2025 CVEs (page 404)
Page 404 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-26201 | Critical | 9.1 | 2025-02-24 | Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass authentication and escalat… |
CVE-2025-26200 | High | 7.2 | 2025-02-24 | SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component. |
CVE-2025-22495 | High | 8.4 | 2025-02-24 | An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated h… |
CVE-2025-26803 | Medium | 5.3 | 2025-02-24 | The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method. |
CVE-2025-25460 | Medium | 4.8 | 2025-02-24 | A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated att… |
CVE-2025-27357 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Musa AVCI Önceki Yazı Link onceki-yazi-linki allows Cross Site Request Forgery.This issue affects Önceki Yaz… |
CVE-2025-27356 | Medium | 5.4 | 2025-02-24 | Missing Authorization vulnerability in Hardik Sticky Header On Scroll sticky-header-on-scroll allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-27355 | High | 7.1 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Nicolas GRILLET Woocommerce – Loi Hamon loi-hamon allows Stored XSS.This issue affects Woocommerce – Loi Ham… |
CVE-2025-27353 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Bob Namaste! LMS namaste-lms allows Cross Site Request Forgery.This issue affects Namaste! LMS: from n/a thr… |
CVE-2025-27352 | High | 7.1 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wumii team 无觅相关文章插件 wumii-related-posts allows Stored XSS… |
CVE-2025-27351 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpertBusinessSearch Local Search SEO Contact Page local-… |
CVE-2025-27349 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nurelm Get Posts nurelm-get-posts allows Stored XSS.This… |
CVE-2025-27348 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel WP Social SEO Booster – Knowledge Graph Social Sig… |
CVE-2025-27347 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techmix Direct Checkout Button for WooCommerce woo-direct… |
CVE-2025-27344 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in filipstepanov Phee's LinkPreview linkpreview allows Cross Site Request Forgery.This issue affects Phee's Lin… |
CVE-2025-27342 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in josesan WooCommerce Recargo de Equivalencia woo-recargo-de-equivalencia allows Cross Site Request Forgery.Th… |
CVE-2025-27341 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in afzal_du Reactive Mortgage Calculator reactive-mortgage-c… |
CVE-2025-27340 | Medium | 5.4 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Forge12 Interactive GmbH F12-Profiler f12-profiler allows Cross Site Request Forgery.This issue affects F12-… |
CVE-2025-27339 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Will Anderson Minimum Password Strength minimum-password-strength allows Cross Site Request Forgery.This iss… |
CVE-2025-27336 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Alex Prokopenko / JustCoded Just Variables just-wp-variables allows Cross Site Request Forgery.This issue af… |
CVE-2025-27335 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Free plug in by SEO Roma Auto Tag Links auto-tag-links allows Cross Site Request Forgery.This issue affects… |
CVE-2025-27332 | High | 7.1 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in gmnazmul Smart Maintenance & Countdown smart-maintenance-countdown allows Stored XSS.This issue affects Smar… |
CVE-2025-27331 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sébastien Dumont WooCommerce Display Products by Tags woo… |
CVE-2025-27330 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PlayerJS PlayerJS playerjs allows DOM-Based XSS.This issu… |
CVE-2025-27329 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inlinkz EZ InLinkz linkup inlinkz-scripter allows DOM-Bas… |
CVE-2025-27328 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in queeez WP-PostRatings Cheater wp-postratings-cheater allows Cross Site Request Forgery.This issue affects WP… |
CVE-2025-27327 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Winlin Live Streaming Video Player – by SRS Player srs-pl… |
CVE-2025-27325 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruce Video.js HLS Player videojs-hls-player allows DOM-B… |
CVE-2025-27323 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jon Bishop WP About Author wp-about-author allows DOM-Bas… |
CVE-2025-27321 | High | 7.1 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in Blighty Blightly Explorer blighty-explorer allows Stored XSS.This issue affects Blightly Explorer: from n/a… |
CVE-2025-27320 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pankaj Mondal Profile Widget Ninja profile-widget-ninja a… |
CVE-2025-27318 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in ixiter Simple Google Sitemap simple-google-sitemap allows Cross Site Request Forgery.This issue affects Simp… |
CVE-2025-27317 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in IT-RAYS RAYS Grid rays-grid allows Cross Site Request Forgery.This issue affects RAYS Grid: from n/a through… |
CVE-2025-27316 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in hosting.io JPG, PNG Compression and Optimization wp-image-compression allows Cross Site Request Forgery.This… |
CVE-2025-27315 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in wptom All-In-One Cufon all-in-one-cufon allows Cross Site Request Forgery.This issue affects All-In-One Cufo… |
CVE-2025-27312 | High | 8.5 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jenst WP Sitemap wp-sitemap allows SQL Injection.This iss… |
CVE-2025-27311 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in luk3thomas Bulk Content Creator bulk-content-creator allows Cross Site Request Forgery.This issue affects Bu… |
CVE-2025-27307 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows Reflected XSS.T… |
CVE-2025-27306 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pathomation Pathomation pathomation allows Stored XSS.Thi… |
CVE-2025-27305 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Achal Jain Table of Contents Block table-of-contents allo… |
CVE-2025-27304 | Medium | 5.9 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating with font Awesome… |
CVE-2025-27303 | Medium | 5.9 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating contact-form-7-sta… |
CVE-2025-27301 | High | 7.2 | 2025-02-24 | Deserialization of Untrusted Data vulnerability in Nazmul Hasan Robin NHR Options Table Manager nhrrob-options-table-manager allows Object Injection.This issue… |
CVE-2025-27300 | High | 7.2 | 2025-02-24 | Deserialization of Untrusted Data vulnerability in giuliopanda ADFO admin-form allows Object Injection.This issue affects ADFO: from n/a through <= 1.9.1. |
CVE-2025-27298 | High | 8.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in cmstactics WP Video Posts wp-video-posts allows OS Command Injection.This issue affects WP Video Posts: from… |
CVE-2025-27297 | High | 7.6 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in guelben Bravo Search & Replace bravo-search-and-replace a… |
CVE-2025-27296 | High | 7.2 | 2025-02-24 | Missing Authorization vulnerability in revenueflex Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue revenueflex-easy-ads allows Exploiting Inc… |
CVE-2025-27294 | Medium | 4.8 | 2025-02-24 | Missing Authorization vulnerability in platcom WP-Asambleas wp-asambleas allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-27290 | Medium | 4.3 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in seyyed-amir Erima Zarinpal Donate erima-zarinpal-donate allows Cross Site Request Forgery.This issue affects… |
CVE-2025-27280 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alobaidi Archive Page archive-page allows DOM-Based XSS.T… |
CVE-2025-27277 | High | 7.1 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in tiefpunkt Add Linked Images To Gallery add-linked-images-to-gallery-v01 allows Cross Site Request Forgery.Th… |
CVE-2025-27276 | High | 8.8 | 2025-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Photo Gallery ( Responsive ) photo-gallery-pearlbells allows Privilege Escalation.This issue affects… |
CVE-2025-27272 | High | 7.5 | 2025-02-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in vinagecko VG PostCarousel vg-postcarou… |
CVE-2025-27266 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignacio Perez Hover Image Button hover-image-button allow… |
CVE-2025-27265 | Medium | 6.5 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aaron D. Campbell Google Maps for WordPress google-maps-f… |
CVE-2025-26883 | Medium | 6.5 | 2025-02-24 | Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-23017 | Medium | 6.0 | 2025-02-24 | WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user… |
CVE-2025-1632 | Low | 3.3 | 2025-02-24 | A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipula… |
CVE-2025-0545 | Medium | 4.7 | 2025-02-24 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tekrom Technology T-Soft E-Commerce allows Cross-S… |
CVE-2025-1488 | Medium | 4.7 | 2025-02-24 | The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insuffici… |
CVE-2025-25279 | Critical | 9.9 | 2025-02-24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which a… |
CVE-2025-24526 | Medium | 4.3 | 2025-02-24 | Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channe… |
CVE-2025-24490 | Critical | 9.6 | 2025-02-24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reorderin… |
CVE-2025-20051 | Critical | 9.9 | 2025-02-24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a boar… |
CVE-2025-1412 | Low | 3.1 | 2025-02-24 | Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user t… |
CVE-2025-0690 | Medium | 6.1 | 2025-02-24 | The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to rea… |
CVE-2025-1629 | Low | 3.5 | 2025-02-24 | A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function… |
CVE-2025-1618 | Medium | 4.3 | 2025-02-24 | A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic. This vulnerability affects unknown code of the file /modules/Mobile/ind… |
CVE-2025-1617 | Low | 2.4 | 2025-02-24 | A vulnerability, which was classified as problematic, was found in Netis WF2780 2.1.41925. This affects an unknown part of the component Wireless 2.4G Menu. Th… |
CVE-2025-1616 | Medium | 4.7 | 2025-02-24 | A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality… |
CVE-2025-1615 | Low | 2.4 | 2025-02-24 | A vulnerability classified as problematic was found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-1614 | Low | 2.4 | 2025-02-24 | A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected is an unknown function of the file /goform/portForwa… |
CVE-2025-1613 | Low | 2.4 | 2025-02-24 | A vulnerability was found in FiberHome AN5506-01A ONU GPON RP2511. It has been rated as problematic. This issue affects some unknown processing of the file /go… |
CVE-2025-1612 | Low | 3.5 | 2025-02-24 | A vulnerability was found in Edimax BR-6288ACL 1.30. It has been declared as problematic. This vulnerability affects unknown code of the file wireless5g_basic… |
CVE-2025-1611 | Medium | 4.7 | 2025-02-24 | A vulnerability was found in ShopXO up to 6.4.0. It has been classified as problematic. This affects an unknown part of the file app/service/ThemeAdminService… |
CVE-2025-1610 | Medium | 6.3 | 2025-02-24 | A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_… |
CVE-2025-1609 | Medium | 6.3 | 2025-02-24 | A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file… |
CVE-2025-1608 | Medium | 6.3 | 2025-02-24 | A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd… |
CVE-2025-1607 | Medium | 4.3 | 2025-02-24 | A vulnerability, which was classified as problematic, has been found in SourceCodester Best Employee Management System 1.0. This issue affects some unknown pro… |
CVE-2025-1606 | Medium | 4.3 | 2025-02-24 | A vulnerability classified as problematic was found in SourceCodester Best Employee Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2025-1599 | Medium | 5.4 | 2025-02-24 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been rated as problematic. Affected by this issue is some unknown funct… |
CVE-2025-1598 | Medium | 6.3 | 2025-02-24 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2025-22635 | High | 7.1 | 2025-02-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Eventer eventer allows Reflected XSS.This issue… |
CVE-2025-22633 | Medium | 5.8 | 2025-02-23 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in StellarWP Give – Divi Donation Modules give-donation-modules-f… |
CVE-2025-22632 | High | 7.1 | 2025-02-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalsoft WooCommerce Pricing – Product Pricing woo-prici… |
CVE-2025-22631 | High | 7.1 | 2025-02-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vbout Marketing Automation marketing-automation allows Re… |
CVE-2025-1597 | Low | 3.5 | 2025-02-23 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been classified as problematic. Affected is an unknown function of the… |
CVE-2025-1596 | High | 7.3 | 2025-02-23 | A vulnerability was found in SourceCodester Best Church Management Software 1.0 and classified as critical. This issue affects some unknown processing of the f… |
CVE-2025-1595 | Medium | 5.3 | 2025-02-23 | A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code… |
CVE-2025-1594 | Medium | 6.3 | 2025-02-23 | A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc… |
CVE-2025-1593 | Medium | 4.7 | 2025-02-23 | A vulnerability classified as critical has been found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /_hr_soft… |
CVE-2025-1592 | Low | 2.4 | 2025-02-23 | A vulnerability was found in SourceCodester Best Employee Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown funct… |
CVE-2025-1591 | Low | 2.4 | 2025-02-23 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown f… |
CVE-2025-1590 | Medium | 4.7 | 2025-02-23 | A vulnerability was found in SourceCodester E-Learning System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/modul… |
CVE-2025-1589 | Medium | 4.3 | 2025-02-23 | A vulnerability was found in SourceCodester E-Learning System 1.0 and classified as problematic. This issue affects some unknown processing of the file /regist… |
CVE-2025-1588 | Medium | 6.5 | 2025-02-23 | A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ad… |
CVE-2025-1467 | Medium | 6.1 | 2025-02-23 | Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight(). This is related… |
CVE-2025-1587 | Medium | 5.3 | 2025-02-23 | A vulnerability was found in SourceCodester Telecom Billing Management System 1.0. It has been rated as critical. This issue affects the function addrecords of… |
CVE-2025-1586 | Low | 3.5 | 2025-02-23 | A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /Blo… |
CVE-2025-1585 | Low | 2.4 | 2025-02-23 | A vulnerability, which was classified as problematic, has been found in otale tale up to 2.0.5. This issue affects the function OptionsService of the file src/… |