2025 CVEs (page 421)
Page 421 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24025 | Medium | 6.1 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users… |
CVE-2025-23222 | High | 8.4 | 2025-01-24 | An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs… |
CVE-2025-22612 | Critical | 10.0 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization… |
CVE-2025-22611 | Critical | 9.9 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization… |
CVE-2025-22610 | Medium | 6.5 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization… |
CVE-2025-22609 | Critical | 10.0 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization… |
CVE-2025-22608 | Medium | 6.5 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization… |
CVE-2025-0701 | Medium | 6.3 | 2025-01-24 | A vulnerability classified as critical has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This affects an unknown part of the… |
CVE-2025-0700 | Medium | 6.3 | 2025-01-24 | A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been rated as critical. Affected by this issue is some u… |
CVE-2025-23991 | Medium | 4.3 | 2025-01-24 | Missing Authorization vulnerability in Dotstore Product Size Charts Plugin for WooCommerce woo-advanced-product-size-chart.This issue affects Product Size Char… |
CVE-2025-22607 | Medium | 5.5 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization… |
CVE-2025-22606 | High | 7.8 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, wh… |
CVE-2025-0699 | Medium | 6.3 | 2025-01-24 | A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been declared as critical. Affected by this vulnerabilit… |
CVE-2025-0698 | Medium | 6.3 | 2025-01-24 | A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been classified as critical. Affected is an unknown func… |
CVE-2025-22605 | High | 7.8 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Starting in version 4.0.0-beta.18 and prior to 4.0.0-beta.2… |
CVE-2025-0697 | Medium | 5.3 | 2025-01-24 | A vulnerability, which was classified as problematic, was found in Telstra Smart Modem Gen 2 up to 20250115. This affects an unknown part of the component HTTP… |
CVE-2025-23889 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten FooGallery Captions foogallery-captions allows… |
CVE-2025-23888 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GrandSlambert Custom Page Extensions custom-page-extensio… |
CVE-2025-23885 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anildhiman MJ Contact us mj-contact-us allows Reflected X… |
CVE-2025-23839 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asif Shakeel Sticky Button sticky-chat-button allows Stor… |
CVE-2025-23838 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rally Vincent Bauernregeln bauernregeln allows Reflected… |
CVE-2025-23837 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martinjuhasz One Backend Language one-backend-language al… |
CVE-2025-23737 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thobian Network-Favorites network-favorites allows Reflec… |
CVE-2025-23734 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Casey Bisson Gigaom Sphinx go-sphinx allows Reflected XSS… |
CVE-2025-23711 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quincy Kwende Quote me quote-me allows Reflected XSS.This… |
CVE-2025-23622 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sabuj Kundu CBX Accounting & Bookkeeping cbxwpsimpleaccou… |
CVE-2025-23621 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in algothemes Causes – Donation Plugin causes allows Reflect… |
CVE-2025-23522 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew Haines-Young HM Portfolio hm-portfolio allows Ref… |
CVE-2025-23427 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson / Team Updraft Redux Converter redux-conve… |
CVE-2025-23422 | High | 7.5 | 2025-01-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in moaluko Store Locator store-locator allows PHP Local File Inclu… |
CVE-2025-22714 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Reflected… |
CVE-2025-0314 | High | 8.7 | 2025-01-24 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of… |
CVE-2025-0693 | Medium | 5.3 | 2025-01-23 | Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an… |
CVE-2025-23012 | High | 7.5 | 2025-01-23 | Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastr… |
CVE-2025-23011 | High | 8.8 | 2025-01-23 | Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted a… |
CVE-2025-24353 | Medium | 5.0 | 2025-01-23 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an a… |
CVE-2025-24034 | Low | 3.2 | 2025-01-23 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau i… |
CVE-2025-24033 | High | 7.5 | 2025-01-23 | @fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not dele… |
CVE-2025-23227 | Medium | 6.4 | 2025-01-23 | IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting. This vulnerability allows authentica… |
CVE-2025-22153 | High | 7.9 | 2025-01-23 | RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type… |
CVE-2025-0650 | High | 8.1 | 2025-01-23 | A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured… |
CVE-2025-23960 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in basteln3rk Save & Import Image from URL save-import-image… |
CVE-2025-23894 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tatsuya wp-flickr-press wp-flickr-press allows Reflected… |
CVE-2025-23836 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SuryaBhan Custom Coming Soon custom-coming-soon allows Re… |
CVE-2025-23835 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jmraya Legal + legal-plus allows Reflected XSS.This issue… |
CVE-2025-23834 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RaminMT Links/Problem Reporter report-broken-links allows… |
CVE-2025-23733 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sayoko SC Simple Zazzle sc-simple-zazzle allows Reflected… |
CVE-2025-23730 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flx0 FLX Dashboard Groups flx-dashboard-groups allows Ref… |
CVE-2025-23729 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fures XTRA Settings xtra-settings allows Reflected XSS.Th… |
CVE-2025-23727 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antonzaroutski AZ Content Finder az-content-finder allows… |
CVE-2025-23725 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pshikli Accessibility Task Manager accessibility-task-man… |
CVE-2025-23724 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oleksandr87 University Quizzes Online university-quizzes-… |
CVE-2025-23723 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hdw player Plestar Directory Listing plestar-directory-li… |
CVE-2025-23722 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mind3dom Mind3doM RyeBread Widgets mind3dom-ryebread-widg… |
CVE-2025-23636 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitar A. My Favorite Car my-favorite-cars allows Reflec… |
CVE-2025-23634 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for… |
CVE-2025-23629 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Subhasis Laha Gallerio gallerio allows Reflected XSS.This… |
CVE-2025-23628 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NewMediaOne GeoDigs geodigs allows Reflected XSS.This iss… |
CVE-2025-23626 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fukushima Kumihimo kumihimo allows Reflected XSS.This iss… |
CVE-2025-23624 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alessandro Benoit WpDevTool wpdevtool allows Reflected XS… |
CVE-2025-23545 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Navnish Bhardwaj WP Social Broadcast wp-social-broadcast… |
CVE-2025-23544 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in heart5 StatPressCN statpresscn allows Reflected XSS.This… |
CVE-2025-23541 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in edmon.parker Download, Downloads ydn-download allows Ref… |
CVE-2025-23540 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohsin Khan WP Front-end login and register wp-front-end-… |
CVE-2025-22768 | High | 7.1 | 2025-01-23 | Cross-Site Request Forgery (CSRF) vulnerability in JinHan Park Rocket Media Library Mime Type rocket-media-library-mime-type allows Stored XSS.This issue affec… |
CVE-2025-22264 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patel WP Query Creator wp-query-creator allows Reflected… |
CVE-2025-0637 | Critical | 9.8 | 2025-01-23 | It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow… |
CVE-2025-23006 | Critical | 9.8 | 2025-01-23 | Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management… |
CVE-2025-0648 | Medium | 4.9 | 2025-01-23 | Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial o… |
CVE-2025-0635 | High | 7.5 | 2025-01-23 | Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain condit… |
CVE-2025-0619 | Medium | 4.9 | 2025-01-23 | Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords |
CVE-2025-24530 | Medium | 6.4 | 2025-01-23 | An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name… |
CVE-2025-24529 | Medium | 6.4 | 2025-01-23 | An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab. |
CVE-2025-24030 | High | 7.1 | 2025-01-23 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes… |
CVE-2025-0612 | High | 7.5 | 2025-01-22 | Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2025-0611 | High | 8.2 | 2025-01-22 | Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2025-23047 | Medium | 6.5 | 2025-01-22 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could… |
CVE-2025-0651 | High | 7.1 | 2025-01-22 | Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges can create a set of sym… |
CVE-2025-24403 | Medium | 4.3 | 2025-01-22 | A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2025-24402 | Medium | 4.3 | 2025-01-22 | A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a Service Fabric URL us… |
CVE-2025-24401 | Medium | 6.8 | 2025-01-22 | Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potent… |
CVE-2025-24400 | Medium | 4.3 | 2025-01-22 | Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers a… |
CVE-2025-24399 | High | 8.8 | 2025-01-22 | Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing… |
CVE-2025-24398 | High | 8.8 | 2025-01-22 | Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any ta… |
CVE-2025-24397 | Medium | 4.3 | 2025-01-22 | An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure p… |
CVE-2025-23028 | Medium | 5.3 | 2025-01-22 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1… |
CVE-2025-20165 | High | 7.5 | 2025-01-22 | A vulnerability in the SIP processing subsystem of Cisco BroadWorks could allow an unauthenticated, remote attacker to halt the processing of incoming SIP requ… |
CVE-2025-20156 | Critical | 9.9 | 2025-01-22 | A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administr… |
CVE-2025-20128 | Medium | 5.3 | 2025-01-22 | A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of… |
CVE-2025-23992 | Medium | 5.9 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toocheke Toocheke Companion toocheke-companion allows Sto… |
CVE-2025-23914 | Critical | 9.8 | 2025-01-22 | Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affe… |
CVE-2025-23809 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sunil Nanda Blue Wrench Video Widget blue-wrench-videos-w… |
CVE-2025-0638 | High | 7.5 | 2025-01-22 | The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked when encountering ill… |
CVE-2025-24027 | Medium | 6.2 | 2025-01-22 | ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting (XSS) vulnerability in versions up to and including 3… |
CVE-2025-23966 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ala Falaki a Gateway for Pasargad Bank on WooCommerce a-g… |
CVE-2025-23959 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linus Lundahl Good Old Gallery good-old-gallery allows Re… |
CVE-2025-23953 | Critical | 10.0 | 2025-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Scriptonite user files user-files allows Upload a Web Shell to a Web Server.This issue affects… |
CVE-2025-23949 | High | 8.1 | 2025-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dzeriho Improved Sale Badges – Free Ve… |
CVE-2025-23948 | High | 8.1 | 2025-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Webarea Background animation blocks ba… |
CVE-2025-23944 | High | 8.8 | 2025-01-22 | Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0. |