2025 CVEs (page 429)
Page 429 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-23445 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in scottswezey Easy Tynt easy-tynt allows Cross Site Request Forgery.This issue affects Easy Tynt: from n/a thr… |
CVE-2025-23444 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nasir179125 Scroll Top Advanced scroll-top-advanced allow… |
CVE-2025-23442 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in mschertel Shockingly Big IE6 Warning shockingly-big-ie6-warning allows Stored XSS.This issue affects Shockin… |
CVE-2025-23438 | High | 7.1 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat WP PT-Viewer wp-ptviewer allows Refle… |
CVE-2025-23436 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in capa Wp-Scribd-List wp-scribd-list allows Stored XSS.This issue affects Wp-Scribd-List: from n/a through <=… |
CVE-2025-23435 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in marcucci Password Protect Plugin for WordPress password-protect-plugin-for-wordpress allows Stored XSS.This… |
CVE-2025-23434 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viher3 Easy EU Cookie law easy-eu-cookie-law allows Store… |
CVE-2025-23432 | High | 7.1 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AlTi5 AlT Report alt-report allows Reflected XSS.This iss… |
CVE-2025-23430 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Oren Yomtov Mass Custom Fields Manager mass-custom-fields-manager allows Reflected XSS.This issue affects Ma… |
CVE-2025-23429 | High | 7.1 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in altima-interactive Altima Lookbook Free for WooCommerce a… |
CVE-2025-23426 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Binesh Dobhal go Social go-social allows Stored XSS.This issue affects go Social: from n/a through <= 1.0. |
CVE-2025-23424 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in bnovotny Marquee Style RSS News Ticker marquee-style-rss-news-ticker allows Cross Site Request Forgery.This… |
CVE-2025-23423 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in Smackcoders Inc., SendGrid for WordPress wp-sendgrid-mailer allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-20630 | Medium | 6.5 | 2025-01-16 | Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker… |
CVE-2025-20621 | Medium | 6.5 | 2025-01-16 | Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields tha… |
CVE-2025-20072 | Medium | 6.5 | 2025-01-16 | Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an atta… |
CVE-2025-0518 | Medium | 5.3 | 2025-01-16 | Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with… |
CVE-2025-0473 | Medium | 6.5 | 2025-01-16 | Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exi… |
CVE-2025-0472 | High | 7.5 | 2025-01-16 | Information exposure in the PMB platform affecting versions 4.2.13 and earlier. This vulnerability allows an attacker to upload a file to the environment and e… |
CVE-2025-0471 | Critical | 9.9 | 2025-01-16 | Unrestricted file upload vulnerability in the PMB platform, affecting versions 4.0.10 and above. This vulnerability could allow an attacker to upload a file to… |
CVE-2025-22916 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a stack overflow via the pppUserName parameter in the formPPPoESetup function. |
CVE-2025-22913 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function. |
CVE-2025-22912 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept. |
CVE-2025-22907 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a stack overflow via the selSSID parameter in the formWlSiteSurvey function. |
CVE-2025-22906 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN. |
CVE-2025-22905 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp. |
CVE-2025-22904 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a stack overflow via the pptpUserName parameter in the setWAN function. |
CVE-2025-0457 | High | 8.8 | 2025-01-16 | The airPASS from NetVision Information has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbit… |
CVE-2025-0456 | Critical | 9.8 | 2025-01-16 | The airPASS from NetVision Information has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access the specific administrat… |
CVE-2025-0455 | Critical | 9.8 | 2025-01-16 | The airPASS from NetVision Information has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, m… |
CVE-2025-0170 | Medium | 6.1 | 2025-01-16 | The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input… |
CVE-2025-0476 | Medium | 4.3 | 2025-01-16 | Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any u… |
CVE-2025-22976 | High | 7.1 | 2025-01-15 | SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a local attacker to execute arbitrary code via not filtering the content correctly at the "checkOrder… |
CVE-2025-22964 | High | 8.1 | 2025-01-15 | DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient input sanitization and… |
CVE-2025-0215 | Medium | 6.1 | 2025-01-15 | The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parame… |
CVE-2025-0492 | High | 7.5 | 2025-01-15 | A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical. Affected by this vulnerability is the function FUN_00412244. The ma… |
CVE-2025-0491 | Medium | 6.3 | 2025-01-15 | A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. Affected is an unknown function of the file /fladmin/cat_dodel.ph… |
CVE-2025-0490 | Medium | 6.3 | 2025-01-15 | A vulnerability, which was classified as critical, has been found in Fanli2012 native-php-cms 1.0. This issue affects some unknown processing of the file /flad… |
CVE-2025-0489 | Medium | 6.3 | 2025-01-15 | A vulnerability classified as critical was found in Fanli2012 native-php-cms 1.0. This vulnerability affects unknown code of the file /fladmin/friendlink_dodel… |
CVE-2025-0488 | Medium | 6.3 | 2025-01-15 | A vulnerability classified as critical has been found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file product_list.php. The manipulat… |
CVE-2025-0487 | Medium | 6.3 | 2025-01-15 | A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /fla… |
CVE-2025-0486 | High | 7.3 | 2025-01-15 | A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-22146 | Critical | 9.1 | 2025-01-15 | Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. I… |
CVE-2025-0485 | Low | 3.5 | 2025-01-15 | A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been classified as problematic. Affected is an unknown function of the file /fladmin/sysconfi… |
CVE-2025-0484 | High | 7.3 | 2025-01-15 | A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical. This issue affects some unknown processing of the file /fladmin/sysconfig… |
CVE-2025-0483 | Low | 3.5 | 2025-01-15 | A vulnerability has been found in Fanli2012 native-php-cms 1.0 and classified as problematic. This vulnerability affects unknown code of the file /fladmin/jump… |
CVE-2025-0482 | High | 7.3 | 2025-01-15 | A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file /fladmin/user_recoverpwd… |
CVE-2025-0501 | High | 7.5 | 2025-01-15 | An issue in the native clients for Amazon WorkSpaces (when running PCoIP protocol) may allow an attacker to access remote sessions via man-in-the-middle. |
CVE-2025-0500 | High | 7.5 | 2025-01-15 | An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to… |
CVE-2025-0481 | Medium | 5.3 | 2025-01-15 | A vulnerability classified as problematic has been found in D-Link DIR-878 1.03. Affected is an unknown function of the file /dllog.cgi of the component HTTP P… |
CVE-2025-23040 | Medium | 6.6 | 2025-01-15 | GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or throug… |
CVE-2025-0502 | Critical | 9.1 | 2025-01-15 | Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Dire… |
CVE-2025-0480 | Medium | 4.3 | 2025-01-15 | A vulnerability classified as problematic has been found in wuzhicms 4.1.0. This affects the function test of the file coreframe/app/search/admin/config.php. T… |
CVE-2025-21083 | Medium | 6.5 | 2025-01-15 | Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post. |
CVE-2025-20088 | Medium | 6.5 | 2025-01-15 | Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authen… |
CVE-2025-20086 | Medium | 6.5 | 2025-01-15 | Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authen… |
CVE-2025-20036 | Medium | 6.5 | 2025-01-15 | Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post. |
CVE-2025-22968 | Critical | 9.8 | 2025-01-15 | An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions |
CVE-2025-22799 | High | 8.5 | 2025-01-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vertim Neon Product Designer neon-product-designer-for-wo… |
CVE-2025-22798 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer Responsive jQuery Slider responsive-jquery-s… |
CVE-2025-22797 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oğulcan Özügenç Gallery and Lightbox gallery-and-lightbox… |
CVE-2025-22795 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitaldonkey Multilang Contact Form multilang-contact-fo… |
CVE-2025-22793 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Bold pagos en linea bold-pagos-en-linea allows DOM-B… |
CVE-2025-22788 | Medium | 5.9 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codexpert, Inc CoDesigner woolementor allows Stored XSS.T… |
CVE-2025-22787 | Medium | 4.3 | 2025-01-15 | Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bu… |
CVE-2025-22786 | High | 7.5 | 2025-01-15 | Path Traversal: '.../...//' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows PHP Local File Incl… |
CVE-2025-22785 | Critical | 9.3 | 2025-01-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ComMotion Course Booking System course-booking-system all… |
CVE-2025-22784 | High | 8.6 | 2025-01-15 | Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Background Control background-control allows Path Traversal.This issue affects Background Contro… |
CVE-2025-22782 | Critical | 9.9 | 2025-01-15 | Unrestricted Upload of File with Dangerous Type vulnerability in Web Ready Now WR Price List Manager For Woocommerce wr-price-list-for-woocommerce allows Uploa… |
CVE-2025-22781 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nativery Nativery nativery allows DOM-Based XSS.This issu… |
CVE-2025-22780 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrey wp-pano wp-pano allows Stored XSS.This issue affec… |
CVE-2025-22779 | Medium | 4.3 | 2025-01-15 | Missing Authorization vulnerability in codeaffairs WP News Sliders wp-news-sliders allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-22778 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in damniel Lijit Search wp-lijit-wijit allows Reflected XSS… |
CVE-2025-22776 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codebycarter WP Bulletin Board wp-bulletin-board allows R… |
CVE-2025-22773 | Medium | 5.3 | 2025-01-15 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Expl… |
CVE-2025-22769 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Brahma Multifox allows Stored XSS.This issue aff… |
CVE-2025-22766 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masoud Amini Zarinpal Paid Download zarinpal-paid-downloa… |
CVE-2025-22765 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weiluri WP Order By wp-order-by allows Reflected XSS.This… |
CVE-2025-22764 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vipul Jariwala WP Post Corrector wp-post-corrector allows… |
CVE-2025-22762 | Medium | 5.9 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin… |
CVE-2025-22761 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer Ajax Contact Form fws-ajax-contact-form allo… |
CVE-2025-22760 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Ref… |
CVE-2025-22759 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-… |
CVE-2025-22758 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harnani Elementor AI Addons ai-addons-for-elementor allow… |
CVE-2025-22755 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bavington WP Headmaster wp-headmaster allows Reflected XS… |
CVE-2025-22754 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Berkman Klein Center Amber amberlink allows Reflected XSS… |
CVE-2025-22753 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in turboSMTP turboSMTP turbosmtp allows Reflected XSS.This i… |
CVE-2025-22752 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WesternDeal GSheetConnector for Forminator Forms gsheetco… |
CVE-2025-22751 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Partners partners allows Reflected XSS.This is… |
CVE-2025-22750 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patel Post Carousel & Slider post-types-carousel-slider a… |
CVE-2025-22749 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemesCraft.co Social Media Engine social-media-engine al… |
CVE-2025-22748 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Setmore SetMore Theme – Custom Post Types service-provide… |
CVE-2025-22747 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten Foundation Columns foundation-columns allows St… |
CVE-2025-22746 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zartis HireHive Job Plugin zartis-job-plugin allows Store… |
CVE-2025-22745 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bjoerne Navigation Du Lapin Blanc navigation-du-lapin-bla… |
CVE-2025-22744 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seodev S-DEV SEO s-dev-seo allows Stored XSS.This issue a… |
CVE-2025-22743 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohsin Rasool Twitter Bootstrap Collapse aka Accordian Sh… |
CVE-2025-22742 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falldeaf WP ViewSTL wp-viewstl allows DOM-Based XSS.This… |
CVE-2025-22738 | Medium | 5.9 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alimir WP ULike wp-ulike allows Stored XSS.This issue aff… |
CVE-2025-22737 | Medium | 5.3 | 2025-01-15 | Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issu… |