2025 CVEs (page 5)
Page 5 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69106 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions. |
CVE-2025-68524 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions. |
CVE-2025-66391 | High | 8.8 | 2026-06-17 | In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a… |
CVE-2025-60236 | Critical | 9.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5. |
CVE-2025-60231 | Critical | 9.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8… |
CVE-2025-60230 | Critical | 9.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9. |
CVE-2025-60229 | Critical | 9.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0. |
CVE-2025-59554 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions. |
CVE-2025-15657 | Medium | 5.3 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions. |
CVE-2025-69179 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions. |
CVE-2025-69178 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions. |
CVE-2025-69177 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions. |
CVE-2025-69176 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in ITactics <= 1.0 versions. |
CVE-2025-69173 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions. |
CVE-2025-69172 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Resurs <= 1.3 versions. |
CVE-2025-69171 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions. |
CVE-2025-69168 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Spike <= 1.2 versions. |
CVE-2025-69167 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Eros <= 1.3 versions. |
CVE-2025-69165 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Choreo <= 1.6 versions. |
CVE-2025-69163 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in WineShop <= 3.17 versions. |
CVE-2025-69162 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Grecko <= 5.17 versions. |
CVE-2025-69161 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Snowy <= 1.13 versions. |
CVE-2025-69160 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gita <= 1.11 versions. |
CVE-2025-69159 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Printo <= 1.11 versions. |
CVE-2025-69151 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions. |
CVE-2025-69150 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Medeus <= 1.14 versions. |
CVE-2025-69149 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions. |
CVE-2025-69148 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Quirky <= 1.23 versions. |
CVE-2025-69147 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Putter <= 1.17 versions. |
CVE-2025-69146 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Dom <= 1.24 versions. |
CVE-2025-69145 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gat <= 1.16 versions. |
CVE-2025-69143 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Mission <= 1.22 versions. |
CVE-2025-69142 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Abelle <= 1.22 versions. |
CVE-2025-69141 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions. |
CVE-2025-69139 | High | 8.6 | 2026-06-17 | Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions. |
CVE-2025-69138 | High | 8.8 | 2026-06-17 | Subscriber Privilege Escalation in Genemy <= 1.6.6 versions. |
CVE-2025-69137 | Medium | 6.5 | 2026-06-17 | Subscriber Broken Access Control in Genemy <= 1.6.6 versions. |
CVE-2025-69136 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions. |
CVE-2025-69135 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions. |
CVE-2025-69131 | High | 7.5 | 2026-06-17 | Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions. |
CVE-2025-69129 | Critical | 10.0 | 2026-06-17 | Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions. |
CVE-2025-69125 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions. |
CVE-2025-69124 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Especio <= 1.0 versions. |
CVE-2025-69122 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions. |
CVE-2025-69121 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions. |
CVE-2025-69119 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions. |
CVE-2025-69118 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions. |
CVE-2025-69117 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions. |
CVE-2025-69116 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions. |
CVE-2025-69114 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions. |
CVE-2025-69113 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions. |
CVE-2025-69112 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions. |
CVE-2025-69110 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions. |
CVE-2025-69109 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions. |
CVE-2025-69108 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions. |
CVE-2025-69107 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions. |
CVE-2025-69105 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions. |
CVE-2025-69104 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions. |
CVE-2025-69103 | High | 7.5 | 2026-06-17 | Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions. |
CVE-2025-62340 | Low | 3.1 | 2026-06-17 | HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automaticall… |
CVE-2025-60223 | High | 7.7 | 2026-06-17 | Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot <= 13.6.5 versions. |
CVE-2025-60218 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in PT Luxa Addons <= 1.2.2 versions. |
CVE-2025-60205 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in ThemeREX Addons <= 2.36.1.1 versions. |
CVE-2025-60085 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions. |
CVE-2025-59872 | Medium | 4.3 | 2026-06-17 | HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain comman… |
CVE-2025-59563 | High | 8.8 | 2026-06-17 | Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions. |
CVE-2025-59560 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions. |
CVE-2025-58954 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions. |
CVE-2025-58953 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Joly <= 1.22.0 versions. |
CVE-2025-58952 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions. |
CVE-2025-58924 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Geya <= 1.15 versions. |
CVE-2025-49403 | High | 7.5 | 2026-06-17 | Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions. |
CVE-2025-48643 | High | 7.8 | 2026-06-17 | In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to local escalation of privilege with no additi… |
CVE-2025-48640 | High | 8.0 | 2026-06-17 | In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adja… |
CVE-2025-48617 | High | 7.8 | 2026-06-17 | In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of… |
CVE-2025-48571 | Medium | 4.3 | 2026-06-17 | In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic error in the code. This could lead to rem… |
CVE-2025-31013 | High | 7.1 | 2026-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Th… |
CVE-2025-15642 | | 2026-06-17 | Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing th… | |
CVE-2025-15641 | | 2026-06-17 | Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially… | |
CVE-2025-71261 | High | 8.6 | 2026-06-16 | An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshak… |
CVE-2025-14272 | | 2026-06-16 | A security issue was identified in Pavilion due to improper authorization enforcement in API endpoints. This vulnerability can allow an unauthorized actor to e… | |
CVE-2025-13036 | | 2026-06-16 | An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login endpoint, an attacker ma… | |
CVE-2025-11694 | | 2026-06-16 | A security issue exists within 1769 CompactLogix controllers due to the missing validation of sequence numbers and source IP addresses in the CIP protocol. Thi… | |
CVE-2025-68045 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions. |
CVE-2025-9912 | Medium | 6.3 | 2026-06-16 | Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to ex… |
CVE-2025-10262 | Medium | 6.3 | 2026-06-16 | Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successful exploitation of this vulnerability ma… |
CVE-2025-69332 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in Bookify <= 1.1.1 versions. |
CVE-2025-68872 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 versions. |
CVE-2025-68851 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions. |
CVE-2025-68840 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions. |
CVE-2025-68049 | Medium | 6.3 | 2026-06-15 | Subscriber Broken Access Control in bunny.net <= 2.3.6 versions. |
CVE-2025-60175 | Medium | 4.4 | 2026-06-15 | Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions. |
CVE-2025-59133 | High | 7.5 | 2026-06-15 | Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions. |
CVE-2025-70102 | Medium | 6.3 | 2026-06-15 | A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:18… |
CVE-2025-68713 | High | 8.0 | 2026-06-15 | An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted appli… |
CVE-2025-56814 | High | 7.8 | 2026-06-15 | A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters. |
CVE-2025-55663 | Medium | 5.5 | 2026-06-15 | A segmentation violation in the Track_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2025-55661 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafte… |
CVE-2025-55660 | Medium | 5.5 | 2026-06-15 | A stack overflow in the gf_opus_read_length function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via sup… |
CVE-2025-55652 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via s… |