS. This vulnerability is caused by a flaw in the WiFi parameter configuration of the ZTELi… |
CVE-2025-2059 | High | 7.3 | 2025-03-07 | A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2025-2058 | High | 7.3 | 2025-03-07 | A vulnerability has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-2057 | High | 7.3 | 2025-03-07 | A vulnerability, which was classified as critical, was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /… |
CVE-2025-2054 | Medium | 4.7 | 2025-03-07 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-0749 | High | 8.1 | 2025-03-07 | The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verification_id' value being… |
CVE-2025-0748 | Medium | 4.3 | 2025-03-07 | The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce va… |
CVE-2025-2053 | Medium | 6.3 | 2025-03-07 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been classified as critical. Affected is an unknown function of the fi… |
CVE-2025-2052 | Medium | 6.3 | 2025-03-07 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2025-2051 | Medium | 6.3 | 2025-03-07 | A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. This vulnerability affects unknown code of th… |
CVE-2025-2050 | High | 7.3 | 2025-03-07 | A vulnerability classified as critical was found in PHPGurukul User Registration & Login and User Management System 3.3. Affected by this vulnerability is an u… |
CVE-2025-1121 | Medium | 6.8 | 2025-03-07 | Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physical access to gain r… |
CVE-2025-2049 | Low | 3.5 | 2025-03-06 | A vulnerability classified as problematic has been found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file AB+.php. The manip… |
CVE-2025-2047 | Low | 3.5 | 2025-03-06 | A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /sea… |
CVE-2025-27598 | High | 7.5 | 2025-03-06 | ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a… |
CVE-2025-2046 | Medium | 6.3 | 2025-03-06 | A vulnerability was found in SourceCodester Best Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-2044 | Medium | 4.7 | 2025-03-06 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-2043 | Medium | 4.7 | 2025-03-06 | A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /admin#themes of the c… |
CVE-2025-2042 | Medium | 4.3 | 2025-03-06 | A vulnerability has been found in huang-yk student-manage 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to… |
CVE-2025-2041 | Medium | 6.3 | 2025-03-06 | A vulnerability, which was classified as critical, has been found in s-a-zhd Ecommerce-Website-using-PHP 1.0. Affected by this issue is some unknown functional… |
CVE-2025-25763 | Critical | 9.8 | 2025-03-06 | crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php |
CVE-2025-2040 | Medium | 6.3 | 2025-03-06 | A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2025-2039 | Medium | 4.7 | 2025-03-06 | A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of the file /admin/del… |
CVE-2025-2038 | High | 7.3 | 2025-03-06 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2025-25497 | High | 8.1 | 2025-03-06 | An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Account Owner" field d… |
CVE-2025-2037 | Medium | 6.3 | 2025-03-06 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the f… |
CVE-2025-2036 | Medium | 6.3 | 2025-03-06 | A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0. It has been classified as critical. This affects an unknown part of the file details.php… |
CVE-2025-27600 | Medium | 6.5 | 2025-03-06 | FastGPT is a knowledge-based platform built on the LLMs. Since the web crawling plug-in does not perform intranet IP verification, an attacker can initiate an… |
CVE-2025-27509 | | 2025-03-06 | fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response… | |
CVE-2025-27506 | Medium | 5.4 | 2025-03-06 | NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Script… |
CVE-2025-26699 | Medium | 5.0 | 2025-03-06 | An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter… |
CVE-2025-26167 | High | 7.5 | 2025-03-06 | Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files. |
CVE-2025-25381 | High | 7.5 | 2025-03-06 | Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information such as usernames an… |
CVE-2025-25361 | Critical | 9.8 | 2025-03-06 | An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code… |
CVE-2025-25294 | Medium | 5.3 | 2025-03-06 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior t… |
CVE-2025-25191 | Medium | 5.4 | 2025-03-06 | Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before… |
CVE-2025-24796 | | 2025-03-06 | Collabora Online is a collaborative online office suite based on LibreOffice. Macro support is disabled by default in Collabora Online, but can be enabled by a… | |
CVE-2025-2035 | Medium | 6.3 | 2025-03-06 | A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2025-2034 | High | 7.3 | 2025-03-06 | A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-2033 | Medium | 6.3 | 2025-03-06 | A vulnerability, which was classified as critical, was found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of the file /us… |
CVE-2025-2032 | Low | 3.5 | 2025-03-06 | A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The… |
CVE-2025-21834 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: seccomp: passthrough uretprobe systemcall without filtering When attaching uretprobes to… |
CVE-2025-21833 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE There is a WARN_ON_ONCE to catch an unli… |
CVE-2025-21832 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: block: don't revert iter for -EIOCBQUEUED blkdev_read_iter() has a few odd checks, like g… |
CVE-2025-21831 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 commit 9d26d3a8f1b0 ("PC… |
CVE-2025-21830 | High | 7.3 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: landlock: Handle weird files A corrupted filesystem (e.g. bcachefs) might return weird fi… |