2025 CVEs (page 52)
Page 52 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69416 | Medium | 5.0 | 2026-01-02 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via… |
CVE-2025-69415 | High | 7.1 | 2026-01-02 | In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is curre… |
CVE-2025-69414 | High | 8.5 | 2026-01-02 | Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token. |
CVE-2025-67160 | High | 7.5 | 2026-01-02 | An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal. |
CVE-2025-67159 | High | 7.5 | 2026-01-02 | Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext. |
CVE-2025-67158 | High | 7.5 | 2026-01-02 | An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitive information and e… |
CVE-2025-34171 | Medium | 5.3 | 2026-01-02 | CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and… |
CVE-2025-15439 | Medium | 6.3 | 2026-01-02 | A vulnerability was identified in Daptin 0.10.3. Affected by this vulnerability is the function goqu.L of the file server/resource/resource_aggregate.go of the… |
CVE-2025-9110 | High | 7.5 | 2026-01-02 | An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions… |
CVE-2025-69284 | Medium | 4.3 | 2026-01-02 | Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings… |
CVE-2025-67269 | High | 7.5 | 2026-01-02 | An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67… |
CVE-2025-67268 | Critical | 9.8 | 2026-01-02 | gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handle… |
CVE-2025-62852 | Medium | 6.5 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they c… |
CVE-2025-62842 | High | 7.8 | 2026-01-02 | An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they ca… |
CVE-2025-62840 | Low | 3.3 | 2026-01-02 | A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local n… |
CVE-2025-59389 | Critical | 9.8 | 2026-01-02 | An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to execute unauthorize… |
CVE-2025-59387 | | 2026-01-02 | An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability t… | |
CVE-2025-59384 | High | 7.5 | 2026-01-02 | A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected… |
CVE-2025-59381 | Medium | 4.9 | 2026-01-02 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they ca… |
CVE-2025-59380 | Medium | 4.9 | 2026-01-02 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they ca… |
CVE-2025-53597 | Medium | 6.5 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vuln… |
CVE-2025-53594 | | 2026-01-02 | A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulner… | |
CVE-2025-52871 | Medium | 6.5 | 2026-01-02 | An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerabil… |
CVE-2025-48721 | Medium | 6.5 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they c… |
CVE-2025-11837 | Critical | 9.8 | 2026-01-02 | An improper control of generation of code vulnerability has been reported to affect Malware Remover. The remote attackers can then exploit the vulnerability to… |
CVE-2025-65125 | Critical | 9.8 | 2026-01-02 | SQL injection in gosaliajainam/online-movie-booking 5.5 in movie_details.php allows attackers to gain sensitive information. |
CVE-2025-62857 | Medium | 6.1 | 2026-01-02 | A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mech… |
CVE-2025-57705 | Medium | 4.9 | 2026-01-02 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker… |
CVE-2025-54166 | Medium | 4.9 | 2026-01-02 | An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, th… |
CVE-2025-54165 | Medium | 4.9 | 2026-01-02 | An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, th… |
CVE-2025-54164 | Medium | 4.9 | 2026-01-02 | An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, th… |
CVE-2025-53596 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-53593 | Medium | 6.5 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they c… |
CVE-2025-53592 | Medium | 6.5 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they ca… |
CVE-2025-53591 | Medium | 6.5 | 2026-01-02 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-53590 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-53589 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-53414 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-53405 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52872 | High | 8.1 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then ex… |
CVE-2025-52864 | High | 8.1 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then ex… |
CVE-2025-52863 | High | 8.1 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then ex… |
CVE-2025-52431 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52430 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52426 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-47208 | Medium | 6.5 | 2026-01-02 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker… |
CVE-2025-45286 | Medium | 6.1 | 2026-01-02 | A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2025-44013 | Medium | 6.5 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they ca… |
CVE-2025-15438 | Medium | 4.7 | 2026-01-02 | A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Me… |
CVE-2025-15437 | Low | 3.5 | 2026-01-02 | A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performing a manipulation of… |
CVE-2025-15436 | High | 7.3 | 2026-01-02 | A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/work_edit.jsp. Such manipulation… |
CVE-2025-15435 | High | 7.3 | 2026-01-02 | A flaw has been found in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_update.jsp. This manipulation… |
CVE-2025-15434 | High | 7.3 | 2026-01-02 | A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. The manipulation of the argument zpjhid results… |
CVE-2025-15432 | Medium | 5.3 | 2026-01-02 | A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function downloadShowFile of… |
CVE-2025-15431 | High | 8.8 | 2026-01-02 | A flaw has been found in UTT 进取 512W 1.7.7-171114. This affects the function strcpy of the file /goform/formFtpServerDirConfig. Executing a manipulation of the… |
CVE-2025-15430 | High | 8.8 | 2026-01-02 | A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerShareDirSelcet. Perfor… |
CVE-2025-15429 | High | 8.8 | 2026-01-02 | A security vulnerability has been detected in UTT 进取 512W 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /goform/formConfigCli… |
CVE-2025-14072 | Medium | 5.3 | 2026-01-02 | The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to rea… |
CVE-2025-13456 | Medium | 6.1 | 2026-01-02 | The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Sit… |
CVE-2025-13153 | Medium | 6.1 | 2026-01-02 | The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the dashboard, which coul… |
CVE-2025-12685 | Medium | 6.5 | 2026-01-02 | The WPBookit WordPress plugin through 1.0.7 lacks a CSRF check when deleting customers. This could allow an unauthenticated attacker to delete any customer thr… |
CVE-2025-15428 | High | 8.8 | 2026-01-02 | A weakness has been identified in UTT 进取 512W 1.7.7-171114. Affected is the function strcpy of the file /goform/formRemoteControl. This manipulation of the arg… |
CVE-2025-15426 | High | 7.3 | 2026-01-02 | A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The… |
CVE-2025-15425 | High | 7.3 | 2026-01-02 | A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the component HTTP GET Pa… |
CVE-2025-15424 | High | 7.3 | 2026-01-02 | A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agent_worksdel.jsp of the component HTTP GET P… |
CVE-2025-15423 | Medium | 6.3 | 2026-01-02 | A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connect.php. Such manipula… |
CVE-2025-14998 | Critical | 9.8 | 2026-01-02 | The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plu… |
CVE-2025-14047 | Medium | 5.3 | 2026-01-02 | The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulner… |
CVE-2025-15422 | Medium | 5.3 | 2026-01-02 | A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/connect.php of the component IP Address Han… |
CVE-2025-15421 | High | 7.3 | 2026-01-02 | A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agent_worksadd.jsp of the component HTTP GET Pa… |
CVE-2025-15420 | High | 7.3 | 2026-01-02 | A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agent_work_report.jsp. The manipulation of t… |
CVE-2025-15419 | Low | 3.3 | 2026-01-02 | A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-… |
CVE-2025-15418 | Low | 3.3 | 2026-01-02 | A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the library lib/gtp/v2/… |
CVE-2025-15417 | Low | 3.3 | 2026-01-01 | A vulnerability was identified in Open5GS up to 2.7.6. Affected is the function sgwc_s11_handle_create_session_request of the file src/sgwc/s11-handler.c of th… |
CVE-2025-15416 | Low | 2.4 | 2026-01-01 | A vulnerability was found in xnx3 wangmarket up to 6.4. This affects an unknown function of the file /siteVar/save.do of the component Add Global Variable Hand… |
CVE-2025-15415 | Medium | 4.7 | 2026-01-01 | A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the file /sits/uploadImage.do of the component… |
CVE-2025-15414 | Medium | 4.7 | 2026-01-01 | A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/git_fetcher.go of the component… |
CVE-2025-15413 | Medium | 5.3 | 2026-01-01 | A vulnerability was detected in wasm3 up to 0.5.0. Impacted is the function op_SetSlot_i32/op_CallIndirect of the file m3_exec.h. Performing a manipulation res… |
CVE-2025-15412 | Medium | 5.3 | 2026-01-01 | A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/w… |
CVE-2025-15411 | Medium | 5.3 | 2026-01-01 | A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/… |
CVE-2025-69203 | Medium | 6.3 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features t… |
CVE-2025-68620 | Critical | 9.1 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to stea… |
CVE-2025-68619 | High | 7.2 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to instal… |
CVE-2025-68273 | Medium | 5.3 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19… |
CVE-2025-55065 | High | 7.5 | 2026-01-01 | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
CVE-2025-15410 | High | 7.3 | 2026-01-01 | A vulnerability was identified in code-projects Online Guitar Store 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manip… |
CVE-2025-15409 | High | 7.3 | 2026-01-01 | A vulnerability was determined in code-projects Online Guitar Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/Delete_p… |
CVE-2025-68272 | High | 7.5 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an una… |
CVE-2025-66398 | Critical | 9.6 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal sta… |
CVE-2025-15408 | High | 7.3 | 2026-01-01 | A vulnerability was found in code-projects Online Guitar Store 1.0. Affected is an unknown function of the file /admin/Create_product.php. Performing a manipul… |
CVE-2025-15407 | High | 7.3 | 2026-01-01 | A vulnerability has been found in code-projects Online Guitar Store 1.0. This impacts an unknown function of the file /admin/Create_category.php. Such manipula… |
CVE-2025-48769 | High | 8.1 | 2026-01-01 | Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two d… |
CVE-2025-48768 | Medium | 6.5 | 2026-01-01 | Release of Invalid Pointer or Reference vulnerability was discovered in fs/inode/fs_inoderemove code of the Apache NuttX RTOS that allowed root filesystem inod… |
CVE-2025-47411 | High | 8.1 | 2026-01-01 | A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap… |
CVE-2025-15406 | Medium | 6.3 | 2026-01-01 | A flaw has been found in PHPGurukul Online Course Registration up to 3.1. This affects an unknown function. This manipulation causes missing authorization. Rem… |
CVE-2025-14627 | Medium | 6.4 | 2026-01-01 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2025-14428 | Medium | 4.3 | 2026-01-01 | The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin for WordPress is vulnerable to unauthori… |
CVE-2025-66023 | Medium | 4.9 | 2026-01-01 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Free (UAF) vulnerability within the MQTT b… |
CVE-2025-15405 | Medium | 4.3 | 2026-01-01 | A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The att… |
CVE-2025-15404 | Medium | 6.3 | 2026-01-01 | A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an unknown function of the file /save_file.p… |