2025 CVEs (page 423)
Page 423 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22714 | High | 7.1 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Reflected… |
CVE-2025-0314 | High | 8.7 | 2025-01-24 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of… |
CVE-2025-0693 | Medium | 5.3 | 2025-01-23 | Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an… |
CVE-2025-23012 | High | 7.5 | 2025-01-23 | Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastr… |
CVE-2025-23011 | High | 8.8 | 2025-01-23 | Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted a… |
CVE-2025-24353 | Medium | 5.0 | 2025-01-23 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an a… |
CVE-2025-24034 | Low | 3.2 | 2025-01-23 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau i… |
CVE-2025-24033 | High | 7.5 | 2025-01-23 | @fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not dele… |
CVE-2025-23227 | Medium | 6.4 | 2025-01-23 | IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting. This vulnerability allows authentica… |
CVE-2025-22153 | High | 7.9 | 2025-01-23 | RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type… |
CVE-2025-0650 | High | 8.1 | 2025-01-23 | A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured… |
CVE-2025-23960 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in basteln3rk Save & Import Image from URL save-import-image… |
CVE-2025-23894 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tatsuya wp-flickr-press wp-flickr-press allows Reflected… |
CVE-2025-23836 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SuryaBhan Custom Coming Soon custom-coming-soon allows Re… |
CVE-2025-23835 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jmraya Legal + legal-plus allows Reflected XSS.This issue… |
CVE-2025-23834 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RaminMT Links/Problem Reporter report-broken-links allows… |
CVE-2025-23733 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sayoko SC Simple Zazzle sc-simple-zazzle allows Reflected… |
CVE-2025-23730 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flx0 FLX Dashboard Groups flx-dashboard-groups allows Ref… |
CVE-2025-23729 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fures XTRA Settings xtra-settings allows Reflected XSS.Th… |
CVE-2025-23727 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antonzaroutski AZ Content Finder az-content-finder allows… |
CVE-2025-23725 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pshikli Accessibility Task Manager accessibility-task-man… |
CVE-2025-23724 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oleksandr87 University Quizzes Online university-quizzes-… |
CVE-2025-23723 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hdw player Plestar Directory Listing plestar-directory-li… |
CVE-2025-23722 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mind3dom Mind3doM RyeBread Widgets mind3dom-ryebread-widg… |
CVE-2025-23636 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitar A. My Favorite Car my-favorite-cars allows Reflec… |
CVE-2025-23634 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for… |
CVE-2025-23629 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Subhasis Laha Gallerio gallerio allows Reflected XSS.This… |
CVE-2025-23628 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NewMediaOne GeoDigs geodigs allows Reflected XSS.This iss… |
CVE-2025-23626 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fukushima Kumihimo kumihimo allows Reflected XSS.This iss… |
CVE-2025-23624 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alessandro Benoit WpDevTool wpdevtool allows Reflected XS… |
CVE-2025-23545 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Navnish Bhardwaj WP Social Broadcast wp-social-broadcast… |
CVE-2025-23544 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in heart5 StatPressCN statpresscn allows Reflected XSS.This… |
CVE-2025-23541 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in edmon.parker Download, Downloads ydn-download allows Ref… |
CVE-2025-23540 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohsin Khan WP Front-end login and register wp-front-end-… |
CVE-2025-22768 | High | 7.1 | 2025-01-23 | Cross-Site Request Forgery (CSRF) vulnerability in JinHan Park Rocket Media Library Mime Type rocket-media-library-mime-type allows Stored XSS.This issue affec… |
CVE-2025-22264 | High | 7.1 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patel WP Query Creator wp-query-creator allows Reflected… |
CVE-2025-0637 | Critical | 9.8 | 2025-01-23 | It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow… |
CVE-2025-23006 | Critical | 9.8 | 2025-01-23 | Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management… |
CVE-2025-0648 | Medium | 4.9 | 2025-01-23 | Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial o… |
CVE-2025-0635 | High | 7.5 | 2025-01-23 | Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain condit… |
CVE-2025-0619 | Medium | 4.9 | 2025-01-23 | Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords |
CVE-2025-24530 | Medium | 6.4 | 2025-01-23 | An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name… |
CVE-2025-24529 | Medium | 6.4 | 2025-01-23 | An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab. |
CVE-2025-24030 | High | 7.1 | 2025-01-23 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes… |
CVE-2025-0612 | High | 7.5 | 2025-01-22 | Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2025-0611 | High | 8.2 | 2025-01-22 | Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2025-23047 | Medium | 6.5 | 2025-01-22 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could… |
CVE-2025-0651 | High | 7.1 | 2025-01-22 | Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges can create a set of sym… |
CVE-2025-24403 | Medium | 4.3 | 2025-01-22 | A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2025-24402 | Medium | 4.3 | 2025-01-22 | A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a Service Fabric URL us… |
CVE-2025-24401 | Medium | 6.8 | 2025-01-22 | Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potent… |
CVE-2025-24400 | Medium | 4.3 | 2025-01-22 | Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers a… |
CVE-2025-24399 | High | 8.8 | 2025-01-22 | Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing… |
CVE-2025-24398 | High | 8.8 | 2025-01-22 | Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any ta… |
CVE-2025-24397 | Medium | 4.3 | 2025-01-22 | An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure p… |
CVE-2025-23028 | Medium | 5.3 | 2025-01-22 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1… |
CVE-2025-20165 | High | 7.5 | 2025-01-22 | A vulnerability in the SIP processing subsystem of Cisco BroadWorks could allow an unauthenticated, remote attacker to halt the processing of incoming SIP requ… |
CVE-2025-20156 | Critical | 9.9 | 2025-01-22 | A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administr… |
CVE-2025-20128 | Medium | 5.3 | 2025-01-22 | A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of… |
CVE-2025-23992 | Medium | 5.9 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toocheke Toocheke Companion toocheke-companion allows Sto… |
CVE-2025-23914 | Critical | 9.8 | 2025-01-22 | Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affe… |
CVE-2025-23809 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sunil Nanda Blue Wrench Video Widget blue-wrench-videos-w… |
CVE-2025-0638 | High | 7.5 | 2025-01-22 | The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked when encountering ill… |
CVE-2025-24027 | Medium | 6.2 | 2025-01-22 | ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting (XSS) vulnerability in versions up to and including 3… |
CVE-2025-23966 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ala Falaki a Gateway for Pasargad Bank on WooCommerce a-g… |
CVE-2025-23959 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linus Lundahl Good Old Gallery good-old-gallery allows Re… |
CVE-2025-23953 | Critical | 10.0 | 2025-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Scriptonite user files user-files allows Upload a Web Shell to a Web Server.This issue affects… |
CVE-2025-23949 | High | 8.1 | 2025-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dzeriho Improved Sale Badges – Free Ve… |
CVE-2025-23948 | High | 8.1 | 2025-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Webarea Background animation blocks ba… |
CVE-2025-23944 | High | 8.8 | 2025-01-22 | Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0. |
CVE-2025-23942 | Critical | 9.1 | 2025-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in ngocuct0912 WP Load Gallery wp-load-gallery allows Upload a Web Shell to a Web Server.This iss… |
CVE-2025-23938 | High | 7.5 | 2025-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CRUDLab Image Gallery Box by CRUDLab i… |
CVE-2025-23932 | Critical | 9.8 | 2025-01-22 | Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <=… |
CVE-2025-23931 | Critical | 9.3 | 2025-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliver Fuhrmann WordPress Local SEO dh-local-seo allows B… |
CVE-2025-23921 | Critical | 9.0 | 2025-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web S… |
CVE-2025-23918 | Critical | 9.9 | 2025-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Enrico Sandoli Smallerik File Browser smallerik-file-browser allows Upload a Web Shell to a We… |
CVE-2025-23910 | High | 8.5 | 2025-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in keighl Menus Plus+ menus-plus allows SQL Injection.This i… |
CVE-2025-23882 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in misanthrop WP Download Codes wp-download-codes allows Ref… |
CVE-2025-23874 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FalconTheme Team WP Block Pack wp-block-pack allows Refle… |
CVE-2025-23867 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markcoker WordPress File Search wpfilesearch allows Refle… |
CVE-2025-23866 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E. Marten EU DSGVO Helper dsgvo allows Reflected XSS.This… |
CVE-2025-23846 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thaikolja Flexible Blogtitle flexible-blogtitle allows Re… |
CVE-2025-23812 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distributio… |
CVE-2025-23811 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ghasemy14 WP2APP wp2appir allows Reflected XSS.This issue… |
CVE-2025-23806 | High | 7.1 | 2025-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFarmer Ultimate Subscribe ultimate-subscribe allows Reflected XSS.This issue affects Ultimate Subscribe… |
CVE-2025-23803 | High | 7.1 | 2025-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in Rik Schennink Snippy snippy allows Reflected XSS.This issue affects Snippy: from n/a through <= 1.4.1. |
CVE-2025-23798 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElbowRobo Mass Messaging in BuddyPress mass-messaging-in-… |
CVE-2025-23784 | High | 7.6 | 2025-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distributio… |
CVE-2025-23781 | High | 7.5 | 2025-01-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Web Mumbai WM Options Import Export wm-options-import-export allows Retrieve Embedded Sensit… |
CVE-2025-23774 | High | 7.5 | 2025-01-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Niket Joshi WPDB to Sql wpdb-to-sql allows Retrieve Embedded Sensitive Data.This issue affec… |
CVE-2025-23770 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caspie Fast Tube fast-tube allows Reflected XSS.This issu… |
CVE-2025-23769 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamsofmatter Content Mirror content-mirror allows Refle… |
CVE-2025-23768 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inwavethemes InFunding infunding allows Reflected XSS.Thi… |
CVE-2025-23758 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pootlepress Pootle button pootle-button allows Reflected… |
CVE-2025-23746 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edem CMC MIGRATE cmc-migrate allows Reflected XSS.This is… |
CVE-2025-23732 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in franciscopalacios Easy Filtering easy-filtering allows Re… |
CVE-2025-23709 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kiroro Formatted post formatted-post allows Reflected XSS… |
CVE-2025-23706 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in milordk Jet Skinner for BuddyPress jet-skinner-for-buddyp… |
CVE-2025-23701 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in limesquare Lime Developer Login lime-developer-login allo… |
CVE-2025-23700 | High | 7.1 | 2025-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonisink yCyclista ycyclista allows Reflected XSS.This is… |