2025 CVEs (page 399)
Page 399 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1858 | High | 7.3 | 2025-03-03 | A vulnerability classified as critical was found in Codezips Online Shopping Website 1.0. This vulnerability affects unknown code of the file /success.php. The… |
CVE-2025-1857 | High | 7.3 | 2025-03-03 | A vulnerability classified as critical has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file /check_… |
CVE-2025-1856 | High | 7.3 | 2025-03-03 | A vulnerability was found in Codezips Gym Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-1723 | High | 8.1 | 2025-03-03 | Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in th… |
CVE-2025-1855 | Medium | 6.3 | 2025-03-03 | A vulnerability was found in PHPGurukul Online Shopping Portal 2.1. It has been declared as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-1854 | Medium | 6.3 | 2025-03-03 | A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/adm… |
CVE-2025-1853 | High | 8.8 | 2025-03-03 | A vulnerability was found in Tenda AC8 16.03.34.06 and classified as critical. This issue affects the function sub_49E098 of the file /goform/SetIpMacBind of t… |
CVE-2025-1852 | High | 8.8 | 2025-03-03 | A vulnerability has been found in Totolink EX1800T 9.1.0cu.2112_B20220316 and classified as critical. This vulnerability affects the function loginAuth of the… |
CVE-2025-1851 | High | 8.8 | 2025-03-03 | A vulnerability, which was classified as critical, was found in Tenda AC7 up to 15.03.06.44. This affects the function formSetFirewallCfg of the file /goform/S… |
CVE-2025-1850 | High | 7.3 | 2025-03-03 | A vulnerability, which was classified as critical, has been found in Codezips College Management System 1.0. Affected by this issue is some unknown functionali… |
CVE-2025-27590 | Critical | 9.0 | 2025-03-03 | In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is… |
CVE-2025-1849 | Medium | 6.3 | 2025-03-03 | A vulnerability classified as critical was found in zj1983 zz up to 2024-8. Affected by this vulnerability is an unknown functionality of the file /import_data… |
CVE-2025-1848 | Medium | 6.3 | 2025-03-03 | A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is an unknown function of the file /import_data_check. The manipulati… |
CVE-2025-20653 | Medium | 6.5 | 2025-03-03 | In da, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure, if an attacker has physical access t… |
CVE-2025-20652 | Medium | 4.6 | 2025-03-03 | In V5 DA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure, if an attacker has physical ac… |
CVE-2025-20651 | Medium | 4.1 | 2025-03-03 | In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure, if an attacker has physical acces… |
CVE-2025-20650 | Medium | 6.8 | 2025-03-03 | In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-20649 | Medium | 6.5 | 2025-03-03 | In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check. This could lead to remote (proximal/adjacent) information… |
CVE-2025-20648 | Medium | 5.5 | 2025-03-03 | In apu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution priv… |
CVE-2025-20647 | Medium | 6.5 | 2025-03-03 | In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base st… |
CVE-2025-20646 | Critical | 9.8 | 2025-03-03 | In wlan AP FW, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege with no additional e… |
CVE-2025-20645 | High | 7.8 | 2025-03-03 | In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2025-20644 | Medium | 6.5 | 2025-03-03 | In Modem, there is a possible memory corruption due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue… |
CVE-2025-1847 | Medium | 6.3 | 2025-03-03 | A vulnerability was found in zj1983 zz up to 2024-8. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to impro… |
CVE-2025-1846 | Medium | 5.4 | 2025-03-03 | A vulnerability was found in zj1983 zz up to 2024-8. It has been declared as problematic. This vulnerability affects the function deleteLocalFile of the file s… |
CVE-2025-1845 | Medium | 6.3 | 2025-03-03 | A vulnerability has been found in ESAFENET DSM 3.1.2 and classified as critical. Affected by this vulnerability is the function examExportPDF of the file /admi… |
CVE-2025-1844 | Medium | 6.3 | 2025-03-03 | A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. Affected is an unknown function of the file /CDGServer3/lo… |
CVE-2025-27585 | Medium | 5.4 | 2025-03-03 | A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to e… |
CVE-2025-27584 | Medium | 5.4 | 2025-03-03 | A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to e… |
CVE-2025-27583 | Critical | 9.1 | 2025-03-03 | Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) Eag… |
CVE-2025-25953 | Medium | 6.5 | 2025-03-03 | Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token exposure. This vulnera… |
CVE-2025-25952 | Medium | 6.5 | 2025-03-03 | An Insecure Direct Object References (IDOR) in the component /getStudemtAllDetailsById?studentId=XX of Serosoft Solutions Pvt Ltd Academia Student Information… |
CVE-2025-25951 | High | 7.5 | 2025-03-03 | An information disclosure vulnerability in the component /rest/cb/executeBasicSearch of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) Ea… |
CVE-2025-25950 | High | 8.1 | 2025-03-03 | Incorrect access control in the component /rest/staffResource/update of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al… |
CVE-2025-25949 | Medium | 5.4 | 2025-03-03 | A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to e… |
CVE-2025-25948 | Critical | 9.1 | 2025-03-03 | Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al… |
CVE-2025-1843 | Medium | 6.3 | 2025-03-03 | A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20250211. This issue affects the function select of the file com/xq/tmall… |
CVE-2025-1842 | Medium | 4.3 | 2025-03-03 | A vulnerability classified as problematic was found in FITSTATS Technologies AthleteMonitoring up to 20250302. This vulnerability affects unknown code of the f… |
CVE-2025-27579 | Medium | 5.4 | 2025-03-03 | In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bitaxe Bitcoin miner… |
CVE-2025-1841 | High | 7.3 | 2025-03-03 | A vulnerability classified as critical has been found in ESAFENET CDG 5.6.3.154.205. This affects an unknown part of the file /CDGServer3/logManagement/ClientS… |
CVE-2025-1840 | High | 7.3 | 2025-03-03 | A vulnerability was found in ESAFENET CDG 5.6.3.154.205. It has been rated as critical. Affected by this issue is some unknown functionality of the file /CDGSe… |
CVE-2025-1836 | Medium | 4.3 | 2025-03-02 | A vulnerability was found in Incorta 2023.4.3. It has been classified as problematic. Affected is an unknown function of the component Edit Insight Handler. Th… |
CVE-2025-1835 | Medium | 6.3 | 2025-03-02 | A vulnerability has been found in osuuu LightPicture 1.2.2 and classified as critical. This vulnerability affects the function upload of the file /app/controll… |
CVE-2025-1834 | Medium | 6.3 | 2025-03-02 | A vulnerability, which was classified as critical, was found in zj1983 zz up to 2024-8. This affects an unknown part of the file /resolve. The manipulation of… |
CVE-2025-1833 | Medium | 6.3 | 2025-03-02 | A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. Affected by this issue is the function sendNotice of the file src/… |
CVE-2025-1832 | Medium | 6.3 | 2025-03-02 | A vulnerability classified as critical was found in zj1983 zz up to 2024-8. Affected by this vulnerability is the function getUserList of the file src/main/jav… |
CVE-2025-1831 | Medium | 6.3 | 2025-03-02 | A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is the function GetDBUser of the file src/main/java/com/futvan/z/syst… |
CVE-2025-1830 | Low | 2.4 | 2025-03-02 | A vulnerability was found in zj1983 zz up to 2024-8. It has been rated as problematic. This issue affects some unknown processing of the component Customer Inf… |
CVE-2025-1829 | Medium | 6.3 | 2025-03-02 | A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been declared as critical. This vulnerability affects the function setMtknatCfg of the… |
CVE-2025-1821 | Medium | 6.3 | 2025-03-02 | A vulnerability was found in zj1983 zz up to 2024-8 and classified as critical. Affected by this issue is the function getUserOrgForUserId of the file src/main… |
CVE-2025-1820 | Medium | 6.3 | 2025-03-02 | A vulnerability has been found in zj1983 zz up to 2024-8 and classified as critical. Affected by this vulnerability is the function getOaWid of the file src/ma… |
CVE-2025-1819 | Medium | 6.3 | 2025-03-02 | A vulnerability, which was classified as critical, was found in Tenda AC7 1200M 15.03.06.44. Affected is the function TendaTelnet of the file /goform/telnet. T… |
CVE-2025-1818 | Medium | 6.3 | 2025-03-02 | A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. This issue affects some unknown processing of the file src/main/ja… |
CVE-2025-0895 | Low | 2.4 | 2025-03-02 | IBM Cognos Analytics Mobile 1.1 for Android could allow a user with physical access to the device, to obtain sensitive information from debugging code log mess… |
CVE-2025-1817 | Low | 2.4 | 2025-03-02 | A vulnerability classified as problematic was found in Mini-Tmall up to 20250211. This vulnerability affects unknown code of the file /admin of the component A… |
CVE-2025-1816 | Medium | 4.3 | 2025-03-02 | A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb. This affects the function audio_element_obu… |
CVE-2025-1815 | High | 7.3 | 2025-03-02 | A vulnerability, which was classified as critical, was found in pbrong hrms up to 1.0.1. This affects the function HrmsDB of the file \resource\resource.go. Th… |
CVE-2025-1814 | High | 8.8 | 2025-03-02 | A vulnerability, which was classified as critical, has been found in Tenda AC6 15.03.05.16. Affected by this issue is some unknown functionality of the file /g… |
CVE-2025-1813 | Medium | 4.3 | 2025-03-02 | A vulnerability classified as problematic was found in zj1983 zz up to 2024-08. Affected by this vulnerability is an unknown functionality. The manipulation le… |
CVE-2025-1812 | Medium | 6.3 | 2025-03-02 | A vulnerability classified as critical has been found in zj1983 zz up to 2024-08. Affected is the function GetUserOrg of the file com/futvan/z/framework/core/S… |
CVE-2025-1811 | High | 7.3 | 2025-03-02 | A vulnerability was found in AT Software Solutions ATSVD up to 3.4.1. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-1810 | Medium | 4.3 | 2025-03-02 | A vulnerability was found in Pixsoft Vivaz 6.0.11. It has been classified as problematic. Affected is an unknown function of the file /servlet?act=login&submit… |
CVE-2025-1809 | High | 7.3 | 2025-03-02 | A vulnerability was found in Pixsoft Sol up to 7.6.6c and classified as critical. This issue affects some unknown processing of the file /pix_projetos/servlet?… |
CVE-2025-25724 | Medium | 4.0 | 2025-03-02 | list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other… |
CVE-2025-1808 | High | 7.3 | 2025-03-02 | A vulnerability has been found in Pixsoft E-Saphira 1.7.24 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login&t… |
CVE-2025-1807 | Low | 3.5 | 2025-03-02 | A vulnerability, which was classified as problematic, was found in Eastnets PaymentSafe 2.5.26.0. This affects an unknown part of the file /directRouter.rfc of… |
CVE-2025-1806 | Medium | 4.3 | 2025-03-02 | A vulnerability, which was classified as problematic, has been found in Eastnets PaymentSafe 2.5.26.0. Affected by this issue is some unknown functionality of… |
CVE-2025-1804 | High | 7.0 | 2025-03-01 | A vulnerability was found in Blizzard Battle.Net up to 2.39.0.15212 on Windows and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2025-1800 | Medium | 6.3 | 2025-03-01 | A vulnerability has been found in D-Link DAR-7000 3.2 and classified as critical. This vulnerability affects the function get_ip_addr_details of the file /view… |
CVE-2025-1799 | Medium | 6.3 | 2025-03-01 | A vulnerability, which was classified as critical, was found in Zorlan SkyCaiji 2.9. This affects the function previewAction of the file vendor/skycaiji/app/ad… |
CVE-2025-1797 | Medium | 6.3 | 2025-03-01 | A vulnerability, which was classified as critical, has been found in Hunan Zhonghe Baiyi Information Technology Baiyiyun Asset Management and Operations System… |
CVE-2025-1791 | Medium | 6.3 | 2025-03-01 | A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical. This vulnerability affects the function fileAction of the file vendor/skycaij… |
CVE-2025-1788 | Medium | 5.3 | 2025-03-01 | A vulnerability, which was classified as critical, was found in rizinorg rizin up to 0.8.0. This affects the function rz_utf8_encode in the library /librz/util… |
CVE-2025-1491 | Medium | 6.4 | 2025-03-01 | The WP Posts Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play_timeout’ parameter in all versions up to, and includ… |
CVE-2025-1404 | Medium | 5.3 | 2025-03-01 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2025-1786 | Medium | 5.3 | 2025-03-01 | A vulnerability was found in rizinorg rizin up to 0.7.4. It has been rated as critical. This issue affects the function msf_stream_directory_free in the librar… |
CVE-2025-1291 | Medium | 6.4 | 2025-03-01 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icon’ parameter i… |
CVE-2025-1671 | Critical | 9.8 | 2025-03-01 | The Academist Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.6. This is due to the academist_m… |
CVE-2025-1638 | Critical | 9.8 | 2025-03-01 | The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2. This is due to the plugin not… |
CVE-2025-1564 | Critical | 9.8 | 2025-03-01 | The SetSail Membership plugin for WordPress is vulnerable to in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a u… |
CVE-2025-1730 | Medium | 6.5 | 2025-03-01 | The Simple Download Counter plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.0 via the 'simple_download_counte… |
CVE-2025-1502 | Medium | 5.3 | 2025-03-01 | The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'download_ip2location_re… |
CVE-2025-1459 | Medium | 6.4 | 2025-03-01 | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Embedded Video(PB) widget in all versions up to, and i… |
CVE-2025-27554 | Critical | 9.9 | 2025-03-01 | ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commands on the build ser… |
CVE-2025-0820 | Medium | 6.4 | 2025-03-01 | The Clicface Trombi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nom’ parameter in all versions up to, and including, 2.08 due to… |
CVE-2025-1780 | Medium | 4.3 | 2025-03-01 | The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing c… |
CVE-2025-23119 | High | 7.5 | 2025-03-01 | An Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Execution (RCE) by a malicious actor with… |
CVE-2025-23118 | Medium | 6.4 | 2025-03-01 | An Improper Certificate Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent network to make uns… |
CVE-2025-23117 | Medium | 6.8 | 2025-03-01 | An Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent network to… |
CVE-2025-23116 | Critical | 9.6 | 2025-03-01 | An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor with access to UniFi P… |
CVE-2025-23115 | Critical | 9.0 | 2025-03-01 | A Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi Protect Cameras man… |
CVE-2025-27416 | | 2025-03-01 | Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with scratch username and password form. Any… | |
CVE-2025-25723 | High | 8.4 | 2025-02-28 | Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code. |
CVE-2025-25478 | Medium | 6.5 | 2025-02-28 | The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of… |
CVE-2025-25476 | Medium | 5.4 | 2025-02-28 | A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Javascript code by spe… |
CVE-2025-25379 | Critical | 9.6 | 2025-02-28 | Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component. |
CVE-2025-26466 | Medium | 5.9 | 2025-02-28 | A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of p… |
CVE-2025-27414 | | 2025-02-28 | MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to RELEASE.2025-02-28T09-55-16Z, a bug in evaluating the trust… | |
CVE-2025-27413 | Medium | 6.5 | 2025-02-28 | PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into th… |
CVE-2025-27410 | Medium | 6.5 | 2025-02-28 | PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's… |