2025 CVEs (page 48)
Page 48 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69355 | Medium | 4.3 | 2026-01-06 | Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-69354 | Medium | 4.3 | 2026-01-06 | Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-69353 | Medium | 4.3 | 2026-01-06 | Missing Authorization vulnerability in Proxy & VPN Blocker Proxy & VPN Blocker proxy-vpn-blocker allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-69352 | Medium | 5.4 | 2026-01-06 | Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-69351 | High | 8.5 | 2026-01-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Blind SQ… |
CVE-2025-69350 | Medium | 5.9 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion accordions-wp allows Stored XSS.Thi… |
CVE-2025-69349 | Medium | 5.4 | 2026-01-06 | Missing Authorization vulnerability in Fahad Mahmood RSS Feed Widget rss-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-69348 | Medium | 4.3 | 2026-01-06 | Missing Authorization vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar allows Exploiting Incorrectly Configured… |
CVE-2025-69346 | Medium | 4.3 | 2026-01-06 | Missing Authorization vulnerability in WPCenter AffiliateX affiliatex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-69345 | Medium | 4.3 | 2026-01-06 | Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-69342 | High | 7.5 | 2026-01-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VanKarWai Calafate calafate allows PHP… |
CVE-2025-69341 | Medium | 5.4 | 2026-01-06 | Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Confi… |
CVE-2025-69336 | Medium | 4.3 | 2026-01-06 | Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-69335 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Team Showcase team-showcase allows Stored XSS… |
CVE-2025-69334 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocomme… |
CVE-2025-69331 | Medium | 4.3 | 2026-01-06 | Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-69327 | Medium | 4.3 | 2026-01-06 | Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-69086 | High | 8.1 | 2026-01-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Issabella issabella allows P… |
CVE-2025-69085 | High | 7.1 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins JobBank jobbank allows Reflected XSS.This issue… |
CVE-2025-69084 | High | 7.1 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Re… |
CVE-2025-69083 | High | 8.1 | 2026-01-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Frappé frappe allows PHP… |
CVE-2025-63083 | Medium | 6.1 | 2026-01-06 | Lack of output escaping leads to a XSS vector in the pagebreak plugin. |
CVE-2025-63082 | Medium | 6.1 | 2026-01-06 | Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. |
CVE-2025-60534 | Critical | 9.8 | 2026-01-06 | Blue Access Cobalt v02.000.195 suffers from an authentication bypass vulnerability, which allows an attacker to selectively proxy requests in order to operate… |
CVE-2025-47553 | High | 8.8 | 2026-01-06 | Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a… |
CVE-2025-39477 | Critical | 9.8 | 2026-01-06 | Missing Authorization vulnerability in Sfwebservice InWave Jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InWa… |
CVE-2025-36589 | High | 7.6 | 2026-01-06 | Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker w… |
CVE-2025-65212 | Critical | 9.8 | 2026-01-06 | An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification… |
CVE-2025-60262 | Critical | 9.8 | 2026-01-06 | An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulnerability about vsft… |
CVE-2025-59379 | High | 7.5 | 2026-01-06 | DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying SQL database via Bli… |
CVE-2025-14979 | High | 7.8 | 2026-01-06 | AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.2… |
CVE-2025-46696 | Medium | 6.4 | 2026-01-06 | Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application, version(s) versions 5.26 to 5.30, contain(s) an Execution with Unnecessary Privileges vulnerab… |
CVE-2025-14026 | High | 7.8 | 2026-01-06 | Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes libr… |
CVE-2025-9637 | Medium | 6.5 | 2026-01-06 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missi… |
CVE-2025-9318 | Medium | 6.5 | 2026-01-06 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_linking’ parameter in… |
CVE-2025-14552 | Medium | 6.4 | 2026-01-06 | The MediaPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mpp-uploader shortcode in all versions up to, and including… |
CVE-2025-9294 | Medium | 4.3 | 2026-01-06 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check… |
CVE-2025-5919 | Medium | 6.5 | 2026-01-06 | The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to… |
CVE-2025-13964 | Medium | 5.3 | 2026-01-06 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the catch_lp… |
CVE-2025-13766 | Medium | 5.4 | 2026-01-06 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion of data du… |
CVE-2025-14371 | Medium | 4.3 | 2026-01-06 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca… |
CVE-2025-13812 | Medium | 4.3 | 2026-01-06 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of da… |
CVE-2025-12067 | Medium | 6.4 | 2026-01-06 | The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Cell Content in all versions up to, and… |
CVE-2025-4776 | Medium | 6.4 | 2026-01-06 | The Phlox theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` HTML attribute in all versions up to, and including, 2.17.7 d… |
CVE-2025-13215 | Medium | 5.3 | 2026-01-06 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.17.13 via… |
CVE-2025-15001 | Critical | 9.8 | 2026-01-06 | The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This… |
CVE-2025-14997 | High | 8.8 | 2026-01-06 | The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delet… |
CVE-2025-14996 | Critical | 9.8 | 2026-01-06 | The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and i… |
CVE-2025-14441 | Medium | 4.3 | 2026-01-06 | The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE `/subscribers` REST API endpoi… |
CVE-2025-14438 | Medium | 6.4 | 2026-01-06 | The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0.30 via the 'pixaba… |
CVE-2025-14120 | Medium | 6.4 | 2026-01-06 | The URL Image Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.7 due t… |
CVE-2025-14153 | Medium | 6.5 | 2026-01-06 | The Page Expire Popup/Redirection for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' shortcode attribute in all versions… |
CVE-2025-14034 | Medium | 5.3 | 2026-01-06 | The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check o… |
CVE-2025-13746 | Medium | 6.4 | 2026-01-06 | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and… |
CVE-2025-13652 | Medium | 6.5 | 2026-01-06 | The CBX Bookmark & Favorite plugin for WordPress is vulnerable to generic SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.0.4… |
CVE-2025-13409 | Medium | 4.9 | 2026-01-06 | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to SQL Injection via the 'params' parameter in all versions up to, and including… |
CVE-2025-11723 | Medium | 6.5 | 2026-01-06 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all vers… |
CVE-2025-11370 | Medium | 5.3 | 2026-01-06 | The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin fo… |
CVE-2025-12793 | High | 7.8 | 2026-01-06 | An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the application to load a DLL from an attacke… |
CVE-2025-20807 | Medium | 6.7 | 2026-01-06 | In dpe, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already o… |
CVE-2025-20806 | Medium | 6.7 | 2026-01-06 | In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained… |
CVE-2025-20805 | Medium | 6.7 | 2026-01-06 | In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained… |
CVE-2025-20804 | Medium | 6.7 | 2026-01-06 | In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained… |
CVE-2025-20803 | Medium | 6.7 | 2026-01-06 | In dpe, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obt… |
CVE-2025-20802 | Medium | 6.7 | 2026-01-06 | In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already ob… |
CVE-2025-20801 | High | 7.0 | 2026-01-06 | In seninf, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obt… |
CVE-2025-20800 | High | 7.8 | 2026-01-06 | In mminfra, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20799 | High | 7.8 | 2026-01-06 | In c2ps, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtaine… |
CVE-2025-20798 | High | 7.8 | 2026-01-06 | In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20797 | High | 7.8 | 2026-01-06 | In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20796 | High | 7.8 | 2026-01-06 | In imgsys, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2025-20795 | High | 7.8 | 2026-01-06 | In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2025-20794 | Medium | 6.5 | 2026-01-06 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20793 | Medium | 6.5 | 2026-01-06 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20787 | Medium | 6.7 | 2026-01-06 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20786 | Medium | 6.7 | 2026-01-06 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20785 | Medium | 6.7 | 2026-01-06 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20784 | Medium | 6.7 | 2026-01-06 | In display, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege if a malicious actor has already… |
CVE-2025-20783 | Medium | 6.7 | 2026-01-06 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20782 | Medium | 6.7 | 2026-01-06 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20781 | High | 7.8 | 2026-01-06 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20780 | High | 7.8 | 2026-01-06 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20779 | High | 7.0 | 2026-01-06 | In display, there is a possible use after free due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtai… |
CVE-2025-20778 | High | 7.8 | 2026-01-06 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20762 | Medium | 6.5 | 2026-01-06 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20761 | Medium | 6.5 | 2026-01-06 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20760 | Medium | 6.5 | 2026-01-06 | In Modem, there is a possible read of uninitialized heap data due to an uncaught exception. This could lead to remote denial of service, if a UE has connected… |
CVE-2025-15385 | Critical | 9.8 | 2026-01-06 | Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue affects com.Afmobi.B… |
CVE-2025-15364 | High | 7.3 | 2026-01-06 | The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due… |
CVE-2025-69197 | Medium | 6.5 | 2026-01-06 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Us… |
CVE-2025-68954 | Medium | 5.4 | 2026-01-06 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a… |
CVE-2025-15444 | Critical | 9.8 | 2026-01-06 | Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium libsodium <= 1.0.20 or a version of libsodium release… |
CVE-2025-69230 | Medium | 5.3 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a lo… |
CVE-2025-69229 | Medium | 5.3 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excess… |
CVE-2025-69228 | High | 7.5 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an A… |
CVE-2025-69227 | High | 7.5 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert state… |
CVE-2025-69225 | Medium | 5.3 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals… |
CVE-2025-69226 | Medium | 5.3 | 2026-01-05 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of abso… |
CVE-2025-69224 | Medium | 6.5 | 2026-01-05 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggli… |
CVE-2025-69223 | High | 7.5 | 2026-01-05 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against… |