2025 CVEs (page 427)
Page 427 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-23567 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Tamer Ziady GDReseller gdreseller allows Stored XSS.This issue affects GDReseller: from n/a through <= 1.6. |
CVE-2025-23566 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in syedamirhussain91 Custom Post custom-post-type-gui allows Stored XSS.This issue affects Custom Post: from n/… |
CVE-2025-23560 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in plumwd Web Testimonials web-testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a thr… |
CVE-2025-23559 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Stepan Stepasyuk MemeOne allows Stored XSS.This issue affects MemeOne: from n/a through 2.0.5. |
CVE-2025-23558 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in digitalfisherman Geotagged Media geotagged-media allows Stored XSS.This issue affects Geotagged Media: from… |
CVE-2025-23557 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Kathleen Malone Find Your Reps find-your-reps allows Stored XSS.This issue affects Find Your Reps: from n/a… |
CVE-2025-23547 | High | 7.1 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Login Page lh-login-page allows Reflected X… |
CVE-2025-23537 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in קידום ובניית אתרים add custom google tag manager add-custom-google-tag-manager allows Stored XSS.This issue… |
CVE-2025-23533 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in zetxek WP Lyrics wplyrics allows Stored XSS.This issue affects WP Lyrics: from n/a through <= 0.4.1. |
CVE-2025-23532 | High | 8.8 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Regios MyAnime Widget myanime-widget allows Privilege Escalation.This issue affects MyAnime Widget: from n/a… |
CVE-2025-23530 | High | 8.8 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in yonisink Custom Post Type Lockdown custom-post-type-lockdown allows Privilege Escalation.This issue affects… |
CVE-2025-23528 | High | 8.8 | 2025-01-16 | Incorrect Privilege Assignment vulnerability in Mosterd3d DD Roles dd-roles allows Privilege Escalation.This issue affects DD Roles: from n/a through <= 4.1. |
CVE-2025-23514 | Medium | 5.3 | 2025-01-16 | Missing Authorization vulnerability in Sanjay Prasad Loginplus loginplus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Log… |
CVE-2025-23513 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in jd7777 Bible Embed bible-embed allows Stored XSS.This issue affects Bible Embed: from n/a through <= 0.0.4. |
CVE-2025-23511 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Stargazer WP-BlackCheck wp-blackcheck allows Stored XSS.This issue affects WP-BlackCheck: from n/a through <… |
CVE-2025-23510 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Jan Štětina WordPress Logging Service wordpress-logging-service allows Stored XSS.This issue affects WordPre… |
CVE-2025-23508 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in OrigoThemes Extra Options – Favicons extra-options-favicons allows Stored XSS.This issue affects Extra Optio… |
CVE-2025-23501 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in SpruceJoy Cookie Consent & Autoblock for GDPR/CCPA cookie-consent-autoblock allows Stored XSS.This issue aff… |
CVE-2025-23499 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier Board Election board-election allows Stored XSS.This issue affects Board Election: from n/a th… |
CVE-2025-23497 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in albdesign Simple Project Manager simple-project-managment allows Stored XSS.This issue affects Simple Projec… |
CVE-2025-23483 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in hoyce Universal Analytics Injector universal-analytics-injector allows Stored XSS.This issue affects Univers… |
CVE-2025-23476 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in isnowfy my-related-posts my-related-posts allows Stored XSS.This issue affects my-related-posts: from n/a th… |
CVE-2025-23471 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Add to Cart Button ect-add-to-cart-button allows Stored XSS.This issue affects ECT Add to Car… |
CVE-2025-23470 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in xavsio4 Visit Site Link enhanced visit-site-link-enhanced allows Stored XSS.This issue affects Visit Site Li… |
CVE-2025-23467 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in vimal.ghorecha RSS News Scroller rss-news-scroller allows Stored XSS.This issue affects RSS News Scroller: f… |
CVE-2025-23463 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Mukesh Dak MD Custom content after or before of post md-custom-content allows Stored XSS.This issue affects… |
CVE-2025-23456 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Oddthinking EmailShroud emailshroud allows Reflected XSS.This issue affects EmailShroud: from n/a through <=… |
CVE-2025-23455 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Master Software Solutions WP VTiger Synchronization msstiger allows Stored XSS.This issue affects WP VTiger… |
CVE-2025-23453 | High | 7.1 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Myriad Solutionz Stars SMTP Mailer stars-smtp-mailer allo… |
CVE-2025-23452 | High | 7.1 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales w… |
CVE-2025-23445 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in scottswezey Easy Tynt easy-tynt allows Cross Site Request Forgery.This issue affects Easy Tynt: from n/a thr… |
CVE-2025-23444 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nasir179125 Scroll Top Advanced scroll-top-advanced allow… |
CVE-2025-23442 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in mschertel Shockingly Big IE6 Warning shockingly-big-ie6-warning allows Stored XSS.This issue affects Shockin… |
CVE-2025-23438 | High | 7.1 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat WP PT-Viewer wp-ptviewer allows Refle… |
CVE-2025-23436 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in capa Wp-Scribd-List wp-scribd-list allows Stored XSS.This issue affects Wp-Scribd-List: from n/a through <=… |
CVE-2025-23435 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in marcucci Password Protect Plugin for WordPress password-protect-plugin-for-wordpress allows Stored XSS.This… |
CVE-2025-23434 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viher3 Easy EU Cookie law easy-eu-cookie-law allows Store… |
CVE-2025-23432 | High | 7.1 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AlTi5 AlT Report alt-report allows Reflected XSS.This iss… |
CVE-2025-23430 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Oren Yomtov Mass Custom Fields Manager mass-custom-fields-manager allows Reflected XSS.This issue affects Ma… |
CVE-2025-23429 | High | 7.1 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in altima-interactive Altima Lookbook Free for WooCommerce a… |
CVE-2025-23426 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Binesh Dobhal go Social go-social allows Stored XSS.This issue affects go Social: from n/a through <= 1.0. |
CVE-2025-23424 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in bnovotny Marquee Style RSS News Ticker marquee-style-rss-news-ticker allows Cross Site Request Forgery.This… |
CVE-2025-23423 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in Smackcoders Inc., SendGrid for WordPress wp-sendgrid-mailer allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-20630 | Medium | 6.5 | 2025-01-16 | Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker… |
CVE-2025-20621 | Medium | 6.5 | 2025-01-16 | Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields tha… |
CVE-2025-20072 | Medium | 6.5 | 2025-01-16 | Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an atta… |
CVE-2025-0518 | Medium | 5.3 | 2025-01-16 | Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with… |
CVE-2025-0473 | Medium | 6.5 | 2025-01-16 | Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exi… |
CVE-2025-0472 | High | 7.5 | 2025-01-16 | Information exposure in the PMB platform affecting versions 4.2.13 and earlier. This vulnerability allows an attacker to upload a file to the environment and e… |
CVE-2025-0471 | Critical | 9.9 | 2025-01-16 | Unrestricted file upload vulnerability in the PMB platform, affecting versions 4.0.10 and above. This vulnerability could allow an attacker to upload a file to… |
CVE-2025-22916 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a stack overflow via the pppUserName parameter in the formPPPoESetup function. |
CVE-2025-22913 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function. |
CVE-2025-22912 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept. |
CVE-2025-22907 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a stack overflow via the selSSID parameter in the formWlSiteSurvey function. |
CVE-2025-22906 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN. |
CVE-2025-22905 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp. |
CVE-2025-22904 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a stack overflow via the pptpUserName parameter in the setWAN function. |
CVE-2025-0457 | High | 8.8 | 2025-01-16 | The airPASS from NetVision Information has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbit… |
CVE-2025-0456 | Critical | 9.8 | 2025-01-16 | The airPASS from NetVision Information has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access the specific administrat… |
CVE-2025-0455 | Critical | 9.8 | 2025-01-16 | The airPASS from NetVision Information has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, m… |
CVE-2025-0170 | Medium | 6.1 | 2025-01-16 | The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input… |
CVE-2025-0476 | Medium | 4.3 | 2025-01-16 | Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any u… |
CVE-2025-22976 | High | 7.1 | 2025-01-15 | SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a local attacker to execute arbitrary code via not filtering the content correctly at the "checkOrder… |
CVE-2025-22964 | High | 8.1 | 2025-01-15 | DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient input sanitization and… |
CVE-2025-0215 | Medium | 6.1 | 2025-01-15 | The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parame… |
CVE-2025-0492 | High | 7.5 | 2025-01-15 | A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical. Affected by this vulnerability is the function FUN_00412244. The ma… |
CVE-2025-0491 | Medium | 6.3 | 2025-01-15 | A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. Affected is an unknown function of the file /fladmin/cat_dodel.ph… |
CVE-2025-0490 | Medium | 6.3 | 2025-01-15 | A vulnerability, which was classified as critical, has been found in Fanli2012 native-php-cms 1.0. This issue affects some unknown processing of the file /flad… |
CVE-2025-0489 | Medium | 6.3 | 2025-01-15 | A vulnerability classified as critical was found in Fanli2012 native-php-cms 1.0. This vulnerability affects unknown code of the file /fladmin/friendlink_dodel… |
CVE-2025-0488 | Medium | 6.3 | 2025-01-15 | A vulnerability classified as critical has been found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file product_list.php. The manipulat… |
CVE-2025-0487 | Medium | 6.3 | 2025-01-15 | A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /fla… |
CVE-2025-0486 | High | 7.3 | 2025-01-15 | A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-22146 | Critical | 9.1 | 2025-01-15 | Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. I… |
CVE-2025-0485 | Low | 3.5 | 2025-01-15 | A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been classified as problematic. Affected is an unknown function of the file /fladmin/sysconfi… |
CVE-2025-0484 | High | 7.3 | 2025-01-15 | A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical. This issue affects some unknown processing of the file /fladmin/sysconfig… |
CVE-2025-0483 | Low | 3.5 | 2025-01-15 | A vulnerability has been found in Fanli2012 native-php-cms 1.0 and classified as problematic. This vulnerability affects unknown code of the file /fladmin/jump… |
CVE-2025-0482 | High | 7.3 | 2025-01-15 | A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file /fladmin/user_recoverpwd… |
CVE-2025-0501 | High | 7.5 | 2025-01-15 | An issue in the native clients for Amazon WorkSpaces (when running PCoIP protocol) may allow an attacker to access remote sessions via man-in-the-middle. |
CVE-2025-0500 | High | 7.5 | 2025-01-15 | An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to… |
CVE-2025-0481 | Medium | 5.3 | 2025-01-15 | A vulnerability classified as problematic has been found in D-Link DIR-878 1.03. Affected is an unknown function of the file /dllog.cgi of the component HTTP P… |
CVE-2025-23040 | Medium | 6.6 | 2025-01-15 | GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or throug… |
CVE-2025-0502 | Critical | 9.1 | 2025-01-15 | Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Dire… |
CVE-2025-0480 | Medium | 4.3 | 2025-01-15 | A vulnerability classified as problematic has been found in wuzhicms 4.1.0. This affects the function test of the file coreframe/app/search/admin/config.php. T… |
CVE-2025-21083 | Medium | 6.5 | 2025-01-15 | Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post. |
CVE-2025-20088 | Medium | 6.5 | 2025-01-15 | Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authen… |
CVE-2025-20086 | Medium | 6.5 | 2025-01-15 | Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authen… |
CVE-2025-20036 | Medium | 6.5 | 2025-01-15 | Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post. |
CVE-2025-22968 | Critical | 9.8 | 2025-01-15 | An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions |
CVE-2025-22799 | High | 8.5 | 2025-01-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vertim Neon Product Designer neon-product-designer-for-wo… |
CVE-2025-22798 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer Responsive jQuery Slider responsive-jquery-s… |
CVE-2025-22797 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oğulcan Özügenç Gallery and Lightbox gallery-and-lightbox… |
CVE-2025-22795 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitaldonkey Multilang Contact Form multilang-contact-fo… |
CVE-2025-22793 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Bold pagos en linea bold-pagos-en-linea allows DOM-B… |
CVE-2025-22788 | Medium | 5.9 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codexpert, Inc CoDesigner woolementor allows Stored XSS.T… |
CVE-2025-22787 | Medium | 4.3 | 2025-01-15 | Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bu… |
CVE-2025-22786 | High | 7.5 | 2025-01-15 | Path Traversal: '.../...//' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows PHP Local File Incl… |
CVE-2025-22785 | Critical | 9.3 | 2025-01-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ComMotion Course Booking System course-booking-system all… |
CVE-2025-22784 | High | 8.6 | 2025-01-15 | Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Background Control background-control allows Path Traversal.This issue affects Background Contro… |
CVE-2025-22782 | Critical | 9.9 | 2025-01-15 | Unrestricted Upload of File with Dangerous Type vulnerability in Web Ready Now WR Price List Manager For Woocommerce wr-price-list-for-woocommerce allows Uploa… |
CVE-2025-22781 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nativery Nativery nativery allows DOM-Based XSS.This issu… |