2025 CVEs (page 395)
Page 395 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27220 | Medium | 4.0 | 2025-03-04 | In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method. |
CVE-2025-27219 | Medium | 5.8 | 2025-03-04 | In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method do… |
CVE-2025-1891 | Medium | 4.3 | 2025-03-04 | A vulnerability was found in shishuocms 1.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site req… |
CVE-2025-1890 | Medium | 6.3 | 2025-03-04 | A vulnerability has been found in shishuocms 1.1 and classified as critical. This vulnerability affects the function handleRequest of the file src/main/java/co… |
CVE-2025-1882 | Medium | 5.0 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been rated as critical. Affected by this issue is some unknown functionality of the com… |
CVE-2025-1881 | Medium | 4.3 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been declared as problematic. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-1880 | Low | 2.0 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been classified as problematic. Affected is an unknown function of the component Device… |
CVE-2025-1879 | Low | 2.4 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This issue affects some unknown processing of the component APK… |
CVE-2025-27501 | High | 8.6 | 2025-03-03 | OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessed without any form o… |
CVE-2025-27500 | High | 8.2 | 2025-03-03 | OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint(/api/upload) on the admin panel can be accessed witho… |
CVE-2025-27499 | Medium | 6.1 | 2025-03-03 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identifie… |
CVE-2025-26206 | Critical | 9.0 | 2025-03-03 | Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component |
CVE-2025-25967 | High | 8.8 | 2025-03-03 | Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthori… |
CVE-2025-25939 | Medium | 6.1 | 2025-03-03 | Reprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform/activate_process via the akey parameter. |
CVE-2025-1889 | Critical | 9.8 | 2025-03-03 | picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that… |
CVE-2025-1878 | Low | 3.1 | 2025-03-03 | A vulnerability has been found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This vulnerability affects unknown code of the component Wi… |
CVE-2025-1877 | Medium | 6.5 | 2025-03-03 | A vulnerability, which was classified as critical, was found in D-Link DAP-1562 1.10. This affects the function pure_auth_check of the component HTTP POST Requ… |
CVE-2025-27371 | Medium | 6.9 | 2025-03-03 | In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities… |
CVE-2025-27370 | Medium | 6.9 | 2025-03-03 | OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanism is used, a mali… |
CVE-2025-0686 | Medium | 6.4 | 2025-03-03 | A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the fi… |
CVE-2025-0685 | Medium | 6.4 | 2025-03-03 | A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the filesystem geometry t… |
CVE-2025-0684 | Medium | 6.4 | 2025-03-03 | A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled parameters from the file… |
CVE-2025-27498 | | 2025-03-03 | aes-gcm is a pure Rust implementation of the AES-GCM. In decrypt_in_place_detached, the decrypted ciphertext (which is the correct ciphertext) is exposed even… | |
CVE-2025-27423 | High | 7.1 | 2025-03-03 | Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompresse… |
CVE-2025-27422 | High | 7.5 | 2025-03-03 | FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges… |
CVE-2025-27421 | High | 7.5 | 2025-03-03 | Abacus is a highly scalable and stateless counting API. A critical goroutine leak vulnerability has been identified in the Abacus server's Server-Sent Events (… |
CVE-2025-25303 | | 2025-03-03 | The MouseTooltipTranslator Chrome extension allows mouseover translation of any language at once. The MouseTooltipTranslator browser extension is vulnerable to… | |
CVE-2025-25302 | Medium | 6.5 | 2025-03-03 | Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any… |
CVE-2025-25301 | High | 7.5 | 2025-03-03 | Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetch… |
CVE-2025-1876 | High | 7.3 | 2025-03-03 | A vulnerability, which was classified as critical, has been found in D-Link DAP-1562 1.10. Affected by this issue is the function http_request_parse of the com… |
CVE-2025-0678 | High | 7.8 | 2025-03-03 | A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry t… |
CVE-2025-0289 | High | 7.8 | 2025-03-03 | Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer… |
CVE-2025-0288 | High | 7.8 | 2025-03-03 | Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not val… |
CVE-2025-0287 | Medium | 5.1 | 2025-03-03 | Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure… |
CVE-2025-0286 | High | 8.4 | 2025-03-03 | Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate t… |
CVE-2025-0285 | High | 7.8 | 2025-03-03 | Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is caused by a failure to properly validate… |
CVE-2025-27420 | Medium | 5.4 | 2025-03-03 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identifie… |
CVE-2025-27419 | High | 7.5 | 2025-03-03 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service (DoS) vulnerability exists in WeGIA. This v… |
CVE-2025-27418 | Medium | 5.4 | 2025-03-03 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identifie… |
CVE-2025-27417 | Medium | 6.1 | 2025-03-03 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identifie… |
CVE-2025-27099 | Medium | 4.8 | 2025-03-03 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the tracker names… |
CVE-2025-27094 | Medium | 5.4 | 2025-03-03 | Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-res… |
CVE-2025-25185 | High | 7.5 | 2025-03-03 | GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker… |
CVE-2025-24023 | Low | 3.7 | 2025-03-03 | Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timi… |
CVE-2025-0555 | High | 7.7 | 2025-03-03 | A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows… |
CVE-2025-1801 | High | 8.1 | 2025-03-03 | A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition req… |
CVE-2025-1125 | High | 7.8 | 2025-03-03 | When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal bu… |
CVE-2025-0689 | High | 7.8 | 2025-03-03 | When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buffers. In certain sc… |
CVE-2025-27279 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lynk Flashfader flashfader allows Reflected XSS.This issu… |
CVE-2025-27278 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Ghedini AcuGIS Leaflet Maps mapfig-premium-leaflet-… |
CVE-2025-27275 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andrew_fisher WOO Codice Fiscale woo-codice-fiscale allow… |
CVE-2025-27274 | Medium | 4.9 | 2025-03-03 | Path Traversal: '.../...//' vulnerability in axelkeller GPX Viewer gpx-viewer allows Path Traversal.This issue affects GPX Viewer: from n/a through <= 2.2.11. |
CVE-2025-27273 | Medium | 5.8 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winking Affiliate Links Manager affiliate-links-manager a… |
CVE-2025-27271 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alberto Cocchiara DB Tables Import/Export db-tables-impor… |
CVE-2025-27270 | Critical | 9.8 | 2025-03-03 | Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Privilege Escalation.This issue aff… |
CVE-2025-27269 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anton Aleksandrov .htaccess Login block htaccess-login-bl… |
CVE-2025-27268 | Critical | 9.3 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Worldwide Expres… |
CVE-2025-27264 | High | 7.5 | 2025-03-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creativeitem Doctor Appointment Bookin… |
CVE-2025-27263 | High | 8.5 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creativeitem Doctor Appointment Booking doctor-appointmen… |
CVE-2025-26999 | High | 8.8 | 2025-03-03 | Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Object Injection.This issue a… |
CVE-2025-26994 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softdiscover Zigaform – Price Calculator & Cost Estimatio… |
CVE-2025-26989 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softdiscover Zigaform zigaform-form-builder-lite allows S… |
CVE-2025-26988 | Critical | 9.3 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allow… |
CVE-2025-26984 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allow… |
CVE-2025-26970 | Critical | 10.0 | 2025-03-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Ark Theme Core ark-core allows Code Injection.This issue affects Ark Theme… |
CVE-2025-26967 | High | 8.8 | 2025-03-03 | Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects… |
CVE-2025-26918 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology Small Package Quotes – Unishippers Edit… |
CVE-2025-26917 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WP Templata wptemplata allows Reflected XSS.Thi… |
CVE-2025-26914 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Variable Inspector variable-inspector allows Reflect… |
CVE-2025-26885 | High | 7.2 | 2025-03-03 | Deserialization of Untrusted Data vulnerability in Beaver Builder WordPress Assistant assistant allows Object Injection.This issue affects WordPress Assistant… |
CVE-2025-26879 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristián Lávaque s2Member s2member allows Reflected XSS.T… |
CVE-2025-26589 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristopher Dino IE CSS3 Support ie-css3-support allows Re… |
CVE-2025-26588 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gabrielperezs TTT Crop ttt-crop allows Reflected XSS.This… |
CVE-2025-26587 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nghorta sidebarTabs sidebartabs allows Reflected XSS.This… |
CVE-2025-26586 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in abelony Events Planner events-planner allows Reflected XS… |
CVE-2025-26585 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DyadyaLesha DL Leadback dl-leadback allows Reflected XSS… |
CVE-2025-26563 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muneeb Mobile rocket-wp-mobile allows Reflected XSS.This… |
CVE-2025-26557 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viperchill ViperBar viperbar allows Reflected XSS.This is… |
CVE-2025-26540 | High | 7.7 | 2025-03-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This iss… |
CVE-2025-26535 | Critical | 9.3 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerc… |
CVE-2025-26534 | High | 8.6 | 2025-03-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This iss… |
CVE-2025-25170 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Migrate Posts migrate-post allows Reflected… |
CVE-2025-25169 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Authors Autocomplete Meta Box authors-autoc… |
CVE-2025-25165 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richardgabriel Staff Directory Plugin: Company Directory… |
CVE-2025-25164 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yuichiro ABE Meta Accelerator meta-accelerator allows Ref… |
CVE-2025-25162 | High | 7.5 | 2025-03-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in kutu62 Sports Rankings and Lists sports-rankings-lists allows A… |
CVE-2025-25161 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SocialEvolution WP Find Your Nearest wp-find-your-nearest… |
CVE-2025-25158 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Antonio Sanchez Uncomplicated SEO uncomplicated-seo allow… |
CVE-2025-25157 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpchurchteam WP Church Center wp-church-center allows Ref… |
CVE-2025-25150 | Critical | 9.3 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows Blind SQL Injection.Thi… |
CVE-2025-25142 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Jake Group WP Less Compiler wp-less-compiler allows S… |
CVE-2025-25137 | Medium | 6.5 | 2025-03-03 | Cross-Site Request Forgery (CSRF) vulnerability in kareemsultan Social Links social-links allows Stored XSS.This issue affects Social Links: from n/a through <… |
CVE-2025-25133 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in newbiesup WP Frontend Submit wp-frontend-submit allows Re… |
CVE-2025-25132 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ravi Singh Visitor Details visitors-details allows Stored… |
CVE-2025-25131 | Medium | 6.5 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in randyjensen RJ Quickcharts rj-quickcharts allows Stored X… |
CVE-2025-25130 | High | 7.5 | 2025-03-03 | Relative Path Traversal vulnerability in Shah Alom Delete Comments By Status delete-comments-by-status allows Path Traversal.This issue affects Delete Comments… |
CVE-2025-25129 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Callback Request allows Reflected XSS. This issu… |
CVE-2025-25127 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rohitashv Singhal Contact Us By Lord Linus contact-us-by-… |
CVE-2025-25124 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devu Status Updater fb-status-updater allows Reflected XS… |
CVE-2025-25122 | High | 8.1 | 2025-03-03 | Path Traversal: '.../...//' vulnerability in hashshop WizShop wizshop allows Path Traversal.This issue affects WizShop: from n/a through <= 3.0.2. |