2025 CVEs (page 421)
Page 421 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24671 | Critical | 9.8 | 2025-01-27 | Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF… |
CVE-2025-24667 | Critical | 9.3 | 2025-01-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Worldwide Expres… |
CVE-2025-24665 | Critical | 9.3 | 2025-01-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Unishippers Edit… |
CVE-2025-24662 | Medium | 5.3 | 2025-01-27 | Missing Authorization vulnerability in LearnDash LearnDash LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Learn… |
CVE-2025-24653 | Medium | 4.3 | 2025-01-27 | Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-24628 | Medium | 5.3 | 2025-01-27 | Authentication Bypass by Spoofing vulnerability in bestwebsoft Google Captcha google-captcha allows Identity Spoofing.This issue affects Google Captcha: from n… |
CVE-2025-24626 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Music Store music-store allows Reflected XSS.T… |
CVE-2025-24606 | Medium | 6.4 | 2025-01-27 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-24603 | Medium | 4.3 | 2025-01-27 | Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Print Barcode Labels for your WooCommerce products/orders a4-barcode-generator.This is… |
CVE-2025-24600 | Medium | 5.3 | 2025-01-27 | Missing Authorization vulnerability in davidfcarr RSVPMarker rsvpmaker.This issue affects RSVPMarker : from n/a through <= 11.4.5. |
CVE-2025-24593 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Reflected… |
CVE-2025-24590 | Medium | 5.3 | 2025-01-27 | Missing Authorization vulnerability in picu picu picu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects picu: from n/a… |
CVE-2025-24540 | Medium | 4.3 | 2025-01-27 | Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Cross Site R… |
CVE-2025-24538 | Medium | 5.4 | 2025-01-27 | Cross-Site Request Forgery (CSRF) vulnerability in Slava Abakumov BuddyPress Groups Extras buddypress-groups-extras allows Cross Site Request Forgery.This issu… |
CVE-2025-24537 | Medium | 5.4 | 2025-01-27 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The E… |
CVE-2025-23982 | High | 7.1 | 2025-01-27 | Missing Authorization vulnerability in Gopi krishnan Fare Calculator fare-calculator allows Stored XSS.This issue affects Fare Calculator: from n/a through <=… |
CVE-2025-23849 | Medium | 5.4 | 2025-01-27 | Missing Authorization vulnerability in bpiwowar PAPERCITE papercite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-23756 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivanchernyakov LawPress – Law Firm Website Management law… |
CVE-2025-23754 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ulrich Sossou The Loops the-loops allows Reflected XSS.Th… |
CVE-2025-23752 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clifton Griffin CGD Arrange Terms shopp-arrange allows Re… |
CVE-2025-23669 | Medium | 6.5 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nurul Amin WP Smart Tooltip wp-smart-tool-tip allows Stor… |
CVE-2025-23656 | Medium | 6.5 | 2025-01-27 | Missing Authorization vulnerability in Saul Morales Pacheco Donate visa donate-visa allows Stored XSS.This issue affects Donate visa: from n/a through <= 1.0.0. |
CVE-2025-23574 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Lau CubePM cubepm allows Reflected XSS.This issu… |
CVE-2025-23531 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidfcarr RSVPMaker Volunteer Roles rsvpmaker-volunteer-… |
CVE-2025-23529 | Medium | 6.5 | 2025-01-27 | Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mi… |
CVE-2025-24754 | Medium | 4.3 | 2025-01-27 | Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0. |
CVE-2025-24685 | High | 8.1 | 2025-01-27 | Path Traversal: '.../...//' vulnerability in Ihor Kit Morkva UA Shipping morkva-ua-shipping allows PHP Local File Inclusion.This issue affects Morkva UA Shippi… |
CVE-2025-24664 | Critical | 9.3 | 2025-01-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express… |
CVE-2025-24612 | Critical | 9.3 | 2025-01-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows… |
CVE-2025-24601 | Critical | 9.8 | 2025-01-27 | Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0… |
CVE-2025-24584 | Medium | 4.3 | 2025-01-27 | Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-24533 | Medium | 5.4 | 2025-01-27 | Cross-Site Request Forgery (CSRF) vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Cross Site Request Forgery.This issue affects Re… |
CVE-2025-23792 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Busters Passwordless WP – Login with your glance or fi… |
CVE-2025-23457 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shipdeoplugin Shipdeo shipdeo-woo allows Reflected XSS.Th… |
CVE-2025-22513 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Simple Locator simple-locator allows Reflec… |
CVE-2025-0696 | Medium | 5.3 | 2025-01-27 | A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library b… |
CVE-2025-0695 | Medium | 5.3 | 2025-01-27 | An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the comp… |
CVE-2025-24814 | Medium | 5.5 | 2025-01-27 | Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" comp… |
CVE-2025-24390 | Medium | 6.8 | 2025-01-27 | A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS… |
CVE-2025-24389 | Medium | 6.3 | 2025-01-27 | Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system… |
CVE-2025-0722 | Medium | 4.7 | 2025-01-27 | A vulnerability classified as critical was found in needyamin image_gallery 1.0. This vulnerability affects unknown code of the file /admin/gallery.php of the… |
CVE-2025-0721 | Medium | 4.3 | 2025-01-27 | A vulnerability classified as problematic has been found in needyamin image_gallery 1.0. This affects the function image_gallery of the file /view.php. The man… |
CVE-2025-0720 | Low | 3.3 | 2025-01-26 | A vulnerability was found in Microword eScan Antivirus 7.0.32 on Linux. It has been rated as problematic. Affected by this issue is the function removeExtraSla… |
CVE-2025-24858 | | 2025-01-26 | Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the s… | |
CVE-2025-0543 | High | 7.8 | 2025-01-25 | Local privilege escalation in G DATA Security Client due to incorrect assignment of privileges to directories. This vulnerability allows a local, unprivileged… |
CVE-2025-0542 | High | 7.8 | 2025-01-25 | Local privilege escalation due to incorrect assignment of privileges of temporary files in the update mechanism of G DATA Management Server. This vulnerability… |
CVE-2025-0350 | Medium | 6.4 | 2025-01-25 | The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Ima… |
CVE-2025-0682 | High | 8.8 | 2025-01-25 | The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_reviews' shortcode… |
CVE-2025-0411 | High | 7.0 | 2025-01-25 | 7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installat… |
CVE-2025-0357 | Critical | 9.8 | 2025-01-25 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_controller::handle_image… |
CVE-2025-24361 | Medium | 5.3 | 2025-01-25 | Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack build… |
CVE-2025-24360 | Medium | 5.3 | 2025-01-25 | Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any reques… |
CVE-2025-21262 | Medium | 5.4 | 2025-01-24 | User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2025-0710 | Low | 3.5 | 2025-01-24 | A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /notice-list… |
CVE-2025-0709 | Low | 2.4 | 2025-01-24 | A vulnerability was found in Dcat-Admin 2.2.1-beta. It has been rated as problematic. This issue affects some unknown processing of the file /admin/auth/roles… |
CVE-2025-0708 | Low | 3.5 | 2025-01-24 | A vulnerability was found in fumiao opencms 2.2. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/model/addOrUpd… |
CVE-2025-0707 | High | 7.8 | 2025-01-24 | A vulnerability was found in Rise Group Rise Mode Temp CPU 2.1. It has been classified as critical. This affects an unknown part in the library CRYPTBASE.dll o… |
CVE-2025-0706 | Low | 2.4 | 2025-01-24 | A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this issue is some un… |
CVE-2025-24363 | Medium | 4.2 | 2025-01-24 | The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.8.9, in CI contexts, the IG Publisher CLI uses gi… |
CVE-2025-0705 | Medium | 4.3 | 2025-01-24 | A vulnerability has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this vulnerabili… |
CVE-2025-0704 | Medium | 5.3 | 2025-01-24 | A vulnerability, which was classified as problematic, was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. Affected is the function… |
CVE-2025-0703 | Medium | 4.3 | 2025-01-24 | A vulnerability, which was classified as problematic, has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This issue affects s… |
CVE-2025-24756 | High | 7.1 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in mgplugin Roi Calculator roi-calculator allows Stored XSS.This issue affects Roi Calculator: from n/a through… |
CVE-2025-24755 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-w… |
CVE-2025-24753 | Medium | 4.3 | 2025-01-24 | Missing Authorization vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-24751 | Medium | 4.3 | 2025-01-24 | Missing Authorization vulnerability in GoDaddy CoBlocks coblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoB… |
CVE-2025-24750 | Medium | 5.4 | 2025-01-24 | Missing Authorization vulnerability in Syed Balkhi ExactMetrics google-analytics-dashboard-for-wp allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-24746 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Iser Popup Maker popup-maker allows Stored XSS.Thi… |
CVE-2025-24739 | Medium | 4.3 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel FluentSMTP fluent-smtp allows Cross Site Request Forgery.This issue affects FluentSMTP: from… |
CVE-2025-24738 | Medium | 4.3 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Jerry Rietveld Call Now Button call-now-button allows Cross Site Request Forgery.This issue affects Call Now… |
CVE-2025-24736 | Medium | 4.3 | 2025-01-24 | Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-24733 | Medium | 6.5 | 2025-01-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Akhtarujjaman Shuvo Post Grid Master a… |
CVE-2025-24732 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems BookingPress bookingpress-appointment-b… |
CVE-2025-24731 | Medium | 5.9 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IP2Location Download IP2Location Country Blocker ip2locat… |
CVE-2025-24730 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affec… |
CVE-2025-24729 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor eleme… |
CVE-2025-24728 | High | 8.5 | 2025-01-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yannick Lefebvre Bug Library bug-library allows Blind SQL… |
CVE-2025-24727 | Medium | 5.9 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Contact Form Email contact-form-to-email allow… |
CVE-2025-24726 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored… |
CVE-2025-24725 | Medium | 4.3 | 2025-01-24 | Missing Authorization vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-24724 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Side Menu Lite side-menu-lite allows Cross Site Request Forgery.This issue affects Side Menu Lit… |
CVE-2025-24723 | Medium | 5.9 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar… |
CVE-2025-24722 | Medium | 5.9 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Stored XSS… |
CVE-2025-24721 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Easy YouTube Gallery easy-youtube-gal… |
CVE-2025-24720 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Sticky Buttons sticky-buttons allows Cross Site Request Forgery.This issue affects Sticky Button… |
CVE-2025-24719 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown widget-countdown allows Stored… |
CVE-2025-24717 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Modal Window modal-window allows Cross Site Request Forgery.This issue affects Modal Window: fro… |
CVE-2025-24716 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Herd Effects mwp-herd-effect allows Cross Site Request Forgery.This issue affects Herd Effects… |
CVE-2025-24715 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box counter-box allows Cross Site Request Forgery.This issue affects Counter Box: from n… |
CVE-2025-24714 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu bubble-menu allows Cross Site Request Forgery.This issue affe… |
CVE-2025-24713 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder button-generation allows Cross Site Request Forgery.Thi… |
CVE-2025-24712 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Radius Blocks radius-blocks allows Cross Site Request Forgery.This issue affects Radius Blocks… |
CVE-2025-24711 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Popup Box popup-box allows Cross Site Request Forgery.This issue affects Popup Box: from n/a thr… |
CVE-2025-24709 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plethora Plugins Plethora Plugins Tabs + Accordions pleth… |
CVE-2025-24706 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor all… |
CVE-2025-24705 | Medium | 5.3 | 2025-01-24 | Missing Authorization vulnerability in Arshid WooCommerce Quick View woo-quick-view allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-24704 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-ga… |
CVE-2025-24703 | Medium | 4.4 | 2025-01-24 | Server-Side Request Forgery (SSRF) vulnerability in Ronald Huereca Comment Edit Core – Simple Comment Editing simple-comment-editing allows Server Side Request… |
CVE-2025-24702 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xagio SEO Xagio SEO xagio-seo allows Stored XSS.This issu… |
CVE-2025-24701 | Medium | 4.4 | 2025-01-24 | Server-Side Request Forgery (SSRF) vulnerability in Bob Chained Quiz chained-quiz allows Server Side Request Forgery.This issue affects Chained Quiz: from n/a… |