2025 CVEs (page 410)
Page 410 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-26547 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in nagarjunsonti My Login Logout Plugin my-loginlogout allows Stored XSS.This issue affects My Login Logout Plu… |
CVE-2025-26545 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in shisuh Related Posts Line-up-Exactly by Milliard related-posts-line-up-exactry-by-milliard allows Stored XSS… |
CVE-2025-26543 | High | 7.1 | 2025-02-13 | Cross-Site Request Forgery (CSRF) vulnerability in Pukhraj Suthar Simple Responsive Menu simple-responsive-menu allows Stored XSS.This issue affects Simple Res… |
CVE-2025-26539 | Medium | 6.5 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in petkivim Embed Google Map embed-google-map allows Stored… |
CVE-2025-26538 | Medium | 6.5 | 2025-02-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Prezi Embedder prezi-embedder allows Stored… |
CVE-2025-1247 | High | 8.3 | 2025-02-13 | A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This… |
CVE-2025-1271 | Medium | 6.1 | 2025-02-13 | Reflected Cross-Site Scripting (XSS) in Anapi Group's h6web. This security flaw could allow an attacker to inject malicious JavaScript code into a URL. When a… |
CVE-2025-1270 | Critical | 9.1 | 2025-02-13 | Insecure direct object reference (IDOR) vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a P… |
CVE-2025-1094 | High | 8.1 | 2025-02-13 | Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() all… |
CVE-2025-21700 | High | 7.8 | 2025-02-13 | In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of child qdisc from one parent to another Lion Ackermann w… |
CVE-2025-0816 | Medium | 6.5 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are sent to the device. |
CVE-2025-0815 | Medium | 6.5 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious ICMPV6 packets are sent to the device. |
CVE-2025-0814 | Medium | 5.3 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network services running on the product when malicious IEC6185… |
CVE-2025-0661 | Medium | 4.3 | 2025-02-13 | The DethemeKit For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the duplicate_post() fun… |
CVE-2025-0327 | High | 7.8 | 2025-02-13 | CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing cl… |
CVE-2025-1070 | High | 8.1 | 2025-02-13 | CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded. |
CVE-2025-1060 | High | 7.5 | 2025-02-13 | CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed b… |
CVE-2025-1059 | High | 7.5 | 2025-02-13 | CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to t… |
CVE-2025-1058 | High | 8.1 | 2025-02-13 | CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded. |
CVE-2025-0692 | Low | 3.5 | 2025-02-13 | The Simple Video Management System WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2025-0837 | Medium | 6.4 | 2025-02-13 | The Puzzles theme for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.2.6 due to insufficient input s… |
CVE-2025-1198 | Medium | 4.2 | 2025-02-13 | An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived con… |
CVE-2025-0896 | Critical | 9.8 | 2025-02-13 | Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled. This could result in unauthorized access b… |
CVE-2025-25286 | Critical | 9.8 | 2025-02-13 | Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code e… |
CVE-2025-20097 | Medium | 4.3 | 2025-02-12 | Uncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before version R01.02.0002 may allow an authenti… |
CVE-2025-1229 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical was found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6. Affected by this vulnerability is an unkn… |
CVE-2025-1228 | Medium | 4.3 | 2025-02-12 | A vulnerability classified as problematic has been found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6. Affected is an unknown function o… |
CVE-2025-1227 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in ywoa up to 2024.07.03. It has been rated as critical. This issue affects the function selectList of the file com/cloudweb/oa/mappe… |
CVE-2025-1226 | Medium | 5.3 | 2025-02-12 | A vulnerability was found in ywoa up to 2024.07.03. It has been declared as critical. This vulnerability affects unknown code of the file /oa/setup/setup.jsp… |
CVE-2025-0113 | | 2025-02-12 | A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from th… | |
CVE-2025-0111 | Medium | 6.5 | 2025-02-12 | An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web… |
CVE-2025-0110 | | 2025-02-12 | A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI reque… | |
CVE-2025-0109 | | 2025-02-12 | An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network acces… | |
CVE-2025-0108 | Critical | 9.1 | 2025-02-12 | An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to b… |
CVE-2025-1225 | Medium | 6.3 | 2025-02-12 | A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/m… |
CVE-2025-1224 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file com/cloudweb/oa/ma… |
CVE-2025-25343 | Critical | 9.8 | 2025-02-12 | Tenda AC6 V15.03.05.16 firmware has a buffer overflow vulnerability in the formexeCommand function. |
CVE-2025-25283 | High | 7.5 | 2025-02-12 | parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay… |
CVE-2025-25205 | High | 8.2 | 2025-02-12 | Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic… |
CVE-2025-25201 | Medium | 4.0 | 2025-02-12 | Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could… |
CVE-2025-1216 | Medium | 6.3 | 2025-02-12 | A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cl… |
CVE-2025-1215 | Low | 2.8 | 2025-02-12 | A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of… |
CVE-2025-1146 | High | 8.1 | 2025-02-12 | CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has ide… |
CVE-2025-0937 | High | 7.1 | 2025-02-12 | Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces. |
CVE-2025-25741 | Medium | 5.4 | 2025-02-12 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6_PppoePassword parameter in the SetIPv6PppoeSetti… |
CVE-2025-25200 | High | 7.5 | 2025-02-12 | Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to pa… |
CVE-2025-25199 | High | 7.5 | 2025-02-12 | go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation (CNG). Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, call… |
CVE-2025-25198 | High | 7.1 | 2025-02-12 | mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionali… |
CVE-2025-1214 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the componen… |
CVE-2025-1213 | Low | 3.5 | 2025-02-12 | A vulnerability was found in pihome-shc PiHome 1.77. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index… |
CVE-2025-25746 | Critical | 9.8 | 2025-02-12 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetWanSettings module. |
CVE-2025-25744 | Critical | 9.8 | 2025-02-12 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings modul… |
CVE-2025-25743 | High | 7.2 | 2025-02-12 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module. |
CVE-2025-25742 | Critical | 9.8 | 2025-02-12 | D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the AccountPassword parameter in the SetSysEmailSettings… |
CVE-2025-25184 | Medium | 6.5 | 2025-02-12 | Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafti… |
CVE-2025-25182 | Critical | 9.4 | 2025-02-12 | Stroom is a data processing, storage and analysis platform. A vulnerability exists starting in version 7.2-beta.53 and prior to versions 7.2.24, 7.3-beta.22, 7… |
CVE-2025-1210 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Affected by this vulnerability is an unknown functionality of the file /co… |
CVE-2025-1209 | Low | 3.5 | 2025-02-12 | A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Affected is the function searchuser of the file /search_resualts.p… |
CVE-2025-25351 | Critical | 9.8 | 2025-02-12 | PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the dateexpense parameter. |
CVE-2025-25349 | Critical | 9.8 | 2025-02-12 | PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the costitem parameter. |
CVE-2025-1208 | Low | 3.5 | 2025-02-12 | A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /Profile… |
CVE-2025-1207 | Low | 3.1 | 2025-02-12 | A vulnerability was found in phjounin TFTPD64 4.64. It has been declared as problematic. This vulnerability affects unknown code of the component DNS Handler… |
CVE-2025-0556 | High | 8.8 | 2025-02-12 | In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive… |
CVE-2025-0516 | Medium | 4.3 | 2025-02-12 | Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform u… |
CVE-2025-0332 | High | 7.8 | 2025-02-12 | In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 (2025.1.211), using the improper limitation of a target path can lead to decompressing an arch… |
CVE-2025-1244 | High | 8.8 | 2025-02-12 | A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnera… |
CVE-2025-1212 | Medium | 4.3 | 2025-02-12 | An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows… |
CVE-2025-1206 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file /dashboard/admin/… |
CVE-2025-1202 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical has been found in SourceCodester Best Church Management Software 1.1. Affected is an unknown function of the file /admin… |
CVE-2025-1042 | Medium | 4.9 | 2025-02-12 | An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2… |
CVE-2025-0376 | High | 8.7 | 2025-02-12 | An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an atta… |
CVE-2025-26378 | High | 8.8 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged… |
CVE-2025-26377 | High | 8.1 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged… |
CVE-2025-26376 | Medium | 6.5 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged… |
CVE-2025-26375 | High | 8.8 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged… |
CVE-2025-26374 | Medium | 6.5 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticate… |
CVE-2025-26373 | Medium | 6.5 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated… |
CVE-2025-26372 | High | 7.1 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26371 | High | 8.8 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26370 | High | 7.1 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26369 | High | 8.8 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26368 | High | 8.1 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26367 | Medium | 4.3 | 2025-02-12 | A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priv… |
CVE-2025-26366 | High | 7.5 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth… |
CVE-2025-26365 | High | 7.5 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth… |
CVE-2025-26364 | High | 7.5 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth… |
CVE-2025-26363 | High | 7.5 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth… |
CVE-2025-26362 | High | 7.5 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth… |
CVE-2025-26361 | Critical | 9.1 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth… |
CVE-2025-26360 | Medium | 5.3 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an… |
CVE-2025-26359 | Critical | 9.8 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an una… |
CVE-2025-26358 | Medium | 5.5 | 2025-02-12 | A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remot… |
CVE-2025-26357 | Medium | 4.9 | 2025-02-12 | A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker t… |
CVE-2025-26356 | High | 7.2 | 2025-02-12 | A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authentica… |
CVE-2025-26355 | Medium | 6.5 | 2025-02-12 | A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker t… |
CVE-2025-26354 | High | 7.2 | 2025-02-12 | A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated r… |
CVE-2025-26353 | Medium | 4.9 | 2025-02-12 | A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sen… |
CVE-2025-26352 | Medium | 6.5 | 2025-02-12 | A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to… |
CVE-2025-26351 | Medium | 4.9 | 2025-02-12 | A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to… |
CVE-2025-26350 | Medium | 4.9 | 2025-02-12 | A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authe… |