2025 CVEs (page 425)
Page 425 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-21531 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and… |
CVE-2025-21530 | Medium | 4.3 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.6… |
CVE-2025-21529 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.40 and prior… |
CVE-2025-21528 | Medium | 4.3 | 2025-01-21 | Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported ve… |
CVE-2025-21527 | Medium | 6.1 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Design Tools SEC). Supported versions that are affected are Prior… |
CVE-2025-21526 | Medium | 5.4 | 2025-01-21 | Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported ve… |
CVE-2025-21525 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior… |
CVE-2025-21524 | Critical | 9.8 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affe… |
CVE-2025-21523 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and… |
CVE-2025-21522 | Medium | 6.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and pr… |
CVE-2025-21521 | High | 7.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.39 and prior, 8.4… |
CVE-2025-21520 | Low | 1.8 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and p… |
CVE-2025-21519 | Medium | 4.4 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior… |
CVE-2025-21518 | Medium | 6.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and… |
CVE-2025-21517 | Medium | 4.3 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21516 | High | 8.1 | 2025-01-21 | Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.5-12… |
CVE-2025-21515 | High | 8.8 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21514 | Medium | 5.3 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21513 | Medium | 6.1 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21512 | Medium | 6.1 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21511 | High | 7.5 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21510 | High | 7.5 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21509 | Medium | 6.5 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21508 | Medium | 6.5 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21507 | Medium | 5.4 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21506 | High | 8.1 | 2025-01-21 | Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Technology Foundation). Supported versions that are affected are… |
CVE-2025-21505 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.40 and prior… |
CVE-2025-21504 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and… |
CVE-2025-21503 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and… |
CVE-2025-21502 | Medium | 4.8 | 2025-01-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2025-21501 | Medium | 6.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and… |
CVE-2025-21500 | Medium | 6.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and… |
CVE-2025-21499 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.4.3 and prior and 9.1.0 and pr… |
CVE-2025-21498 | Medium | 5.3 | 2025-01-21 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily e… |
CVE-2025-21497 | Medium | 5.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and… |
CVE-2025-21495 | Medium | 4.4 | 2025-01-21 | Vulnerability in the MySQL Enterprise Firewall product of Oracle MySQL (component: Firewall). Supported versions that are affected are 8.0.40 and prior, 8.4.3… |
CVE-2025-21494 | Medium | 4.1 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.39 and prior… |
CVE-2025-21493 | Medium | 4.4 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.4.3 and prior… |
CVE-2025-21492 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.4.0… |
CVE-2025-21491 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and… |
CVE-2025-21490 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and… |
CVE-2025-21489 | Medium | 6.1 | 2025-01-21 | Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Region Mapping). Supported versions that are affected a… |
CVE-2025-24024 | Critical | 9.1 | 2025-01-21 | Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't ope… |
CVE-2025-23369 | High | 8.8 | 2025-01-21 | An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized i… |
CVE-2025-24461 | Medium | 6.5 | 2025-01-21 | In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint |
CVE-2025-24460 | Medium | 4.3 | 2025-01-21 | In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool |
CVE-2025-24459 | Medium | 4.6 | 2025-01-21 | In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page |
CVE-2025-24458 | High | 7.1 | 2025-01-21 | In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration |
CVE-2025-24457 | Medium | 5.5 | 2025-01-21 | In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs |
CVE-2025-24456 | Medium | 6.7 | 2025-01-21 | In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping |
CVE-2025-24020 | Medium | 6.1 | 2025-01-21 | WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in the `control.php` endpoint of versions up to and including… |
CVE-2025-24019 | High | 7.1 | 2025-01-21 | YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager t… |
CVE-2025-23996 | Medium | 4.3 | 2025-01-21 | Cross-Site Request Forgery (CSRF) vulnerability in AnyRoad AnyRoad anyguide allows Cross Site Request Forgery.This issue affects AnyRoad: from n/a through <= 1… |
CVE-2025-23994 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatebud Estatebud – Properties & Listings estatebud-pro… |
CVE-2025-23580 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew BizLibrary bizlibrary allows Reflected XSS.This i… |
CVE-2025-23551 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp SexBundle sexbundle allows Reflected XSS.This iss… |
CVE-2025-23489 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Messenlehner WP-Announcements wp-announcements allo… |
CVE-2025-23477 | High | 8.2 | 2025-01-21 | Missing Authorization vulnerability in realtyworkstation Realty Workstation realty-workstation allows Accessing Functionality Not Properly Constrained by ACLs… |
CVE-2025-23461 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xkollsoftware Social2Blog social2blog allows Reflected XS… |
CVE-2025-23454 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flashmaniac Nature FlipBook vertical-diamond-flipbook-fla… |
CVE-2025-22722 | Medium | 4.3 | 2025-01-21 | Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-22721 | Medium | 4.3 | 2025-01-21 | Missing Authorization vulnerability in Farhan Noor ApplyOnline apply-online allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-22661 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Payments – Get Paid with PayPal, Square & St… |
CVE-2025-22276 | Medium | 5.9 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enguerranws Related Post Shortcode related-post-shortcode… |
CVE-2025-22267 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Themes Shortcode Compatibility weaver-the… |
CVE-2025-22150 | Medium | 6.8 | 2025-01-21 | Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for… |
CVE-2025-24018 | High | 7.6 | 2025-01-21 | YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for an authenticated user with rights to edit/create a page or c… |
CVE-2025-24017 | High | 7.6 | 2025-01-21 | YesWiki is a wiki system written in PHP. Versions up to and including 4.4.5 are vulnerable to any end-user crafting a DOM based XSS on all of YesWiki's pages w… |
CVE-2025-24012 | Medium | 4.6 | 2025-01-21 | Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are a… |
CVE-2025-24011 | Medium | 5.3 | 2025-01-21 | Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determin… |
CVE-2025-0377 | High | 7.5 | 2025-01-21 | HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry. |
CVE-2025-24001 | High | 7.1 | 2025-01-21 | Cross-Site Request Forgery (CSRF) vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PP… |
CVE-2025-23998 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in raratheme UltraLight the-ultralight allows Reflected XSS… |
CVE-2025-23997 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tamara Solution Tamara Checkout tamara-checkout allows St… |
CVE-2025-22825 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Store… |
CVE-2025-22763 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Brizy Pro allows Reflected XSS. This issue affec… |
CVE-2025-22735 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Burge WordPress Tag Cloud Plugin – Tag Groups tag-g… |
CVE-2025-22733 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edit… |
CVE-2025-22732 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Admiral Ad Blocking Detector ad-blocking-detector allows… |
CVE-2025-22727 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps MailChimp Subscribe Forms mailchimp-subscribe-… |
CVE-2025-22723 | Critical | 9.1 | 2025-01-21 | Unrestricted Upload of File with Dangerous Type vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scann… |
CVE-2025-22719 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikAppointments Services Booking Calendar vikapp… |
CVE-2025-22718 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roninwp FAT Event Lite fat-event-lite allows Stored XSS.T… |
CVE-2025-22717 | High | 7.5 | 2025-01-21 | Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects My T… |
CVE-2025-22716 | High | 8.5 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows SQL Injection… |
CVE-2025-22711 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Maier Image Source Control image-source-control-is… |
CVE-2025-22710 | High | 7.6 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce a… |
CVE-2025-22709 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This i… |
CVE-2025-22706 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS. T… |
CVE-2025-22553 | Critical | 9.3 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in dhananjaysingh Multiple Carousel multicarousel allows SQL… |
CVE-2025-22322 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messagi… |
CVE-2025-22318 | High | 7.5 | 2025-01-21 | Missing Authorization vulnerability in enituretechnology Standard Box Sizes – for WooCommerce standard-box-sizes.This issue affects Standard Box Sizes – for Wo… |
CVE-2025-22311 | High | 7.5 | 2025-01-21 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DeluxeThemes Private Messages for User… |
CVE-2025-22262 | Medium | 5.9 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WittyFolk Bonjour Bar bonjour-bar allows Stored XSS.This… |
CVE-2025-21664 | High | 7.8 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function The documentation in rculis… |
CVE-2025-21663 | Critical | 10.0 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-tegra: Read iommu stream id from device tree Nvidia's Tegra MGBE contr… |
CVE-2025-21662 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix variable not being completed when function returns When cmd_alloc_index()… |
CVE-2025-21661 | High | 7.8 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix missing lookup table cleanups When a virtuser device is created via c… |
CVE-2025-21660 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked When `ksmbd_vfs_kern_p… |
CVE-2025-21659 | High | 8.1 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not ful… |