2025 CVEs (page 422)
Page 422 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-23942 | Critical | 9.1 | 2025-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in ngocuct0912 WP Load Gallery wp-load-gallery allows Upload a Web Shell to a Web Server.This iss… |
CVE-2025-23938 | High | 7.5 | 2025-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CRUDLab Image Gallery Box by CRUDLab i… |
CVE-2025-23932 | Critical | 9.8 | 2025-01-22 | Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <=… |
CVE-2025-23931 | Critical | 9.3 | 2025-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliver Fuhrmann WordPress Local SEO dh-local-seo allows B… |
CVE-2025-23921 | Critical | 9.0 | 2025-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web S… |
CVE-2025-23918 | Critical | 9.9 | 2025-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Enrico Sandoli Smallerik File Browser smallerik-file-browser allows Upload a Web Shell to a We… |
CVE-2025-23910 | High | 8.5 | 2025-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in keighl Menus Plus+ menus-plus allows SQL Injection.This i… |
CVE-2025-23882 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in misanthrop WP Download Codes wp-download-codes allows Ref… |
CVE-2025-23874 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FalconTheme Team WP Block Pack wp-block-pack allows Refle… |
CVE-2025-23867 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markcoker WordPress File Search wpfilesearch allows Refle… |
CVE-2025-23866 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E. Marten EU DSGVO Helper dsgvo allows Reflected XSS.This… |
CVE-2025-23846 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thaikolja Flexible Blogtitle flexible-blogtitle allows Re… |
CVE-2025-23812 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distributio… |
CVE-2025-23811 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ghasemy14 WP2APP wp2appir allows Reflected XSS.This issue… |
CVE-2025-23806 | High | 7.1 | 2025-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFarmer Ultimate Subscribe ultimate-subscribe allows Reflected XSS.This issue affects Ultimate Subscribe… |
CVE-2025-23803 | High | 7.1 | 2025-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in Rik Schennink Snippy snippy allows Reflected XSS.This issue affects Snippy: from n/a through <= 1.4.1. |
CVE-2025-23798 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElbowRobo Mass Messaging in BuddyPress mass-messaging-in-… |
CVE-2025-23784 | High | 7.6 | 2025-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distributio… |
CVE-2025-23781 | High | 7.5 | 2025-01-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Web Mumbai WM Options Import Export wm-options-import-export allows Retrieve Embedded Sensit… |
CVE-2025-23774 | High | 7.5 | 2025-01-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Niket Joshi WPDB to Sql wpdb-to-sql allows Retrieve Embedded Sensitive Data.This issue affec… |
CVE-2025-23770 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caspie Fast Tube fast-tube allows Reflected XSS.This issu… |
CVE-2025-23769 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamsofmatter Content Mirror content-mirror allows Refle… |
CVE-2025-23768 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inwavethemes InFunding infunding allows Reflected XSS.Thi… |
CVE-2025-23758 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pootlepress Pootle button pootle-button allows Reflected… |
CVE-2025-23746 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edem CMC MIGRATE cmc-migrate allows Reflected XSS.This is… |
CVE-2025-23732 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in franciscopalacios Easy Filtering easy-filtering allows Re… |
CVE-2025-23709 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kiroro Formatted post formatted-post allows Reflected XSS… |
CVE-2025-23706 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in milordk Jet Skinner for BuddyPress jet-skinner-for-buddyp… |
CVE-2025-23701 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in limesquare Lime Developer Login lime-developer-login allo… |
CVE-2025-23700 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonisink yCyclista ycyclista allows Reflected XSS.This is… |
CVE-2025-23697 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webdeal Podčlánková inzerce podclankova-inzerce allows Re… |
CVE-2025-23696 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronan Mockett Staging CDN staging-cdn allows Reflected XS… |
CVE-2025-23695 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kinlane CtyGrid Hyp3rL0cal Search hyp3rl0cal-city-search… |
CVE-2025-23686 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpdevca Admin Menu Organizer admin-menu-organizer allows… |
CVE-2025-23684 | Medium | 4.3 | 2025-01-22 | Missing Authorization vulnerability in Eugen Bobrowski Debug Tool debug-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-23683 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xdxdVSxdxd MACME macme allows Reflected XSS.This issue af… |
CVE-2025-23682 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bhuvnesh Gupta Preloader Quotes preloader-quotes allows R… |
CVE-2025-23681 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat REDIRECTION PLUS redirection-plus allows Re… |
CVE-2025-23679 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flourish Pixel FP RSS Category Excluder fp-rss-category-e… |
CVE-2025-23678 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Imranur Rahman LocalGrid localgrid allows Reflected XS… |
CVE-2025-23676 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Email lh-email allows Reflected XSS.This is… |
CVE-2025-23674 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andygauk Bit.ly linker bitly-linker allows Reflected XSS… |
CVE-2025-23672 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tenteeglobal Instant Appointment instant-appointment allo… |
CVE-2025-23643 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in a.ankit ReadMe Creator readme-creator allows Reflected XS… |
CVE-2025-23631 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Lewis Content Planner content-planner allows Reflec… |
CVE-2025-23630 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Irshad A.Khan Cyber Slider cyber-new-slider allows Reflec… |
CVE-2025-23625 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode Unique UX unique-ux allows Reflected XSS.This issu… |
CVE-2025-23611 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webhue WH Cache & Security wh-cache-and-security allows R… |
CVE-2025-23610 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tehsmash Ultimate Events ultimate-events allows Reflected… |
CVE-2025-23609 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Helle1 Tagesteller tagesteller allows Reflected XSS.This… |
CVE-2025-23607 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camoo Sarl CAMOO SMS camoo-sms allows Reflected XSS.This… |
CVE-2025-23606 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sebkay Calendi calendi allows Reflected XSS.This issue af… |
CVE-2025-23605 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lampd Call To Action Popup call-to-action-popup allows Re… |
CVE-2025-23604 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maeve Lander Rezdy Reloaded reloaded-rezdy allows Stored… |
CVE-2025-23603 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MohammadJafar Khajeh Group category creator group-categor… |
CVE-2025-23602 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter… |
CVE-2025-23601 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patrice Tab My Content tab-my-content allows Reflected XS… |
CVE-2025-23597 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sabareesha Rio Photo Gallery rio-photo-gallery allows Ref… |
CVE-2025-23592 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in animexxx dForms dforms allows Reflected XSS.This issue af… |
CVE-2025-23589 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markugwuanyi ContentOptin Lite contentoptin allows Reflec… |
CVE-2025-23583 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Explara Explara Membership explara-membership allows Refl… |
CVE-2025-23578 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Custom CSS Addons css-addons allows Reflected… |
CVE-2025-23562 | Medium | 5.8 | 2025-01-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pitinca XLSXviewer xlsx-viewer allows Path Traversal.This issue… |
CVE-2025-23548 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bilal TAS Responsivity responsivity allows Reflected XSS… |
CVE-2025-23535 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martin_ziegert REAL WordPress Sidebar drag-and-drop-custo… |
CVE-2025-23512 | High | 7.5 | 2025-01-22 | Missing Authorization vulnerability in 118group Team 118GROUP Agent team-118group-agent allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-23509 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in siteheart HyperComments comments-with-hypercommentscom al… |
CVE-2025-23507 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blrt Blrt WP Embed blrt-wp-embed allows Reflected XSS.Thi… |
CVE-2025-23506 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imsoftware WP IMAP Auth wp-imap-authentication allows Ref… |
CVE-2025-23503 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osolwordpress Customizable Captcha and Contact Us customi… |
CVE-2025-23500 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faaiq Simple Custom post type custom field simple-content… |
CVE-2025-23498 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ContentLocalized Translation.Pro translation-pro allows R… |
CVE-2025-23495 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chetan Khandla WooCommerce Order Search woocommerce-order… |
CVE-2025-23486 | Medium | 6.5 | 2025-01-22 | Missing Authorization vulnerability in tamlyn Database Sync database-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-23475 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fireantology History timeline history-timeline allows Ref… |
CVE-2025-23462 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anil Jailta FWD Slider fwd-slider allows Reflected XSS.Th… |
CVE-2025-23449 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidpuc Simple shortcode buttons simple-shortcode-button… |
CVE-2025-22980 | Medium | 6.7 | 2025-01-22 | A SQL Injection vulnerability exists in Senayan Library Management System SLiMS 9 Bulian 9.6.1 via the tempLoanID parameter in the loan form on /admin/modules/… |
CVE-2025-22772 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stephanemartinw Mapbox for WP Advanced mapbox-for-wp-adva… |
CVE-2025-0604 | Medium | 5.4 | 2025-01-22 | A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new cr… |
CVE-2025-0395 | Medium | 6.2 | 2025-01-22 | When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and siz… |
CVE-2025-0429 | High | 7.2 | 2025-01-22 | The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of unt… |
CVE-2025-0428 | High | 7.2 | 2025-01-22 | The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of unt… |
CVE-2025-23237 | Medium | 6.6 | 2025-01-22 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If a us… |
CVE-2025-22450 | High | 7.5 | 2025-01-22 | Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. A remote attacker may disable the LAN-side firewall function of… |
CVE-2025-20617 | High | 7.2 | 2025-01-22 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an a… |
CVE-2025-23083 | High | 7.7 | 2025-01-22 | With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also… |
CVE-2025-0625 | Low | 3.1 | 2025-01-22 | A vulnerability, which was classified as problematic, was found in CampCodes School Management Software 1.0. This affects an unknown part of the component Atta… |
CVE-2025-23196 | High | 8.8 | 2025-01-21 | A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. Th… |
CVE-2025-23195 | High | 7.5 | 2025-01-21 | An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occu… |
CVE-2025-21571 | High | 7.3 | 2025-01-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.24 and pr… |
CVE-2025-21570 | Medium | 6.1 | 2025-01-21 | Vulnerability in the Oracle Life Sciences Argus Safety product of Oracle Health Sciences Applications (component: Login). The supported version that is affec… |
CVE-2025-21569 | Medium | 6.6 | 2025-01-21 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Services). The supported version that is affecte… |
CVE-2025-21568 | Medium | 4.5 | 2025-01-21 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security). The supported version that is… |
CVE-2025-21567 | Medium | 4.3 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 9.1.0 and prior… |
CVE-2025-21566 | Medium | 6.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.1.0 and prior. Easily exp… |
CVE-2025-21565 | High | 7.5 | 2025-01-21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install). The supported version that is affected is 9.3.6. Easily… |
CVE-2025-21564 | High | 8.1 | 2025-01-21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affecte… |
CVE-2025-21563 | Medium | 4.3 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported vers… |
CVE-2025-21562 | Medium | 4.3 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported vers… |