2025 CVEs (page 417)
Page 417 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24574 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev WooCommerce Receipt Uploader pe… |
CVE-2025-24569 | High | 7.5 | 2025-02-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder… |
CVE-2025-24559 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.Th… |
CVE-2025-24557 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware PlainInventory z-inventory-manager allows Refle… |
CVE-2025-24556 | High | 7.5 | 2025-02-03 | Insertion of Sensitive Information into Log File vulnerability in DualCube MooWoodle moowoodle allows Retrieve Embedded Sensitive Data.This issue affects MooWo… |
CVE-2025-24545 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK Forms Validation bsk-gravity-forms-custom-v… |
CVE-2025-24544 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashed-slug.net Bitcoin and Altcoin Wallets wallets allow… |
CVE-2025-24541 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dinamiko DK White Label dk-white-label allows Reflected X… |
CVE-2025-24536 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThriveDesk ThriveDesk thrivedesk allows Reflected XSS.Thi… |
CVE-2025-23984 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Refl… |
CVE-2025-23923 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wackey Lockets lockets allows Reflected XSS.This issue af… |
CVE-2025-23920 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sourcing Team ApplicantPro applicantpro allows Reflected… |
CVE-2025-23819 | High | 7.5 | 2025-02-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Marco Milesi WP Cloud cloud allows Absolute Path Traversal.This… |
CVE-2025-23799 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tubegtld .TUBE Video Curator tube-video-curator allows Re… |
CVE-2025-23755 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tosend.it PAFacile pafacile allows Reflected XSS.This iss… |
CVE-2025-23747 | Medium | 6.5 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitesh Awesome Timeline awesome-timeline allows Stored XS… |
CVE-2025-23685 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebTechGlobal RomanCart romancart-on-wordpress allows Ref… |
CVE-2025-23614 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in niksudan WordPress Additional Logins wp-additional-logins… |
CVE-2025-23599 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aarvansh Infotech eMarksheet emarksheet allows Reflected… |
CVE-2025-23594 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uzzal Mondal Google Map With Fancybox location-piker allo… |
CVE-2025-23593 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kvvaradha EmailPress emailpress allows Reflected XSS.This… |
CVE-2025-23591 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blulogistics1 blu Logistics blu-logistics allows Reflecte… |
CVE-2025-23590 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dezdy.com Dezdy dezdy-mcommerce allows Reflected XSS.This… |
CVE-2025-23588 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in baonguyenyam WOW Best CSS Compiler best-css-compiler allo… |
CVE-2025-23582 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haider Ali Bulk Categories Assign bulk-categories-assign… |
CVE-2025-23581 | Medium | 6.5 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Demo User DZS demo-user-dzs-showcase-yo… |
CVE-2025-23561 | Medium | 6.5 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robertkay MLL Audio Player MP3 Ajax music-let-loose-mp3-a… |
CVE-2025-23527 | Medium | 6.5 | 2025-02-03 | Missing Authorization vulnerability in hemnathmouli WC Wallet wc-wallet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WC W… |
CVE-2025-23491 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikash Srivastava VSTEMPLATE Creator vstemplate-creator a… |
CVE-2025-22775 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in idiatech Catalog Importer, Scraper & Crawler intelligent-… |
CVE-2025-22704 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abinav Thakuri WordPress Signature wordpress-signature al… |
CVE-2025-22703 | High | 7.1 | 2025-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in manuelvicedo Forge – Front-End Page Builder forge allows Stored XSS.This issue affects Forge – Front-End Pag… |
CVE-2025-22701 | Medium | 5.4 | 2025-02-03 | Server-Side Request Forgery (SSRF) vulnerability in shinetheme Traveler Layout Essential For Elementor traveler-layout-essential-for-elementor.This issue affec… |
CVE-2025-22695 | Medium | 4.3 | 2025-02-03 | Authorization Bypass Through User-Controlled Key vulnerability in NirWp Team Nirweb support nirweb-support.This issue affects Nirweb support: from n/a through… |
CVE-2025-22694 | Medium | 4.3 | 2025-02-03 | Missing Authorization vulnerability in Dotstore Hide Shipping Method For WooCommerce hide-shipping-method-for-woocommerce.This issue affects Hide Shipping Meth… |
CVE-2025-22693 | High | 7.6 | 2025-02-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Galle… |
CVE-2025-22691 | High | 7.6 | 2025-02-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows SQL Injection.This i… |
CVE-2025-22690 | High | 7.1 | 2025-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in DigiTimber DigiTimber cPanel Integration digitimber-cpanel-integration allows Stored XSS.This issue affects… |
CVE-2025-22688 | High | 7.1 | 2025-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Ederson Peka Unlimited Page Sidebars unlimited-page-sidebars allows Stored XSS.This issue affects Unlimited… |
CVE-2025-22686 | Medium | 5.3 | 2025-02-03 | Missing Authorization vulnerability in WesternDeal CF7 Google Sheets Connector cf7-google-sheets-connector allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-22685 | High | 7.1 | 2025-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in CheGevara29 Tags to Keywords tags-to-meta-keywords allows Stored XSS.This issue affects Tags to Keywords: fr… |
CVE-2025-22684 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hakan Ozevin WP BASE Booking wp-base-booking-of-appointme… |
CVE-2025-22683 | Medium | 6.5 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper NotificationX notificationx allows Stored XSS… |
CVE-2025-22682 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting… |
CVE-2025-22681 | Medium | 4.3 | 2025-02-03 | Missing Authorization vulnerability in Xfinitysoft Content Cloner super-seo-content-cloner allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-22679 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows Re… |
CVE-2025-22677 | Medium | 4.8 | 2025-02-03 | Missing Authorization vulnerability in UIUX Lab Uix Shortcodes uix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-22292 | Medium | 6.5 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Felipe Peixoto Powerful Auto Chat powers-triggers-of-woo-… |
CVE-2025-22260 | Medium | 4.3 | 2025-02-03 | Missing Authorization vulnerability in Marcus (aka @msykes) Meta Tag Manager meta-tag-manager.This issue affects Meta Tag Manager: from n/a through <= 3.1. |
CVE-2025-0015 | High | 7.8 | 2025-02-03 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
CVE-2025-25066 | High | 8.1 | 2025-02-03 | nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c. |
CVE-2025-25063 | Medium | 4.4 | 2025-02-03 | An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they… |
CVE-2025-25062 | Medium | 4.4 | 2025-02-03 | An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor… |
CVE-2025-20643 | Low | 3.9 | 2025-02-03 | In DA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure, if an attacker has physical acces… |
CVE-2025-20642 | Medium | 6.6 | 2025-02-03 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-20641 | Medium | 6.6 | 2025-02-03 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-20640 | Medium | 4.3 | 2025-02-03 | In DA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure, if an attacker has physical acces… |
CVE-2025-20639 | Medium | 6.6 | 2025-02-03 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-20638 | Medium | 4.3 | 2025-02-03 | In DA, there is a possible read of uninitialized heap data due to uninitialized data. This could lead to local information disclosure, if an attacker has physi… |
CVE-2025-20637 | High | 7.5 | 2025-02-03 | In network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional execution privilege… |
CVE-2025-20636 | Medium | 6.7 | 2025-02-03 | In secmem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alr… |
CVE-2025-20635 | Medium | 6.6 | 2025-02-03 | In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical… |
CVE-2025-20634 | Critical | 9.8 | 2025-02-03 | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution, if a UE has connected to a rogue bas… |
CVE-2025-20633 | High | 8.8 | 2025-02-03 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with… |
CVE-2025-20632 | High | 7.8 | 2025-02-03 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additiona… |
CVE-2025-20631 | High | 7.8 | 2025-02-03 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additiona… |
CVE-2025-0974 | Medium | 5.0 | 2025-02-03 | A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argu… |
CVE-2025-0973 | Medium | 5.4 | 2025-02-03 | A vulnerability classified as critical was found in CmsEasy 7.7.7.9. This vulnerability affects the function backAll_action in the library lib/admin/database_a… |
CVE-2025-0972 | Low | 3.5 | 2025-02-03 | A vulnerability classified as problematic has been found in Zenvia Movidesk up to 25.01.22. This affects an unknown part of the component New Ticket Handler. T… |
CVE-2025-0971 | Low | 3.5 | 2025-02-03 | A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been rated as problematic. Affected by this issue is some unknown functionality of the file… |
CVE-2025-0970 | Medium | 4.3 | 2025-02-02 | A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-0967 | Medium | 6.3 | 2025-02-02 | A vulnerability was found in code-projects Chat System 1.0 and classified as critical. This issue affects some unknown processing of the file /user/add_chatroo… |
CVE-2025-0961 | Low | 3.5 | 2025-02-01 | A vulnerability, which was classified as problematic, has been found in code-projects Job Recruitment 1.0. Affected by this issue is some unknown functionality… |
CVE-2025-0950 | Medium | 6.3 | 2025-02-01 | A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. This issue affects some unknown processing of the file st… |
CVE-2025-0949 | Medium | 6.3 | 2025-02-01 | A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-0948 | Medium | 6.3 | 2025-02-01 | A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affects an unknown part of the file incview… |
CVE-2025-0947 | Medium | 6.3 | 2025-02-01 | A vulnerability, which was classified as critical, has been found in itsourcecode Tailoring Management System 1.0. Affected by this issue is some unknown funct… |
CVE-2025-0946 | Medium | 6.3 | 2025-02-01 | A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-0945 | Medium | 6.3 | 2025-02-01 | A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file typedelete.p… |
CVE-2025-0944 | Medium | 6.3 | 2025-02-01 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fil… |
CVE-2025-0943 | Medium | 6.3 | 2025-02-01 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2025-23091 | Medium | 5.9 | 2025-02-01 | An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM… |
CVE-2025-0939 | Medium | 6.3 | 2025-02-01 | The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versi… |
CVE-2025-0366 | High | 8.8 | 2025-02-01 | The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, 4.8.7 via the get_… |
CVE-2025-0365 | Medium | 6.5 | 2025-02-01 | The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.8.7 via the inline SVG feature. This makes… |
CVE-2025-24891 | Critical | 9.6 | 2025-01-31 | Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrar… |
CVE-2025-0934 | Medium | 6.3 | 2025-01-31 | A vulnerability was found in code-projects Job Recruitment 1.0. It has been classified as problematic. This affects an unknown part of the file /parse/_call_jo… |
CVE-2025-0938 | | 2025-01-31 | The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to… | |
CVE-2025-23001 | Medium | 6.1 | 2025-01-31 | A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can ma… |
CVE-2025-22957 | Critical | 9.8 | 2025-01-31 | A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without any authentication. This vulnerability co… |
CVE-2025-23215 | | 2025-01-31 | PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Mave… | |
CVE-2025-22994 | Medium | 6.1 | 2025-01-31 | O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings. |
CVE-2025-0930 | Medium | 6.1 | 2025-01-31 | Reflected Cross-Site Scripting (XSS) in TeamCal Neo, version 3.8.2. This allows an attacker to execute malicious JavaScript code, after injecting code via the… |
CVE-2025-0929 | Critical | 9.8 | 2025-01-31 | SQL injection vulnerability in TeamCal Neo, version 3.8.2. This could allow an attacker to retrieve, update and delete all database information by injecting a… |
CVE-2025-24831 | Medium | 6.6 | 2025-01-31 | Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before b… |
CVE-2025-24830 | Medium | 6.3 | 2025-01-31 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39… |
CVE-2025-24829 | Medium | 6.3 | 2025-01-31 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39… |
CVE-2025-24828 | Medium | 6.3 | 2025-01-31 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39… |
CVE-2025-24827 | Medium | 6.3 | 2025-01-31 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39… |
CVE-2025-21683 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sk_select_reuseport() memory leak As pointed out in the original comment, lo… |