2025 CVEs (page 396)
Page 396 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1935 | Medium | 4.3 | 2025-03-04 | A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firefox 136, Firefox ESR… |
CVE-2025-1934 | Medium | 6.5 | 2025-03-04 | It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was no… |
CVE-2025-1933 | High | 7.6 | 2025-03-04 | On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a di… |
CVE-2025-1932 | High | 8.1 | 2025-03-04 | An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later. This… |
CVE-2025-1931 | High | 7.5 | 2025-03-04 | It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerabil… |
CVE-2025-1930 | High | 8.8 | 2025-03-04 | On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led t… |
CVE-2025-1925 | Medium | 5.3 | 2025-03-04 | A vulnerability classified as problematic was found in Open5GS up to 2.7.2. Affected by this vulnerability is the function amf_nsmf_pdusession_handle_update_sm… |
CVE-2025-22226 | High | 7.1 | 2025-03-04 | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrativ… |
CVE-2025-22225 | High | 8.2 | 2025-03-04 | VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading t… |
CVE-2025-22224 | Critical | 9.3 | 2025-03-04 | VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local admi… |
CVE-2025-0958 | Medium | 5.4 | 2025-03-04 | The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. T… |
CVE-2025-0370 | Medium | 6.4 | 2025-03-04 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to… |
CVE-2025-26849 | Medium | 4.3 | 2025-03-04 | There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that conta… |
CVE-2025-0512 | Medium | 6.4 | 2025-03-04 | The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all… |
CVE-2025-0433 | Medium | 6.4 | 2025-03-04 | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross… |
CVE-2025-27521 | Medium | 6.8 | 2025-03-04 | Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2025-0360 | High | 7.8 | 2025-03-04 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could l… |
CVE-2025-0359 | High | 8.5 | 2025-03-04 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applicati… |
CVE-2025-1906 | Medium | 4.7 | 2025-03-04 | A vulnerability has been found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2025-1905 | Low | 3.5 | 2025-03-04 | A vulnerability, which was classified as problematic, was found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file empl… |
CVE-2025-1904 | Low | 3.5 | 2025-03-04 | A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank System 1.0. Affected by this issue is some unknown functionali… |
CVE-2025-1307 | Critical | 9.8 | 2025-03-04 | The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() fu… |
CVE-2025-1306 | High | 8.8 | 2025-03-04 | The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect… |
CVE-2025-24309 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability… |
CVE-2025-24301 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can b… |
CVE-2025-23420 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability… |
CVE-2025-23418 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-23414 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can b… |
CVE-2025-23409 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can b… |
CVE-2025-23240 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability… |
CVE-2025-23234 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through buffer overflow. |
CVE-2025-22897 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through buffer overflow. |
CVE-2025-22847 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-22841 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-22837 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference. |
CVE-2025-22835 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability… |
CVE-2025-22443 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-21098 | Medium | 5.5 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read bypass permission check. |
CVE-2025-21097 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference. |
CVE-2025-21089 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-21084 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through through NULL pointer dereference.. This… |
CVE-2025-20626 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can b… |
CVE-2025-20091 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can b… |
CVE-2025-20081 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can b… |
CVE-2025-20042 | Medium | 5.5 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read. |
CVE-2025-20024 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. This vulnerability can… |
CVE-2025-20021 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-20011 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory. |
CVE-2025-1903 | High | 7.3 | 2025-03-04 | A vulnerability was found in Codezips Online Shopping Website 1.0. It has been rated as critical. This issue affects some unknown processing of the file /cart_… |
CVE-2025-1902 | High | 7.3 | 2025-03-04 | A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code of the file /passw… |
CVE-2025-1901 | High | 7.3 | 2025-03-04 | A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been classified as critical. This affects an unknown part of the file /admi… |
CVE-2025-1900 | High | 7.3 | 2025-03-04 | A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-1639 | High | 8.8 | 2025-03-04 | The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on th… |
CVE-2025-1321 | Medium | 6.5 | 2025-03-04 | The teachPress plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tpsearch' shortcode in all versions up to, and including… |
CVE-2025-0912 | Critical | 9.8 | 2025-03-04 | The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted i… |
CVE-2025-0587 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. This vulnerability can… |
CVE-2025-1899 | Medium | 6.5 | 2025-03-04 | A vulnerability has been found in Tenda TX3 16.03.13.11_multi and classified as critical. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-1898 | Medium | 6.5 | 2025-03-04 | A vulnerability, which was classified as critical, was found in Tenda TX3 16.03.13.11_multi. Affected is an unknown function of the file /goform/openSchedWifi… |
CVE-2025-1897 | Medium | 6.5 | 2025-03-04 | A vulnerability, which was classified as critical, has been found in Tenda TX3 16.03.13.11_multi. This issue affects some unknown processing of the file /gofor… |
CVE-2025-1896 | Medium | 6.5 | 2025-03-04 | A vulnerability classified as critical was found in Tenda TX3 16.03.13.11_multi. This vulnerability affects unknown code of the file /goform/SetStaticRouteCfg… |
CVE-2025-1895 | Medium | 6.5 | 2025-03-04 | A vulnerability classified as critical has been found in Tenda TX3 16.03.13.11_multi. This affects an unknown part of the file /goform/setMacFilterCfg. The man… |
CVE-2025-1894 | High | 7.3 | 2025-03-04 | A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been rated as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-1893 | Medium | 4.3 | 2025-03-04 | A vulnerability was found in Open5GS up to 2.7.2. It has been declared as problematic. Affected by this vulnerability is the function gmm_state_authentication… |
CVE-2025-1892 | Low | 2.4 | 2025-03-04 | A vulnerability was found in shishuocms 1.1. It has been classified as problematic. Affected is an unknown function of the file /manage/folder/add.json of the… |
CVE-2025-1695 | Medium | 5.3 | 2025-03-04 | In NGINX Unit before version 1.34.2 with the Java Language Module in use, undisclosed requests can lead to an infinite loop and cause an increase in CPU resour… |
CVE-2025-27221 | Low | 3.2 | 2025-03-04 | In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because u… |
CVE-2025-27220 | Medium | 4.0 | 2025-03-04 | In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method. |
CVE-2025-27219 | Medium | 5.8 | 2025-03-04 | In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method do… |
CVE-2025-1891 | Medium | 4.3 | 2025-03-04 | A vulnerability was found in shishuocms 1.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site req… |
CVE-2025-1890 | Medium | 6.3 | 2025-03-04 | A vulnerability has been found in shishuocms 1.1 and classified as critical. This vulnerability affects the function handleRequest of the file src/main/java/co… |
CVE-2025-1882 | Medium | 5.0 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been rated as critical. Affected by this issue is some unknown functionality of the com… |
CVE-2025-1881 | Medium | 4.3 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been declared as problematic. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-1880 | Low | 2.0 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been classified as problematic. Affected is an unknown function of the component Device… |
CVE-2025-1879 | Low | 2.4 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This issue affects some unknown processing of the component APK… |
CVE-2025-27501 | High | 8.6 | 2025-03-03 | OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessed without any form o… |
CVE-2025-27500 | High | 8.2 | 2025-03-03 | OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint(/api/upload) on the admin panel can be accessed witho… |
CVE-2025-27499 | Medium | 6.1 | 2025-03-03 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identifie… |
CVE-2025-26206 | Critical | 9.0 | 2025-03-03 | Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component |
CVE-2025-25967 | High | 8.8 | 2025-03-03 | Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthori… |
CVE-2025-25939 | Medium | 6.1 | 2025-03-03 | Reprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform/activate_process via the akey parameter. |
CVE-2025-1889 | Critical | 9.8 | 2025-03-03 | picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that… |
CVE-2025-1878 | Low | 3.1 | 2025-03-03 | A vulnerability has been found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This vulnerability affects unknown code of the component Wi… |
CVE-2025-1877 | Medium | 6.5 | 2025-03-03 | A vulnerability, which was classified as critical, was found in D-Link DAP-1562 1.10. This affects the function pure_auth_check of the component HTTP POST Requ… |
CVE-2025-27371 | Medium | 6.9 | 2025-03-03 | In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities… |
CVE-2025-27370 | Medium | 6.9 | 2025-03-03 | OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanism is used, a mali… |
CVE-2025-0686 | Medium | 6.4 | 2025-03-03 | A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the fi… |
CVE-2025-0685 | Medium | 6.4 | 2025-03-03 | A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the filesystem geometry t… |
CVE-2025-0684 | Medium | 6.4 | 2025-03-03 | A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled parameters from the file… |
CVE-2025-27498 | | 2025-03-03 | aes-gcm is a pure Rust implementation of the AES-GCM. In decrypt_in_place_detached, the decrypted ciphertext (which is the correct ciphertext) is exposed even… | |
CVE-2025-27423 | High | 7.1 | 2025-03-03 | Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompresse… |
CVE-2025-27422 | High | 7.5 | 2025-03-03 | FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges… |
CVE-2025-27421 | High | 7.5 | 2025-03-03 | Abacus is a highly scalable and stateless counting API. A critical goroutine leak vulnerability has been identified in the Abacus server's Server-Sent Events (… |
CVE-2025-25303 | | 2025-03-03 | The MouseTooltipTranslator Chrome extension allows mouseover translation of any language at once. The MouseTooltipTranslator browser extension is vulnerable to… | |
CVE-2025-25302 | Medium | 6.5 | 2025-03-03 | Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any… |
CVE-2025-25301 | High | 7.5 | 2025-03-03 | Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetch… |
CVE-2025-1876 | High | 7.3 | 2025-03-03 | A vulnerability, which was classified as critical, has been found in D-Link DAP-1562 1.10. Affected by this issue is the function http_request_parse of the com… |
CVE-2025-0678 | High | 7.8 | 2025-03-03 | A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry t… |
CVE-2025-0289 | High | 7.8 | 2025-03-03 | Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer… |
CVE-2025-0288 | High | 7.8 | 2025-03-03 | Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not val… |
CVE-2025-0287 | Medium | 5.1 | 2025-03-03 | Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure… |