2025 CVEs (page 406)
Page 406 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-26772 | Medium | 6.5 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor… |
CVE-2025-26771 | Medium | 6.5 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This… |
CVE-2025-26770 | Medium | 6.5 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Waymark waymark allows Stored XSS.This issue affects… |
CVE-2025-26769 | Medium | 6.5 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-eleme… |
CVE-2025-26758 | Medium | 5.3 | 2025-02-17 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RebelCode Spotlight Social Media Feeds spotlight-social-photo-feeds… |
CVE-2025-26754 | Medium | 6.5 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Timeline Block timeline-block-block allows Store… |
CVE-2025-23845 | High | 7.1 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 ImageMeta imagemeta allows Reflected XSS.This issu… |
CVE-2025-23840 | High | 7.1 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webjema WP-NOTCAPTCHA wp-notcaptcha allows Reflected XSS… |
CVE-2025-0714 | Medium | 6.5 | 2025-02-17 | The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of… |
CVE-2025-0001 | Medium | 6.5 | 2025-02-17 | Abacus ERP is versions older than 2024.210.16036, 2023.205.15833, 2022.105.15542 are affected by an authenticated arbitrary file read vulnerability. |
CVE-2025-1381 | Medium | 6.3 | 2025-02-17 | A vulnerability was found in code-projects Real Estate Property Management System 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2025-1380 | Medium | 6.3 | 2025-02-17 | A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /d… |
CVE-2025-1379 | Medium | 6.3 | 2025-02-17 | A vulnerability has been found in code-projects Real Estate Property Management System 1.0 and classified as critical. Affected by this vulnerability is an unk… |
CVE-2025-1378 | Low | 3.3 | 2025-02-17 | A vulnerability, which was classified as problematic, was found in radare2 5.9.9 33286. Affected is an unknown function in the library /libr/main/rasm2.c of th… |
CVE-2025-1389 | High | 8.8 | 2025-02-17 | Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify… |
CVE-2025-1377 | Low | 3.3 | 2025-02-17 | A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip… |
CVE-2025-1376 | Low | 2.5 | 2025-02-17 | A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr… |
CVE-2025-0924 | High | 7.2 | 2025-02-17 | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 d… |
CVE-2025-1388 | High | 8.8 | 2025-02-17 | Orca HCM from LEARNING DIGITAL has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and run web shells |
CVE-2025-1387 | Critical | 9.8 | 2025-02-17 | Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user. |
CVE-2025-1374 | Medium | 6.3 | 2025-02-17 | A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. This affects an unknown part of the file /se… |
CVE-2025-1373 | Low | 3.3 | 2025-02-17 | A vulnerability was found in FFmpeg up to 7.1. It has been rated as problematic. Affected by this issue is the function mov_read_trak of the file libavformat/m… |
CVE-2025-26700 | Medium | 5.2 | 2025-02-17 | Authentication bypass using an alternate path or channel issue exists in ”RoboForm Password Manager" App for Android versions prior to 9.7.4, which may allow a… |
CVE-2025-1372 | Medium | 5.3 | 2025-02-17 | A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_strin… |
CVE-2025-1371 | Low | 3.3 | 2025-02-17 | A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file r… |
CVE-2025-1370 | Medium | 5.3 | 2025-02-17 | A vulnerability, which was classified as critical, has been found in MicroWorld eScan Antivirus 7.0.32 on Linux. Affected by this issue is the function sprintf… |
CVE-2025-1369 | Medium | 4.5 | 2025-02-17 | A vulnerability classified as critical was found in MicroWord eScan Antivirus 7.0.32 on Linux. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-1368 | Low | 2.3 | 2025-02-17 | A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects the function ReadConfig… |
CVE-2025-1367 | Medium | 5.3 | 2025-02-17 | A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been classified as critical. This affects the function sprintf of the component… |
CVE-2025-1366 | Medium | 5.3 | 2025-02-17 | A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this issue is the function strcpy of the compone… |
CVE-2025-1365 | Medium | 5.3 | 2025-02-17 | A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the compo… |
CVE-2025-0591 | High | 7.8 | 2025-02-17 | Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abu… |
CVE-2025-26779 | Medium | 4.9 | 2025-02-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Path T… |
CVE-2025-26768 | High | 7.1 | 2025-02-16 | Cross-Site Request Forgery (CSRF) vulnerability in what3words what3words Address Field 3-word-address-validation-field allows Stored XSS.This issue affects wha… |
CVE-2025-26767 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affect… |
CVE-2025-26766 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows Stored XSS.This issue aff… |
CVE-2025-26765 | Medium | 5.4 | 2025-02-16 | Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Co… |
CVE-2025-26761 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons al… |
CVE-2025-26759 | High | 7.1 | 2025-02-16 | Cross-Site Request Forgery (CSRF) vulnerability in alexvtn Content Snippet Manager content-snippet-manager allows Stored XSS.This issue affects Content Snippet… |
CVE-2025-26755 | High | 7.6 | 2025-02-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider wp-airbnb-review-slider… |
CVE-2025-23975 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker… |
CVE-2025-22689 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Levan Tarbor Forex Calculators fx-calculators allows Stor… |
CVE-2025-22680 | High | 7.1 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Ad Inserter Pro allows Reflected XSS. This issue… |
CVE-2025-22676 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in upcasted AWS S3 for WordPress Plugin – Upcasted upcasted-… |
CVE-2025-22291 | Medium | 5.3 | 2025-02-16 | Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Exp… |
CVE-2025-22290 | Critical | 9.3 | 2025-02-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Editi… |
CVE-2025-22289 | Medium | 6.5 | 2025-02-16 | Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Exploiting Inco… |
CVE-2025-22286 | High | 7.1 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express… |
CVE-2025-22284 | High | 7.1 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Unishippers Editio… |
CVE-2025-1364 | Medium | 5.3 | 2025-02-16 | A vulnerability has been found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this vulnerability is the function passProm… |
CVE-2025-1360 | Low | 3.5 | 2025-02-16 | A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the fi… |
CVE-2025-1359 | Medium | 4.3 | 2025-02-16 | A vulnerability, which was classified as problematic, has been found in SIAM Industria de Automação e Monitoramento SIAM 2.0. This issue affects some unknown p… |
CVE-2025-1358 | Medium | 4.3 | 2025-02-16 | A vulnerability classified as problematic was found in Pix Software Vivaz 6.0.10. This vulnerability affects unknown code. The manipulation leads to cross-site… |
CVE-2025-1357 | Medium | 4.3 | 2025-02-16 | A vulnerability classified as problematic has been found in Seventh D-Guard up to 20250206. This affects an unknown part of the component HTTP GET Request Hand… |
CVE-2025-1356 | Medium | 6.3 | 2025-02-16 | A vulnerability was found in needyamin Library Card System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-1355 | High | 7.3 | 2025-02-16 | A vulnerability was found in needyamin Library Card System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-1354 | | 2025-02-16 | A cross-site scripting (XSS) vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validation and can be trigge… | |
CVE-2025-1353 | High | 7.0 | 2025-02-16 | A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical. This issue affects some unknown processing in the library profapi.dll. The… |
CVE-2025-1352 | Medium | 5.0 | 2025-02-16 | A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library lib… |
CVE-2025-1341 | Low | 3.7 | 2025-02-16 | A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. This affects an unknown part of the component Setting Handler. The manipulation… |
CVE-2025-1340 | High | 8.8 | 2025-02-16 | A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cste… |
CVE-2025-1339 | Medium | 6.3 | 2025-02-16 | A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cg… |
CVE-2025-1338 | High | 7.3 | 2025-02-16 | A vulnerability was found in NUUO Camera up to 20250203. It has been declared as critical. This vulnerability affects the function print_file of the file /hand… |
CVE-2025-1337 | Low | 3.5 | 2025-02-16 | A vulnerability was found in Eastnets PaymentSafe 2.5.26.0. It has been classified as problematic. This affects an unknown part of the component BIC Search. Th… |
CVE-2025-1336 | Medium | 4.3 | 2025-02-16 | A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimg_action in the library… |
CVE-2025-1335 | Medium | 4.3 | 2025-02-16 | A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9. Affected is the function deleteimg_action in the library lib/admin/file_adm… |
CVE-2025-1332 | Low | 2.4 | 2025-02-16 | A vulnerability has been found in FastCMS up to 0.1.5 and classified as problematic. This vulnerability affects unknown code of the file /fastcms.html#/templat… |
CVE-2025-26793 | | 2025-02-15 | The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, passwo… | |
CVE-2025-0822 | Medium | 6.5 | 2025-02-15 | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible fo… |
CVE-2025-1005 | Medium | 6.4 | 2025-02-15 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion widget in all versions up t… |
CVE-2025-22209 | Medium | 4.7 | 2025-02-15 | A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL com… |
CVE-2025-22208 | Medium | 4.7 | 2025-02-15 | A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL com… |
CVE-2025-0935 | Medium | 4.3 | 2025-02-15 | The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions i… |
CVE-2025-1302 | Critical | 9.8 | 2025-02-15 | Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute a… |
CVE-2025-0997 | High | 8.1 | 2025-02-15 | Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Exte… |
CVE-2025-0996 | Medium | 5.4 | 2025-02-15 | Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox (U… |
CVE-2025-0995 | High | 8.8 | 2025-02-15 | Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-26819 | High | 8.6 | 2025-02-15 | Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections. |
CVE-2025-21401 | Medium | 4.5 | 2025-02-15 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2025-0593 | High | 8.8 | 2025-02-14 | The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device. |
CVE-2025-0592 | High | 8.8 | 2025-02-14 | The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device. |
CVE-2025-25304 | | 2025-02-14 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and… | |
CVE-2025-25297 | High | 8.6 | 2025-02-14 | Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forger… |
CVE-2025-25296 | Medium | 6.1 | 2025-02-14 | Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HT… |
CVE-2025-25290 | Medium | 5.3 | 2025-02-14 | @octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2… |
CVE-2025-25289 | Medium | 5.3 | 2025-02-14 | @octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Servi… |
CVE-2025-25288 | Medium | 5.3 | 2025-02-14 | @octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm pack… |
CVE-2025-25285 | Medium | 5.3 | 2025-02-14 | @octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific `options`… |
CVE-2025-0503 | Low | 3.1 | 2025-02-14 | Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata fr… |
CVE-2025-26508 | Critical | 9.8 | 2025-02-14 | Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privi… |
CVE-2025-26507 | Critical | 9.8 | 2025-02-14 | Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privi… |
CVE-2025-26506 | Critical | 9.8 | 2025-02-14 | Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privi… |
CVE-2025-26158 | Medium | 5.6 | 2025-02-14 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the manage-employee.php page of Kashipara Online Attendance Management System V1.0. This vu… |
CVE-2025-26157 | Medium | 5.9 | 2025-02-14 | A SQL Injection vulnerability was found in /bpms/index.php in Source Code and Project Beauty Parlour Management System V1.1, which allows remote attackers to e… |
CVE-2025-26156 | High | 8.8 | 2025-02-14 | A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbit… |
CVE-2025-25997 | High | 7.5 | 2025-02-14 | Directory Traversal vulnerability in FeMiner wms v.1.0 allows a remote attacker to obtain sensitive information via the databak.php component. |
CVE-2025-25994 | High | 7.5 | 2025-02-14 | SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id. |
CVE-2025-25993 | Medium | 5.1 | 2025-02-14 | SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameter "itemid." |
CVE-2025-25992 | Medium | 5.1 | 2025-02-14 | SQL Injection vulnerability in FeMiner wms 1.0 allows a remote attacker to obtain sensitive information via the inquire_inout_item.php component. |
CVE-2025-25991 | Medium | 5.1 | 2025-02-14 | SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component. |