2025 CVEs (page 397)
Page 397 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0286 | High | 8.4 | 2025-03-03 | Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate t… |
CVE-2025-0285 | High | 7.8 | 2025-03-03 | Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is caused by a failure to properly validate… |
CVE-2025-27420 | Medium | 5.4 | 2025-03-03 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identifie… |
CVE-2025-27419 | High | 7.5 | 2025-03-03 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service (DoS) vulnerability exists in WeGIA. This v… |
CVE-2025-27418 | Medium | 5.4 | 2025-03-03 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identifie… |
CVE-2025-27417 | Medium | 6.1 | 2025-03-03 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identifie… |
CVE-2025-27099 | Medium | 4.8 | 2025-03-03 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the tracker names… |
CVE-2025-27094 | Medium | 5.4 | 2025-03-03 | Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-res… |
CVE-2025-25185 | High | 7.5 | 2025-03-03 | GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker… |
CVE-2025-24023 | Low | 3.7 | 2025-03-03 | Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timi… |
CVE-2025-0555 | High | 7.7 | 2025-03-03 | A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows… |
CVE-2025-1801 | High | 8.1 | 2025-03-03 | A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition req… |
CVE-2025-1125 | High | 7.8 | 2025-03-03 | When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal bu… |
CVE-2025-0689 | High | 7.8 | 2025-03-03 | When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buffers. In certain sc… |
CVE-2025-27279 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lynk Flashfader flashfader allows Reflected XSS.This issu… |
CVE-2025-27278 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Ghedini AcuGIS Leaflet Maps mapfig-premium-leaflet-… |
CVE-2025-27275 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andrew_fisher WOO Codice Fiscale woo-codice-fiscale allow… |
CVE-2025-27274 | Medium | 4.9 | 2025-03-03 | Path Traversal: '.../...//' vulnerability in axelkeller GPX Viewer gpx-viewer allows Path Traversal.This issue affects GPX Viewer: from n/a through <= 2.2.11. |
CVE-2025-27273 | Medium | 5.8 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winking Affiliate Links Manager affiliate-links-manager a… |
CVE-2025-27271 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alberto Cocchiara DB Tables Import/Export db-tables-impor… |
CVE-2025-27270 | Critical | 9.8 | 2025-03-03 | Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Privilege Escalation.This issue aff… |
CVE-2025-27269 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anton Aleksandrov .htaccess Login block htaccess-login-bl… |
CVE-2025-27268 | Critical | 9.3 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Worldwide Expres… |
CVE-2025-27264 | High | 7.5 | 2025-03-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creativeitem Doctor Appointment Bookin… |
CVE-2025-27263 | High | 8.5 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creativeitem Doctor Appointment Booking doctor-appointmen… |
CVE-2025-26999 | High | 8.8 | 2025-03-03 | Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Object Injection.This issue a… |
CVE-2025-26994 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softdiscover Zigaform – Price Calculator & Cost Estimatio… |
CVE-2025-26989 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softdiscover Zigaform zigaform-form-builder-lite allows S… |
CVE-2025-26988 | Critical | 9.3 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allow… |
CVE-2025-26984 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allow… |
CVE-2025-26970 | Critical | 10.0 | 2025-03-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Ark Theme Core ark-core allows Code Injection.This issue affects Ark Theme… |
CVE-2025-26967 | High | 8.8 | 2025-03-03 | Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects… |
CVE-2025-26918 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology Small Package Quotes – Unishippers Edit… |
CVE-2025-26917 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WP Templata wptemplata allows Reflected XSS.Thi… |
CVE-2025-26914 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Variable Inspector variable-inspector allows Reflect… |
CVE-2025-26885 | High | 7.2 | 2025-03-03 | Deserialization of Untrusted Data vulnerability in Beaver Builder WordPress Assistant assistant allows Object Injection.This issue affects WordPress Assistant… |
CVE-2025-26879 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristián Lávaque s2Member s2member allows Reflected XSS.T… |
CVE-2025-26589 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristopher Dino IE CSS3 Support ie-css3-support allows Re… |
CVE-2025-26588 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gabrielperezs TTT Crop ttt-crop allows Reflected XSS.This… |
CVE-2025-26587 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nghorta sidebarTabs sidebartabs allows Reflected XSS.This… |
CVE-2025-26586 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in abelony Events Planner events-planner allows Reflected XS… |
CVE-2025-26585 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DyadyaLesha DL Leadback dl-leadback allows Reflected XSS… |
CVE-2025-26563 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muneeb Mobile rocket-wp-mobile allows Reflected XSS.This… |
CVE-2025-26557 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viperchill ViperBar viperbar allows Reflected XSS.This is… |
CVE-2025-26540 | High | 7.7 | 2025-03-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This iss… |
CVE-2025-26535 | Critical | 9.3 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerc… |
CVE-2025-26534 | High | 8.6 | 2025-03-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This iss… |
CVE-2025-25170 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Migrate Posts migrate-post allows Reflected… |
CVE-2025-25169 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Authors Autocomplete Meta Box authors-autoc… |
CVE-2025-25165 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richardgabriel Staff Directory Plugin: Company Directory… |
CVE-2025-25164 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yuichiro ABE Meta Accelerator meta-accelerator allows Ref… |
CVE-2025-25162 | High | 7.5 | 2025-03-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in kutu62 Sports Rankings and Lists sports-rankings-lists allows A… |
CVE-2025-25161 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SocialEvolution WP Find Your Nearest wp-find-your-nearest… |
CVE-2025-25158 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Antonio Sanchez Uncomplicated SEO uncomplicated-seo allow… |
CVE-2025-25157 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpchurchteam WP Church Center wp-church-center allows Ref… |
CVE-2025-25150 | Critical | 9.3 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows Blind SQL Injection.Thi… |
CVE-2025-25142 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Jake Group WP Less Compiler wp-less-compiler allows S… |
CVE-2025-25137 | Medium | 6.5 | 2025-03-03 | Cross-Site Request Forgery (CSRF) vulnerability in kareemsultan Social Links social-links allows Cross Site Request Forgery. This issue affects Social Links… |
CVE-2025-25133 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in newbiesup WP Frontend Submit wp-frontend-submit allows Re… |
CVE-2025-25132 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ravi Singh Visitor Details visitors-details allows Stored… |
CVE-2025-25131 | Medium | 6.5 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in randyjensen RJ Quickcharts rj-quickcharts allows Stored X… |
CVE-2025-25130 | High | 7.5 | 2025-03-03 | Relative Path Traversal vulnerability in Shah Alom Delete Comments By Status delete-comments-by-status allows Path Traversal.This issue affects Delete Comments… |
CVE-2025-25129 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Callback Request allows Reflected XSS. This issu… |
CVE-2025-25127 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rohitashv Singhal Contact Us By Lord Linus contact-us-by-… |
CVE-2025-25124 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devu Status Updater fb-status-updater allows Reflected XS… |
CVE-2025-25122 | High | 8.1 | 2025-03-03 | Path Traversal: '.../...//' vulnerability in hashshop WizShop wizshop allows Path Traversal.This issue affects WizShop: from n/a through <= 3.0.2. |
CVE-2025-25121 | High | 7.1 | 2025-03-03 | Cross-Site Request Forgery (CSRF) vulnerability in shyammakwana Theme Options Z theme-options-z allows Cross Site Request Forgery.This issue affects Theme Opti… |
CVE-2025-25119 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alejandro Aranda Woocommerce osCommerce Sync woo-oscommer… |
CVE-2025-25118 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin al… |
CVE-2025-25115 | Medium | 6.5 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zeshan Abdullah Like dislike plus counter like-dislike-pl… |
CVE-2025-25114 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ehabstar User Role user-roles allows Reflected XSS.This i… |
CVE-2025-25113 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Senktec Implied Cookie Consent implied-cookie-consent all… |
CVE-2025-25112 | High | 7.6 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kareemsultan Social Links social-links allows Command Lin… |
CVE-2025-25109 | High | 8.1 | 2025-03-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky WP Vehicle Manager js-vehicle-… |
CVE-2025-25108 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shalomworld SW Plus shalom-world-media-gallery allows Ref… |
CVE-2025-25102 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Harrison Yahoo BOSS yahoo-boss allows Reflected XSS… |
CVE-2025-25099 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in accreteinfosolution Appointment Buddy Widget appointment-… |
CVE-2025-25092 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gtlwpdev All push notification for WP all-push-notificati… |
CVE-2025-25090 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamstime Dreamstime Stock Photos dreamstime-stock-photo… |
CVE-2025-25089 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appten Image Rotator appten-image-rotator allows Reflecte… |
CVE-2025-25087 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim seekXL Snapr seekxl-snapr allows Reflected XSS.This i… |
CVE-2025-25084 | Medium | 6.5 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antrouss UniTimetable unitimetable allows Stored XSS.This… |
CVE-2025-25083 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dave Lavoie EP4 More Embeds ep4-more-embeds allows Stored… |
CVE-2025-25070 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ed atrero Album Reviewer albumreviewer allows Stored XSS… |
CVE-2025-24758 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations… |
CVE-2025-24694 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banner… |
CVE-2025-23956 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Leishman WP Easy Post Mailer wp-mailer allows Ref… |
CVE-2025-23945 | High | 7.5 | 2025-03-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Webliup Popliup popliup allows PHP Loc… |
CVE-2025-23904 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rebrandpress Rebrand Fluent Forms rebrand-fluent-forms al… |
CVE-2025-23903 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woofx Local Shipping Labels for WooCommerce local-shippin… |
CVE-2025-23883 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in unalignedcoder Stray Random Quotes stray-quotes allows Re… |
CVE-2025-23881 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in littlejon LJ Custom Menu Links lj-custom-menu-links allow… |
CVE-2025-23879 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PillarDev Easy Automatic Newsletter Lite easy-automatic-n… |
CVE-2025-23852 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robin90 First Comment Redirect first-comment-redirect all… |
CVE-2025-23850 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojowill Mojo Under Construction mojo-under-construction… |
CVE-2025-23847 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saill Site Launcher site-launcher allows Reflected XSS.Th… |
CVE-2025-23843 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphrmanager WP-HR Manager: The Human Resources Plugin for… |
CVE-2025-23829 | Medium | 6.5 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codingkart Woo Update Variations In Cart woo-update-varia… |
CVE-2025-23814 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRUDLab CRUDLab Like Box crudlab-facebook-like-box allows… |
CVE-2025-23813 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tony Hayes Guten Free Options guten-free-options allows R… |