2025 CVEs (page 431)
Page 431 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-23026 | Medium | 6.1 | 2025-01-13 | jte (Java Template Engine) is a secure and lightweight template engine for Java and Kotlin. In affected versions Jte HTML templates with `script` tags or scrip… |
CVE-2025-22144 | Critical | 9.8 | 2025-01-13 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can vali… |
CVE-2025-22142 | Medium | 5.4 | 2025-01-13 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In affected versions an admin can add the ability to have users fill out a… |
CVE-2025-22963 | High | 7.5 | 2025-01-13 | Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin. |
CVE-2025-22800 | Medium | 4.3 | 2025-01-13 | Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-22777 | Critical | 9.8 | 2025-01-13 | Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3. |
CVE-2025-22588 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in intelligence_lab Scanventory woocommerce-inventory-manage… |
CVE-2025-22586 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dstoever WPEX Replace DB Urls wpex-replace allows Reflect… |
CVE-2025-22583 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anshulsojatia Scan External Links scan-external-links all… |
CVE-2025-22576 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Downing Site PIN site-pin allows Reflected XSS.Thi… |
CVE-2025-22570 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdjekic Inline Tweets inline-tweets allows Stored XSS.Thi… |
CVE-2025-22569 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GrandSlambert Featured Page Widget featured-page-widget a… |
CVE-2025-22568 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arete-it Post And Page Reactions post-and-page-reactions… |
CVE-2025-22567 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trustist TRUSTist REVIEWer trustist-reviewer allows Refle… |
CVE-2025-22514 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yamna Khawaja KNR Author List Widget knr-author-list-widg… |
CVE-2025-22506 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smart Agenda Smart Agenda smart-agenda-prise-de-rendez-vo… |
CVE-2025-22499 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FAKTOR VIER F4 Post Tree f4-tree allows Reflected XSS.Thi… |
CVE-2025-22498 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N3wNormal LucidLMS lucidlms allows Reflected XSS.This iss… |
CVE-2025-22344 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in timmcdaniels Media Category Library media-category-librar… |
CVE-2025-22337 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin Order Audit Log for WooCommerce order-audi… |
CVE-2025-22314 | High | 7.1 | 2025-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Scripts Food Store – Online Food Delivery & Pickup foo… |
CVE-2025-22828 | Medium | 4.3 | 2025-01-13 | CloudStack users can add and read comments (annotations) on resources they are authorised to access. Due to an access validation issue that affects Apache Cl… |
CVE-2025-0412 | High | 7.8 | 2025-01-13 | Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2025-0410 | Medium | 6.3 | 2025-01-13 | A vulnerability classified as critical was found in liujianview gymxmjpa 1.0. This vulnerability affects the function MenberDaoInpl of the file src/main/java/c… |
CVE-2025-0409 | Medium | 6.3 | 2025-01-13 | A vulnerability classified as critical has been found in liujianview gymxmjpa 1.0. This affects the function MembertypeDaoImpl of the file src/main/java/com/li… |
CVE-2025-0408 | Medium | 6.3 | 2025-01-13 | A vulnerability was found in liujianview gymxmjpa 1.0. It has been rated as critical. Affected by this issue is the function LoosDaoImpl of the file src/main/j… |
CVE-2025-0407 | Medium | 6.3 | 2025-01-13 | A vulnerability was found in liujianview gymxmjpa 1.0. It has been declared as critical. Affected by this vulnerability is the function EquipmentDaoImpl of the… |
CVE-2025-0406 | Medium | 6.3 | 2025-01-13 | A vulnerability was found in liujianview gymxmjpa 1.0. It has been classified as critical. Affected is the function SubjectDaoImpl of the file src/main/java/co… |
CVE-2025-0405 | Medium | 6.3 | 2025-01-13 | A vulnerability was found in liujianview gymxmjpa 1.0 and classified as critical. This issue affects the function GoodsDaoImpl of the file src/main/java/com/li… |
CVE-2025-0404 | Medium | 6.3 | 2025-01-13 | A vulnerability has been found in liujianview gymxmjpa 1.0 and classified as critical. This vulnerability affects the function CoachController of the file src/… |
CVE-2025-0403 | Medium | 5.3 | 2025-01-13 | A vulnerability, which was classified as problematic, has been found in 1902756969 reggie 1.0. Affected by this issue is some unknown functionality of the file… |
CVE-2025-0402 | Medium | 6.3 | 2025-01-13 | A vulnerability classified as critical was found in 1902756969 reggie 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/… |
CVE-2025-0401 | Medium | 5.3 | 2025-01-13 | A vulnerability classified as critical has been found in 1902756969 reggie 1.0. Affected is the function download of the file src/main/java/com/itheima/reggie/… |
CVE-2025-0400 | Low | 2.4 | 2025-01-12 | A vulnerability was found in StarSea99 starsea-mall 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/catego… |
CVE-2025-0399 | Medium | 4.7 | 2025-01-12 | A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file… |
CVE-2025-0398 | Low | 2.4 | 2025-01-12 | A vulnerability has been found in longpi1 warehouse 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2025-0397 | Low | 3.5 | 2025-01-12 | A vulnerability, which was classified as problematic, was found in reckcn SPPanAdmin 1.0. Affected is an unknown function of the file /;/admin/role/edit. The m… |
CVE-2025-0396 | High | 7.8 | 2025-01-12 | A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of… |
CVE-2025-0392 | Medium | 6.3 | 2025-01-11 | A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagrid… |
CVE-2025-0391 | Medium | 6.3 | 2025-01-11 | A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This issue affects the funct… |
CVE-2025-0390 | Medium | 5.3 | 2025-01-11 | A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of th… |
CVE-2025-23109 | Medium | 6.5 | 2025-01-11 | Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for i… |
CVE-2025-23108 | Medium | 4.3 | 2025-01-11 | Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnera… |
CVE-2025-0107 | Critical | 9.8 | 2025-01-11 | An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in… |
CVE-2025-0106 | Medium | 5.3 | 2025-01-11 | A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesystem. |
CVE-2025-0105 | Critical | 9.1 | 2025-01-11 | An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-d… |
CVE-2025-0104 | Medium | 6.1 | 2025-01-11 | A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of… |
CVE-2025-0103 | High | 8.8 | 2025-01-11 | An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hash… |
CVE-2025-23113 | Low | 3.4 | 2025-01-10 | An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containin… |
CVE-2025-23112 | Medium | 6.1 | 2025-01-10 | An issue was discovered in REDCap 14.9.6. A stored cross-site scripting (XSS) vulnerability allows authenticated users to inject malicious scripts into the Sur… |
CVE-2025-23111 | Medium | 4.7 | 2025-01-10 | An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacke… |
CVE-2025-23110 | Medium | 6.1 | 2025-01-10 | An issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in the email-subject field exists while performing an upload of… |
CVE-2025-23079 | Medium | 6.1 | 2025-01-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - ArticleFeedbackv5… |
CVE-2025-23078 | Medium | 6.5 | 2025-01-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Breadcrumbs2 exte… |
CVE-2025-22949 | Critical | 9.8 | 2025-01-10 | Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code execution. |
CVE-2025-22600 | Medium | 6.5 | 2025-01-10 | WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_doacao.php endpoint… |
CVE-2025-22599 | Medium | 6.5 | 2025-01-10 | WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the home.php endpoint of the WeGIA a… |
CVE-2025-22598 | High | 8.3 | 2025-01-10 | WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the cadastrarSocio.php endpoint of the… |
CVE-2025-22597 | High | 8.3 | 2025-01-10 | WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the CobrancaController.php endpoint of… |
CVE-2025-22596 | Medium | 6.5 | 2025-01-10 | WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the modulos_visiveis.php endpoint of… |
CVE-2025-22152 | Critical | 9.1 | 2025-01-10 | Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowin… |
CVE-2025-23022 | Medium | 4.0 | 2025-01-10 | FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c. |
CVE-2025-22946 | Critical | 9.8 | 2025-01-10 | Tenda ac9 v1.0 firmware v15.03.05.19 contains a stack overflow vulnerability in /goform/SetOnlineDevName, which may lead to remote arbitrary code execution. |
CVE-2025-23016 | Critical | 9.3 | 2025-01-10 | FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to… |
CVE-2025-0311 | Medium | 6.4 | 2025-01-10 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to, and i… |
CVE-2025-21380 | High | 8.8 | 2025-01-09 | Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network. |
CVE-2025-21385 | High | 8.8 | 2025-01-09 | A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network. |
CVE-2025-22151 | Low | 3.7 | 2025-01-09 | Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberr… |
CVE-2025-21598 | High | 7.5 | 2025-01-09 | An Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (rpd) allows an unauthenticated, network-based… |
CVE-2025-22149 | | 2025-01-09 | JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full re… | |
CVE-2025-21628 | Critical | 9.1 | 2025-01-09 | Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of query_operator passed from t… |
CVE-2025-21602 | Medium | 6.5 | 2025-01-09 | An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an u… |
CVE-2025-21600 | Medium | 6.5 | 2025-01-09 | An Out-of-Bounds Read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logic… |
CVE-2025-21599 | High | 7.5 | 2025-01-09 | A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Tunnel Driver (jtd) of Juniper Networks Junos OS Evolved allows an unauthenti… |
CVE-2025-21596 | Medium | 5.5 | 2025-01-09 | An Improper Handling of Exceptional Conditions vulnerability in the command-line processing of Juniper Networks Junos OS on SRX1500, SRX4100, and SRX4200 devic… |
CVE-2025-21593 | Medium | 6.5 | 2025-01-09 | An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved all… |
CVE-2025-21592 | Medium | 5.5 | 2025-01-09 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devi… |
CVE-2025-22827 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in joomag WP Joomag wp-joomag allows DOM-Based XSS.This issu… |
CVE-2025-22826 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce Sell Digital Downloads sell-digital-downloads… |
CVE-2025-22824 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lucia.intelisano Live Flight Radar live-flight-radar allo… |
CVE-2025-22823 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jtwerdy Genesis Style Shortcodes genesis-style-shortcodes… |
CVE-2025-22822 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bishawjit-das wp custom countdown wp-custom-countdown all… |
CVE-2025-22821 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vfthemes StorePress storepress allows DOM-Based XSS.This… |
CVE-2025-22820 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in goldsounds VR Views vr-views allows Stored XSS.This issue… |
CVE-2025-22819 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roberto Bottalico Qr Code and Barcode Scanner Reader qr-c… |
CVE-2025-22818 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S3Bubble S3Player – WooCommerce & Elementor Integration d… |
CVE-2025-22817 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra bp-profile-shortcode… |
CVE-2025-22815 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This… |
CVE-2025-22814 | High | 7.1 | 2025-01-09 | Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affect… |
CVE-2025-22813 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot conversatio… |
CVE-2025-22812 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aezaz Shaikh News Ticker Widget for Elementor news-ticker… |
CVE-2025-22811 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Stan MT Addons for Elementor mt-addons-for-eleme… |
CVE-2025-22810 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phi Phan Content Blocks Builder content-blocks-builder al… |
CVE-2025-22809 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theme funda PDF Catalog Woocommerce pdf-catalog-woocommer… |
CVE-2025-22808 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Surbma Surbma | Premium WP surbma-premium-wp allows DOM-B… |
CVE-2025-22807 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Responsive Flickr Slideshow mobile-friendly-flickr… |
CVE-2025-22806 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor black-widge… |
CVE-2025-22805 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Skill Bar skillbars allows Stored XSS.This is… |
CVE-2025-22804 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block author-avatars allo… |
CVE-2025-22803 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Advanced Product Information for WooCommerce w… |