2025 CVEs (page 415)
Page 415 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24962 | High | 8.8 | 2025-02-03 | reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd parameters. This issue… |
CVE-2025-24961 | | 2025-02-03 | org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local fi… | |
CVE-2025-24960 | High | 8.7 | 2025-02-03 | Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(s). This can lead t… |
CVE-2025-24959 | | 2025-02-03 | zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into `process.en… | |
CVE-2025-24899 | High | 7.5 | 2025-02-03 | reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacker with any role** (… |
CVE-2025-24370 | | 2025-02-03 | Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution v… | |
CVE-2025-22918 | High | 7.5 | 2025-02-03 | Polycom RealPresence Group 500 <=20 has Insecure Permissions due to automatically loaded cookies. This allows for the use of administrator functions, resulting… |
CVE-2025-25181 | Medium | 5.8 | 2025-02-03 | A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the Pm… |
CVE-2025-25065 | Medium | 5.3 | 2025-02-03 | SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized re… |
CVE-2025-25064 | High | 8.8 | 2025-02-03 | SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient… |
CVE-2025-22978 | Critical | 9.8 | 2025-02-03 | eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module. |
CVE-2025-24898 | | 2025-02-03 | rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the… | |
CVE-2025-24781 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WPJobBoard allows Reflected XSS. This issue affe… |
CVE-2025-24707 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Re… |
CVE-2025-24697 | Medium | 6.5 | 2025-02-03 | Missing Authorization vulnerability in Realwebcare Image Gallery – Responsive Photo Gallery awesome-responsive-photo-gallery allows Exploiting Incorrectly Conf… |
CVE-2025-24684 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader media-downloader allows Ref… |
CVE-2025-24676 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in umangmetatagg Custom WP Store Locator custom-store-locato… |
CVE-2025-24661 | High | 8.8 | 2025-02-03 | Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This i… |
CVE-2025-24660 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership Custom Messages simple-membe… |
CVE-2025-24656 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Provisioning realtyna-provisioning allo… |
CVE-2025-24646 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc XML for Avito xml-for-avito allows Reflected XSS… |
CVE-2025-24643 | Medium | 6.5 | 2025-02-03 | Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-24642 | Medium | 6.5 | 2025-02-03 | Missing Authorization vulnerability in theme funda Setup Default Featured Image setup-default-feature-image allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-24639 | Medium | 6.5 | 2025-02-03 | Insertion of Sensitive Information Into Sent Data vulnerability in Greys Korea for WooCommerce korea-for-woocommerce allows Retrieve Embedded Sensitive Data.Th… |
CVE-2025-24631 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templat… |
CVE-2025-24630 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Sikshya LMS sikshya allows Reflected XSS.This… |
CVE-2025-24629 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpgear Import Excel to Gravity Forms gf-excel-import allo… |
CVE-2025-24620 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hkharpreetkumar1 AIO Shortcodes aio-shortcodes allows Sto… |
CVE-2025-24605 | Medium | 4.9 | 2025-02-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RealMag777 WOLF bulk-editor allows Path Traversal.This issue af… |
CVE-2025-24576 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Landing Page Cat landing-page-cat allows Refle… |
CVE-2025-24574 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev WooCommerce Receipt Uploader pe… |
CVE-2025-24569 | High | 7.5 | 2025-02-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder… |
CVE-2025-24559 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.Th… |
CVE-2025-24557 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware PlainInventory z-inventory-manager allows Refle… |
CVE-2025-24556 | High | 7.5 | 2025-02-03 | Insertion of Sensitive Information into Log File vulnerability in DualCube MooWoodle moowoodle allows Retrieve Embedded Sensitive Data.This issue affects MooWo… |
CVE-2025-24545 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK Forms Validation bsk-gravity-forms-custom-v… |
CVE-2025-24544 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashed-slug.net Bitcoin and Altcoin Wallets wallets allow… |
CVE-2025-24541 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dinamiko DK White Label dk-white-label allows Reflected X… |
CVE-2025-24536 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThriveDesk ThriveDesk thrivedesk allows Reflected XSS.Thi… |
CVE-2025-23984 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Refl… |
CVE-2025-23923 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wackey Lockets lockets allows Reflected XSS.This issue af… |
CVE-2025-23920 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sourcing Team ApplicantPro applicantpro allows Reflected… |
CVE-2025-23819 | High | 7.5 | 2025-02-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Marco Milesi WP Cloud cloud allows Absolute Path Traversal.This… |
CVE-2025-23799 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tubegtld .TUBE Video Curator tube-video-curator allows Re… |
CVE-2025-23755 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tosend.it PAFacile pafacile allows Reflected XSS.This iss… |
CVE-2025-23747 | Medium | 6.5 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitesh Awesome Timeline awesome-timeline allows Stored XS… |
CVE-2025-23685 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebTechGlobal RomanCart romancart-on-wordpress allows Ref… |
CVE-2025-23614 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in niksudan WordPress Additional Logins wp-additional-logins… |
CVE-2025-23599 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aarvansh Infotech eMarksheet emarksheet allows Reflected… |
CVE-2025-23594 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uzzal Mondal Google Map With Fancybox location-piker allo… |
CVE-2025-23593 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kvvaradha EmailPress emailpress allows Reflected XSS.This… |
CVE-2025-23591 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blulogistics1 blu Logistics blu-logistics allows Reflecte… |
CVE-2025-23590 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dezdy.com Dezdy dezdy-mcommerce allows Reflected XSS.This… |
CVE-2025-23588 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in baonguyenyam WOW Best CSS Compiler best-css-compiler allo… |
CVE-2025-23582 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haider Ali Bulk Categories Assign bulk-categories-assign… |
CVE-2025-23581 | Medium | 6.5 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Demo User DZS demo-user-dzs-showcase-yo… |
CVE-2025-23561 | Medium | 6.5 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robertkay MLL Audio Player MP3 Ajax music-let-loose-mp3-a… |
CVE-2025-23527 | Medium | 6.5 | 2025-02-03 | Missing Authorization vulnerability in hemnathmouli WC Wallet wc-wallet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WC W… |
CVE-2025-23491 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikash Srivastava VSTEMPLATE Creator vstemplate-creator a… |
CVE-2025-22775 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in idiatech Catalog Importer, Scraper & Crawler intelligent-… |
CVE-2025-22704 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abinav Thakuri WordPress Signature wordpress-signature al… |
CVE-2025-22703 | High | 7.1 | 2025-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in manuelvicedo Forge – Front-End Page Builder forge allows Stored XSS.This issue affects Forge – Front-End Pag… |
CVE-2025-22701 | Medium | 5.4 | 2025-02-03 | Server-Side Request Forgery (SSRF) vulnerability in shinetheme Traveler Layout Essential For Elementor traveler-layout-essential-for-elementor.This issue affec… |
CVE-2025-22695 | Medium | 4.3 | 2025-02-03 | Authorization Bypass Through User-Controlled Key vulnerability in NirWp Team Nirweb support nirweb-support.This issue affects Nirweb support: from n/a through… |
CVE-2025-22694 | Medium | 4.3 | 2025-02-03 | Missing Authorization vulnerability in Dotstore Hide Shipping Method For WooCommerce hide-shipping-method-for-woocommerce.This issue affects Hide Shipping Meth… |
CVE-2025-22693 | High | 7.6 | 2025-02-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Galle… |
CVE-2025-22691 | High | 7.6 | 2025-02-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows SQL Injection.This i… |
CVE-2025-22690 | High | 7.1 | 2025-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in DigiTimber DigiTimber cPanel Integration digitimber-cpanel-integration allows Stored XSS.This issue affects… |
CVE-2025-22688 | High | 7.1 | 2025-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Ederson Peka Unlimited Page Sidebars unlimited-page-sidebars allows Stored XSS.This issue affects Unlimited… |
CVE-2025-22686 | Medium | 5.3 | 2025-02-03 | Missing Authorization vulnerability in WesternDeal CF7 Google Sheets Connector cf7-google-sheets-connector allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-22685 | High | 7.1 | 2025-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in CheGevara29 Tags to Keywords tags-to-meta-keywords allows Stored XSS.This issue affects Tags to Keywords: fr… |
CVE-2025-22684 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hakan Ozevin WP BASE Booking wp-base-booking-of-appointme… |
CVE-2025-22683 | Medium | 6.5 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper NotificationX notificationx allows Stored XSS… |
CVE-2025-22682 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting… |
CVE-2025-22681 | Medium | 4.3 | 2025-02-03 | Missing Authorization vulnerability in Xfinitysoft Content Cloner super-seo-content-cloner allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-22679 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows Re… |
CVE-2025-22677 | Medium | 4.8 | 2025-02-03 | Missing Authorization vulnerability in UIUX Lab Uix Shortcodes uix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-22292 | Medium | 6.5 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Felipe Peixoto Powerful Auto Chat powers-triggers-of-woo-… |
CVE-2025-22260 | Medium | 4.3 | 2025-02-03 | Missing Authorization vulnerability in Marcus (aka @msykes) Meta Tag Manager meta-tag-manager.This issue affects Meta Tag Manager: from n/a through <= 3.1. |
CVE-2025-0015 | High | 7.8 | 2025-02-03 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
CVE-2025-25066 | High | 8.1 | 2025-02-03 | nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c. |
CVE-2025-25063 | Medium | 4.4 | 2025-02-03 | An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they… |
CVE-2025-25062 | Medium | 4.4 | 2025-02-03 | An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor… |
CVE-2025-20643 | Low | 3.9 | 2025-02-03 | In DA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure, if an attacker has physical acces… |
CVE-2025-20642 | Medium | 6.6 | 2025-02-03 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-20641 | Medium | 6.6 | 2025-02-03 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-20640 | Medium | 4.3 | 2025-02-03 | In DA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure, if an attacker has physical acces… |
CVE-2025-20639 | Medium | 6.6 | 2025-02-03 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-20638 | Medium | 4.3 | 2025-02-03 | In DA, there is a possible read of uninitialized heap data due to uninitialized data. This could lead to local information disclosure, if an attacker has physi… |
CVE-2025-20637 | High | 7.5 | 2025-02-03 | In network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional execution privilege… |
CVE-2025-20636 | Medium | 6.7 | 2025-02-03 | In secmem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alr… |
CVE-2025-20635 | Medium | 6.6 | 2025-02-03 | In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical… |
CVE-2025-20634 | Critical | 9.8 | 2025-02-03 | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution, if a UE has connected to a rogue bas… |
CVE-2025-20633 | High | 8.8 | 2025-02-03 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with… |
CVE-2025-20632 | High | 7.8 | 2025-02-03 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additiona… |
CVE-2025-20631 | High | 7.8 | 2025-02-03 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additiona… |
CVE-2025-0974 | Medium | 5.0 | 2025-02-03 | A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argu… |
CVE-2025-0973 | Medium | 5.4 | 2025-02-03 | A vulnerability classified as critical was found in CmsEasy 7.7.7.9. This vulnerability affects the function backAll_action in the library lib/admin/database_a… |
CVE-2025-0972 | Low | 3.5 | 2025-02-03 | A vulnerability classified as problematic has been found in Zenvia Movidesk up to 25.01.22. This affects an unknown part of the component New Ticket Handler. T… |
CVE-2025-0971 | Low | 3.5 | 2025-02-03 | A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been rated as problematic. Affected by this issue is some unknown functionality of the file… |