2025 CVEs (page 50)
Page 50 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15458 | High | 7.3 | 2026-01-05 | A vulnerability was determined in bg5sbk MiniCMS up to 1.8. This affects an unknown function of the file /mc-admin/post-edit.php of the component Article Handl… |
CVE-2025-15457 | High | 7.3 | 2026-01-05 | A vulnerability was found in bg5sbk MiniCMS up to 1.8. The impacted element is an unknown function of the file /minicms/mc-admin/post.php of the component Tras… |
CVE-2025-15456 | High | 7.3 | 2026-01-05 | A vulnerability has been found in bg5sbk MiniCMS up to 1.8. The affected element is an unknown function of the file /mc-admin/page-edit.php of the component Pu… |
CVE-2025-15455 | Medium | 6.5 | 2026-01-05 | A flaw has been found in bg5sbk MiniCMS up to 1.8. Impacted is the function delete_page of the file /minicms/mc-admin/page.php of the component File Recovery R… |
CVE-2025-15454 | Low | 3.1 | 2026-01-05 | A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender… |
CVE-2025-15453 | Medium | 6.3 | 2026-01-05 | A security vulnerability has been detected in milvus up to 2.6.7. This vulnerability affects the function expr.Exec of the file pkg/util/expr/expr.go of the co… |
CVE-2025-15452 | Low | 2.4 | 2026-01-05 | A weakness has been identified in xnx3 wangmarket up to 4.9. This affects the function variableList of the file /admin/system/variableList.do of the component… |
CVE-2025-15451 | Low | 2.4 | 2026-01-05 | A security flaw has been discovered in xnx3 wangmarket up to 4.9. Affected by this issue is some unknown functionality of the file /admin/system/variableSave.d… |
CVE-2025-15450 | Medium | 6.3 | 2026-01-05 | A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected by this vulnerability is the function findOrderH… |
CVE-2025-5591 | Medium | 5.4 | 2026-01-05 | Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and per… |
CVE-2025-15449 | Medium | 5.4 | 2026-01-05 | A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/ja… |
CVE-2025-15448 | Medium | 6.3 | 2026-01-05 | A vulnerability was found in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. This impacts the function Upload of the file src/main/java/c… |
CVE-2025-15443 | Medium | 4.7 | 2026-01-04 | A vulnerability was identified in CRMEB up to 5.6.1. This issue affects some unknown processing of the file /adminapi/product/product_export. Such manipulation… |
CVE-2025-15442 | Medium | 4.7 | 2026-01-04 | A vulnerability was determined in CRMEB up to 5.6.1. This vulnerability affects unknown code of the file /adminapi/export/product_list. This manipulation of th… |
CVE-2025-14830 | Medium | 4.9 | 2026-01-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in JFrog Artifactory (Workers) allows Cross-Site Scri… |
CVE-2025-3660 | Medium | 6.5 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains a broken access control vulnerability that allows authenticated users to access other users'… |
CVE-2025-3654 | Medium | 5.3 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to device hardware in… |
CVE-2025-3653 | High | 7.3 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper access control vulnerability that allows unauthorized device manipulation by acce… |
CVE-2025-3652 | Medium | 5.3 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to private audio reco… |
CVE-2025-3646 | High | 7.3 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authorization bypass vulnerability that allows unauthorized users to add users as shared o… |
CVE-2025-15115 | Medium | 6.5 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any us… |
CVE-2025-64125 | | 2026-01-03 | A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (… | |
CVE-2025-64124 | High | 8.8 | 2026-01-03 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows… |
CVE-2025-64123 | Critical | 9.8 | 2026-01-02 | Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack… |
CVE-2025-64122 | Medium | 5.5 | 2026-01-02 | Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Signature Spoofing by Key Theft.This issue affects Mu… |
CVE-2025-64121 | Critical | 9.8 | 2026-01-02 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue… |
CVE-2025-64120 | High | 8.8 | 2026-01-02 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows… |
CVE-2025-64119 | | 2026-01-02 | A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9. | |
CVE-2025-69417 | Medium | 5.0 | 2026-01-02 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via… |
CVE-2025-69416 | Medium | 5.0 | 2026-01-02 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via… |
CVE-2025-69415 | High | 7.1 | 2026-01-02 | In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is curre… |
CVE-2025-69414 | High | 8.5 | 2026-01-02 | Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token. |
CVE-2025-67160 | High | 7.5 | 2026-01-02 | An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal. |
CVE-2025-67159 | High | 7.5 | 2026-01-02 | Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext. |
CVE-2025-67158 | High | 7.5 | 2026-01-02 | An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitive information and e… |
CVE-2025-34171 | Medium | 5.3 | 2026-01-02 | CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and… |
CVE-2025-15439 | Medium | 6.3 | 2026-01-02 | A vulnerability was identified in Daptin 0.10.3. Affected by this vulnerability is the function goqu.L of the file server/resource/resource_aggregate.go of the… |
CVE-2025-9110 | High | 7.5 | 2026-01-02 | An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions… |
CVE-2025-69284 | Medium | 4.3 | 2026-01-02 | Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings… |
CVE-2025-67269 | High | 7.5 | 2026-01-02 | An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67… |
CVE-2025-67268 | Critical | 9.8 | 2026-01-02 | gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handle… |
CVE-2025-62852 | Medium | 6.5 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they c… |
CVE-2025-62842 | High | 7.8 | 2026-01-02 | An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they ca… |
CVE-2025-62840 | Low | 3.3 | 2026-01-02 | A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local n… |
CVE-2025-59389 | Critical | 9.8 | 2026-01-02 | An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to execute unauthorize… |
CVE-2025-59387 | | 2026-01-02 | An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability t… | |
CVE-2025-59384 | High | 7.5 | 2026-01-02 | A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected… |
CVE-2025-59381 | Medium | 4.9 | 2026-01-02 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they ca… |
CVE-2025-59380 | Medium | 4.9 | 2026-01-02 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they ca… |
CVE-2025-53597 | Medium | 6.5 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vuln… |
CVE-2025-53594 | | 2026-01-02 | A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulner… | |
CVE-2025-52871 | Medium | 6.5 | 2026-01-02 | An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerabil… |
CVE-2025-48721 | Medium | 6.5 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they c… |
CVE-2025-11837 | Critical | 9.8 | 2026-01-02 | An improper control of generation of code vulnerability has been reported to affect Malware Remover. The remote attackers can then exploit the vulnerability to… |
CVE-2025-65125 | Critical | 9.8 | 2026-01-02 | SQL injection in gosaliajainam/online-movie-booking 5.5 in movie_details.php allows attackers to gain sensitive information. |
CVE-2025-62857 | Medium | 6.1 | 2026-01-02 | A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mech… |
CVE-2025-57705 | Medium | 4.9 | 2026-01-02 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker… |
CVE-2025-54166 | Medium | 4.9 | 2026-01-02 | An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, th… |
CVE-2025-54165 | Medium | 4.9 | 2026-01-02 | An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, th… |
CVE-2025-54164 | Medium | 4.9 | 2026-01-02 | An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, th… |
CVE-2025-53596 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-53593 | Medium | 6.5 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they c… |
CVE-2025-53592 | Medium | 6.5 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they ca… |
CVE-2025-53591 | Medium | 6.5 | 2026-01-02 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-53590 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-53589 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-53414 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-53405 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52872 | High | 8.1 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then ex… |
CVE-2025-52864 | High | 8.1 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then ex… |
CVE-2025-52863 | High | 8.1 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then ex… |
CVE-2025-52431 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52430 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52426 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-47208 | Medium | 6.5 | 2026-01-02 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker… |
CVE-2025-45286 | Medium | 6.1 | 2026-01-02 | A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2025-44013 | Medium | 6.5 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they ca… |
CVE-2025-15438 | Medium | 4.7 | 2026-01-02 | A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Me… |
CVE-2025-15437 | Low | 3.5 | 2026-01-02 | A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performing a manipulation of… |
CVE-2025-15436 | High | 7.3 | 2026-01-02 | A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/work_edit.jsp. Such manipulation… |
CVE-2025-15435 | High | 7.3 | 2026-01-02 | A flaw has been found in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_update.jsp. This manipulation… |
CVE-2025-15434 | High | 7.3 | 2026-01-02 | A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. The manipulation of the argument zpjhid results… |
CVE-2025-15432 | Medium | 5.3 | 2026-01-02 | A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function downloadShowFile of… |
CVE-2025-15431 | High | 8.8 | 2026-01-02 | A flaw has been found in UTT 进取 512W 1.7.7-171114. This affects the function strcpy of the file /goform/formFtpServerDirConfig. Executing a manipulation of the… |
CVE-2025-15430 | High | 8.8 | 2026-01-02 | A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerShareDirSelcet. Perfor… |
CVE-2025-15429 | High | 8.8 | 2026-01-02 | A security vulnerability has been detected in UTT 进取 512W 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /goform/formConfigCli… |
CVE-2025-14072 | Medium | 5.3 | 2026-01-02 | The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to rea… |
CVE-2025-13456 | Medium | 6.1 | 2026-01-02 | The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Sit… |
CVE-2025-13153 | Medium | 6.1 | 2026-01-02 | The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the dashboard, which coul… |
CVE-2025-12685 | Medium | 6.5 | 2026-01-02 | The WPBookit WordPress plugin through 1.0.7 lacks a CSRF check when deleting customers. This could allow an unauthenticated attacker to delete any customer thr… |
CVE-2025-15428 | High | 8.8 | 2026-01-02 | A weakness has been identified in UTT 进取 512W 1.7.7-171114. Affected is the function strcpy of the file /goform/formRemoteControl. This manipulation of the arg… |
CVE-2025-15426 | High | 7.3 | 2026-01-02 | A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The… |
CVE-2025-15425 | High | 7.3 | 2026-01-02 | A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the component HTTP GET Pa… |
CVE-2025-15424 | High | 7.3 | 2026-01-02 | A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agent_worksdel.jsp of the component HTTP GET P… |
CVE-2025-15423 | Medium | 6.3 | 2026-01-02 | A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connect.php. Such manipula… |
CVE-2025-14998 | Critical | 9.8 | 2026-01-02 | The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plu… |
CVE-2025-14047 | Medium | 5.3 | 2026-01-02 | The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulner… |
CVE-2025-15422 | Medium | 5.3 | 2026-01-02 | A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/connect.php of the component IP Address Han… |
CVE-2025-15421 | High | 7.3 | 2026-01-02 | A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agent_worksadd.jsp of the component HTTP GET Pa… |
CVE-2025-15420 | High | 7.3 | 2026-01-02 | A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agent_work_report.jsp. The manipulation of t… |