2025 CVEs (page 405)
Page 405 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1584 | Medium | 4.3 | 2025-02-23 | A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-we… |
CVE-2025-1583 | Medium | 6.3 | 2025-02-23 | A vulnerability classified as critical has been found in PHPGurukul Online Nurse Hiring System 1.0. This affects an unknown part of the file /admin/search-repo… |
CVE-2025-1582 | Medium | 6.3 | 2025-02-23 | A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-1581 | Medium | 6.3 | 2025-02-23 | A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-1580 | Medium | 6.3 | 2025-02-23 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the f… |
CVE-2025-1579 | Low | 2.4 | 2025-02-23 | A vulnerability was found in code-projects Blood Bank System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/u… |
CVE-2025-1578 | Medium | 6.3 | 2025-02-23 | A vulnerability, which was classified as critical, was found in PHPGurukul/Campcodes Online Shopping Portal 2.1. This affects an unknown part of the file /sear… |
CVE-2025-1577 | Low | 3.5 | 2025-02-23 | A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank System 1.0. Affected by this issue is some unknown functionali… |
CVE-2025-1576 | Medium | 6.3 | 2025-02-23 | A vulnerability classified as critical was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability is an unknown func… |
CVE-2025-1575 | Medium | 4.3 | 2025-02-23 | A vulnerability classified as problematic has been found in Harpia DiagSystem 12. Affected is an unknown function of the file /diagsystem/PACS/atualatendimento… |
CVE-2025-27012 | High | 8.8 | 2025-02-22 | Cross-Site Request Forgery (CSRF) vulnerability in a1post A1POST.BG Shipping for Woo a1post-bg-shipping-for-woocommerce allows Privilege Escalation.This issue… |
CVE-2025-26973 | Medium | 6.5 | 2025-02-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WarfarePlugins Social Warfare social-warfare allows DOM-B… |
CVE-2025-26776 | Critical | 10.0 | 2025-02-22 | Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server. This issue affects Chaty Pro: fr… |
CVE-2025-26774 | High | 7.1 | 2025-02-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rock Solid Responsive Modal Builder for High Conversion –… |
CVE-2025-26764 | Medium | 6.5 | 2025-02-22 | Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Co… |
CVE-2025-26763 | Critical | 9.8 | 2025-02-22 | Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object Injection.This issue affects Responsive S… |
CVE-2025-26760 | High | 7.5 | 2025-02-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Calculator Builder calcula… |
CVE-2025-26757 | High | 7.5 | 2025-02-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FULL SERVICES FULL Customer full-custo… |
CVE-2025-26756 | High | 7.1 | 2025-02-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-ga… |
CVE-2025-26750 | Medium | 6.5 | 2025-02-22 | Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects V… |
CVE-2025-0957 | High | 7.2 | 2025-02-22 | The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.1 due to insufficient… |
CVE-2025-1557 | Medium | 4.3 | 2025-02-22 | A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The manipulation leads to cross-site request f… |
CVE-2025-1556 | Medium | 4.7 | 2025-02-22 | A vulnerability, which was classified as problematic, has been found in westboy CicadasCMS 1.0. This issue affects some unknown processing of the file /system… |
CVE-2025-0953 | High | 7.2 | 2025-02-22 | The SMTP for Sendinblue – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2 due to insufficient i… |
CVE-2025-0918 | High | 7.2 | 2025-02-22 | The SMTP for SendGrid – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4 due to insufficient inp… |
CVE-2025-21704 | High | 7.8 | 2025-02-22 | In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is s… |
CVE-2025-1553 | Low | 3.5 | 2025-02-22 | A vulnerability was found in pankajindevops scale up to 3633544a00245d3df88b6d13d9b3dd0f411be7f6. It has been classified as problematic. Affected is an unknown… |
CVE-2025-1361 | High | 7.5 | 2025-02-22 | The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing… |
CVE-2025-1510 | High | 7.3 | 2025-02-22 | The The Custom Post Type Date Archives plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.7.1. This is… |
CVE-2025-1509 | High | 7.3 | 2025-02-22 | The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the s… |
CVE-2025-27109 | High | 7.3 | 2025-02-21 | solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal… |
CVE-2025-27108 | High | 7.3 | 2025-02-21 | dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's `.replace()` opens up to potential Cross-s… |
CVE-2025-27106 | High | 8.8 | 2025-02-21 | binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Exe… |
CVE-2025-27105 | Critical | 9.1 | 2025-02-21 | vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. Ho… |
CVE-2025-27104 | High | 7.5 | 2025-02-21 | vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the… |
CVE-2025-26622 | High | 7.5 | 2025-02-21 | vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately… |
CVE-2025-25282 | High | 8.1 | 2025-02-21 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploit the Insecure Dire… |
CVE-2025-1555 | High | 7.3 | 2025-02-21 | A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. This vulnerability affects the function saveImage. The manipu… |
CVE-2025-25772 | Medium | 5.1 | 2025-02-21 | A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accoun… |
CVE-2025-25770 | Medium | 6.8 | 2025-02-21 | Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /agency/AgencyUserController.java. |
CVE-2025-25769 | High | 8.0 | 2025-02-21 | Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /controller/UserController.java. |
CVE-2025-25768 | Medium | 5.4 | 2025-02-21 | MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerabili… |
CVE-2025-25767 | Medium | 4.8 | 2025-02-21 | A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via… |
CVE-2025-25605 | Medium | 6.5 | 2025-02-21 | Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua. |
CVE-2025-25604 | Medium | 6.5 | 2025-02-21 | Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua. |
CVE-2025-25878 | Low | 3.8 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /del.php. The attack can use SQL inject… |
CVE-2025-25877 | Low | 3.8 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /admin.php. The attack can use SQL inje… |
CVE-2025-25876 | High | 7.2 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attack can use SQL inj… |
CVE-2025-25875 | Medium | 6.4 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /message.php. The attack can use SQL in… |
CVE-2025-25766 | Medium | 4.8 | 2025-02-21 | An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .j… |
CVE-2025-25765 | Medium | 4.0 | 2025-02-21 | MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do. |
CVE-2025-26014 | Critical | 9.8 | 2025-02-21 | A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter. |
CVE-2025-25510 | Medium | 6.5 | 2025-02-21 | Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the get_parentControl_list_Info function. |
CVE-2025-25507 | Medium | 6.5 | 2025-02-21 | There is a RCE vulnerability in Tenda AC6 15.03.05.16_multi. In the formexeCommand function, the parameter cmdinput will cause remote command execution. |
CVE-2025-25505 | Medium | 6.5 | 2025-02-21 | Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the sub_452A4 function. |
CVE-2025-1548 | Low | 3.5 | 2025-02-21 | A vulnerability was found in iteachyou Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/archi… |
CVE-2025-1546 | High | 7.3 | 2025-02-21 | A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this vulnerability is th… |
CVE-2025-1403 | High | 8.6 | 2025-02-21 | Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengin… |
CVE-2025-26013 | High | 8.2 | 2025-02-21 | An issue in Loggrove v.1.0 allows a remote attacker to obtain sensitive information via the read.py component. |
CVE-2025-1544 | Medium | 6.3 | 2025-02-21 | A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /ajax/loadShopInfo.ph… |
CVE-2025-1543 | Medium | 4.3 | 2025-02-21 | A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3. This issue affects some unknown processing of the file /re… |
CVE-2025-1539 | High | 8.8 | 2025-02-21 | A vulnerability, which was classified as critical, has been found in D-Link DAP-1320 1.00. Affected by this issue is the function replace_special_char of the f… |
CVE-2025-1538 | High | 8.8 | 2025-02-21 | A vulnerability classified as critical was found in D-Link DAP-1320 1.00. Affected by this vulnerability is the function set_ws_action of the file /dws/api/. T… |
CVE-2025-1537 | Medium | 6.3 | 2025-02-21 | A vulnerability was found in Harpia DiagSystem 12. It has been rated as critical. This issue affects some unknown processing of the file /diagsystem/PACS/atual… |
CVE-2025-1536 | High | 7.3 | 2025-02-21 | A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability affects unknown co… |
CVE-2025-0838 | Critical | 9.8 | 2025-02-21 | There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not… |
CVE-2025-26794 | High | 7.5 | 2025-02-21 | Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1… |
CVE-2025-1535 | High | 7.3 | 2025-02-21 | A vulnerability was found in Baiyi Cloud Asset Management System 8.142.100.161. It has been classified as critical. This affects an unknown part of the file /w… |
CVE-2025-1489 | Medium | 6.4 | 2025-02-21 | The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and including, 4.5.4 d… |
CVE-2025-1402 | Medium | 5.3 | 2025-02-21 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete… |
CVE-2025-1471 | High | 7.8 | 2025-02-21 | In Eclipse OMR versions 0.2.0 to 0.4.0, some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string an… |
CVE-2025-1470 | Medium | 5.5 | 2025-02-21 | In Eclipse OMR, from the initial contribution to version 0.4.0, some OMR internal port library and utilities consumers of z/OS atoe functions do not check thei… |
CVE-2025-1410 | Medium | 6.4 | 2025-02-21 | The Events Calendar Made Simple – Pie Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's piecal shortcode in all versi… |
CVE-2025-0728 | High | 7.5 | 2025-02-21 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of ser… |
CVE-2025-0727 | High | 7.5 | 2025-02-21 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of ser… |
CVE-2025-0726 | High | 7.5 | 2025-02-21 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of service by specially crafted packets. T… |
CVE-2025-1407 | Medium | 6.4 | 2025-02-21 | The AMO Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's amoteam_skills shortcode in all versions up to, and in… |
CVE-2025-1406 | Medium | 6.4 | 2025-02-21 | The Newpost Catch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's npc shortcode in all versions up to, and including, 1.3.19… |
CVE-2025-1001 | Medium | 5.7 | 2025-02-21 | Medixant RadiAnt DICOM Viewer is vulnerable due to failure of the update mechanism to verify the update server's certificate which could allow an attacker to a… |
CVE-2025-27100 | Medium | 6.5 | 2025-02-21 | lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by ex… |
CVE-2025-27088 | High | 8.2 | 2025-02-20 | oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting (XSS) vulnerability enables attackers to create mal… |
CVE-2025-25957 | Medium | 6.1 | 2025-02-20 | Cross Site Scripting vulnerabilities in Xunruicms v.4.6.3 and before allows a remote attacker to escalate privileges via a crafted script. |
CVE-2025-25679 | High | 8.0 | 2025-02-20 | Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function. |
CVE-2025-25678 | Critical | 9.8 | 2025-02-20 | Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function. |
CVE-2025-25676 | Critical | 9.8 | 2025-02-20 | Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function. |
CVE-2025-25675 | Critical | 9.8 | 2025-02-20 | Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str variable receives the cmdinput parameter fr… |
CVE-2025-25674 | Critical | 9.8 | 2025-02-20 | Tenda AC10 V1.0 V15.03.06.23 is vulnerable to Buffer Overflow in form_fast_setting_wifi_set via the parameter ssid. |
CVE-2025-25668 | Critical | 9.8 | 2025-02-20 | Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_47D878 function. |
CVE-2025-25667 | Critical | 9.8 | 2025-02-20 | Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the urls parameter in the function get_parentControl_list_Info. |
CVE-2025-25664 | Critical | 9.8 | 2025-02-20 | Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_49E098 function. |
CVE-2025-25663 | Critical | 9.8 | 2025-02-20 | A vulnerability was found in Tenda AC8V4 V16.03.34.06. Affected is the function SUB_0046AC38 of the file /goform/WifiExtraSet. The manipulation of the argument… |
CVE-2025-25662 | Critical | 9.8 | 2025-02-20 | Tenda O4 V3.0 V1.0.0.10(2936) is vulnerable to Buffer Overflow in the function SafeSetMacFilter of the file /goform/setMacFilterList via the argument remark/ty… |
CVE-2025-22973 | High | 7.5 | 2025-02-20 | An issue in QiboSoft QiboCMS X1.0 allows a remote attacker to obtain sensitive information via the http_curl() function in the '/application/common. php' file… |
CVE-2025-25960 | Medium | 6.1 | 2025-02-20 | Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the backg… |
CVE-2025-25958 | Medium | 5.4 | 2025-02-20 | Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via a crafted script. |
CVE-2025-27098 | Medium | 5.8 | 2025-02-20 | GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST… |
CVE-2025-27097 | High | 7.5 | 2025-02-20 | GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST… |
CVE-2025-25299 | | 2025-02-20 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was dis… | |
CVE-2025-24893 | Critical | 9.8 | 2025-02-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution… |
CVE-2025-1265 | Critical | 9.9 | 2025-02-20 | An OS command injection vulnerability exists in Vinci Protocol Analyzer that could allow an attacker to escalate privileges and perform code execution on affec… |