2025 CVEs (page 416)
Page 416 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22675 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Alert Box Block – Display notice/alerts in the f… |
CVE-2025-22674 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Product Blocks for WooCommerce product-blocks… |
CVE-2025-22664 | Medium | 5.9 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This… |
CVE-2025-22662 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-… |
CVE-2025-22653 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tuyennv Music Press Pro music-press-pro allows Stored XSS… |
CVE-2025-22643 | Medium | 4.3 | 2025-02-04 | Missing Authorization vulnerability in famethemes OnePress onepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-22642 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtowebsites Dynamic Conditions dynamicconditions allows S… |
CVE-2025-22641 | Medium | 5.9 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prem Tiwari FM Notification Bar fm-notification-bar allow… |
CVE-2025-22206 | Medium | 4.7 | 2025-02-04 | A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL com… |
CVE-2025-0825 | Medium | 5.3 | 2025-02-04 | cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploi… |
CVE-2025-1020 | Critical | 9.8 | 2025-02-04 | Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-1019 | Medium | 4.3 | 2025-02-04 | The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack… |
CVE-2025-1018 | Medium | 5.3 | 2025-02-04 | The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential sp… |
CVE-2025-1017 | Critical | 9.8 | 2025-02-04 | Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption a… |
CVE-2025-1016 | Critical | 9.8 | 2025-02-04 | Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bug… |
CVE-2025-1015 | Medium | 5.4 | 2025-02-04 | The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malici… |
CVE-2025-1014 | High | 8.8 | 2025-02-04 | Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Fir… |
CVE-2025-1013 | Medium | 6.5 | 2025-02-04 | A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vu… |
CVE-2025-1012 | High | 7.5 | 2025-02-04 | A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7… |
CVE-2025-1011 | High | 8.8 | 2025-02-04 | A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vul… |
CVE-2025-1010 | High | 8.8 | 2025-02-04 | An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefo… |
CVE-2025-1009 | Critical | 9.8 | 2025-02-04 | An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135… |
CVE-2025-0510 | Medium | 6.5 | 2025-02-04 | Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vu… |
CVE-2025-24860 | Medium | 5.4 | 2025-02-04 | Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using Cassand… |
CVE-2025-0890 | Critical | 9.8 | 2025-02-04 | **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_201… |
CVE-2025-23015 | High | 8.8 | 2025-02-04 | Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser w… |
CVE-2025-22205 | High | 7.5 | 2025-02-04 | Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x. |
CVE-2025-22204 | Critical | 9.8 | 2025-02-04 | Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability. |
CVE-2025-20907 | Medium | 6.0 | 2025-02-04 | Improper privilege management in Samsung Find prior to SMR Feb-2025 Release 1 allows local privileged attackers to disable Samsung Find. |
CVE-2025-20906 | Medium | 5.5 | 2025-02-04 | Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB. |
CVE-2025-20905 | Medium | 6.3 | 2025-02-04 | Out-of-bounds read and write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to read and write out-of-bounds memory. |
CVE-2025-20904 | Medium | 6.3 | 2025-02-04 | Out-of-bounds write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to cause memory corruption. |
CVE-2025-20902 | Medium | 5.1 | 2025-02-04 | Improper access control in Media Controller prior to version 1.0.24.5282 allows local attacker to launch activities in MediaController's privilege. |
CVE-2025-20901 | Medium | 4.4 | 2025-02-04 | Out-of-bounds read in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to read out-of-bounds memory. |
CVE-2025-20900 | Medium | 6.3 | 2025-02-04 | Out-of-bounds write in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-20899 | Medium | 4.0 | 2025-02-04 | Improper access control in PushNotification prior to version 13.0.00.15 in Android 12, 14.0.00.7 in Android 13, and 15.1.00.5 in Android 14 allows local attack… |
CVE-2025-20898 | Medium | 4.6 | 2025-02-04 | Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20897 | Medium | 6.8 | 2025-02-04 | Improper access control in Secure Folder prior to version 1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12 allows local attacker to… |
CVE-2025-20896 | Medium | 4.0 | 2025-02-04 | Use of implicit intent for sensitive communication in EasySetup prior to version 11.1.18 allows local attackers to access sensitive information. |
CVE-2025-20895 | Low | 3.2 | 2025-02-04 | Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary applications to bypass r… |
CVE-2025-20894 | Medium | 4.6 | 2025-02-04 | Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20893 | Medium | 5.1 | 2025-02-04 | Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the configuration of notifications. |
CVE-2025-20892 | Medium | 5.9 | 2025-02-04 | Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. User interaction is… |
CVE-2025-20891 | Medium | 5.3 | 2025-02-04 | Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary… |
CVE-2025-20890 | High | 7.0 | 2025-02-04 | Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. U… |
CVE-2025-20889 | Medium | 5.3 | 2025-02-04 | Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory… |
CVE-2025-20888 | High | 7.0 | 2025-02-04 | Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code wit… |
CVE-2025-20887 | Medium | 5.3 | 2025-02-04 | Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User inte… |
CVE-2025-20886 | Medium | 4.1 | 2025-02-04 | Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key. |
CVE-2025-20885 | Medium | 6.4 | 2025-02-04 | Out-of-bounds write in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to cause memory corruption. |
CVE-2025-20884 | Medium | 4.6 | 2025-02-04 | Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20883 | Medium | 4.6 | 2025-02-04 | Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20882 | High | 7.0 | 2025-02-04 | Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary co… |
CVE-2025-20881 | High | 7.0 | 2025-02-04 | Out-of-bounds write in accessing buffer storing the decoded video frames in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbi… |
CVE-2025-0466 | Medium | 5.3 | 2025-02-04 | The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and s… |
CVE-2025-0368 | Medium | 6.1 | 2025-02-04 | The Banner Garden Plugin for WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflec… |
CVE-2025-24982 | Medium | 4.3 | 2025-02-04 | Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log d… |
CVE-2025-22475 | Low | 3.7 | 2025-02-04 | Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primitive with a Risky Implementation vulnerab… |
CVE-2025-1003 | | 2025-02-04 | A potential vulnerability has been identified in HP Anyware Agent for Linux which might allow for authentication bypass which may result in escalation of privi… | |
CVE-2025-0148 | Low | 2.6 | 2025-02-03 | Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of informati… |
CVE-2025-24958 | High | 8.8 | 2025-02-03 | WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` endpoint. This vuln… |
CVE-2025-24957 | Critical | 9.8 | 2025-02-03 | WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_socio.php` endpoint. T… |
CVE-2025-24906 | Critical | 9.8 | 2025-02-03 | WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobranca.php` endpoint… |
CVE-2025-24905 | Critical | 9.8 | 2025-02-03 | WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarras_cobranca.php` endp… |
CVE-2025-24902 | High | 8.8 | 2025-02-03 | WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.php` endpoint. This vu… |
CVE-2025-24901 | High | 8.8 | 2025-02-03 | WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_permissao.php` endpoint. Th… |
CVE-2025-24371 | | 2025-02-03 | CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `l… | |
CVE-2025-24029 | Medium | 5.3 | 2025-02-03 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the da… |
CVE-2025-23210 | | 2025-02-03 | phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site… | |
CVE-2025-22129 | Medium | 4.3 | 2025-02-03 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an unauthorized user might get access to… |
CVE-2025-24962 | High | 8.8 | 2025-02-03 | reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd parameters. This issue… |
CVE-2025-24961 | | 2025-02-03 | org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local fi… | |
CVE-2025-24960 | High | 8.7 | 2025-02-03 | Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(s). This can lead t… |
CVE-2025-24959 | | 2025-02-03 | zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into `process.en… | |
CVE-2025-24899 | High | 7.5 | 2025-02-03 | reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacker with any role** (… |
CVE-2025-24370 | | 2025-02-03 | Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution v… | |
CVE-2025-22918 | High | 7.5 | 2025-02-03 | Polycom RealPresence Group 500 <=20 has Insecure Permissions due to automatically loaded cookies. This allows for the use of administrator functions, resulting… |
CVE-2025-25181 | Medium | 5.8 | 2025-02-03 | A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the Pm… |
CVE-2025-25065 | Medium | 5.3 | 2025-02-03 | SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized re… |
CVE-2025-25064 | High | 8.8 | 2025-02-03 | SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient… |
CVE-2025-22978 | Critical | 9.8 | 2025-02-03 | eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module. |
CVE-2025-24898 | | 2025-02-03 | rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the… | |
CVE-2025-24781 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WPJobBoard allows Reflected XSS. This issue affe… |
CVE-2025-24707 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Re… |
CVE-2025-24697 | Medium | 6.5 | 2025-02-03 | Missing Authorization vulnerability in Realwebcare Image Gallery – Responsive Photo Gallery awesome-responsive-photo-gallery allows Exploiting Incorrectly Conf… |
CVE-2025-24684 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader media-downloader allows Ref… |
CVE-2025-24676 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in umangmetatagg Custom WP Store Locator custom-store-locato… |
CVE-2025-24661 | High | 8.8 | 2025-02-03 | Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This i… |
CVE-2025-24660 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership Custom Messages simple-membe… |
CVE-2025-24656 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Provisioning realtyna-provisioning allo… |
CVE-2025-24646 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc XML for Avito xml-for-avito allows Reflected XSS… |
CVE-2025-24643 | Medium | 6.5 | 2025-02-03 | Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-24642 | Medium | 6.5 | 2025-02-03 | Missing Authorization vulnerability in theme funda Setup Default Featured Image setup-default-feature-image allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-24639 | Medium | 6.5 | 2025-02-03 | Insertion of Sensitive Information Into Sent Data vulnerability in Greys Korea for WooCommerce korea-for-woocommerce allows Retrieve Embedded Sensitive Data.Th… |
CVE-2025-24631 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templat… |
CVE-2025-24630 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Sikshya LMS sikshya allows Reflected XSS.This… |
CVE-2025-24629 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpgear Import Excel to Gravity Forms gf-excel-import allo… |
CVE-2025-24620 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hkharpreetkumar1 AIO Shortcodes aio-shortcodes allows Sto… |
CVE-2025-24605 | Medium | 4.9 | 2025-02-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RealMag777 WOLF bulk-editor allows Path Traversal.This issue af… |
CVE-2025-24576 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Landing Page Cat landing-page-cat allows Refle… |