2025 CVEs (page 400)
Page 400 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0769 | | 2025-02-28 | PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function… | |
CVE-2025-25635 | High | 8.0 | 2025-02-28 | TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the pppoe_dns1 p… |
CVE-2025-25610 | High | 8.0 | 2025-02-28 | TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_gw pa… |
CVE-2025-25609 | High | 8.0 | 2025-02-28 | TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_ipv6… |
CVE-2025-25429 | Medium | 4.8 | 2025-02-28 | Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the r_name variable inside the have_same_name function on the /adds… |
CVE-2025-25428 | High | 8.0 | 2025-02-28 | TRENDnet TEW-929DRU 1.0.0.10 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2025-1795 | | 2025-02-28 | During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicod… | |
CVE-2025-0160 | High | 8.1 | 2025-02-28 | IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5… |
CVE-2025-0159 | Critical | 9.1 | 2025-02-28 | IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5… |
CVE-2025-27408 | Medium | 4.8 | 2025-02-28 | Manifest offers users a one-file micro back end. Prior to version 4.9.2, Manifest employs a weak password hashing implementation that uses SHA3 without a salt… |
CVE-2025-25431 | Medium | 4.8 | 2025-02-28 | Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the The ssid key of wifi_data parameter on the /captive_portal.htm… |
CVE-2025-25430 | Medium | 4.8 | 2025-02-28 | Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the configname parameter on the /cbi_addcert.htm page. |
CVE-2025-24849 | High | 7.1 | 2025-02-28 | Lack of encryption in transit for cloud infrastructure facilitating potential for sensitive data manipulation or exposure. |
CVE-2025-24843 | Medium | 5.1 | 2025-02-28 | Insecure file retrieval process that facilitates potential for file manipulation to affect product stability and confidentiality, integrity, authenticity, and… |
CVE-2025-24318 | Medium | 6.8 | 2025-02-28 | Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session compromise. |
CVE-2025-24316 | Medium | 5.3 | 2025-02-28 | The Dario Health Internet-based server infrastructure is vulnerable due to exposure of development environment details, which could lead to unsafe functionalit… |
CVE-2025-23405 | Medium | 5.3 | 2025-02-28 | Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attacks (ex log injection). |
CVE-2025-20060 | High | 7.5 | 2025-02-28 | An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted to the Android device via the Dario Hea… |
CVE-2025-20049 | Medium | 5.8 | 2025-02-28 | The Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive information. |
CVE-2025-0985 | Medium | 5.5 | 2025-02-28 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD stores potentially sensitive information in environment variables that could be obtained by a local user. |
CVE-2025-27400 | Low | 2.9 | 2025-02-28 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a… |
CVE-2025-26263 | Medium | 5.1 | 2025-02-28 | GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure due to improper memo… |
CVE-2025-26047 | Medium | 5.1 | 2025-02-28 | Loggrove v1.0 is vulnerable to SQL Injection in the read.py file. |
CVE-2025-25461 | Medium | 5.4 | 2025-02-28 | A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS… |
CVE-2025-26326 | High | 8.8 | 2025-02-28 | A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker t… |
CVE-2025-25916 | Medium | 5.4 | 2025-02-28 | wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php. |
CVE-2025-1776 | Medium | 6.1 | 2025-02-28 | Cross-Site Scripting (XSS) vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to execute arbitrary code via the ‘query’ par… |
CVE-2025-1749 | Medium | 4.7 | 2025-02-28 | HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by… |
CVE-2025-1748 | Medium | 4.7 | 2025-02-28 | HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by… |
CVE-2025-1747 | Medium | 4.7 | 2025-02-28 | HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by… |
CVE-2025-1746 | Medium | 6.1 | 2025-02-28 | Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browse… |
CVE-2025-22274 | | 2025-02-28 | It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint… | |
CVE-2025-22273 | | 2025-02-28 | Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword"… | |
CVE-2025-22272 | | 2025-02-28 | In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is th… | |
CVE-2025-22271 | | 2025-02-28 | The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mecha… | |
CVE-2025-22270 | | 2025-02-28 | An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a new role in the "name" field. It shoul… | |
CVE-2025-1319 | High | 7.2 | 2025-02-28 | The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up t… |
CVE-2025-1300 | Medium | 6.1 | 2025-02-28 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. The CodeChecker web server contains an… |
CVE-2025-22492 | Medium | 6.3 | 2025-02-28 | The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrat… |
CVE-2025-22491 | Medium | 6.7 | 2025-02-28 | The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead into execution of arb… |
CVE-2025-1662 | Medium | 6.4 | 2025-02-28 | The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'url_media_uploade… |
CVE-2025-1570 | High | 8.1 | 2025-02-28 | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeo… |
CVE-2025-1560 | Medium | 6.4 | 2025-02-28 | The WOW Entrance Effects (WEE!) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all versions up to, and i… |
CVE-2025-1413 | | 2025-02-28 | DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, wh… | |
CVE-2025-1572 | Medium | 6.5 | 2025-02-28 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all versions up to, and… |
CVE-2025-1571 | Medium | 6.4 | 2025-02-28 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Image Comparison Widget… |
CVE-2025-1405 | Medium | 6.4 | 2025-02-28 | The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all versions up to, an… |
CVE-2025-0764 | Medium | 6.5 | 2025-02-28 | The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class i… |
CVE-2025-1513 | High | 7.2 | 2025-02-28 | The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for Wo… |
CVE-2025-1511 | Medium | 6.1 | 2025-02-28 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Reflected Cross-Site Scriptin… |
CVE-2025-1506 | Medium | 4.3 | 2025-02-28 | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.0. T… |
CVE-2025-1757 | Medium | 6.4 | 2025-02-28 | The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfhub_portfolio' and 'p… |
CVE-2025-1505 | Medium | 6.1 | 2025-02-28 | The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and inc… |
CVE-2025-0801 | Medium | 4.3 | 2025-02-28 | The RateMyAgent Official plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing o… |
CVE-2025-1744 | Critical | 9.8 | 2025-02-28 | Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before <5.9.9. |
CVE-2025-23225 | Medium | 6.5 | 2025-02-28 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user to cause a denial of service due to the improper handling of invalid headers sent… |
CVE-2025-0975 | High | 8.8 | 2025-02-28 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute code due to improper neutralization of escape characters. |
CVE-2025-0823 | Medium | 6.5 | 2025-02-28 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 and 12.0.0 through 12.0.4 could allow a remote attacker to traverse directories on the system. An attacker could… |
CVE-2025-25729 | High | 7.5 | 2025-02-28 | An information disclosure vulnerability in Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 allows attackers to obtai… |
CVE-2025-25728 | Medium | 6.5 | 2025-02-28 | Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to send communications to the update API in plaintex… |
CVE-2025-25727 | Medium | 6.2 | 2025-02-28 | Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext. |
CVE-2025-25477 | High | 8.1 | 2025-02-28 | A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the vic… |
CVE-2025-1687 | High | 8.8 | 2025-02-28 | The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missing nonce validation… |
CVE-2025-1682 | High | 8.8 | 2025-02-28 | The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'save_se… |
CVE-2025-1681 | Medium | 5.4 | 2025-02-28 | The Cardealer theme for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check and missing filename sa… |
CVE-2025-24832 | Medium | 5.5 | 2025-02-27 | Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for… |
CVE-2025-26325 | Critical | 9.8 | 2025-02-27 | ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php. |
CVE-2025-26264 | High | 8.8 | 2025-02-27 | GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notification Settings fea… |
CVE-2025-25730 | Medium | 4.6 | 2025-02-27 | An issue in Motorola Mobility Droid Razr HD (Model XT926) System Version: 9.18.94.XT926.Verizon.en.US allows physically proximate unauthorized attackers to acc… |
CVE-2025-25570 | Critical | 9.8 | 2025-02-27 | Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials. |
CVE-2025-22952 | Critical | 9.8 | 2025-02-27 | elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perfo… |
CVE-2025-21824 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix a use of uninitialized mutex commit c8347f915e67 ("gpu: host1x: Fix boot… |
CVE-2025-21823 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: Drop unmanaged ELP metric worker The ELP worker needs to calculate new metric… |
CVE-2025-21822 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: Set driver data before its usage If vmclock_ptp_register() fails during pro… |
CVE-2025-21821 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: fbdev: omap: use threaded IRQ for LCD DMA When using touchscreen and framebuffer, Nokia 7… |
CVE-2025-21820 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: tty: xilinx_uartps: split sysrq handling lockdep detects the following circular locking d… |
CVE-2025-21819 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amd/display: Use HW lock mgr for PSR1" This reverts commit a2b5a9956269 ("drm… |
CVE-2025-21817 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: block: mark GFP_NOIO around sysfs ->store() sysfs ->store is called with queue freezed, m… |
CVE-2025-21816 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING hrtimers are m… |
CVE-2025-21815 | High | 7.1 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: mm/compaction: fix UBSAN shift-out-of-bounds warning syzkaller reported a UBSAN shift-out… |
CVE-2025-21814 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure info->enable callback is always set The ioctl and sysfs handlers unconditiona… |
CVE-2025-21813 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fix off-by-one root mis-connection Before attaching a new root to the o… |
CVE-2025-21812 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ax25: rcu protect dev->ax25_ptr syzbot found a lockdep issue [1]. We should remove ax25… |
CVE-2025-21811 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect access to buffers with no active references nilfs_lookup_dirty_data_buffe… |
CVE-2025-21810 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() There are… |
CVE-2025-21809 | High | 7.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: rxrpc, afs: Fix peer hash locking vs RCU callback In its address list, afs now retains po… |
CVE-2025-21808 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: net: xdp: Disallow attaching device-bound programs in generic mode Device-bound programs… |
CVE-2025-21807 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: block: fix queue freeze vs limits lock order in sysfs store methods queue_attr_store() al… |
CVE-2025-21806 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encountered dur… |
CVE-2025-21805 | Critical | 9.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Add missing deinit() call A warning is triggered when repeatedly connecting an… |
CVE-2025-21804 | High | 7.1 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() The rcar… |
CVE-2025-21803 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix warnings during S3 suspend The enable_gpe_wakeup() function calls acpi_ena… |
CVE-2025-21802 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix oops when unload drivers paralleling When unload hclge driver, it tries to… |
CVE-2025-21801 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: net: ravb: Fix missing rtnl lock in suspend/resume path Fix the suspend/resume path by en… |
CVE-2025-21800 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset When bit offset for HWS_… |
CVE-2025-21799 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns() When get… |
CVE-2025-21798 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: firewire: test: Fix potential null dereference in firewire kunit test kunit_kzalloc() may… |
CVE-2025-22624 | | 2025-02-27 | FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable. The web application dynamically generat… | |
CVE-2025-0767 | Critical | 9.8 | 2025-02-27 | WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer… |
CVE-2025-27399 | Medium | 5.3 | 2025-02-27 | Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is s… |