2025 CVEs (page 402)
Page 402 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1675 | High | 8.2 | 2025-02-25 | The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough… |
CVE-2025-1674 | High | 8.2 | 2025-02-25 | A lack of input validation allows for out of bounds reads caused by malicious or malformed packets. |
CVE-2025-1673 | High | 8.2 | 2025-02-25 | A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation. |
CVE-2025-1648 | High | 7.5 | 2025-02-25 | The Yawave plugin for WordPress is vulnerable to SQL Injection via the 'lbid' parameter in all versions up to, and including, 2.9.1 due to insufficient escapin… |
CVE-2025-1128 | Critical | 9.8 | 2025-02-25 | The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, r… |
CVE-2025-1063 | Medium | 5.3 | 2025-02-25 | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2025-22210 | High | 7.2 | 2025-02-25 | A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL… |
CVE-2025-1646 | High | 7.3 | 2025-02-25 | A vulnerability, which was classified as critical, has been found in Lumsoft ERP 8. Affected by this issue is some unknown functionality of the file /Api/TinyM… |
CVE-2025-27145 | Low | 3.6 | 2025-02-25 | copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. B… |
CVE-2025-1645 | Medium | 6.3 | 2025-02-25 | A vulnerability classified as critical was found in Benner Connecta 1.0.5330. Affected by this vulnerability is an unknown functionality of the file /Usuarios/… |
CVE-2025-1644 | Medium | 4.3 | 2025-02-25 | A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0. Affected is an unknown function of the file /DadosPessoais/SG_Gravar… |
CVE-2025-1643 | Medium | 4.3 | 2025-02-25 | A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of the file /DadosPess… |
CVE-2025-1642 | Medium | 4.3 | 2025-02-25 | A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the file /AGE0000700/G… |
CVE-2025-1641 | High | 7.3 | 2025-02-25 | A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been classified as critical. This affects an unknown part of the file /AGE0000700/GetHorario… |
CVE-2025-1640 | High | 7.3 | 2025-02-25 | A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /Home/J… |
CVE-2025-27144 | | 2025-02-24 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSO… | |
CVE-2025-27143 | Medium | 6.1 | 2025-02-24 | Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to im… |
CVE-2025-22974 | Critical | 9.8 | 2025-02-24 | SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php com… |
CVE-2025-27141 | Medium | 6.5 | 2025-02-24 | Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to ve… |
CVE-2025-27140 | Critical | 9.8 | 2025-02-24 | WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the WeGIA application… |
CVE-2025-25513 | Critical | 9.8 | 2025-02-24 | Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php. |
CVE-2025-27137 | Medium | 4.4 | 2025-02-24 | Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows u… |
CVE-2025-26533 | High | 8.1 | 2025-02-24 | An SQL injection risk was identified in the module list filter within course search. |
CVE-2025-26532 | Low | 3.1 | 2025-02-24 | Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. |
CVE-2025-26531 | Low | 3.1 | 2025-02-24 | Insufficient capability checks made it possible to disable badges a user does not have permission to access. |
CVE-2025-26530 | High | 8.3 | 2025-02-24 | The question bank filter required additional sanitizing to prevent a reflected XSS risk. |
CVE-2025-26529 | High | 8.3 | 2025-02-24 | Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk. |
CVE-2025-26528 | Low | 3.4 | 2025-02-24 | The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk. |
CVE-2025-26527 | Medium | 5.3 | 2025-02-24 | Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. |
CVE-2025-26526 | Medium | 6.5 | 2025-02-24 | Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities. |
CVE-2025-26525 | High | 8.6 | 2025-02-24 | Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live in… |
CVE-2025-27364 | Critical | 10.0 | 2025-02-24 | In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implant) compilation funct… |
CVE-2025-27133 | High | 8.8 | 2025-02-24 | WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3.2.15 at the `adici… |
CVE-2025-27112 | Medium | 6.5 | 2025-02-24 | Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API end… |
CVE-2025-26201 | Critical | 9.1 | 2025-02-24 | Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass authentication and escalat… |
CVE-2025-26200 | High | 7.2 | 2025-02-24 | SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component. |
CVE-2025-22495 | High | 8.4 | 2025-02-24 | An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated h… |
CVE-2025-26803 | Medium | 5.3 | 2025-02-24 | The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method. |
CVE-2025-25460 | Medium | 4.8 | 2025-02-24 | A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated att… |
CVE-2025-27357 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Musa AVCI Önceki Yazı Link onceki-yazi-linki allows Cross Site Request Forgery.This issue affects Önceki Yaz… |
CVE-2025-27356 | Medium | 5.4 | 2025-02-24 | Missing Authorization vulnerability in Hardik Sticky Header On Scroll sticky-header-on-scroll allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-27355 | High | 7.1 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Nicolas GRILLET Woocommerce – Loi Hamon loi-hamon allows Stored XSS.This issue affects Woocommerce – Loi Ham… |
CVE-2025-27353 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Bob Namaste! LMS namaste-lms allows Cross Site Request Forgery.This issue affects Namaste! LMS: from n/a thr… |
CVE-2025-27352 | High | 7.1 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wumii team 无觅相关文章插件 wumii-related-posts allows Stored XSS… |
CVE-2025-27351 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpertBusinessSearch Local Search SEO Contact Page local-… |
CVE-2025-27349 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nurelm Get Posts nurelm-get-posts allows Stored XSS.This… |
CVE-2025-27348 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel WP Social SEO Booster – Knowledge Graph Social Sig… |
CVE-2025-27347 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techmix Direct Checkout Button for WooCommerce woo-direct… |
CVE-2025-27344 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in filipstepanov Phee's LinkPreview linkpreview allows Cross Site Request Forgery.This issue affects Phee's Lin… |
CVE-2025-27342 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in josesan WooCommerce Recargo de Equivalencia woo-recargo-de-equivalencia allows Cross Site Request Forgery.Th… |
CVE-2025-27341 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in afzal_du Reactive Mortgage Calculator reactive-mortgage-c… |
CVE-2025-27340 | Medium | 5.4 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Forge12 Interactive GmbH F12-Profiler f12-profiler allows Cross Site Request Forgery.This issue affects F12-… |
CVE-2025-27339 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Will Anderson Minimum Password Strength minimum-password-strength allows Cross Site Request Forgery.This iss… |
CVE-2025-27336 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Alex Prokopenko / JustCoded Just Variables just-wp-variables allows Cross Site Request Forgery.This issue af… |
CVE-2025-27335 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Free plug in by SEO Roma Auto Tag Links auto-tag-links allows Cross Site Request Forgery.This issue affects… |
CVE-2025-27332 | High | 7.1 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in gmnazmul Smart Maintenance & Countdown smart-maintenance-countdown allows Stored XSS.This issue affects Smar… |
CVE-2025-27331 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sébastien Dumont WooCommerce Display Products by Tags woo… |
CVE-2025-27330 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PlayerJS PlayerJS playerjs allows DOM-Based XSS.This issu… |
CVE-2025-27329 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inlinkz EZ InLinkz linkup inlinkz-scripter allows DOM-Bas… |
CVE-2025-27328 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in queeez WP-PostRatings Cheater wp-postratings-cheater allows Cross Site Request Forgery.This issue affects WP… |
CVE-2025-27327 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Winlin Live Streaming Video Player – by SRS Player srs-pl… |
CVE-2025-27325 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruce Video.js HLS Player videojs-hls-player allows DOM-B… |
CVE-2025-27323 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jon Bishop WP About Author wp-about-author allows DOM-Bas… |
CVE-2025-27321 | High | 7.1 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Blighty Blightly Explorer blighty-explorer allows Stored XSS.This issue affects Blightly Explorer: from n/a… |
CVE-2025-27320 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pankaj Mondal Profile Widget Ninja profile-widget-ninja a… |
CVE-2025-27318 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in ixiter Simple Google Sitemap simple-google-sitemap allows Cross Site Request Forgery.This issue affects Simp… |
CVE-2025-27317 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in IT-RAYS RAYS Grid rays-grid allows Cross Site Request Forgery.This issue affects RAYS Grid: from n/a through… |
CVE-2025-27316 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in hosting.io JPG, PNG Compression and Optimization wp-image-compression allows Cross Site Request Forgery.This… |
CVE-2025-27315 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in wptom All-In-One Cufon all-in-one-cufon allows Cross Site Request Forgery.This issue affects All-In-One Cufo… |
CVE-2025-27312 | High | 8.5 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jenst WP Sitemap wp-sitemap allows SQL Injection.This iss… |
CVE-2025-27311 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in luk3thomas Bulk Content Creator bulk-content-creator allows Cross Site Request Forgery.This issue affects Bu… |
CVE-2025-27307 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows Reflected XSS.T… |
CVE-2025-27306 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pathomation Pathomation pathomation allows Stored XSS.Thi… |
CVE-2025-27305 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Achal Jain Table of Contents Block table-of-contents allo… |
CVE-2025-27304 | Medium | 5.9 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating with font Awesome… |
CVE-2025-27303 | Medium | 5.9 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating contact-form-7-sta… |
CVE-2025-27301 | High | 7.2 | 2025-02-24 | Deserialization of Untrusted Data vulnerability in Nazmul Hasan Robin NHR Options Table Manager nhrrob-options-table-manager allows Object Injection.This issue… |
CVE-2025-27300 | High | 7.2 | 2025-02-24 | Deserialization of Untrusted Data vulnerability in giuliopanda ADFO admin-form allows Object Injection.This issue affects ADFO: from n/a through <= 1.9.1. |
CVE-2025-27298 | High | 8.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in cmstactics WP Video Posts wp-video-posts allows OS Command Injection.This issue affects WP Video Posts: from… |
CVE-2025-27297 | High | 7.6 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in guelben Bravo Search & Replace bravo-search-and-replace a… |
CVE-2025-27296 | High | 7.2 | 2025-02-24 | Missing Authorization vulnerability in revenueflex Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue revenueflex-easy-ads allows Exploiting Inc… |
CVE-2025-27294 | Medium | 4.8 | 2025-02-24 | Missing Authorization vulnerability in platcom WP-Asambleas wp-asambleas allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-27290 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in seyyed-amir Erima Zarinpal Donate erima-zarinpal-donate allows Cross Site Request Forgery.This issue affects… |
CVE-2025-27280 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alobaidi Archive Page archive-page allows DOM-Based XSS.T… |
CVE-2025-27277 | High | 7.1 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in tiefpunkt Add Linked Images To Gallery add-linked-images-to-gallery-v01 allows Cross Site Request Forgery.Th… |
CVE-2025-27276 | High | 8.8 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Photo Gallery ( Responsive ) photo-gallery-pearlbells allows Privilege Escalation.This issue affects… |
CVE-2025-27272 | High | 7.5 | 2025-02-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in vinagecko VG PostCarousel vg-postcarou… |
CVE-2025-27266 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignacio Perez Hover Image Button hover-image-button allow… |
CVE-2025-27265 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aaron D. Campbell Google Maps for WordPress google-maps-f… |
CVE-2025-26883 | Medium | 6.5 | 2025-02-24 | Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-23017 | Medium | 6.0 | 2025-02-24 | WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user… |
CVE-2025-1632 | Low | 3.3 | 2025-02-24 | A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipula… |
CVE-2025-0545 | Medium | 4.7 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tekrom Technology T-Soft E-Commerce allows Cross-S… |
CVE-2025-1488 | Medium | 4.7 | 2025-02-24 | The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insuffici… |
CVE-2025-25279 | Critical | 9.9 | 2025-02-24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which a… |
CVE-2025-24526 | Medium | 4.3 | 2025-02-24 | Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channe… |
CVE-2025-24490 | Critical | 9.6 | 2025-02-24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reorderin… |
CVE-2025-20051 | Critical | 9.9 | 2025-02-24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a boar… |
CVE-2025-1412 | Low | 3.1 | 2025-02-24 | Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user t… |
CVE-2025-0690 | Medium | 6.1 | 2025-02-24 | The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to rea… |