2025 CVEs (page 401)
Page 401 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22868 | High | 7.5 | 2025-02-26 | An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. |
CVE-2025-0889 | High | 7.8 | 2025-02-26 | Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM o… |
CVE-2025-0236 | Medium | 5.3 | 2025-02-26 | Out-of-bounds vulnerability in slope processing during curve rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4… |
CVE-2025-0235 | Medium | 5.3 | 2025-02-26 | Out-of-bounds vulnerability due to improper memory release during image rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generi… |
CVE-2025-0234 | Medium | 5.3 | 2025-02-26 | Out-of-bounds vulnerability in curve segmentation processing of Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer D… |
CVE-2025-1091 | Medium | 4.3 | 2025-02-26 | A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known. |
CVE-2025-0760 | Low | 2.7 | 2025-02-26 | A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption. |
CVE-2025-25521 | Critical | 9.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php. |
CVE-2025-25520 | Critical | 9.8 | 2025-02-25 | Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php. |
CVE-2025-25519 | Critical | 9.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php. |
CVE-2025-25517 | Critical | 9.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php. |
CVE-2025-25516 | Critical | 9.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php. |
CVE-2025-25515 | High | 8.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database. |
CVE-2025-25514 | Medium | 6.5 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php. |
CVE-2025-22211 | Low | 3.4 | 2025-02-25 | A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary… |
CVE-2025-0514 | High | 7.8 | 2025-02-25 | Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on a… |
CVE-2025-27148 | High | 8.8 | 2025-02-25 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory ca… |
CVE-2025-27146 | Low | 2.7 | 2025-02-25 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbit… |
CVE-2025-27142 | High | 8.8 | 2025-02-25 | LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network without needing an int… |
CVE-2025-27139 | Medium | 6.8 | 2025-02-25 | Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting when the preferences… |
CVE-2025-27110 | High | 7.5 | 2025-02-25 | Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and… |
CVE-2025-27135 | Critical | 9.8 | 2025-02-25 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts… |
CVE-2025-25192 | Medium | 6.5 | 2025-02-25 | GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information… |
CVE-2025-23046 | High | 7.5 | 2025-02-25 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is… |
CVE-2025-1204 | | 2025-02-25 | The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existing device network set… | |
CVE-2025-1068 | High | 7.3 | 2025-02-25 | There is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the loca… |
CVE-2025-1067 | High | 7.3 | 2025-02-25 | There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file… |
CVE-2025-26601 | High | 7.8 | 2025-02-25 | A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the tr… |
CVE-2025-26600 | High | 7.8 | 2025-02-25 | A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device i… |
CVE-2025-26599 | High | 7.8 | 2025-02-25 | An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap… |
CVE-2025-26598 | High | 7.8 | 2025-02-25 | An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns… |
CVE-2025-26597 | High | 7.8 | 2025-02-25 | A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave… |
CVE-2025-26596 | High | 7.8 | 2025-02-25 | A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), whic… |
CVE-2025-26595 | High | 7.8 | 2025-02-25 | A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the v… |
CVE-2025-26594 | High | 7.8 | 2025-02-25 | A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, t… |
CVE-2025-23024 | Medium | 4.3 | 2025-02-25 | GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active pl… |
CVE-2025-21627 | Medium | 6.5 | 2025-02-25 | GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the… |
CVE-2025-21626 | Medium | 5.8 | 2025-02-25 | GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive informati… |
CVE-2025-27000 | Medium | 5.4 | 2025-02-25 | Missing Authorization vulnerability in George Pattichis Simple Photo Feed simple-photo-feed allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-26995 | Medium | 5.4 | 2025-02-25 | Missing Authorization vulnerability in Anton Vanyukov Market Exporter market-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-26993 | High | 7.1 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Refl… |
CVE-2025-26991 | High | 7.1 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ollybach WPPizza wppizza allows Reflected XSS.This issue… |
CVE-2025-26987 | High | 7.1 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-f… |
CVE-2025-26985 | High | 8.1 | 2025-02-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support maje… |
CVE-2025-26983 | Medium | 4.3 | 2025-02-25 | Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom allows Exploiting Incorrectly Configure… |
CVE-2025-26981 | High | 7.1 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows… |
CVE-2025-26980 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wired Impact Wired Impact Volunteer Management wired-impa… |
CVE-2025-26979 | High | 7.5 | 2025-02-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Aman Funnel Builder by FunnelKit funne… |
CVE-2025-26977 | Low | 3.8 | 2025-02-25 | Authorization Bypass Through User-Controlled Key vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-26975 | Medium | 5.3 | 2025-02-25 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Accessing Functionality Not Properly Constrained by ACLs.This is… |
CVE-2025-26974 | Critical | 9.3 | 2025-02-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator… |
CVE-2025-26971 | High | 7.6 | 2025-02-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Poll Maker poll-maker allows Blind SQL Injection… |
CVE-2025-26966 | Critical | 9.8 | 2025-02-25 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/… |
CVE-2025-26965 | Medium | 5.3 | 2025-02-25 | Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-26964 | High | 7.5 | 2025-02-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution al… |
CVE-2025-26963 | Medium | 5.4 | 2025-02-25 | Cross-Site Request Forgery (CSRF) vulnerability in ClickWhale ClickWhale clickwhale allows Cross Site Request Forgery.This issue affects ClickWhale: from n/a t… |
CVE-2025-26962 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Easy Contact Form Lite contact-form-lite allows… |
CVE-2025-26960 | Medium | 6.5 | 2025-02-25 | Missing Authorization vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Exploiting… |
CVE-2025-26957 | High | 7.5 | 2025-02-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Deetronix Affiliate Coupons affiliate-… |
CVE-2025-26952 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Business Card Block business-card-block allows S… |
CVE-2025-26949 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Team Section Block team-section allows Stored XS… |
CVE-2025-26948 | Medium | 4.3 | 2025-02-25 | Missing Authorization vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2. |
CVE-2025-26947 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Services Section block services-section allows S… |
CVE-2025-26946 | High | 7.6 | 2025-02-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Yelp Review Slider wp-yelp-review-slider all… |
CVE-2025-26945 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Info Cards info-cards allows Stored XSS.This iss… |
CVE-2025-26943 | Critical | 9.3 | 2025-02-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Blind SQL In… |
CVE-2025-26939 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Counters Block counters-block allows Stored XSS… |
CVE-2025-26938 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Countdown Timer countdown-time allows Stored XSS… |
CVE-2025-26937 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XS… |
CVE-2025-26935 | High | 7.5 | 2025-02-25 | Path Traversal: '.../...//' vulnerability in wpjobportal WP Job Portal wp-job-portal allows PHP Local File Inclusion.This issue affects WP Job Portal: from n/a… |
CVE-2025-26932 | High | 7.5 | 2025-02-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QuantumCloud ChatBot chatbot allows PH… |
CVE-2025-26931 | High | 7.1 | 2025-02-25 | Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Tribulant Gallery Voting gallery-voting allows Stored XSS.This issue affects Tribulant Ga… |
CVE-2025-26928 | Medium | 4.3 | 2025-02-25 | Missing Authorization vulnerability in Xfinitysoft Order Limit for WooCommerce wc-order-limit-lite allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-26926 | Medium | 4.3 | 2025-02-25 | Cross-Site Request Forgery (CSRF) vulnerability in fs-code Booknetic booknetic.This issue affects Booknetic: from n/a through <= 4.0.9. |
CVE-2025-26915 | High | 8.5 | 2025-02-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This i… |
CVE-2025-26913 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webandprint AR For WordPress ar-for-wordpress allows DOM-… |
CVE-2025-26912 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons al… |
CVE-2025-26911 | Medium | 4.3 | 2025-02-25 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectl… |
CVE-2025-26907 | High | 7.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calc… |
CVE-2025-26905 | High | 7.5 | 2025-02-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This is… |
CVE-2025-26904 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gal_op WP Responsive Auto Fit Text wp-responsive-slab-tex… |
CVE-2025-26900 | Critical | 9.8 | 2025-02-25 | Deserialization of Untrusted Data vulnerability in flexmls Flexmls® IDX flexmls-idx allows Object Injection.This issue affects Flexmls® IDX: from n/a through <… |
CVE-2025-26897 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baden List Related Attachments list-related-attachments-w… |
CVE-2025-26896 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vpiwigo PiwigoPress piwigopress allows Stored XSS.This is… |
CVE-2025-26893 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kiran Potphode Easy Charts easy-charts allows DOM-Based X… |
CVE-2025-26891 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana ibtana-visual-editor allows Stored XSS.T… |
CVE-2025-26887 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlr… |
CVE-2025-26884 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-b… |
CVE-2025-26882 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Popup Builder easy-notify-lite allows Stored XSS… |
CVE-2025-26881 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored X… |
CVE-2025-26878 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patternsinthecloud Autoship Cloud for WooCommerce Subscri… |
CVE-2025-26877 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows St… |
CVE-2025-26876 | Medium | 6.8 | 2025-02-25 | Path Traversal: '.../...//' vulnerability in CodeManas Search with Typesense search-with-typesense allows Path Traversal.This issue affects Search with Typesen… |
CVE-2025-26871 | Medium | 4.3 | 2025-02-25 | Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-26868 | High | 7.1 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fastflow Fast Flow fast-flow-dashboard allows Reflected X… |
CVE-2025-26753 | High | 7.5 | 2025-02-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-i… |
CVE-2025-26752 | High | 8.6 | 2025-02-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-i… |
CVE-2025-26751 | High | 7.1 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood Alphabetic Pagination alphabetic-pagination… |
CVE-2025-1262 | Medium | 5.3 | 2025-02-25 | The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthen… |
CVE-2025-1676 | Medium | 6.3 | 2025-02-25 | A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the function pdf2swf of the… |