2025 CVEs (page 424)
Page 424 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0377 | High | 7.5 | 2025-01-21 | HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry. |
CVE-2025-24001 | High | 7.1 | 2025-01-21 | Cross-Site Request Forgery (CSRF) vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PP… |
CVE-2025-23998 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in raratheme UltraLight the-ultralight allows Reflected XSS… |
CVE-2025-23997 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tamara Solution Tamara Checkout tamara-checkout allows St… |
CVE-2025-22825 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Store… |
CVE-2025-22763 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Brizy Pro allows Reflected XSS. This issue affec… |
CVE-2025-22735 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Burge WordPress Tag Cloud Plugin – Tag Groups tag-g… |
CVE-2025-22733 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edit… |
CVE-2025-22732 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Admiral Ad Blocking Detector ad-blocking-detector allows… |
CVE-2025-22727 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps MailChimp Subscribe Forms mailchimp-subscribe-… |
CVE-2025-22723 | Critical | 9.1 | 2025-01-21 | Unrestricted Upload of File with Dangerous Type vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scann… |
CVE-2025-22719 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikAppointments Services Booking Calendar vikapp… |
CVE-2025-22718 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roninwp FAT Event Lite fat-event-lite allows Stored XSS.T… |
CVE-2025-22717 | High | 7.5 | 2025-01-21 | Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects My T… |
CVE-2025-22716 | High | 8.5 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows SQL Injection… |
CVE-2025-22711 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Maier Image Source Control image-source-control-is… |
CVE-2025-22710 | High | 7.6 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce a… |
CVE-2025-22709 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This i… |
CVE-2025-22706 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS. T… |
CVE-2025-22553 | Critical | 9.3 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in dhananjaysingh Multiple Carousel multicarousel allows SQL… |
CVE-2025-22322 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messagi… |
CVE-2025-22318 | High | 7.5 | 2025-01-21 | Missing Authorization vulnerability in enituretechnology Standard Box Sizes – for WooCommerce standard-box-sizes.This issue affects Standard Box Sizes – for Wo… |
CVE-2025-22311 | High | 7.5 | 2025-01-21 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DeluxeThemes Private Messages for User… |
CVE-2025-22262 | Medium | 5.9 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WittyFolk Bonjour Bar bonjour-bar allows Stored XSS.This… |
CVE-2025-21664 | High | 7.8 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function The documentation in rculis… |
CVE-2025-21663 | Critical | 10.0 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-tegra: Read iommu stream id from device tree Nvidia's Tegra MGBE contr… |
CVE-2025-21662 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix variable not being completed when function returns When cmd_alloc_index()… |
CVE-2025-21661 | High | 7.8 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix missing lookup table cleanups When a virtuser device is created via c… |
CVE-2025-21660 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked When `ksmbd_vfs_kern_p… |
CVE-2025-21659 | High | 8.1 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not ful… |
CVE-2025-21658 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid NULL pointer dereference if no valid extent tree [BUG] Syzbot reported a cra… |
CVE-2025-21657 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass() scx_ops_bypass() i… |
CVE-2025-21656 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur scsi_execute_… |
CVE-2025-0615 | Medium | 5.3 | 2025-01-21 | Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability allows an attacker to modify an email to contain the ‘+’ symbol to access the… |
CVE-2025-0614 | Medium | 5.3 | 2025-01-21 | Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability could allow an attacker to modify a single email to contain upper and lower c… |
CVE-2025-0450 | Medium | 6.4 | 2025-01-21 | The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27… |
CVE-2025-23184 | Medium | 5.9 | 2025-01-21 | A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream ins… |
CVE-2025-0371 | Medium | 6.4 | 2025-01-21 | The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insu… |
CVE-2025-23086 | Medium | 6.1 | 2025-01-21 | On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site… |
CVE-2025-24014 | Medium | 4.2 | 2025-01-20 | Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a… |
CVE-2025-23214 | | 2025-01-20 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By monitoring the err… | |
CVE-2025-23221 | Medium | 5.4 | 2025-01-20 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the… |
CVE-2025-24013 | Medium | 5.3 | 2025-01-20 | CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can c… |
CVE-2025-24010 | Medium | 6.5 | 2025-01-20 | Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to defa… |
CVE-2025-23220 | Critical | 9.8 | 2025-01-20 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the We… |
CVE-2025-23219 | Critical | 9.8 | 2025-01-20 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the We… |
CVE-2025-23218 | Critical | 9.8 | 2025-01-20 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the We… |
CVE-2025-23044 | Medium | 6.8 | 2025-01-20 | PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This in… |
CVE-2025-22620 | Medium | 5.0 | 2025-01-20 | gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intend… |
CVE-2025-22131 | Medium | 6.1 | 2025-01-20 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file… |
CVE-2025-24337 | High | 8.4 | 2025-01-20 | WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini. |
CVE-2025-21655 | High | 7.8 | 2025-01-20 | In the Linux kernel, the following vulnerability has been resolved: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period io_eventfd_do_sign… |
CVE-2025-0479 | | 2025-01-20 | This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vu… | |
CVE-2025-0590 | High | 7.5 | 2025-01-20 | Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk. |
CVE-2025-0586 | High | 7.2 | 2025-01-20 | The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular sy… |
CVE-2025-0585 | Critical | 9.8 | 2025-01-20 | The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify… |
CVE-2025-0584 | Medium | 5.3 | 2025-01-20 | The a+HRD from aEnrich Technology has a Server-side Request Forgery, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal… |
CVE-2025-0582 | Medium | 4.7 | 2025-01-20 | A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. This vulnerability affects unknown code of the file /add-pig… |
CVE-2025-0581 | Low | 3.5 | 2025-01-20 | A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. This affects an unknown part of the file /chat/group/send… |
CVE-2025-0580 | Medium | 5.6 | 2025-01-20 | A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-0579 | High | 7.3 | 2025-01-20 | A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-0583 | Medium | 6.1 | 2025-01-20 | The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript… |
CVE-2025-0578 | Low | 3.5 | 2025-01-20 | A vulnerability was found in Facile Sistemas Cloud Apps up to 20250107. It has been classified as problematic. Affected is an unknown function of the file /acc… |
CVE-2025-0576 | Medium | 4.3 | 2025-01-20 | A vulnerability was found in Mobotix M15 4.3.4.83 and classified as problematic. This issue affects some unknown processing of the file /control/player?center&… |
CVE-2025-0575 | Low | 3.9 | 2025-01-19 | A vulnerability has been found in Union Bank of India Vyom 8.0.34 on Android and classified as problematic. This vulnerability affects unknown code of the comp… |
CVE-2025-21654 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: ovl: support encoding fid from inode with no alias Dmitry Safonov reported that a WARN_ON… |
CVE-2025-21653 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute syzbot found that TCA_FLOW_RSHIFT… |
CVE-2025-21652 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: ipvlan: Fix use-after-free in ipvlan_get_iflink(). syzbot presented an use-after-free rep… |
CVE-2025-21651 | Medium | 4.7 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: don't auto enable misc vector Currently, there is a time window between misc i… |
CVE-2025-21650 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue The TQP BAR sp… |
CVE-2025-21649 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices Currently, HIP08 devices d… |
CVE-2025-21648 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size… |
CVE-2025-21647 | High | 7.3 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed… |
CVE-2025-21646 | High | 7.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix the maximum cell name length The kafs filesystem limits the maximum length of a… |
CVE-2025-21645 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it Wakeup for… |
CVE-2025-21644 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix tlb invalidation when wedging If GuC fails to load, the driver wedges, but in… |
CVE-2025-21643 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix kernel async DIO Netfslib needs to be able to handle kernel-initiated asynchro… |
CVE-2025-21642 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: mptcp: sysctl: sched: avoid using current->nsproxy Using the 'net' structure via 'current… |
CVE-2025-21641 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: mptcp: sysctl: blackhole timeout: avoid using current->nsproxy As mentioned in the previo… |
CVE-2025-21640 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy As mentioned in a previous co… |
CVE-2025-21639 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: rto_min/max: avoid using current->nsproxy As mentioned in a previous commit… |
CVE-2025-21638 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: auth_enable: avoid using current->nsproxy As mentioned in a previous commit… |
CVE-2025-21637 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: udp_port: avoid using current->nsproxy As mentioned in a previous commit of… |
CVE-2025-21636 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy As mentioned in a prev… |
CVE-2025-21635 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy As mentioned in a previou… |
CVE-2025-21634 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: remove kernfs active break A warning was found: WARNING: CPU: 10 PID: 348… |
CVE-2025-21632 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before "getting" registers The x86 shadow stack su… |
CVE-2025-21631 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UA… |
CVE-2025-0567 | Medium | 4.5 | 2025-01-19 | A vulnerability classified as problematic was found in Epic Games Launcher up to 17.2.1. This vulnerability affects unknown code in the library profapi.dll of… |
CVE-2025-0566 | High | 8.8 | 2025-01-19 | A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13. This affects the function formSetDevNetName of the file /goform/SetDevNetName… |
CVE-2025-0565 | High | 7.3 | 2025-01-19 | A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipu… |
CVE-2025-0564 | High | 7.3 | 2025-01-19 | A vulnerability was found in code-projects Fantasy-Cricket 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-0563 | Medium | 6.3 | 2025-01-19 | A vulnerability was found in code-projects Fantasy-Cricket 1.0. It has been classified as critical. Affected is an unknown function of the file /dash/update.ph… |
CVE-2025-0562 | Medium | 6.3 | 2025-01-19 | A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/a… |
CVE-2025-0561 | Medium | 6.3 | 2025-01-19 | A vulnerability has been found in itsourcecode Farm Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-… |
CVE-2025-0560 | Low | 2.4 | 2025-01-18 | A vulnerability, which was classified as problematic, was found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /photo… |
CVE-2025-0559 | Low | 2.4 | 2025-01-18 | A vulnerability, which was classified as problematic, has been found in Campcodes School Management Software 1.0. This issue affects some unknown processing of… |
CVE-2025-0558 | Medium | 6.3 | 2025-01-18 | A vulnerability classified as critical was found in TDuckCloud tduck-platform up to 4.0. This vulnerability affects the function QueryProThemeRequest of the fi… |
CVE-2025-0557 | Medium | 4.3 | 2025-01-18 | A vulnerability classified as problematic has been found in Hyland Alfresco Community Edition and Alfresco Enterprise Edition up to 6.2.2. This affects an unkn… |
CVE-2025-0515 | Medium | 4.3 | 2025-01-18 | The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to… |