2025 CVEs (page 414)
Page 414 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24968 | High | 8.8 | 2025-02-04 | reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with specific roles, suc… |
CVE-2025-24967 | Medium | 5.4 | 2025-02-04 | reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability exists in the admin panel's user manag… |
CVE-2025-24966 | Medium | 5.4 | 2025-02-04 | reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or sanitizes user inputs… |
CVE-2025-24964 | Critical | 9.6 | 2025-02-04 | Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest… |
CVE-2025-24963 | Medium | 5.9 | 2025-02-04 | Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Espe… |
CVE-2025-0960 | Critical | 9.8 | 2025-02-04 | AutomationDirect C-more EA9 HMI contains a function with bounds checks that can be skipped, which could result in an attacker abusing the function to cause a d… |
CVE-2025-0630 | Medium | 6.5 | 2025-02-04 | Multiple Western Telematic (WTI) products contain a web interface that is vulnerable to a local file inclusion attack (LFI), where any authenticated user has p… |
CVE-2025-0509 | High | 7.3 | 2025-02-04 | A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA… |
CVE-2025-25039 | Medium | 4.7 | 2025-02-04 | A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrar… |
CVE-2025-24971 | | 2025-02-04 | DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Command Injection vulnerability was disco… | |
CVE-2025-24373 | Medium | 6.5 | 2025-02-04 | woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce o… |
CVE-2025-0451 | Medium | 6.3 | 2025-02-04 | Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI… |
CVE-2025-0445 | Medium | 5.4 | 2025-02-04 | Use after free in V8 in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-0444 | Medium | 6.3 | 2025-02-04 | Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2025-23060 | Medium | 6.6 | 2025-02-04 | A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vu… |
CVE-2025-23059 | Medium | 6.8 | 2025-02-04 | A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If… |
CVE-2025-23058 | High | 8.8 | 2025-02-04 | A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauth… |
CVE-2025-0364 | Critical | 9.8 | 2025-02-04 | BigAntSoft BigAnt Server, up to and including version 5.6.06, is vulnerable to unauthenticated remote code execution via account registration. An unauthenticat… |
CVE-2025-24677 | Critical | 9.9 | 2025-02-04 | Improper Control of Generation of Code ('Code Injection') vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies a… |
CVE-2025-24648 | High | 7.5 | 2025-02-04 | Incorrect Privilege Assignment vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Privilege Escalation.This issue affects A… |
CVE-2025-24602 | High | 7.1 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP24 WP24 Domain Check wp24-domain-check allows Reflected… |
CVE-2025-24599 | High | 7.1 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Re… |
CVE-2025-24598 | High | 7.1 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.Th… |
CVE-2025-23645 | High | 7.1 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Optimize Worldwide Find Content IDs find-content-ids allo… |
CVE-2025-22794 | High | 7.1 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ianhaycox World Cup Predictor world-cup-predictor allows… |
CVE-2025-22730 | Medium | 6.5 | 2025-02-04 | Missing Authorization vulnerability in ksher thailand Ksher ksher-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-22700 | High | 8.5 | 2025-02-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects… |
CVE-2025-22699 | Critical | 9.0 | 2025-02-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects… |
CVE-2025-22697 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-add… |
CVE-2025-22696 | Medium | 5.4 | 2025-02-04 | Missing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from… |
CVE-2025-22675 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Alert Box Block – Display notice/alerts in the f… |
CVE-2025-22674 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Product Blocks for WooCommerce product-blocks… |
CVE-2025-22664 | Medium | 5.9 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This… |
CVE-2025-22662 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-… |
CVE-2025-22653 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tuyennv Music Press Pro music-press-pro allows Stored XSS… |
CVE-2025-22643 | Medium | 4.3 | 2025-02-04 | Missing Authorization vulnerability in famethemes OnePress onepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-22642 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtowebsites Dynamic Conditions dynamicconditions allows S… |
CVE-2025-22641 | Medium | 5.9 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prem Tiwari FM Notification Bar fm-notification-bar allow… |
CVE-2025-22206 | Medium | 4.7 | 2025-02-04 | A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL com… |
CVE-2025-0825 | Medium | 5.3 | 2025-02-04 | cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploi… |
CVE-2025-1020 | Critical | 9.8 | 2025-02-04 | Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-1019 | Medium | 4.3 | 2025-02-04 | The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack… |
CVE-2025-1018 | Medium | 5.3 | 2025-02-04 | The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential sp… |
CVE-2025-1017 | Critical | 9.8 | 2025-02-04 | Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption a… |
CVE-2025-1016 | Critical | 9.8 | 2025-02-04 | Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bug… |
CVE-2025-1015 | Medium | 5.4 | 2025-02-04 | The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malici… |
CVE-2025-1014 | High | 8.8 | 2025-02-04 | Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Fir… |
CVE-2025-1013 | Medium | 6.5 | 2025-02-04 | A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vu… |
CVE-2025-1012 | High | 7.5 | 2025-02-04 | A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7… |
CVE-2025-1011 | High | 8.8 | 2025-02-04 | A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vul… |
CVE-2025-1010 | High | 8.8 | 2025-02-04 | An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefo… |
CVE-2025-1009 | Critical | 9.8 | 2025-02-04 | An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135… |
CVE-2025-0510 | Medium | 6.5 | 2025-02-04 | Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vu… |
CVE-2025-24860 | Medium | 5.4 | 2025-02-04 | Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using Cassand… |
CVE-2025-0890 | Critical | 9.8 | 2025-02-04 | **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_201… |
CVE-2025-23015 | High | 8.8 | 2025-02-04 | Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser w… |
CVE-2025-22205 | High | 7.5 | 2025-02-04 | Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x. |
CVE-2025-22204 | Critical | 9.8 | 2025-02-04 | Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability. |
CVE-2025-20907 | Medium | 6.0 | 2025-02-04 | Improper privilege management in Samsung Find prior to SMR Feb-2025 Release 1 allows local privileged attackers to disable Samsung Find. |
CVE-2025-20906 | Medium | 5.5 | 2025-02-04 | Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB. |
CVE-2025-20905 | Medium | 6.3 | 2025-02-04 | Out-of-bounds read and write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to read and write out-of-bounds memory. |
CVE-2025-20904 | Medium | 6.3 | 2025-02-04 | Out-of-bounds write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to cause memory corruption. |
CVE-2025-20902 | Medium | 5.1 | 2025-02-04 | Improper access control in Media Controller prior to version 1.0.24.5282 allows local attacker to launch activities in MediaController's privilege. |
CVE-2025-20901 | Medium | 4.4 | 2025-02-04 | Out-of-bounds read in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to read out-of-bounds memory. |
CVE-2025-20900 | Medium | 6.3 | 2025-02-04 | Out-of-bounds write in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-20899 | Medium | 4.0 | 2025-02-04 | Improper access control in PushNotification prior to version 13.0.00.15 in Android 12, 14.0.00.7 in Android 13, and 15.1.00.5 in Android 14 allows local attack… |
CVE-2025-20898 | Medium | 4.6 | 2025-02-04 | Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20897 | Medium | 6.8 | 2025-02-04 | Improper access control in Secure Folder prior to version 1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12 allows local attacker to… |
CVE-2025-20896 | Medium | 4.0 | 2025-02-04 | Use of implicit intent for sensitive communication in EasySetup prior to version 11.1.18 allows local attackers to access sensitive information. |
CVE-2025-20895 | Low | 3.2 | 2025-02-04 | Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary applications to bypass r… |
CVE-2025-20894 | Medium | 4.6 | 2025-02-04 | Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20893 | Medium | 5.1 | 2025-02-04 | Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the configuration of notifications. |
CVE-2025-20892 | Medium | 5.9 | 2025-02-04 | Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. User interaction is… |
CVE-2025-20891 | Medium | 5.3 | 2025-02-04 | Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary… |
CVE-2025-20890 | High | 7.0 | 2025-02-04 | Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. U… |
CVE-2025-20889 | Medium | 5.3 | 2025-02-04 | Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory… |
CVE-2025-20888 | High | 7.0 | 2025-02-04 | Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code wit… |
CVE-2025-20887 | Medium | 5.3 | 2025-02-04 | Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User inte… |
CVE-2025-20886 | Medium | 4.1 | 2025-02-04 | Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key. |
CVE-2025-20885 | Medium | 6.4 | 2025-02-04 | Out-of-bounds write in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to cause memory corruption. |
CVE-2025-20884 | Medium | 4.6 | 2025-02-04 | Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20883 | Medium | 4.6 | 2025-02-04 | Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20882 | High | 7.0 | 2025-02-04 | Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary co… |
CVE-2025-20881 | High | 7.0 | 2025-02-04 | Out-of-bounds write in accessing buffer storing the decoded video frames in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbi… |
CVE-2025-0466 | Medium | 5.3 | 2025-02-04 | The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and s… |
CVE-2025-0368 | Medium | 6.1 | 2025-02-04 | The Banner Garden Plugin for WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflec… |
CVE-2025-24982 | Medium | 4.3 | 2025-02-04 | Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log d… |
CVE-2025-22475 | Low | 3.7 | 2025-02-04 | Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primitive with a Risky Implementation vulnerab… |
CVE-2025-1003 | | 2025-02-04 | A potential vulnerability has been identified in HP Anyware Agent for Linux which might allow for authentication bypass which may result in escalation of privi… | |
CVE-2025-0148 | Low | 2.6 | 2025-02-03 | Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of informati… |
CVE-2025-24958 | High | 8.8 | 2025-02-03 | WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` endpoint. This vuln… |
CVE-2025-24957 | Critical | 9.8 | 2025-02-03 | WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_socio.php` endpoint. T… |
CVE-2025-24906 | Critical | 9.8 | 2025-02-03 | WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobranca.php` endpoint… |
CVE-2025-24905 | Critical | 9.8 | 2025-02-03 | WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarras_cobranca.php` endp… |
CVE-2025-24902 | High | 8.8 | 2025-02-03 | WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.php` endpoint. This vu… |
CVE-2025-24901 | High | 8.8 | 2025-02-03 | WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_permissao.php` endpoint. Th… |
CVE-2025-24371 | | 2025-02-03 | CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `l… | |
CVE-2025-24029 | Medium | 5.3 | 2025-02-03 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the da… |
CVE-2025-23210 | | 2025-02-03 | phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site… | |
CVE-2025-22129 | Medium | 4.3 | 2025-02-03 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an unauthorized user might get access to… |