2025 CVEs (page 51)
Page 51 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15419 | Low | 3.3 | 2026-01-02 | A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-… |
CVE-2025-15418 | Low | 3.3 | 2026-01-02 | A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the library lib/gtp/v2/… |
CVE-2025-15417 | Low | 3.3 | 2026-01-01 | A vulnerability was identified in Open5GS up to 2.7.6. Affected is the function sgwc_s11_handle_create_session_request of the file src/sgwc/s11-handler.c of th… |
CVE-2025-15416 | Low | 2.4 | 2026-01-01 | A vulnerability was found in xnx3 wangmarket up to 6.4. This affects an unknown function of the file /siteVar/save.do of the component Add Global Variable Hand… |
CVE-2025-15415 | Medium | 4.7 | 2026-01-01 | A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the file /sits/uploadImage.do of the component… |
CVE-2025-15414 | Medium | 4.7 | 2026-01-01 | A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/git_fetcher.go of the component… |
CVE-2025-15413 | Medium | 5.3 | 2026-01-01 | A vulnerability was detected in wasm3 up to 0.5.0. Impacted is the function op_SetSlot_i32/op_CallIndirect of the file m3_exec.h. Performing a manipulation res… |
CVE-2025-15412 | Medium | 5.3 | 2026-01-01 | A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/w… |
CVE-2025-15411 | Medium | 5.3 | 2026-01-01 | A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/… |
CVE-2025-69203 | Medium | 6.3 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features t… |
CVE-2025-68620 | Critical | 9.1 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to stea… |
CVE-2025-68619 | High | 7.2 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to instal… |
CVE-2025-68273 | Medium | 5.3 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19… |
CVE-2025-55065 | High | 7.5 | 2026-01-01 | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
CVE-2025-15410 | High | 7.3 | 2026-01-01 | A vulnerability was identified in code-projects Online Guitar Store 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manip… |
CVE-2025-15409 | High | 7.3 | 2026-01-01 | A vulnerability was determined in code-projects Online Guitar Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/Delete_p… |
CVE-2025-68272 | High | 7.5 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an una… |
CVE-2025-66398 | Critical | 9.6 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal sta… |
CVE-2025-15408 | High | 7.3 | 2026-01-01 | A vulnerability was found in code-projects Online Guitar Store 1.0. Affected is an unknown function of the file /admin/Create_product.php. Performing a manipul… |
CVE-2025-15407 | High | 7.3 | 2026-01-01 | A vulnerability has been found in code-projects Online Guitar Store 1.0. This impacts an unknown function of the file /admin/Create_category.php. Such manipula… |
CVE-2025-48769 | High | 8.1 | 2026-01-01 | Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two d… |
CVE-2025-48768 | Medium | 6.5 | 2026-01-01 | Release of Invalid Pointer or Reference vulnerability was discovered in fs/inode/fs_inoderemove code of the Apache NuttX RTOS that allowed root filesystem inod… |
CVE-2025-47411 | High | 8.1 | 2026-01-01 | A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap… |
CVE-2025-15406 | Medium | 6.3 | 2026-01-01 | A flaw has been found in PHPGurukul Online Course Registration up to 3.1. This affects an unknown function. This manipulation causes missing authorization. Rem… |
CVE-2025-14627 | Medium | 6.4 | 2026-01-01 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2025-14428 | Medium | 4.3 | 2026-01-01 | The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin for WordPress is vulnerable to unauthori… |
CVE-2025-66023 | Medium | 4.9 | 2026-01-01 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Free (UAF) vulnerability within the MQTT b… |
CVE-2025-15405 | Medium | 4.3 | 2026-01-01 | A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The att… |
CVE-2025-15404 | Medium | 6.3 | 2026-01-01 | A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an unknown function of the file /save_file.p… |
CVE-2025-11157 | High | 7.8 | 2026-01-01 | A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast… |
CVE-2025-13820 | Medium | 5.3 | 2026-01-01 | The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to a… |
CVE-2025-69413 | Medium | 5.3 | 2026-01-01 | In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. |
CVE-2025-69412 | Low | 3.4 | 2026-01-01 | KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing… |
CVE-2025-67711 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67710 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67709 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67708 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67707 | Medium | 5.6 | 2025-12-31 | ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload… |
CVE-2025-67706 | Medium | 5.6 | 2025-12-31 | ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload… |
CVE-2025-67705 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67704 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67703 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-69288 | Critical | 9.1 | 2025-12-31 | Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the dat… |
CVE-2025-69286 | Critical | 9.8 | 2025-12-31 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API… |
CVE-2025-68700 | High | 8.8 | 2025-12-31 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (normal login account)… |
CVE-2025-34469 | High | 7.5 | 2025-12-31 | Cowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability in the emulated shell implementation of wget and curl. In the default… |
CVE-2025-15398 | Low | 3.7 | 2025-12-31 | A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthControll… |
CVE-2025-53235 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osuthorpe Easy Social easy-social-media allows Reflected… |
CVE-2025-66148 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Conformer for Elementor conformer-elementor allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-66146 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Logger for Elementor logger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66145 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Worker for WPBakery worker-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-66144 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Worker for Elementor worker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-52739 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Sala allows Reflected XSS.This issue affects Sala… |
CVE-2025-50053 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin – Your native, mobil… |
CVE-2025-47566 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomSounds allows Reflected XSS.This issue affects ZoomSo… |
CVE-2025-31054 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Themefy Bloggie allows Reflected XSS.This issue affects Bloggie: from n/a through 2.0.8. |
CVE-2025-30628 | High | 8.5 | 2025-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder… |
CVE-2025-28973 | Medium | 6.5 | 2025-12-31 | Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress pro-watermark allows Path Traversal.This issue affects Pro Bulk Wa… |
CVE-2025-28949 | High | 8.5 | 2025-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codedraft Mediabay - WordPress Media Library Folders allo… |
CVE-2025-23757 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proloy Chakroborty ZD Scribd iPaper zd-scribd-ipaper allo… |
CVE-2025-23719 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zckevin ZhinaTwitterWidget zhina-twitter-widget allows Re… |
CVE-2025-23707 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matamko En Masse en-masse-wp allows Reflected XSS.This is… |
CVE-2025-23705 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry Zielke Zielke Design Project Gallery zielke-design-… |
CVE-2025-23667 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christopher Churchill custom-post-edit front-end-post-edi… |
CVE-2025-66153 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Headinger for Elementor headinger-elementor allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-66152 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Criptopayer for Elementor criptopayer-elementor allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-66151 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Countdowner for Elementor countdowner-elementor allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-66150 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Appender appender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects A… |
CVE-2025-66149 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove UnGrabber ungrabber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-34468 | Critical | 9.8 | 2025-12-31 | libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostn… |
CVE-2025-34467 | Medium | 4.3 | 2025-12-31 | ZwiiCMS versions prior to 13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorization checks combined… |
CVE-2025-15394 | Medium | 4.7 | 2025-12-31 | A vulnerability was detected in iCMS up to 8.0.0. Affected is the function Save of the file app/config/ConfigAdmincp.php of the component POST Parameter Handle… |
CVE-2025-15393 | Medium | 6.3 | 2025-12-31 | A security vulnerability has been detected in Kohana KodiCMS up to 13.82.135. This impacts the function Save of the file cms/modules/kodicms/classes/kodicms/mo… |
CVE-2025-62989 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affe… |
CVE-2025-59135 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powe… |
CVE-2025-49355 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ikaes Accessibility Press ilogic-accessibility allows Sto… |
CVE-2025-49337 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in janhenckens Dashboard Beacon wp-dashboard-beacon allows S… |
CVE-2025-23608 | High | 7.1 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omar Mohamed Mohamoud LIVE TV live-tv allows Reflected XS… |
CVE-2025-15392 | Medium | 6.3 | 2025-12-31 | A weakness has been identified in Kohana KodiCMS up to 13.82.135. This affects the function like of the file cms/modules/pages/classes/kodicms/model/page.php o… |
CVE-2025-15391 | Medium | 6.3 | 2025-12-31 | A weakness has been identified in D-Link DIR-806A 100CNb11. Affected is the function ssdpcgi_main of the component SSDP Request Handler. This manipulation caus… |
CVE-2025-66160 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Select Graphist for Elementor Graphist for Elementor graphist-elementor allows Exploiting Incorrectly Configu… |
CVE-2025-66159 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Walker for Elementor walker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66158 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Gmaper for Elementor gmaper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66157 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Sliper for Elementor sliper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66156 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Watcher for Elementor watcher-elementor allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-66155 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Questionar for Elementor questionar-elementor allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-66154 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in merkulove Couponer for Elementor couponer-elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-63038 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured A… |
CVE-2025-63021 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetipi Valenti Engine valenti-engine allows DOM-Based X… |
CVE-2025-62874 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in Alexander AnyComment anycomment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-62123 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in inkthemes WP Gmail SMTP wp-gmail-smtp allows Cross Site Request Forgery.This issue affects WP Gmail SMTP: fr… |
CVE-2025-62115 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in ThemeBoy Hide Plugins hide-plugins allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-62113 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in emendo_seb Co-marquage service-public.fr co-marquage-service-public allows Cross Site Request Forgery.This i… |
CVE-2025-62101 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Omid Shamloo Pardakht Delkhah pardakht-delkhah allows Cross Site Request Forgery.This issue affects Pardakht… |
CVE-2025-62099 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in approveme Signature Add-On for Gravity Forms gravity-signature-forms-add-on allows Exploiting Incorrectly Configured Acc… |
CVE-2025-62088 | Medium | 5.4 | 2025-12-31 | Server-Side Request Forgery (SSRF) vulnerability in extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site wp_scraper allows Server Side R… |
CVE-2025-62083 | Medium | 4.3 | 2025-12-31 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah BoomDevs WordPress Coming Soon coming-soon-by-boomdevs a… |
CVE-2025-62078 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in Fahad Mahmood Easy Upload Files During Checkout easy-upload-files-during-checkout allows Exploiting Incorrectly Configur… |
CVE-2025-59138 | Medium | 4.9 | 2025-12-31 | Server-Side Request Forgery (SSRF) vulnerability in Jthemes Genemy genemy allows Server Side Request Forgery.This issue affects Genemy: from n/a through <= 1.6… |
CVE-2025-49352 | Medium | 4.3 | 2025-12-31 | Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows… |