2025 CVEs (page 408)
Page 408 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-25901 | High | 7.5 | 2025-02-13 | A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/WanSlaacCfgRpm.htm… |
CVE-2025-25900 | Medium | 4.9 | 2025-02-13 | A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the username and password parameters at /userRpm/PPPoEv6CfgRpm.htm. This vulnerabi… |
CVE-2025-25899 | Low | 3.5 | 2025-02-13 | A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'gw' parameter at /userRpm/WanDynamicIpV6CfgRpm.htm. This vulnerability allows… |
CVE-2025-25898 | High | 7.5 | 2025-02-13 | A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm. This vulnerability allows… |
CVE-2025-25897 | High | 7.5 | 2025-02-13 | A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'ip' parameter at /userRpm/WanStaticIpV6CfgRpm.htm. This vulnerability allows… |
CVE-2025-25357 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code… |
CVE-2025-25356 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute a… |
CVE-2025-25355 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute a… |
CVE-2025-25354 | High | 7.2 | 2025-02-13 | A SQL Injection was found in /admin/admin-profile.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the co… |
CVE-2025-25352 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/aboutus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code vi… |
CVE-2025-25287 | Medium | 4.7 | 2025-02-13 | Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to st… |
CVE-2025-24904 | High | 8.5 | 2025-02-13 | libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior… |
CVE-2025-24903 | High | 8.5 | 2025-02-13 | libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior… |
CVE-2025-22480 | High | 7.0 | 2025-02-13 | Dell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. A low-privileged attacker with local access could poten… |
CVE-2025-0426 | Medium | 6.2 | 2025-02-13 | A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint… |
CVE-2025-21701 | High | 7.8 | 2025-02-13 | In the Linux kernel, the following vulnerability has been resolved: net: avoid race between device unregistration and ethnl ops The following trace can be se… |
CVE-2025-26582 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Blackbam TinyMCE Advanced qTranslate fix editor problems tinymce-advanced-qtranslate-fix-editor-problems all… |
CVE-2025-26580 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Complete SEO Page/Post Specific Social Share Buttons pagepost-specific-social-share-buttons allows Stored XS… |
CVE-2025-26578 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in mathieuhays Simple Documentation client-documentation allows Stored XSS.This issue affects Simple Documentat… |
CVE-2025-26577 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in daxiawp DX-auto-publish dx-auto-publish allows Stored XSS.This issue affects DX-auto-publish: from n/a throu… |
CVE-2025-26574 | Medium | 6.5 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moch Amir Google Drive WP Media google-drive-wp-media all… |
CVE-2025-26572 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in jesseheap WP PHPList phplist-form-integration allows Cross Site Request Forgery.This issue affects WP PHPLis… |
CVE-2025-26571 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in wibiya Wibiya Toolbar wibiya allows Cross Site Request Forgery.This issue affects Wibiya Toolbar: from n/a t… |
CVE-2025-26570 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in uamv Glance That allows Cross Site Request Forgery. This issue affects Glance That: from n/a through 4.9. |
CVE-2025-26569 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Callmeforsox Post Thumbs allows Stored XSS. This issue affects Post Thumbs: from n/a through 1.5. |
CVE-2025-26568 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in jensmueller Easy Amazon Product Information easy-amazon-product-information allows Stored XSS.This issue aff… |
CVE-2025-26567 | Medium | 6.5 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farjana55 Font Awesome WP font-awesome-wp allows DOM-Base… |
CVE-2025-26562 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Patnaik RSS Filter rss-filter allows Stored XSS.This issue affects RSS Filter: from n/a through <= 1… |
CVE-2025-26561 | Medium | 5.9 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elfsight Elfsight Yottie Lite yottie-lite allows Stored X… |
CVE-2025-26558 | Medium | 6.5 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mkkmail Aparat Responsive aparat-responsive allows DOM-Ba… |
CVE-2025-26552 | High | 7.1 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in badrHan Naver Syndication V2 badr-naver-syndication allow… |
CVE-2025-26551 | High | 7.1 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Bootstrap collapse bootstrap-collapse allows St… |
CVE-2025-26550 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Kunal Shivale Global Meta Keyword & Description global-meta-keyword-and-description allows Stored XSS.This i… |
CVE-2025-26549 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in pa1 WP Html Page Sitemap wp-html-page-sitemap allows Stored XSS.This issue affects WP Html Page Sitemap: fro… |
CVE-2025-26547 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in nagarjunsonti My Login Logout Plugin my-loginlogout allows Stored XSS.This issue affects My Login Logout Plu… |
CVE-2025-26545 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in shisuh Related Posts Line-up-Exactly by Milliard related-posts-line-up-exactry-by-milliard allows Stored XSS… |
CVE-2025-26543 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Pukhraj Suthar Simple Responsive Menu simple-responsive-menu allows Stored XSS.This issue affects Simple Res… |
CVE-2025-26539 | Medium | 6.5 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in petkivim Embed Google Map embed-google-map allows Stored… |
CVE-2025-26538 | Medium | 6.5 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Prezi Embedder prezi-embedder allows Stored… |
CVE-2025-1247 | High | 8.3 | 2025-02-13 | A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This… |
CVE-2025-1271 | Medium | 6.1 | 2025-02-13 | Reflected Cross-Site Scripting (XSS) in Anapi Group's h6web. This security flaw could allow an attacker to inject malicious JavaScript code into a URL. When a… |
CVE-2025-1270 | Critical | 9.1 | 2025-02-13 | Insecure direct object reference (IDOR) vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a P… |
CVE-2025-1094 | High | 8.1 | 2025-02-13 | Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() all… |
CVE-2025-21700 | High | 7.8 | 2025-02-13 | In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of child qdisc from one parent to another Lion Ackermann w… |
CVE-2025-0816 | Medium | 6.5 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are sent to the device. |
CVE-2025-0815 | Medium | 6.5 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious ICMPV6 packets are sent to the device. |
CVE-2025-0814 | Medium | 5.3 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network services running on the product when malicious IEC6185… |
CVE-2025-0661 | Medium | 4.3 | 2025-02-13 | The DethemeKit For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the duplicate_post() fun… |
CVE-2025-0327 | High | 7.8 | 2025-02-13 | CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing cl… |
CVE-2025-1070 | High | 8.1 | 2025-02-13 | CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded. |
CVE-2025-1060 | High | 7.5 | 2025-02-13 | CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed b… |
CVE-2025-1059 | High | 7.5 | 2025-02-13 | CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to t… |
CVE-2025-1058 | High | 8.1 | 2025-02-13 | CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded. |
CVE-2025-0692 | Low | 3.5 | 2025-02-13 | The Simple Video Management System WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2025-0837 | Medium | 6.4 | 2025-02-13 | The Puzzles theme for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.2.6 due to insufficient input s… |
CVE-2025-1198 | Medium | 4.2 | 2025-02-13 | An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived con… |
CVE-2025-0896 | Critical | 9.8 | 2025-02-13 | Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled. This could result in unauthorized access b… |
CVE-2025-25286 | Critical | 9.8 | 2025-02-13 | Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code e… |
CVE-2025-20097 | Medium | 4.3 | 2025-02-12 | Uncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before version R01.02.0002 may allow an authenti… |
CVE-2025-1229 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical was found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6. Affected by this vulnerability is an unkn… |
CVE-2025-1228 | Medium | 4.3 | 2025-02-12 | A vulnerability classified as problematic has been found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6. Affected is an unknown function o… |
CVE-2025-1227 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in ywoa up to 2024.07.03. It has been rated as critical. This issue affects the function selectList of the file com/cloudweb/oa/mappe… |
CVE-2025-1226 | Medium | 5.3 | 2025-02-12 | A vulnerability was found in ywoa up to 2024.07.03. It has been declared as critical. This vulnerability affects unknown code of the file /oa/setup/setup.jsp… |
CVE-2025-0113 | | 2025-02-12 | A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from th… | |
CVE-2025-0111 | Medium | 6.5 | 2025-02-12 | An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web… |
CVE-2025-0110 | | 2025-02-12 | A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI reque… | |
CVE-2025-0109 | | 2025-02-12 | An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network acces… | |
CVE-2025-0108 | Critical | 9.1 | 2025-02-12 | An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to b… |
CVE-2025-1225 | Medium | 6.3 | 2025-02-12 | A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/m… |
CVE-2025-1224 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file com/cloudweb/oa/ma… |
CVE-2025-25343 | Critical | 9.8 | 2025-02-12 | Tenda AC6 V15.03.05.16 firmware has a buffer overflow vulnerability in the formexeCommand function. |
CVE-2025-25283 | High | 7.5 | 2025-02-12 | parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay… |
CVE-2025-25205 | High | 8.2 | 2025-02-12 | Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic… |
CVE-2025-25201 | Medium | 4.0 | 2025-02-12 | Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could… |
CVE-2025-1216 | Medium | 6.3 | 2025-02-12 | A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cl… |
CVE-2025-1215 | Low | 2.8 | 2025-02-12 | A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of… |
CVE-2025-1146 | High | 8.1 | 2025-02-12 | CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has ide… |
CVE-2025-0937 | High | 7.1 | 2025-02-12 | Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces. |
CVE-2025-25741 | Medium | 5.4 | 2025-02-12 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6_PppoePassword parameter in the SetIPv6PppoeSetti… |
CVE-2025-25200 | High | 7.5 | 2025-02-12 | Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to pa… |
CVE-2025-25199 | High | 7.5 | 2025-02-12 | go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation (CNG). Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, call… |
CVE-2025-25198 | High | 7.1 | 2025-02-12 | mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionali… |
CVE-2025-1214 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the componen… |
CVE-2025-1213 | Low | 3.5 | 2025-02-12 | A vulnerability was found in pihome-shc PiHome 1.77. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index… |
CVE-2025-25746 | Critical | 9.8 | 2025-02-12 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetWanSettings module. |
CVE-2025-25744 | Critical | 9.8 | 2025-02-12 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings modul… |
CVE-2025-25743 | High | 7.2 | 2025-02-12 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module. |
CVE-2025-25742 | Critical | 9.8 | 2025-02-12 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the AccountPassword parameter in the SetSysEmailSettings… |
CVE-2025-25184 | Medium | 6.5 | 2025-02-12 | Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafti… |
CVE-2025-25182 | Critical | 9.4 | 2025-02-12 | Stroom is a data processing, storage and analysis platform. A vulnerability exists starting in version 7.2-beta.53 and prior to versions 7.2.24, 7.3-beta.22, 7… |
CVE-2025-1210 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Affected by this vulnerability is an unknown functionality of the file /co… |
CVE-2025-1209 | Low | 3.5 | 2025-02-12 | A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Affected is the function searchuser of the file /search_resualts.p… |
CVE-2025-25351 | Critical | 9.8 | 2025-02-12 | PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the dateexpense parameter. |
CVE-2025-25349 | Critical | 9.8 | 2025-02-12 | PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the costitem parameter. |
CVE-2025-1208 | Low | 3.5 | 2025-02-12 | A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /Profile… |
CVE-2025-1207 | Low | 3.1 | 2025-02-12 | A vulnerability was found in phjounin TFTPD64 4.64. It has been declared as problematic. This vulnerability affects unknown code of the component DNS Handler… |
CVE-2025-0556 | High | 8.8 | 2025-02-12 | In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive… |
CVE-2025-0516 | Medium | 4.3 | 2025-02-12 | Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform u… |
CVE-2025-0332 | High | 7.8 | 2025-02-12 | In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 (2025.1.211), using the improper limitation of a target path can lead to decompressing an arch… |
CVE-2025-1244 | High | 8.8 | 2025-02-12 | A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnera… |