2025 CVEs (page 416)
Page 416 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0970 | Medium | 4.3 | 2025-02-02 | A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-0967 | Medium | 6.3 | 2025-02-02 | A vulnerability was found in code-projects Chat System 1.0 and classified as critical. This issue affects some unknown processing of the file /user/add_chatroo… |
CVE-2025-0961 | Low | 3.5 | 2025-02-01 | A vulnerability, which was classified as problematic, has been found in code-projects Job Recruitment 1.0. Affected by this issue is some unknown functionality… |
CVE-2025-0950 | Medium | 6.3 | 2025-02-01 | A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. This issue affects some unknown processing of the file st… |
CVE-2025-0949 | Medium | 6.3 | 2025-02-01 | A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-0948 | Medium | 6.3 | 2025-02-01 | A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affects an unknown part of the file incview… |
CVE-2025-0947 | Medium | 6.3 | 2025-02-01 | A vulnerability, which was classified as critical, has been found in itsourcecode Tailoring Management System 1.0. Affected by this issue is some unknown funct… |
CVE-2025-0946 | Medium | 6.3 | 2025-02-01 | A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-0945 | Medium | 6.3 | 2025-02-01 | A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file typedelete.p… |
CVE-2025-0944 | Medium | 6.3 | 2025-02-01 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fil… |
CVE-2025-0943 | Medium | 6.3 | 2025-02-01 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2025-23091 | Medium | 5.9 | 2025-02-01 | An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM… |
CVE-2025-0939 | Medium | 6.3 | 2025-02-01 | The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versi… |
CVE-2025-0366 | High | 8.8 | 2025-02-01 | The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, 4.8.7 via the get_… |
CVE-2025-0365 | Medium | 6.5 | 2025-02-01 | The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.8.7 via the inline SVG feature. This makes… |
CVE-2025-24891 | Critical | 9.6 | 2025-01-31 | Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrar… |
CVE-2025-0934 | Medium | 6.3 | 2025-01-31 | A vulnerability was found in code-projects Job Recruitment 1.0. It has been classified as problematic. This affects an unknown part of the file /parse/_call_jo… |
CVE-2025-0938 | | 2025-01-31 | The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to… | |
CVE-2025-23001 | Medium | 6.1 | 2025-01-31 | A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can ma… |
CVE-2025-22957 | Critical | 9.8 | 2025-01-31 | A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without any authentication. This vulnerability co… |
CVE-2025-23215 | | 2025-01-31 | PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Mave… | |
CVE-2025-22994 | Medium | 6.1 | 2025-01-31 | O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings. |
CVE-2025-0930 | Medium | 6.1 | 2025-01-31 | Reflected Cross-Site Scripting (XSS) in TeamCal Neo, version 3.8.2. This allows an attacker to execute malicious JavaScript code, after injecting code via the… |
CVE-2025-0929 | Critical | 9.8 | 2025-01-31 | SQL injection vulnerability in TeamCal Neo, version 3.8.2. This could allow an attacker to retrieve, update and delete all database information by injecting a… |
CVE-2025-24831 | Medium | 6.6 | 2025-01-31 | Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before b… |
CVE-2025-24830 | Medium | 6.3 | 2025-01-31 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39… |
CVE-2025-24829 | Medium | 6.3 | 2025-01-31 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39… |
CVE-2025-24828 | Medium | 6.3 | 2025-01-31 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39… |
CVE-2025-24827 | Medium | 6.3 | 2025-01-31 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39… |
CVE-2025-21683 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sk_select_reuseport() memory leak As pointed out in the original comment, lo… |
CVE-2025-21682 | High | 7.3 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: always recalculate features after XDP clearing, fix null-deref Recalculate fea… |
CVE-2025-21681 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix lockup on tx to unregistering netdev with carrier Commit in a fixes tag… |
CVE-2025-21680 | High | 7.8 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: pktgen: Avoid out-of-bounds access in get_imix_entries Passing a sufficient amount of imi… |
CVE-2025-21679 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: btrfs: add the missing error handling inside get_canonical_dev_path Inside function get_c… |
CVE-2025-21678 | High | 7.8 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: gtp: Destroy device along with udp socket's netns dismantle. gtp_newlink() links the devi… |
CVE-2025-21677 | High | 7.8 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: pfcp: Destroy device along with udp socket's netns dismantle. pfcp_newlink() links the de… |
CVE-2025-21676 | High | 7.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: net: fec: handle page_pool_dev_alloc_pages error The fec_enet_update_cbd function calls p… |
CVE-2025-21675 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clear port select structure when fail to create Clear the port select structure… |
CVE-2025-21674 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel Attempt to enable… |
CVE-2025-21673 | Critical | 9.8 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double free of TCP_Server_Info::hostname When shutting down the server i… |
CVE-2025-21672 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix merge preference rule failure condition syzbot reported a lock held when returni… |
CVE-2025-21671 | High | 7.8 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early, it frees allocated… |
CVE-2025-21670 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: vsock/bpf: return early if transport is not assigned Some of the core functions can only… |
CVE-2025-21669 | High | 7.8 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: discard packets if the transport changes If the socket has been de-assigned… |
CVE-2025-21668 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8mp-blk-ctrl: add missing loop break condition Currently imx8mp_blk_ctrl_rem… |
CVE-2025-21667 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: iomap: avoid avoid truncating 64-bit offset to 32 bits on 32-bit kernels, iomap_write_del… |
CVE-2025-21666 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] Recent reports have shown ho… |
CVE-2025-21665 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: filemap: avoid truncating 64-bit offset to 32 bits On 32-bit kernels, folio_seek_hole_dat… |
CVE-2025-24749 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Overt Software Solutions LTD EZPZ SAML SP Single Sign On (SSO) allows Cross Site Request Forgery. This issue… |
CVE-2025-24718 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in activity-log.com WP Sessions Time Monitoring Full Automat… |
CVE-2025-24710 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcel Pol Gwolle Guestbook gwolle-gb allows Reflected XS… |
CVE-2025-24686 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic custom-registration-form-buil… |
CVE-2025-24635 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in integrationdevpaytm Paytm Payment Donation paytm-donation… |
CVE-2025-24632 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advan… |
CVE-2025-24609 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PORTONE PORTONE 우커머스 결제 iamport-for-woocommerce allows Re… |
CVE-2025-24608 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Mail Queue gd-mail-queue allows Reflect… |
CVE-2025-24597 | Medium | 6.5 | 2025-01-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-… |
CVE-2025-24563 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeglow Cleanup – Directory Listing & Classifieds WordP… |
CVE-2025-24560 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking a… |
CVE-2025-24551 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oneteamsoftware Radio Buttons and Swatches for WooCommerc… |
CVE-2025-24549 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Mahbubur Rahman Post Meta post-meta allows Reflected XSS.This issue affects Post Meta: from n/a through <= 1… |
CVE-2025-24535 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Donation skt-donation allows Reflected X… |
CVE-2025-24534 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dinamiko DPortfolio dportfolio allows Reflected XSS.This… |
CVE-2025-23990 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in jablonczay Scroll Styler scroll-styler.This issue affects Scroll Styler: from n/a through <= 1.1. |
CVE-2025-23989 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Internal Link Builder internal-link-builder allows Cross Site Request Forgery.This issue a… |
CVE-2025-23987 | Medium | 6.5 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codegearthemes Designer designer allows DOM-Based XSS.Thi… |
CVE-2025-23985 | Medium | 5.4 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Cross Site Request Forgery.This issue affects Dynamic U… |
CVE-2025-23980 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in James Andrews Full Circle full-circle allows Stored XSS.This issue affects Full Circle: from n/a through <=… |
CVE-2025-23978 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Ninos FlashCounter flashcounter allows Stored XSS.This issue affects FlashCounter: from n/a through <= 1.1.8. |
CVE-2025-23977 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Bhaskar Dhote Post Carousel Slider post-carousel-slider allows Stored XSS.This issue affects Post Carousel S… |
CVE-2025-23976 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in operationsissuu Issuu Panel issuu-panel allows Stored XSS.This issue affects Issuu Panel: from n/a through <… |
CVE-2025-23759 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gavin Affiliate Tools Việt Nam affiliate-tools-viet-nam a… |
CVE-2025-23671 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sav WP OpenSearch wp-opensearch allows Stored XSS.This is… |
CVE-2025-23596 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grafeon Notifikácie.sk notifikacie-sk allows Reflected XS… |
CVE-2025-22757 | Medium | 6.5 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Sto… |
CVE-2025-22720 | Medium | 5.8 | 2025-01-31 | Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Confi… |
CVE-2025-22564 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faaiq Pretty Url pretty-url allows Reflected XSS.This iss… |
CVE-2025-22341 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in parswp Hide Login+ hide-login allows Reflected XSS.This i… |
CVE-2025-22332 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanaver CloudFlare(R) Cache Purge cloudflare-cache-purge… |
CVE-2025-22265 | Medium | 6.5 | 2025-01-31 | Missing Authorization vulnerability in mgplugin EMI Calculator emi-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-22216 | Medium | 5.4 | 2025-01-31 | A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP… |
CVE-2025-0809 | High | 7.2 | 2025-01-31 | The Link Fixer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via broken links in all versions up to, and including, 3.4 due to insufficient… |
CVE-2025-0507 | Medium | 6.4 | 2025-01-31 | The Ticketmeo – Sell Tickets – Event Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up… |
CVE-2025-0493 | Critical | 9.8 | 2025-01-31 | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclusion in all version… |
CVE-2025-0470 | Medium | 6.1 | 2025-01-31 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title para… |
CVE-2025-24336 | Low | 3.3 | 2025-01-31 | SXF Common Library handles input data improperly. If a product using the library reads a crafted file, the product may be crashed. |
CVE-2025-24886 | High | 7.7 | 2025-01-30 | pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specifie… |
CVE-2025-24885 | High | 7.6 | 2025-01-30 | pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control on rendering custo… |
CVE-2025-0882 | Medium | 6.3 | 2025-01-30 | A vulnerability was found in code-projects Chat System up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-0881 | Medium | 6.3 | 2025-01-30 | A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/adm… |
CVE-2025-0880 | Medium | 6.3 | 2025-01-30 | A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/a… |
CVE-2025-0574 | High | 7.5 | 2025-01-30 | Sante PACS Server URL path Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service conditio… |
CVE-2025-0573 | Medium | 5.3 | 2025-01-30 | Sante PACS Server DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files… |
CVE-2025-0572 | Medium | 4.3 | 2025-01-30 | Sante PACS Server Web Portal DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbi… |
CVE-2025-0571 | Medium | 6.5 | 2025-01-30 | Sante PACS Server Web Portal DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-… |
CVE-2025-0570 | Medium | 6.5 | 2025-01-30 | Sante PACS Server Web Portal DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-… |
CVE-2025-0569 | High | 7.5 | 2025-01-30 | Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service… |
CVE-2025-0568 | High | 7.5 | 2025-01-30 | Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service… |
CVE-2025-24802 | High | 8.6 | 2025-01-30 | Plonky2 is a SNARK implementation based on techniques from PLONK and FRI. Lookup tables, whose length is not divisible by 26 = floor(num_routed_wires / 3) alwa… |
CVE-2025-0147 | High | 8.8 | 2025-01-30 | Type confusion in the Zoom Workplace App for Linux before 6.2.10 may allow an authorized user to conduct an escalation of privilege via network access. |