2025 CVEs (page 408)
Page 408 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-26767 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affect… |
CVE-2025-26766 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows Stored XSS.This issue aff… |
CVE-2025-26765 | Medium | 5.4 | 2025-02-16 | Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Co… |
CVE-2025-26761 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons al… |
CVE-2025-26759 | High | 7.1 | 2025-02-16 | Cross-Site Request Forgery (CSRF) vulnerability in alexvtn Content Snippet Manager content-snippet-manager allows Stored XSS.This issue affects Content Snippet… |
CVE-2025-26755 | High | 7.6 | 2025-02-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider wp-airbnb-review-slider… |
CVE-2025-23975 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker… |
CVE-2025-22689 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Levan Tarbor Forex Calculators fx-calculators allows Stor… |
CVE-2025-22680 | High | 7.1 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Ad Inserter Pro allows Reflected XSS. This issue… |
CVE-2025-22676 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in upcasted AWS S3 for WordPress Plugin – Upcasted upcasted-… |
CVE-2025-22291 | Medium | 5.3 | 2025-02-16 | Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Exp… |
CVE-2025-22290 | Critical | 9.3 | 2025-02-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Editi… |
CVE-2025-22289 | Medium | 6.5 | 2025-02-16 | Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Exploiting Inco… |
CVE-2025-22286 | High | 7.1 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express… |
CVE-2025-22284 | High | 7.1 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Unishippers Editio… |
CVE-2025-1364 | Medium | 5.3 | 2025-02-16 | A vulnerability has been found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this vulnerability is the function passProm… |
CVE-2025-1360 | Low | 3.5 | 2025-02-16 | A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the fi… |
CVE-2025-1359 | Medium | 4.3 | 2025-02-16 | A vulnerability, which was classified as problematic, has been found in SIAM Industria de Automação e Monitoramento SIAM 2.0. This issue affects some unknown p… |
CVE-2025-1358 | Medium | 4.3 | 2025-02-16 | A vulnerability classified as problematic was found in Pix Software Vivaz 6.0.10. This vulnerability affects unknown code. The manipulation leads to cross-site… |
CVE-2025-1357 | Medium | 4.3 | 2025-02-16 | A vulnerability classified as problematic has been found in Seventh D-Guard up to 20250206. This affects an unknown part of the component HTTP GET Request Hand… |
CVE-2025-1356 | Medium | 6.3 | 2025-02-16 | A vulnerability was found in needyamin Library Card System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-1355 | High | 7.3 | 2025-02-16 | A vulnerability was found in needyamin Library Card System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-1354 | | 2025-02-16 | A cross-site scripting (XSS) vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validation and can be trigge… | |
CVE-2025-1353 | High | 7.0 | 2025-02-16 | A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical. This issue affects some unknown processing in the library profapi.dll. The… |
CVE-2025-1352 | Medium | 5.0 | 2025-02-16 | A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library lib… |
CVE-2025-1341 | Low | 3.7 | 2025-02-16 | A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. This affects an unknown part of the component Setting Handler. The manipulation… |
CVE-2025-1340 | High | 8.8 | 2025-02-16 | A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cste… |
CVE-2025-1339 | Medium | 6.3 | 2025-02-16 | A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cg… |
CVE-2025-1338 | High | 7.3 | 2025-02-16 | A vulnerability was found in NUUO Camera up to 20250203. It has been declared as critical. This vulnerability affects the function print_file of the file /hand… |
CVE-2025-1337 | Low | 3.5 | 2025-02-16 | A vulnerability was found in Eastnets PaymentSafe 2.5.26.0. It has been classified as problematic. This affects an unknown part of the component BIC Search. Th… |
CVE-2025-1336 | Medium | 4.3 | 2025-02-16 | A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimg_action in the library… |
CVE-2025-1335 | Medium | 4.3 | 2025-02-16 | A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9. Affected is the function deleteimg_action in the library lib/admin/file_adm… |
CVE-2025-1332 | Low | 2.4 | 2025-02-16 | A vulnerability has been found in FastCMS up to 0.1.5 and classified as problematic. This vulnerability affects unknown code of the file /fastcms.html#/templat… |
CVE-2025-26793 | | 2025-02-15 | The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, passwo… | |
CVE-2025-0822 | Medium | 6.5 | 2025-02-15 | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible fo… |
CVE-2025-1005 | Medium | 6.4 | 2025-02-15 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion widget in all versions up t… |
CVE-2025-22209 | Medium | 4.7 | 2025-02-15 | A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL com… |
CVE-2025-22208 | Medium | 4.7 | 2025-02-15 | A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL com… |
CVE-2025-0935 | Medium | 4.3 | 2025-02-15 | The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions i… |
CVE-2025-1302 | Critical | 9.8 | 2025-02-15 | Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute a… |
CVE-2025-0997 | High | 8.1 | 2025-02-15 | Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Exte… |
CVE-2025-0996 | Medium | 5.4 | 2025-02-15 | Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox (U… |
CVE-2025-0995 | High | 8.8 | 2025-02-15 | Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-26819 | High | 8.6 | 2025-02-15 | Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections. |
CVE-2025-21401 | Medium | 4.5 | 2025-02-15 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2025-0593 | High | 8.8 | 2025-02-14 | The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device. |
CVE-2025-0592 | High | 8.8 | 2025-02-14 | The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device. |
CVE-2025-25304 | | 2025-02-14 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and… | |
CVE-2025-25297 | High | 8.6 | 2025-02-14 | Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forger… |
CVE-2025-25296 | Medium | 6.1 | 2025-02-14 | Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HT… |
CVE-2025-25290 | Medium | 5.3 | 2025-02-14 | @octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2… |
CVE-2025-25289 | Medium | 5.3 | 2025-02-14 | @octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Servi… |
CVE-2025-25288 | Medium | 5.3 | 2025-02-14 | @octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm pack… |
CVE-2025-25285 | Medium | 5.3 | 2025-02-14 | @octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific `options`… |
CVE-2025-0503 | Low | 3.1 | 2025-02-14 | Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata fr… |
CVE-2025-26508 | Critical | 9.8 | 2025-02-14 | Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privi… |
CVE-2025-26507 | Critical | 9.8 | 2025-02-14 | Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privi… |
CVE-2025-26506 | Critical | 9.8 | 2025-02-14 | Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privi… |
CVE-2025-26158 | Medium | 5.6 | 2025-02-14 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the manage-employee.php page of Kashipara Online Attendance Management System V1.0. This vu… |
CVE-2025-26157 | Medium | 5.9 | 2025-02-14 | A SQL Injection vulnerability was found in /bpms/index.php in Source Code and Project Beauty Parlour Management System V1.1, which allows remote attackers to e… |
CVE-2025-26156 | High | 8.8 | 2025-02-14 | A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbit… |
CVE-2025-25997 | High | 7.5 | 2025-02-14 | Directory Traversal vulnerability in FeMiner wms v.1.0 allows a remote attacker to obtain sensitive information via the databak.php component. |
CVE-2025-25994 | High | 7.5 | 2025-02-14 | SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id. |
CVE-2025-25993 | Medium | 5.1 | 2025-02-14 | SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameter "itemid." |
CVE-2025-25992 | Medium | 5.1 | 2025-02-14 | SQL Injection vulnerability in FeMiner wms 1.0 allows a remote attacker to obtain sensitive information via the inquire_inout_item.php component. |
CVE-2025-25991 | Medium | 5.1 | 2025-02-14 | SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component. |
CVE-2025-25990 | Medium | 6.1 | 2025-02-14 | Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component. |
CVE-2025-25988 | Medium | 4.8 | 2025-02-14 | Cross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title parameter and the Title pa… |
CVE-2025-25295 | | 2025-02-14 | Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access… | |
CVE-2025-25206 | High | 8.3 | 2025-02-14 | eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user t… |
CVE-2025-25204 | Medium | 6.3 | 2025-02-14 | `gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attes… |
CVE-2025-25745 | High | 8.8 | 2025-02-14 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetQuickVPNSettings module. |
CVE-2025-25740 | Medium | 5.5 | 2025-02-14 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the PSK parameter in the SetQuickVPNSettings module. |
CVE-2025-1239 | | 2025-02-14 | A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Blocked Sites list. An authentica… | |
CVE-2025-1071 | Medium | 4.8 | 2025-02-14 | A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An authentica… |
CVE-2025-0178 | Medium | 6.1 | 2025-02-14 | An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in… |
CVE-2025-24700 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator wp-event-aggregator allo… |
CVE-2025-24699 | High | 7.1 | 2025-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company WP Coder wp-coder allows Cross-Site Scripting (XSS).This issue affects WP Coder: from n/a throug… |
CVE-2025-24692 | High | 7.1 | 2025-02-14 | Missing Authorization vulnerability in M.Code Bulk Menu Edit bulk-menu-edit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-24688 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.Th… |
CVE-2025-24641 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rickonline_nl Better WishList API better-wlm-api allows S… |
CVE-2025-24617 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acy… |
CVE-2025-24616 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UIUX Lab Uix Page Builder uix-page-builder allows Reflect… |
CVE-2025-24615 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Analytics Cat analytics-cat allows Reflected X… |
CVE-2025-24614 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agile Logix Post Timeline post-timeline allows Reflected… |
CVE-2025-24607 | Medium | 5.8 | 2025-02-14 | Missing Authorization vulnerability in Northern Beaches Websites IdeaPush ideapush allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-24592 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SysBasics Customize My Account for WooCommerce customize-… |
CVE-2025-24567 | Medium | 6.5 | 2025-02-14 | Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2025-24566 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomáš Groulík Intro Tour Tutorial DeepPresentation dp-int… |
CVE-2025-24565 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflect… |
CVE-2025-24564 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Contact Form With Shortcode contact-form-w… |
CVE-2025-24558 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This i… |
CVE-2025-24554 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit awcode-toolkit allows Reflected XSS… |
CVE-2025-23905 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johannes van Poelgeest Admin Options Pages admin-options-… |
CVE-2025-23857 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SmartDataSoft Essential WP Real Estate essential-wp-real-… |
CVE-2025-23853 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in michelem NoFollow Free nofollow-free allows Reflected XSS… |
CVE-2025-23851 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khushwant Singh Coronavirus (COVID-19) Outbreak Data Widg… |
CVE-2025-23790 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wassereimer Easy Code Placement allows Reflected XSS. Thi… |
CVE-2025-23789 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking | AB T… |
CVE-2025-23788 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roni Saha Easy Filter easy-filter allows Reflected XSS.Th… |