2025 CVEs (page 409)
Page 409 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-23787 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foxskav Easy Bet easy-bet allows Reflected XSS.This issue… |
CVE-2025-23786 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Email to Download email-to-download allows Reflec… |
CVE-2025-23771 | Medium | 6.5 | 2025-02-14 | Missing Authorization vulnerability in Murali Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly… |
CVE-2025-23766 | Medium | 6.5 | 2025-02-14 | Missing Authorization vulnerability in ashamil OPSI Israel Domestic Shipments woo-ups-pickup allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-23751 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Data Dash data-dash allows Reflected XSS.This is… |
CVE-2025-23750 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devbunchuk Custom Widget Creator custom-widget-creator al… |
CVE-2025-23748 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Singsys Singsys -Awesome Gallery awesome-gallery-singsys… |
CVE-2025-23742 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podamibe Nepal Podamibe Twilio Private Call podamibe-twil… |
CVE-2025-23658 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tauhidul Alam Advanced Angular Contact Form advanced-angu… |
CVE-2025-23657 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RusAlex WordPress-to-candidate for Salesforce CRM salesfo… |
CVE-2025-23655 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crystalwebpro Contact Form 7 – Paystack Add-on cf7-paysta… |
CVE-2025-23653 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabeel Tahir Form To Online Booking cf7-calendly-integrat… |
CVE-2025-23652 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fabio Zuanon Add custom content after post add-custom-con… |
CVE-2025-23651 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adamskaat Scroll Top scroll-to-top-builder allows Reflect… |
CVE-2025-23650 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp Tidy.ro tidyro allows Reflected XSS.This issue af… |
CVE-2025-23648 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wjharil AdsMiddle adsmiddle allows Reflected XSS.This iss… |
CVE-2025-23647 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ariagle WP-Clap wp-clap allows Reflected XSS.This issue a… |
CVE-2025-23646 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Brooks Library Instruction Recorder library-instruct… |
CVE-2025-23598 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in craig.edmunds@gmail.com Recip.ly reciply allows Reflected… |
CVE-2025-23571 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in makong Internal Links Generator internal-links-generator… |
CVE-2025-23568 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fredsted WP Login Attempt Log wp-login-attempt-log allows… |
CVE-2025-23534 | Medium | 6.5 | 2025-02-14 | Missing Authorization vulnerability in Mark Winiarski WPLingo wplingo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-23525 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kvvaradha Kv Compose Email From Dashboard kv-send-email-f… |
CVE-2025-23523 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoststreamsell HSS Embed Streaming Video hss-embed-stream… |
CVE-2025-23492 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CantonBolo WordPress 淘宝客插件 taobaoke allows Reflected XSS… |
CVE-2025-23474 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mike Martel Live Dashboard live-dashboard allows Reflecte… |
CVE-2025-23431 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khaninejad Envato Affiliater envato-affiliater allows Ref… |
CVE-2025-23428 | High | 7.1 | 2025-02-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arash Safari QMean – WordPress Did You Mean qmean allows… |
CVE-2025-22705 | High | 7.1 | 2025-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in godthor Disqus Popular Posts disqus-popular-posts allows Reflected XSS.This issue affects Disqus Popular Pos… |
CVE-2025-22702 | Medium | 6.3 | 2025-02-14 | Missing Authorization vulnerability in ThemeGoods Photography photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-22698 | Medium | 6.3 | 2025-02-14 | Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-0867 | Critical | 9.9 | 2025-02-14 | The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the… |
CVE-2025-26524 | | 2025-02-14 | This vulnerability exists in RupeeWeb trading platform due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker… | |
CVE-2025-26523 | | 2025-02-14 | This vulnerability exists in RupeeWeb trading platform due to insufficient authorization controls on certain API endpoints handling addition and deletion opera… | |
CVE-2025-26522 | | 2025-02-14 | This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker w… | |
CVE-2025-0821 | Medium | 6.5 | 2025-02-14 | Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficien… |
CVE-2025-26791 | Medium | 4.5 | 2025-02-14 | DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS). |
CVE-2025-26789 | | 2025-02-14 | An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive informati… | |
CVE-2025-26788 | High | 8.4 | 2025-02-14 | StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction. |
CVE-2025-1298 | Critical | 9.8 | 2025-02-14 | Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover. |
CVE-2025-22630 | Critical | 9.9 | 2025-02-14 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Marketing Fire Widget Options widget-options allows OS Com… |
CVE-2025-23406 | Medium | 5.3 | 2025-02-14 | Out-of-bounds read vulnerability caused by improper checking of TCP MSS option values exists in Cente middleware TCP/IP Network Series, which may lead to proce… |
CVE-2025-26519 | High | 8.1 | 2025-02-14 | musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to… |
CVE-2025-1053 | Medium | 4.9 | 2025-02-14 | Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave… |
CVE-2025-22962 | High | 7.2 | 2025-02-13 | A critical remote code execution (RCE) vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters when debugging mod… |
CVE-2025-22961 | High | 8.0 | 2025-02-13 | A critical information disclosure vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters due to Incorrect Access… |
CVE-2025-22960 | High | 8.0 | 2025-02-13 | A session hijacking vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters. Unauthenticated attackers can access… |
CVE-2025-26473 | High | 7.5 | 2025-02-13 | The Mojave Inverter uses the GET method for sensitive information. |
CVE-2025-25281 | High | 7.5 | 2025-02-13 | An attacker may modify the URL to discover sensitive information about the target network. |
CVE-2025-25195 | Medium | 4.3 | 2025-02-13 | Zulip is an open source team chat application. A weekly cron job (added in 50256f48314250978f521ef439cafa704e056539) demotes channels to being "inactive" after… |
CVE-2025-25067 | Critical | 9.8 | 2025-02-13 | mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands. |
CVE-2025-24865 | Critical | 10.0 | 2025-02-13 | The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sens… |
CVE-2025-24861 | High | 7.5 | 2025-02-13 | An attacker may inject commands via specially-crafted post requests. |
CVE-2025-24836 | High | 7.1 | 2025-02-13 | With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected… |
CVE-2025-23421 | Medium | 6.4 | 2025-02-13 | An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enab… |
CVE-2025-23411 | Medium | 6.3 | 2025-02-13 | mySCADA myPRO Manager is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to obtain sensitive information. An attacker would ne… |
CVE-2025-22896 | High | 8.6 | 2025-02-13 | mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information. |
CVE-2025-20615 | Medium | 6.2 | 2025-02-13 | The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level… |
CVE-2025-1283 | Critical | 9.8 | 2025-02-13 | The Dingtian DT-R0 Series is vulnerable to an exploit that allows attackers to bypass login requirements by directly navigating to the main page. |
CVE-2025-1127 | Critical | 9.1 | 2025-02-13 | The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem. |
CVE-2025-24889 | Medium | 4.5 | 2025-02-13 | The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to ve… |
CVE-2025-24888 | High | 8.1 | 2025-02-13 | The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to ve… |
CVE-2025-25389 | Critical | 9.8 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/forgot-password.php in Phpgurukul Land Record System v1.0, which allows remote attackers to execute arbitrary… |
CVE-2025-25388 | Critical | 9.8 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/edit-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitra… |
CVE-2025-25387 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/manage-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbit… |
CVE-2025-26511 | High | 8.8 | 2025-02-13 | Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0… |
CVE-2025-25901 | High | 7.5 | 2025-02-13 | A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/WanSlaacCfgRpm.htm… |
CVE-2025-25900 | Medium | 4.9 | 2025-02-13 | A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the username and password parameters at /userRpm/PPPoEv6CfgRpm.htm. This vulnerabi… |
CVE-2025-25899 | Low | 3.5 | 2025-02-13 | A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'gw' parameter at /userRpm/WanDynamicIpV6CfgRpm.htm. This vulnerability allows… |
CVE-2025-25898 | High | 7.5 | 2025-02-13 | A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm. This vulnerability allows… |
CVE-2025-25897 | High | 7.5 | 2025-02-13 | A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'ip' parameter at /userRpm/WanStaticIpV6CfgRpm.htm. This vulnerability allows… |
CVE-2025-25357 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code… |
CVE-2025-25356 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute a… |
CVE-2025-25355 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute a… |
CVE-2025-25354 | High | 7.2 | 2025-02-13 | A SQL Injection was found in /admin/admin-profile.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the co… |
CVE-2025-25352 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/aboutus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code vi… |
CVE-2025-25287 | Medium | 4.7 | 2025-02-13 | Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to st… |
CVE-2025-24904 | High | 8.5 | 2025-02-13 | libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior… |
CVE-2025-24903 | High | 8.5 | 2025-02-13 | libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior… |
CVE-2025-22480 | High | 7.0 | 2025-02-13 | Dell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. A low-privileged attacker with local access could poten… |
CVE-2025-0426 | Medium | 6.2 | 2025-02-13 | A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint… |
CVE-2025-21701 | High | 7.8 | 2025-02-13 | In the Linux kernel, the following vulnerability has been resolved: net: avoid race between device unregistration and ethnl ops The following trace can be se… |
CVE-2025-26582 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Blackbam TinyMCE Advanced qTranslate fix editor problems tinymce-advanced-qtranslate-fix-editor-problems all… |
CVE-2025-26580 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Complete SEO Page/Post Specific Social Share Buttons pagepost-specific-social-share-buttons allows Stored XS… |
CVE-2025-26578 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in mathieuhays Simple Documentation client-documentation allows Stored XSS.This issue affects Simple Documentat… |
CVE-2025-26577 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in daxiawp DX-auto-publish dx-auto-publish allows Stored XSS.This issue affects DX-auto-publish: from n/a throu… |
CVE-2025-26574 | Medium | 6.5 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moch Amir Google Drive WP Media google-drive-wp-media all… |
CVE-2025-26572 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in jesseheap WP PHPList phplist-form-integration allows Cross Site Request Forgery.This issue affects WP PHPLis… |
CVE-2025-26571 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in wibiya Wibiya Toolbar wibiya allows Cross Site Request Forgery.This issue affects Wibiya Toolbar: from n/a t… |
CVE-2025-26570 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in uamv Glance That allows Cross Site Request Forgery. This issue affects Glance That: from n/a through 4.9. |
CVE-2025-26569 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Callmeforsox Post Thumbs allows Stored XSS. This issue affects Post Thumbs: from n/a through 1.5. |
CVE-2025-26568 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in jensmueller Easy Amazon Product Information easy-amazon-product-information allows Stored XSS.This issue aff… |
CVE-2025-26567 | Medium | 6.5 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farjana55 Font Awesome WP font-awesome-wp allows DOM-Base… |
CVE-2025-26562 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Patnaik RSS Filter rss-filter allows Stored XSS.This issue affects RSS Filter: from n/a through <= 1… |
CVE-2025-26561 | Medium | 5.9 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elfsight Elfsight Yottie Lite yottie-lite allows Stored X… |
CVE-2025-26558 | Medium | 6.5 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mkkmail Aparat Responsive aparat-responsive allows DOM-Ba… |
CVE-2025-26552 | High | 7.1 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in badrHan Naver Syndication V2 badr-naver-syndication allow… |
CVE-2025-26551 | High | 7.1 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Bootstrap collapse bootstrap-collapse allows St… |
CVE-2025-26550 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Kunal Shivale Global Meta Keyword & Description global-meta-keyword-and-description allows Stored XSS.This i… |
CVE-2025-26549 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in pa1 WP Html Page Sitemap wp-html-page-sitemap allows Stored XSS.This issue affects WP Html Page Sitemap: fro… |