2025 CVEs (page 407)
Page 407 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22921 | Medium | 6.5 | 2025-02-18 | FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. |
CVE-2025-26617 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26616 | High | 7.5 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA appl… |
CVE-2025-26615 | Critical | 10.0 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA appl… |
CVE-2025-26614 | High | 8.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26613 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. An OS Command Injection vulnerability was discovered in the WeG… |
CVE-2025-26612 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26611 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26610 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26609 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26608 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26607 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26606 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26605 | High | 8.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-27016 | Medium | 6.5 | 2025-02-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite – Google Drive Plugin allows Stored XS… |
CVE-2025-27013 | Medium | 5.3 | 2025-02-18 | Missing Authorization vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-26623 | Critical | 9.8 | 2025-02-18 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A heap buffer overflow was found in… |
CVE-2025-26604 | High | 8.3 | 2025-02-18 | Discord-Bot-Framework-Kernel is a Discord bot framework built with interactions.py, featuring modular extension management and secure execution. Because of the… |
CVE-2025-22663 | High | 8.6 | 2025-02-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allow… |
CVE-2025-22657 | High | 7.5 | 2025-02-18 | Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-22656 | High | 8.1 | 2025-02-18 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Oscar Alvarez Cookie Monster cookie-mo… |
CVE-2025-22654 | Critical | 10.0 | 2025-02-18 | Unrestricted Upload of File with Dangerous Type vulnerability in kodeshpa Simplified simplified allows Using Malicious Files.This issue affects Simplified: fro… |
CVE-2025-22650 | Medium | 6.5 | 2025-02-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnenschein Smartarget smartarget-contact-us… |
CVE-2025-22645 | Medium | 5.3 | 2025-02-18 | Improper Restriction of Excessive Authentication Attempts vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Password Brute Forcing.T… |
CVE-2025-22639 | High | 8.5 | 2025-02-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn Distance Rate Shipping for WooCommerce distance… |
CVE-2025-0622 | Medium | 6.4 | 2025-02-18 | A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an at… |
CVE-2025-26603 | Medium | 4.2 | 2025-02-18 | Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables a… |
CVE-2025-26465 | Medium | 6.8 | 2025-02-18 | A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impers… |
CVE-2025-25305 | High | 7.0 | 2025-02-18 | Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle… |
CVE-2025-25284 | | 2025-02-18 | The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's WPS (Web Processing Service) implementa… | |
CVE-2025-24895 | Critical | 9.1 | 2025-02-18 | CIE.AspNetCore.Authentication is an AspNetCore Remote Authenticator for CIE 3.0. Authentication using Spid and CIE is based on the SAML2 standard which provide… |
CVE-2025-24894 | Critical | 9.1 | 2025-02-18 | SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID. Authentication using Spid and CIE is based on the SAML2 standard which provides… |
CVE-2025-21608 | Medium | 5.3 | 2025-02-18 | Meshtastic is an open source mesh networking solution. In affected firmware versions crafted packets over MQTT are able to appear as a DM in client to a node e… |
CVE-2025-26620 | | 2025-02-18 | Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condit… | |
CVE-2025-26058 | Medium | 4.2 | 2025-02-18 | Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application app… |
CVE-2025-25300 | | 2025-02-18 | smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner `View` link and navigating to 3rd party… | |
CVE-2025-22207 | | 2025-02-18 | Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler. | |
CVE-2025-21703 | High | 7.8 | 2025-02-18 | In the Linux kernel, the following vulnerability has been resolved: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() qdisc_tree_reduce_backlog()… |
CVE-2025-21702 | High | 7.8 | 2025-02-18 | In the Linux kernel, the following vulnerability has been resolved: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 Expected behaviour: In case we r… |
CVE-2025-1414 | Medium | 6.5 | 2025-02-18 | Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2025-1269 | Medium | 4.8 | 2025-02-18 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing. This issue affects Liman MYS: before 2.1.1… |
CVE-2025-1035 | Medium | 5.7 | 2025-02-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input t… |
CVE-2025-0817 | High | 7.2 | 2025-02-18 | The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.9.11 due to insuff… |
CVE-2025-0521 | High | 7.2 | 2025-02-18 | The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2… |
CVE-2025-1023 | Critical | 9.8 | 2025-02-18 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vu… |
CVE-2025-0981 | Medium | 6.1 | 2025-02-18 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting (XSS) vulne… |
CVE-2025-0864 | Medium | 6.1 | 2025-02-18 | The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shor… |
CVE-2025-0425 | | 2025-02-18 | Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed Server" to which this… | |
CVE-2025-0424 | | 2025-02-18 | In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site scripting vulnerabili… | |
CVE-2025-0423 | | 2025-02-18 | In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabi… | |
CVE-2025-0422 | | 2025-02-18 | An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. (Remote Code Execution) For… | |
CVE-2025-0805 | Medium | 6.4 | 2025-02-18 | The Mortgage Calculator / Loan Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mlcalc' shortcode in all versions… |
CVE-2025-0796 | Medium | 4.3 | 2025-02-18 | The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.11. This is due to… |
CVE-2025-1390 | Medium | 6.1 | 2025-02-18 | The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incor… |
CVE-2025-25224 | High | 7.5 | 2025-02-18 | The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php. If… |
CVE-2025-25223 | Medium | 5.3 | 2025-02-18 | The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a path traversal vulnerability in dloader.php. If this vu… |
CVE-2025-25222 | Critical | 9.8 | 2025-02-18 | The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this v… |
CVE-2025-25221 | Critical | 9.8 | 2025-02-18 | The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulner… |
CVE-2025-25055 | Medium | 5.3 | 2025-02-18 | Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation. If exploited, restr… |
CVE-2025-20075 | High | 7.2 | 2025-02-18 | Server-side request forgery (SSRF) vulnerability exists in FileMegane versions above 3.0.0.0 prior to 3.4.0.0. Executing arbitrary backend Web API requests cou… |
CVE-2025-1392 | Low | 3.5 | 2025-02-17 | A vulnerability has been found in D-Link DIR-816 1.01TO and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2025-21103 | High | 7.8 | 2025-02-17 | Dell NetWorker Management Console, version(s) 19.11 through 19.11.0.3 & Versions prior to 19.10.0.7 contain(s) an improper neutralization of server-side vulner… |
CVE-2025-1391 | Medium | 5.4 | 2025-02-17 | A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches th… |
CVE-2025-26778 | Medium | 5.9 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Gallery gallery allows Stored XSS.This issue a… |
CVE-2025-26775 | Medium | 5.9 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 BEAR woo-bulk-editor allows Stored XSS.This is… |
CVE-2025-26773 | Medium | 4.3 | 2025-02-17 | Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-26772 | Medium | 6.5 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor… |
CVE-2025-26771 | Medium | 6.5 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This… |
CVE-2025-26770 | Medium | 6.5 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Waymark waymark allows Stored XSS.This issue affects… |
CVE-2025-26769 | Medium | 6.5 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-eleme… |
CVE-2025-26758 | Medium | 5.3 | 2025-02-17 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RebelCode Spotlight Social Media Feeds spotlight-social-photo-feeds… |
CVE-2025-26754 | Medium | 6.5 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Timeline Block timeline-block-block allows Store… |
CVE-2025-23845 | High | 7.1 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 ImageMeta imagemeta allows Reflected XSS.This issu… |
CVE-2025-23840 | High | 7.1 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webjema WP-NOTCAPTCHA wp-notcaptcha allows Reflected XSS… |
CVE-2025-0714 | Medium | 6.5 | 2025-02-17 | The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of… |
CVE-2025-0001 | Medium | 6.5 | 2025-02-17 | Abacus ERP is versions older than 2024.210.16036, 2023.205.15833, 2022.105.15542 are affected by an authenticated arbitrary file read vulnerability. |
CVE-2025-1381 | Medium | 6.3 | 2025-02-17 | A vulnerability was found in code-projects Real Estate Property Management System 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2025-1380 | Medium | 6.3 | 2025-02-17 | A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /d… |
CVE-2025-1379 | Medium | 6.3 | 2025-02-17 | A vulnerability has been found in code-projects Real Estate Property Management System 1.0 and classified as critical. Affected by this vulnerability is an unk… |
CVE-2025-1378 | Low | 3.3 | 2025-02-17 | A vulnerability, which was classified as problematic, was found in radare2 5.9.9 33286. Affected is an unknown function in the library /libr/main/rasm2.c of th… |
CVE-2025-1389 | High | 8.8 | 2025-02-17 | Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify… |
CVE-2025-1377 | Low | 3.3 | 2025-02-17 | A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip… |
CVE-2025-1376 | Low | 2.5 | 2025-02-17 | A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr… |
CVE-2025-0924 | High | 7.2 | 2025-02-17 | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 d… |
CVE-2025-1388 | High | 8.8 | 2025-02-17 | Orca HCM from LEARNING DIGITAL has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and run web shells |
CVE-2025-1387 | Critical | 9.8 | 2025-02-17 | Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user. |
CVE-2025-1374 | Medium | 6.3 | 2025-02-17 | A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. This affects an unknown part of the file /se… |
CVE-2025-1373 | Low | 3.3 | 2025-02-17 | A vulnerability was found in FFmpeg up to 7.1. It has been rated as problematic. Affected by this issue is the function mov_read_trak of the file libavformat/m… |
CVE-2025-26700 | Medium | 5.2 | 2025-02-17 | Authentication bypass using an alternate path or channel issue exists in ”RoboForm Password Manager" App for Android versions prior to 9.7.4, which may allow a… |
CVE-2025-1372 | Medium | 5.3 | 2025-02-17 | A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_strin… |
CVE-2025-1371 | Low | 3.3 | 2025-02-17 | A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file r… |
CVE-2025-1370 | Medium | 5.3 | 2025-02-17 | A vulnerability, which was classified as critical, has been found in MicroWorld eScan Antivirus 7.0.32 on Linux. Affected by this issue is the function sprintf… |
CVE-2025-1369 | Medium | 4.5 | 2025-02-17 | A vulnerability classified as critical was found in MicroWord eScan Antivirus 7.0.32 on Linux. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-1368 | Low | 2.3 | 2025-02-17 | A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects the function ReadConfig… |
CVE-2025-1367 | Medium | 5.3 | 2025-02-17 | A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been classified as critical. This affects the function sprintf of the component… |
CVE-2025-1366 | Medium | 5.3 | 2025-02-17 | A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this issue is the function strcpy of the compone… |
CVE-2025-1365 | Medium | 5.3 | 2025-02-17 | A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the compo… |
CVE-2025-0591 | High | 7.8 | 2025-02-17 | Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abu… |
CVE-2025-26779 | Medium | 4.9 | 2025-02-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Path T… |
CVE-2025-26768 | High | 7.1 | 2025-02-16 | Cross-Site Request Forgery (CSRF) vulnerability in what3words what3words Address Field 3-word-address-validation-field allows Stored XSS.This issue affects wha… |