2025 CVEs (page 414)
Page 414 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1108 | High | 8.6 | 2025-02-07 | Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of ema… |
CVE-2025-1107 | Critical | 9.9 | 2025-02-07 | Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password withou… |
CVE-2025-25069 | Medium | 6.5 | 2025-02-07 | A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP r… |
CVE-2025-25168 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Black and White BookPress – For Book Authors book-press allows Cross-Site Scripting (XSS).This issue affects… |
CVE-2025-25167 | High | 8.2 | 2025-02-07 | Missing Authorization vulnerability in Black and White BookPress – For Book Authors book-press allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-25166 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in gabrieldarezzo InLocation inlocation allows Stored XSS.This issue affects InLocation: from n/a through <= 1… |
CVE-2025-25163 | High | 7.5 | 2025-02-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows P… |
CVE-2025-25160 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Mark Barnes Style Tweaker style-tweaker allows Stored XSS.This issue affects Style Tweaker: from n/a through… |
CVE-2025-25159 | High | 7.1 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robert_kolatzek WP doodlez wpdoodlez allows Stored XSS.Th… |
CVE-2025-25156 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Stanko Metodiev Quote Comments quote-comments allows Stored XSS.This issue affects Quote Comments: from n/a… |
CVE-2025-25155 | High | 7.5 | 2025-02-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in efreja Music Sheet Viewer music-sheet-viewer allows Path Traver… |
CVE-2025-25154 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in scweber Custom Comment Notifications custom-comment-notifications allows Stored XSS.This issue affects Custo… |
CVE-2025-25153 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in djjmz Simple Auto Tag simple-auto-tag allows Stored XSS.This issue affects Simple Auto Tag: from n/a through… |
CVE-2025-25152 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in LukaszWiecek Smart DoFollow smart-dofollow allows Stored XSS.This issue affects Smart DoFollow: from n/a thr… |
CVE-2025-25151 | High | 8.5 | 2025-02-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows SQL Injection.This issu… |
CVE-2025-25149 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Danillo Nunes Login-box login-box allows Stored XSS.This issue affects Login-box: from n/a through <= 2.0.4. |
CVE-2025-25148 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in ElbowRobo Read More Copy Link read-more-copy-link allows Stored XSS.This issue affects Read More Copy Link… |
CVE-2025-25147 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Phillip.Gooch Auto SEO auto-seo allows Stored XSS.This issue affects Auto SEO: from n/a through <= 2.5.6. |
CVE-2025-25146 | Medium | 4.3 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in saleandro Songkick Concerts and Festivals songkick-concerts-and-festivals allows Cross Site Request Forgery… |
CVE-2025-25145 | Medium | 5.4 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in jordan.hatch Infusionsoft Analytics infusionsoft-web-tracker allows Cross Site Request Forgery.This issue af… |
CVE-2025-25144 | High | 7.1 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theasys Theasys theasys allows Stored XSS.This issue affe… |
CVE-2025-25143 | Medium | 4.3 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in ibasit GlobalQuran globalquran allows Cross Site Request Forgery.This issue affects GlobalQuran: from n/a th… |
CVE-2025-25141 | High | 7.5 | 2025-02-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zankover Fami Sales Popup fami-sales-p… |
CVE-2025-25140 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile… |
CVE-2025-25139 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Cynob IT Consultancy WP Custom Post RSS Feed wp-custom-post-rss-feed allows Stored XSS.This issue affects WP… |
CVE-2025-25138 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + W… |
CVE-2025-25136 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shujahat21 Optimate Ads optimate-ads allows Stored XSS.Th… |
CVE-2025-25135 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Victor Barkalov Custom Links On Admin Dashboard Toolbar customize-wpadmin allows Stored XSS.This issue affec… |
CVE-2025-25128 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in orlandolac Facilita Form Tracker facilita-form-tracker allows Stored XSS.This issue affects Facilita Form Tr… |
CVE-2025-25126 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in zmseo ZMSEO zmseo allows Stored XSS.This issue affects ZMSEO: from n/a through <= 1.14.1. |
CVE-2025-25125 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a thro… |
CVE-2025-25123 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in xdark Easy Related Posts easy-related-posts allows Stored XSS.This issue affects Easy Related Posts: from n/… |
CVE-2025-25120 | Medium | 4.3 | 2025-02-07 | Missing Authorization vulnerability in Melodic Media Slide Banners slide-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-25117 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Polonski Smart Countdown FX smart-countdown-fx allow… |
CVE-2025-25116 | High | 7.6 | 2025-02-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sudipto Link to URL / Post link-to-url-post allows Blind… |
CVE-2025-25111 | Medium | 5.4 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Cross Site Request Forgery.This issue affects WP Spell C… |
CVE-2025-25110 | Medium | 5.4 | 2025-02-07 | Missing Authorization vulnerability in Metagauss Event Kikfyre kikfyre-events-calendar-tickets allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-25107 | Critical | 9.6 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in sainwp OneStore Sites onestore-sites allows Cross Site Request Forgery.This issue affects OneStore Sites: fr… |
CVE-2025-25106 | Critical | 9.6 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in FancyWP Starter Templates by FancyWP starter-templates allows Cross Site Request Forgery.This issue affects… |
CVE-2025-25105 | Medium | 5.9 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in coffeestudios Pop Up popup-seo-optimized allows Stored XS… |
CVE-2025-25104 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in mraliende URL-Preview-Box good-url-preview-box allows Cross Site Request Forgery.This issue affects URL-Prev… |
CVE-2025-25103 | Medium | 4.3 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Indeed API indeed-api allows Cross Site Request Forgery.This issue affects Indeed API: from n/a thr… |
CVE-2025-25101 | Critical | 9.6 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in MetricThemes Munk Sites munk-sites allows Cross Site Request Forgery.This issue affects Munk Sites: from n/a… |
CVE-2025-25098 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Links in Captions links-in-captions allows Stor… |
CVE-2025-25097 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kwiliarty External Video For Everybody external-video-for… |
CVE-2025-25096 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in titusbicknell RSS in Page rss-in-page allows Stored XSS.T… |
CVE-2025-25095 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reverbnationdev ReverbNation Widgets reverbnation-widgets… |
CVE-2025-25094 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amitythemes.com Breaking News Ticker breaking-news-ticker… |
CVE-2025-25093 | Medium | 6.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in paulswarthout Child Themes Helper child-themes-helper allows Path Traversal.This issue affects Child Themes… |
CVE-2025-25091 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackdesign NextGen Cooliris Gallery nextgen-cooliris-gall… |
CVE-2025-25088 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in blackus3r WP Keyword Monitor wp-keyword-monitor allows Cross Site Request Forgery.This issue affects WP Keyw… |
CVE-2025-25085 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matt_mcbrien WP SimpleWeather wp-simpleweather allows Sto… |
CVE-2025-25082 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search flexidx-home-search allow… |
CVE-2025-25081 | Medium | 4.2 | 2025-02-07 | Missing Authorization vulnerability in DeannaS Embed RSS embed-rss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects E… |
CVE-2025-25080 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gubbigubbi Kona Gallery Block kona-instagram-feed-for-gut… |
CVE-2025-25079 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Select All Text Box simple-select-al… |
CVE-2025-25078 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrew Norcross Google Earth Embed google-earth-tours all… |
CVE-2025-25077 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dugbug Easy Chart Builder for WordPress easy-chart-builde… |
CVE-2025-25076 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicholaswilson Graceful Email Obfuscation graceful-email-… |
CVE-2025-25075 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Show notice or message on admin area show-notice-or-message-on-admin-area allows Stored XSS.This i… |
CVE-2025-25074 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Nirmal Kumar Ram WP Social Stream wp-social-stream allows Stored XSS.This issue affects WP Social Stream: fr… |
CVE-2025-25073 | Medium | 5.9 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vasilis Triantafyllou Easy WP Tiles easy-wp-tiles allows… |
CVE-2025-25072 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in thunderbax WP Admin Custom Page wp-admin-custom-page allows Stored XSS.This issue affects WP Admin Custom Pa… |
CVE-2025-25071 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in topplugins Vignette Ads vignete-ads allows Stored XSS.This issue affects Vignette Ads: from n/a through <= 0… |
CVE-2025-0304 | High | 8.8 | 2025-02-07 | in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use afte… |
CVE-2025-0303 | High | 8.8 | 2025-02-07 | in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through buffer o… |
CVE-2025-0302 | Medium | 5.5 | 2025-02-07 | in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through integer overflow. |
CVE-2025-1077 | | 2025-02-07 | A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather). The… | |
CVE-2025-22880 | High | 7.8 | 2025-02-07 | Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target v… |
CVE-2025-23085 | Medium | 5.3 | 2025-02-07 | A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected… |
CVE-2025-1072 | Medium | 6.5 | 2025-02-07 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5… |
CVE-2025-22402 | Low | 2.6 | 2025-02-07 | Dell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnera… |
CVE-2025-1086 | Medium | 5.3 | 2025-02-07 | A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical. This vulnerability affects unknown code of the file /s… |
CVE-2025-1061 | Critical | 9.8 | 2025-02-07 | The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.16. This is due to insufficient… |
CVE-2025-1085 | Medium | 4.3 | 2025-02-07 | A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manip… |
CVE-2025-1084 | Medium | 4.3 | 2025-02-07 | A vulnerability, which was classified as problematic, has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this issue is some unknown functionalit… |
CVE-2025-0675 | High | 7.5 | 2025-02-07 | Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure. |
CVE-2025-0674 | Critical | 9.8 | 2025-02-07 | Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Att… |
CVE-2025-21408 | High | 8.8 | 2025-02-06 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2025-21404 | Medium | 4.3 | 2025-02-06 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-21342 | High | 8.8 | 2025-02-06 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2025-21283 | Medium | 6.5 | 2025-02-06 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2025-21279 | Medium | 6.5 | 2025-02-06 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2025-21267 | Medium | 4.4 | 2025-02-06 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-21253 | Medium | 5.3 | 2025-02-06 | Microsoft Edge for IOS and Android Spoofing Vulnerability |
CVE-2025-21177 | High | 8.7 | 2025-02-06 | Server-side request forgery (ssrf) in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network. |
CVE-2025-1083 | Low | 3.1 | 2025-02-06 | A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2025-1082 | Low | 3.5 | 2025-02-06 | A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected is an unknown function of the file /api/admin/question… |
CVE-2025-23094 | High | 7.3 | 2025-02-06 | The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, and V10 R1.42.6 and… |
CVE-2025-1081 | Low | 3.1 | 2025-02-06 | A vulnerability was found in Bharti Airtel Xstream Fiber up to 20250123. It has been rated as problematic. This issue affects some unknown processing of the co… |
CVE-2025-1004 | Medium | 5.3 | 2025-02-06 | Certain HP LaserJet Pro printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer via IPP (Internet Printing Pro… |
CVE-2025-0158 | Medium | 5.5 | 2025-02-06 | IBM EntireX 11.1 could allow a local user to cause a denial of service due to an unhandled error and fault isolation. |
CVE-2025-23093 | High | 8.8 | 2025-02-06 | The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authenticated attacker to… |
CVE-2025-22936 | Medium | 5.7 | 2025-02-06 | An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote attacker to obtain sensitive information vi… |
CVE-2025-24787 | High | 8.6 | 2025-02-06 | WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, whi… |
CVE-2025-24786 | Critical | 10.0 | 2025-02-06 | WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traver… |
CVE-2025-22992 | Critical | 9.8 | 2025-02-06 | A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms project >= 11.6.9. The vulnerability is caused by improper handling of us… |
CVE-2025-24981 | Critical | 9.3 | 2025-02-06 | MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from m… |
CVE-2025-23217 | | 2025-02-06 | mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmpro… | |
CVE-2025-22867 | High | 7.5 | 2025-02-06 | On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_pat… |