2025 CVEs (page 403)
Page 403 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1629 | Low | 3.5 | 2025-02-24 | A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function… |
CVE-2025-1618 | Medium | 4.3 | 2025-02-24 | A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic. This vulnerability affects unknown code of the file /modules/Mobile/ind… |
CVE-2025-1617 | Low | 2.4 | 2025-02-24 | A vulnerability, which was classified as problematic, was found in Netis WF2780 2.1.41925. This affects an unknown part of the component Wireless 2.4G Menu. Th… |
CVE-2025-1616 | Medium | 4.7 | 2025-02-24 | A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality… |
CVE-2025-1615 | Low | 2.4 | 2025-02-24 | A vulnerability classified as problematic was found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-1614 | Low | 2.4 | 2025-02-24 | A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected is an unknown function of the file /goform/portForwa… |
CVE-2025-1613 | Low | 2.4 | 2025-02-24 | A vulnerability was found in FiberHome AN5506-01A ONU GPON RP2511. It has been rated as problematic. This issue affects some unknown processing of the file /go… |
CVE-2025-1612 | Low | 3.5 | 2025-02-24 | A vulnerability was found in Edimax BR-6288ACL 1.30. It has been declared as problematic. This vulnerability affects unknown code of the file wireless5g_basic… |
CVE-2025-1611 | Medium | 4.7 | 2025-02-24 | A vulnerability was found in ShopXO up to 6.4.0. It has been classified as problematic. This affects an unknown part of the file app/service/ThemeAdminService… |
CVE-2025-1610 | Medium | 6.3 | 2025-02-24 | A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_… |
CVE-2025-1609 | Medium | 6.3 | 2025-02-24 | A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file… |
CVE-2025-1608 | Medium | 6.3 | 2025-02-24 | A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd… |
CVE-2025-1607 | Medium | 4.3 | 2025-02-24 | A vulnerability, which was classified as problematic, has been found in SourceCodester Best Employee Management System 1.0. This issue affects some unknown pro… |
CVE-2025-1606 | Medium | 4.3 | 2025-02-24 | A vulnerability classified as problematic was found in SourceCodester Best Employee Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2025-1599 | Medium | 5.4 | 2025-02-24 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been rated as problematic. Affected by this issue is some unknown funct… |
CVE-2025-1598 | Medium | 6.3 | 2025-02-24 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2025-22635 | High | 7.1 | 2025-02-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Eventer eventer allows Reflected XSS.This issue… |
CVE-2025-22633 | Medium | 5.8 | 2025-02-23 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in StellarWP Give – Divi Donation Modules give-donation-modules-f… |
CVE-2025-22632 | High | 7.1 | 2025-02-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalsoft WooCommerce Pricing – Product Pricing woo-prici… |
CVE-2025-22631 | High | 7.1 | 2025-02-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vbout Marketing Automation marketing-automation allows Re… |
CVE-2025-1597 | Low | 3.5 | 2025-02-23 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been classified as problematic. Affected is an unknown function of the… |
CVE-2025-1596 | High | 7.3 | 2025-02-23 | A vulnerability was found in SourceCodester Best Church Management Software 1.0 and classified as critical. This issue affects some unknown processing of the f… |
CVE-2025-1595 | Medium | 5.3 | 2025-02-23 | A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code… |
CVE-2025-1594 | Medium | 6.3 | 2025-02-23 | A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc… |
CVE-2025-1593 | Medium | 4.7 | 2025-02-23 | A vulnerability classified as critical has been found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /_hr_soft… |
CVE-2025-1592 | Low | 2.4 | 2025-02-23 | A vulnerability was found in SourceCodester Best Employee Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown funct… |
CVE-2025-1591 | Low | 2.4 | 2025-02-23 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown f… |
CVE-2025-1590 | Medium | 4.7 | 2025-02-23 | A vulnerability was found in SourceCodester E-Learning System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/modul… |
CVE-2025-1589 | Medium | 4.3 | 2025-02-23 | A vulnerability was found in SourceCodester E-Learning System 1.0 and classified as problematic. This issue affects some unknown processing of the file /regist… |
CVE-2025-1588 | Medium | 6.5 | 2025-02-23 | A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ad… |
CVE-2025-1467 | Medium | 6.1 | 2025-02-23 | Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight(). This is related… |
CVE-2025-1587 | Medium | 5.3 | 2025-02-23 | A vulnerability was found in SourceCodester Telecom Billing Management System 1.0. It has been rated as critical. This issue affects the function addrecords of… |
CVE-2025-1586 | Low | 3.5 | 2025-02-23 | A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /Blo… |
CVE-2025-1585 | Low | 2.4 | 2025-02-23 | A vulnerability, which was classified as problematic, has been found in otale tale up to 2.0.5. This issue affects the function OptionsService of the file src/… |
CVE-2025-1584 | Medium | 4.3 | 2025-02-23 | A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-we… |
CVE-2025-1583 | Medium | 6.3 | 2025-02-23 | A vulnerability classified as critical has been found in PHPGurukul Online Nurse Hiring System 1.0. This affects an unknown part of the file /admin/search-repo… |
CVE-2025-1582 | Medium | 6.3 | 2025-02-23 | A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-1581 | Medium | 6.3 | 2025-02-23 | A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-1580 | Medium | 6.3 | 2025-02-23 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the f… |
CVE-2025-1579 | Low | 2.4 | 2025-02-23 | A vulnerability was found in code-projects Blood Bank System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/u… |
CVE-2025-1578 | Medium | 6.3 | 2025-02-23 | A vulnerability, which was classified as critical, was found in PHPGurukul/Campcodes Online Shopping Portal 2.1. This affects an unknown part of the file /sear… |
CVE-2025-1577 | Low | 3.5 | 2025-02-23 | A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank System 1.0. Affected by this issue is some unknown functionali… |
CVE-2025-1576 | Medium | 6.3 | 2025-02-23 | A vulnerability classified as critical was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability is an unknown func… |
CVE-2025-1575 | Medium | 4.3 | 2025-02-23 | A vulnerability classified as problematic has been found in Harpia DiagSystem 12. Affected is an unknown function of the file /diagsystem/PACS/atualatendimento… |
CVE-2025-27012 | High | 8.8 | 2025-02-22 | Cross-Site Request Forgery (CSRF) vulnerability in a1post A1POST.BG Shipping for Woo a1post-bg-shipping-for-woocommerce allows Privilege Escalation.This issue… |
CVE-2025-26973 | Medium | 6.5 | 2025-02-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WarfarePlugins Social Warfare social-warfare allows DOM-B… |
CVE-2025-26776 | Critical | 10.0 | 2025-02-22 | Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server. This issue affects Chaty Pro: fr… |
CVE-2025-26774 | High | 7.1 | 2025-02-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rock Solid Responsive Modal Builder for High Conversion –… |
CVE-2025-26764 | Medium | 6.5 | 2025-02-22 | Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Co… |
CVE-2025-26763 | Critical | 9.8 | 2025-02-22 | Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object Injection.This issue affects Responsive S… |
CVE-2025-26760 | High | 7.5 | 2025-02-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Calculator Builder calcula… |
CVE-2025-26757 | High | 7.5 | 2025-02-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FULL SERVICES FULL Customer full-custo… |
CVE-2025-26756 | High | 7.1 | 2025-02-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-ga… |
CVE-2025-26750 | Medium | 6.5 | 2025-02-22 | Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects V… |
CVE-2025-0957 | High | 7.2 | 2025-02-22 | The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.1 due to insufficient… |
CVE-2025-1557 | Medium | 4.3 | 2025-02-22 | A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The manipulation leads to cross-site request f… |
CVE-2025-1556 | Medium | 4.7 | 2025-02-22 | A vulnerability, which was classified as problematic, has been found in westboy CicadasCMS 1.0. This issue affects some unknown processing of the file /system… |
CVE-2025-0953 | High | 7.2 | 2025-02-22 | The SMTP for Sendinblue – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2 due to insufficient i… |
CVE-2025-0918 | High | 7.2 | 2025-02-22 | The SMTP for SendGrid – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4 due to insufficient inp… |
CVE-2025-21704 | High | 7.8 | 2025-02-22 | In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is s… |
CVE-2025-1553 | Low | 3.5 | 2025-02-22 | A vulnerability was found in pankajindevops scale up to 3633544a00245d3df88b6d13d9b3dd0f411be7f6. It has been classified as problematic. Affected is an unknown… |
CVE-2025-1361 | High | 7.5 | 2025-02-22 | The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing… |
CVE-2025-1510 | High | 7.3 | 2025-02-22 | The The Custom Post Type Date Archives plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.7.1. This is… |
CVE-2025-1509 | High | 7.3 | 2025-02-22 | The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the s… |
CVE-2025-27109 | High | 7.3 | 2025-02-21 | solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal… |
CVE-2025-27108 | High | 7.3 | 2025-02-21 | dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's `.replace()` opens up to potential Cross-s… |
CVE-2025-27106 | High | 8.8 | 2025-02-21 | binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Exe… |
CVE-2025-27105 | Critical | 9.1 | 2025-02-21 | vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. Ho… |
CVE-2025-27104 | High | 7.5 | 2025-02-21 | vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the… |
CVE-2025-26622 | High | 7.5 | 2025-02-21 | vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately… |
CVE-2025-25282 | High | 8.1 | 2025-02-21 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploit the Insecure Dire… |
CVE-2025-1555 | High | 7.3 | 2025-02-21 | A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. This vulnerability affects the function saveImage. The manipu… |
CVE-2025-25772 | Medium | 5.1 | 2025-02-21 | A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accoun… |
CVE-2025-25770 | Medium | 6.8 | 2025-02-21 | Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /agency/AgencyUserController.java. |
CVE-2025-25769 | High | 8.0 | 2025-02-21 | Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /controller/UserController.java. |
CVE-2025-25768 | Medium | 5.4 | 2025-02-21 | MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerabili… |
CVE-2025-25767 | Medium | 4.8 | 2025-02-21 | A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via… |
CVE-2025-25605 | Medium | 6.5 | 2025-02-21 | Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua. |
CVE-2025-25604 | Medium | 6.5 | 2025-02-21 | Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua. |
CVE-2025-25878 | Low | 3.8 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /del.php. The attack can use SQL inject… |
CVE-2025-25877 | Low | 3.8 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /admin.php. The attack can use SQL inje… |
CVE-2025-25876 | High | 7.2 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attack can use SQL inj… |
CVE-2025-25875 | Medium | 6.4 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /message.php. The attack can use SQL in… |
CVE-2025-25766 | Medium | 4.8 | 2025-02-21 | An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .j… |
CVE-2025-25765 | Medium | 4.0 | 2025-02-21 | MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do. |
CVE-2025-26014 | Critical | 9.8 | 2025-02-21 | A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter. |
CVE-2025-25510 | Medium | 6.5 | 2025-02-21 | Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the get_parentControl_list_Info function. |
CVE-2025-25507 | Medium | 6.5 | 2025-02-21 | There is a RCE vulnerability in Tenda AC6 15.03.05.16_multi. In the formexeCommand function, the parameter cmdinput will cause remote command execution. |
CVE-2025-25505 | Medium | 6.5 | 2025-02-21 | Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the sub_452A4 function. |
CVE-2025-1548 | Low | 3.5 | 2025-02-21 | A vulnerability was found in iteachyou Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/archi… |
CVE-2025-1546 | High | 7.3 | 2025-02-21 | A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this vulnerability is th… |
CVE-2025-1403 | High | 8.6 | 2025-02-21 | Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengin… |
CVE-2025-26013 | High | 8.2 | 2025-02-21 | An issue in Loggrove v.1.0 allows a remote attacker to obtain sensitive information via the read.py component. |
CVE-2025-1544 | Medium | 6.3 | 2025-02-21 | A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /ajax/loadShopInfo.ph… |
CVE-2025-1543 | Medium | 4.3 | 2025-02-21 | A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3. This issue affects some unknown processing of the file /re… |
CVE-2025-1539 | High | 8.8 | 2025-02-21 | A vulnerability, which was classified as critical, has been found in D-Link DAP-1320 1.00. Affected by this issue is the function replace_special_char of the f… |
CVE-2025-1538 | High | 8.8 | 2025-02-21 | A vulnerability classified as critical was found in D-Link DAP-1320 1.00. Affected by this vulnerability is the function set_ws_action of the file /dws/api/. T… |
CVE-2025-1537 | Medium | 6.3 | 2025-02-21 | A vulnerability was found in Harpia DiagSystem 12. It has been rated as critical. This issue affects some unknown processing of the file /diagsystem/PACS/atual… |
CVE-2025-1536 | High | 7.3 | 2025-02-21 | A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability affects unknown co… |
CVE-2025-0838 | Critical | 9.8 | 2025-02-21 | There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not… |