2025 CVEs (page 428)
Page 428 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22780 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrey wp-pano wp-pano allows Stored XSS.This issue affec… |
CVE-2025-22779 | Medium | 4.3 | 2025-01-15 | Missing Authorization vulnerability in codeaffairs WP News Sliders wp-news-sliders allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-22778 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in damniel Lijit Search wp-lijit-wijit allows Reflected XSS… |
CVE-2025-22776 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codebycarter WP Bulletin Board wp-bulletin-board allows R… |
CVE-2025-22773 | Medium | 5.3 | 2025-01-15 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Expl… |
CVE-2025-22769 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Brahma Multifox allows Stored XSS.This issue aff… |
CVE-2025-22766 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masoud Amini Zarinpal Paid Download zarinpal-paid-downloa… |
CVE-2025-22765 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weiluri WP Order By wp-order-by allows Reflected XSS.This… |
CVE-2025-22764 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vipul Jariwala WP Post Corrector wp-post-corrector allows… |
CVE-2025-22762 | Medium | 5.9 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin… |
CVE-2025-22761 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer Ajax Contact Form fws-ajax-contact-form allo… |
CVE-2025-22760 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Ref… |
CVE-2025-22759 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-… |
CVE-2025-22758 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harnani Elementor AI Addons ai-addons-for-elementor allow… |
CVE-2025-22755 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bavington WP Headmaster wp-headmaster allows Reflected XS… |
CVE-2025-22754 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Berkman Klein Center Amber amberlink allows Reflected XSS… |
CVE-2025-22753 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in turboSMTP turboSMTP turbosmtp allows Reflected XSS.This i… |
CVE-2025-22752 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WesternDeal GSheetConnector for Forminator Forms gsheetco… |
CVE-2025-22751 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Partners partners allows Reflected XSS.This is… |
CVE-2025-22750 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patel Post Carousel & Slider post-types-carousel-slider a… |
CVE-2025-22749 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemesCraft.co Social Media Engine social-media-engine al… |
CVE-2025-22748 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Setmore SetMore Theme – Custom Post Types service-provide… |
CVE-2025-22747 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten Foundation Columns foundation-columns allows St… |
CVE-2025-22746 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zartis HireHive Job Plugin zartis-job-plugin allows Store… |
CVE-2025-22745 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bjoerne Navigation Du Lapin Blanc navigation-du-lapin-bla… |
CVE-2025-22744 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seodev S-DEV SEO s-dev-seo allows Stored XSS.This issue a… |
CVE-2025-22743 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohsin Rasool Twitter Bootstrap Collapse aka Accordian Sh… |
CVE-2025-22742 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falldeaf WP ViewSTL wp-viewstl allows DOM-Based XSS.This… |
CVE-2025-22738 | Medium | 5.9 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alimir WP ULike wp-ulike allows Stored XSS.This issue aff… |
CVE-2025-22737 | Medium | 5.3 | 2025-01-15 | Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issu… |
CVE-2025-22736 | High | 8.8 | 2025-01-15 | Incorrect Privilege Assignment vulnerability in Saad Iqbal User Management user-management allows Privilege Escalation.This issue affects User Management: from… |
CVE-2025-22734 | Medium | 5.9 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Posts Footer Manager intell… |
CVE-2025-22731 | Medium | 4.3 | 2025-01-15 | Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Cross Site R… |
CVE-2025-22729 | Medium | 4.3 | 2025-01-15 | Missing Authorization vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-22724 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MojofyWP Product Carousel For WooCommerce – WoorouSell al… |
CVE-2025-22587 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atanas Krachev SEO Bulk Editor seo-bulk-editor allows Sto… |
CVE-2025-22346 | Medium | 6.4 | 2025-01-15 | Server-Side Request Forgery (SSRF) vulnerability in Faizaan Gagan Course Migration for LearnDash allows Server Side Request Forgery.This issue affects Course M… |
CVE-2025-22329 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agile Logix Free Google Maps wp-map allows Stored XSS.Thi… |
CVE-2025-22317 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gallery Ape Photo Gallery – Image Gallery by Ape gallery-… |
CVE-2025-21088 | Medium | 6.5 | 2025-01-15 | Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's… |
CVE-2025-21629 | High | 8.2 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets The blamed commit disabled ha… |
CVE-2025-0448 | Medium | 4.3 | 2025-01-15 | Inappropriate implementation in Compositing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-0447 | High | 8.8 | 2025-01-15 | Inappropriate implementation in Navigation in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform privilege escalation via a crafted HTML… |
CVE-2025-0446 | Medium | 4.3 | 2025-01-15 | Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-0443 | High | 8.8 | 2025-01-15 | Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-0442 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-0441 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information fro… |
CVE-2025-0440 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2025-0439 | Medium | 6.5 | 2025-01-15 | Race in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing… |
CVE-2025-0438 | High | 8.8 | 2025-01-15 | Stack buffer overflow in Tracing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML p… |
CVE-2025-0437 | High | 8.8 | 2025-01-15 | Out of bounds read in Metrics in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2025-0436 | High | 8.8 | 2025-01-15 | Integer overflow in Skia in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2025-0435 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2025-0434 | High | 8.8 | 2025-01-15 | Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2025-0193 | | 2025-01-15 | A stored Cross-site Scripting (XSS) vulnerability exists in the MGate 5121/5122/5123 Series firmware version v1.0 because of insufficient sanitization and enco… | |
CVE-2025-0356 | High | 7.2 | 2025-01-15 | NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network. |
CVE-2025-0355 | High | 7.5 | 2025-01-15 | Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS… |
CVE-2025-0354 | Medium | 4.8 | 2025-01-15 | Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, W… |
CVE-2025-23061 | Critical | 9.0 | 2025-01-15 | Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an inc… |
CVE-2025-22394 | Medium | 6.7 | 2025-01-15 | Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with loc… |
CVE-2025-21101 | Medium | 6.6 | 2025-01-15 | Dell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability. A local malicious user could potentially exploit this vulnerability d… |
CVE-2025-23013 | | 2025-01-15 | In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be dep… | |
CVE-2025-0343 | High | 7.5 | 2025-01-15 | Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itself which assumes th… |
CVE-2025-22997 | Medium | 4.8 | 2025-01-15 | A stored cross-site scripting (XSS) vulnerability in the prf_table_content component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrar… |
CVE-2025-22996 | Medium | 4.8 | 2025-01-15 | A stored cross-site scripting (XSS) vulnerability in the spf_table_content component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrar… |
CVE-2025-23019 | Medium | 5.4 | 2025-01-14 | IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network interface. |
CVE-2025-23018 | Medium | 5.4 | 2025-01-14 | IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attacker to spo… |
CVE-2025-21139 | High | 7.8 | 2025-01-14 | Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-21138 | High | 7.8 | 2025-01-14 | Substance3D - Designer versions 14.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-21137 | High | 7.8 | 2025-01-14 | Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-21136 | High | 7.8 | 2025-01-14 | Substance3D - Designer versions 14.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-21135 | High | 7.8 | 2025-01-14 | Animate versions 24.0.6, 23.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code executi… |
CVE-2025-23074 | Low | 2.4 | 2025-01-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality Misus… |
CVE-2025-23073 | Low | 3.5 | 2025-01-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded… |
CVE-2025-23072 | Medium | 5.4 | 2025-01-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RefreshSpecial Ex… |
CVE-2025-23042 | High | 7.5 | 2025-01-14 | Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python funct… |
CVE-2025-23041 | Medium | 5.8 | 2025-01-14 | Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated on… |
CVE-2025-21134 | High | 7.8 | 2025-01-14 | Illustrator on iPad versions 3.0.7 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exec… |
CVE-2025-21133 | High | 7.8 | 2025-01-14 | Illustrator on iPad versions 3.0.7 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exec… |
CVE-2025-21132 | High | 7.8 | 2025-01-14 | Substance3D - Stager versions 3.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-21131 | High | 7.8 | 2025-01-14 | Substance3D - Stager versions 3.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-21130 | High | 7.8 | 2025-01-14 | Substance3D - Stager versions 3.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-21129 | High | 7.8 | 2025-01-14 | Substance3D - Stager versions 3.0.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2025-21128 | High | 7.8 | 2025-01-14 | Substance3D - Stager versions 3.0.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-21127 | High | 7.8 | 2025-01-14 | Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could lead to arbitrary code executio… |
CVE-2025-21122 | High | 7.8 | 2025-01-14 | Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code… |
CVE-2025-0474 | High | 7.7 | 2025-01-14 | Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery (SSRF) allowing for arbitrary file read and network resource requests as the applicati… |
CVE-2025-23366 | Medium | 6.5 | 2025-01-14 | A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed… |
CVE-2025-23052 | High | 7.2 | 2025-01-14 | Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this vulnerability coul… |
CVE-2025-23051 | High | 7.2 | 2025-01-14 | An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. Successful exploitat… |
CVE-2025-23025 | Critical | 9.0 | 2025-01-14 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. NOTE: The Realtime WYSIWYG Editor extension was **expe… |
CVE-2025-21607 | High | 7.5 | 2025-01-14 | Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of t… |
CVE-2025-21417 | High | 8.8 | 2025-01-14 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2025-21413 | High | 8.8 | 2025-01-14 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2025-21411 | High | 8.8 | 2025-01-14 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2025-21409 | High | 8.8 | 2025-01-14 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2025-21405 | High | 7.3 | 2025-01-14 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2025-21403 | Medium | 6.4 | 2025-01-14 | On-Premises Data Gateway Information Disclosure Vulnerability |
CVE-2025-21402 | High | 7.8 | 2025-01-14 | Microsoft Office OneNote Remote Code Execution Vulnerability |
CVE-2025-21395 | High | 7.8 | 2025-01-14 | Microsoft Access Remote Code Execution Vulnerability |