2025 CVEs (page 55)
Page 55 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15372 | Low | 2.4 | 2025-12-31 | A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/ind… |
CVE-2025-15223 | Medium | 4.3 | 2025-12-31 | A vulnerability was found in Philipinho Simple-PHP-Blog up to 94b5d3e57308bce5dfbc44c3edafa9811893d958. Impacted is an unknown function of the file /login.php… |
CVE-2025-68131 | High | 7.5 | 2025-12-31 | cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5… |
CVE-2025-15371 | High | 7.8 | 2025-12-31 | A vulnerability has been found in Tenda i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G and TEG5328F up to 65.10.15.6. Affected is an unknown function of the c… |
CVE-2025-11964 | Low | 1.9 | 2025-12-31 | On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le… |
CVE-2025-11961 | Low | 1.9 | 2025-12-31 | pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a wel… |
CVE-2025-62753 | High | 7.5 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MadrasThemes MAS Videos masvideos allo… |
CVE-2025-59131 | High | 7.1 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in hoernerfranz WP-CalDav2ICS wp-caldav2ics allows Stored XSS.This issue affects WP-CalDav2ICS: from n/a throug… |
CVE-2025-15114 | Critical | 9.8 | 2025-12-30 | Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML fil… |
CVE-2025-15113 | Critical | 9.3 | 2025-12-30 | Ksenia Security lares (legacy model) Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload M… |
CVE-2025-15112 | Medium | 5.4 | 2025-12-30 | Ksenia Security lares (legacy model) version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 're… |
CVE-2025-15111 | Critical | 9.8 | 2025-12-30 | Ksenia Security lares (legacy model) version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access… |
CVE-2025-15360 | Medium | 4.7 | 2025-12-30 | A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadCo… |
CVE-2025-66723 | High | 7.5 | 2025-12-30 | inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all… |
CVE-2025-61594 | High | 7.5 | 2025-12-30 | URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundl… |
CVE-2025-15357 | Medium | 6.3 | 2025-12-30 | A vulnerability was found in D-Link DI-7400G+ 19.12.25A1. This affects an unknown function of the file /msp_info.htm?flag=cmd. The manipulation of the argument… |
CVE-2025-15356 | High | 8.8 | 2025-12-30 | A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSet. The manipulation… |
CVE-2025-14987 | | 2025-12-30 | When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecuti… | |
CVE-2025-14986 | | 2025-12-30 | When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutio… | |
CVE-2025-69261 | High | 7.5 | 2025-12-30 | WasmEdge is a WebAssembly runtime. Prior to version 0.16.0-alpha.3, a multiplication in `WasmEdge/include/runtime/instance/memory.h` can wrap, causing `checkAc… |
CVE-2025-69257 | Medium | 6.7 | 2025-12-30 | theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.1.1, the application loads custom… |
CVE-2025-69210 | Medium | 5.4 | 2025-12-30 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability… |
CVE-2025-66823 | Medium | 5.4 | 2025-12-30 | An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Ed… |
CVE-2025-50343 | Critical | 9.8 | 2025-12-30 | An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in Mat_VarCreateStruct() when the nfields value does not match the actual num… |
CVE-2025-15354 | High | 7.3 | 2025-12-30 | A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/add_admin.php. Executing ma… |
CVE-2025-15353 | High | 7.3 | 2025-12-30 | A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is the function edit_admin_query of the file /admin/edit_admin_query.php… |
CVE-2025-69256 | High | 7.5 | 2025-12-30 | The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to ve… |
CVE-2025-66835 | High | 7.1 | 2025-12-30 | TrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the user's context. |
CVE-2025-66834 | High | 7.3 | 2025-12-30 | A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via… |
CVE-2025-66824 | High | 8.7 | 2025-12-30 | A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueConf Server v5.5.2.10… |
CVE-2025-15264 | High | 7.3 | 2025-12-30 | A vulnerability was determined in FeehiCMS up to 2.1.1. Impacted is an unknown function of the file frontend/web/timthumb.php of the component TimThumb. Execut… |
CVE-2025-15263 | High | 7.3 | 2025-12-30 | A weakness has been identified in BiggiDroid Simple PHP CMS 1.0. Affected is an unknown function of the file /admin/login.php of the component Admin Login. Exe… |
CVE-2025-65411 | High | 7.5 | 2025-12-30 | A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payloa… |
CVE-2025-65409 | High | 7.5 | 2025-12-30 | A divide-by-zero in the encryption/decryption routines of GNU Recutils v1.9 allows attackers to cause a Denial of Service (DoS) via inputting an empty value as… |
CVE-2025-56332 | Critical | 9.1 | 2025-12-30 | Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration |
CVE-2025-15262 | Medium | 4.7 | 2025-12-30 | A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo H… |
CVE-2025-15258 | Low | 3.5 | 2025-12-30 | A weakness has been identified in Edimax BR-6208AC 1.02/1.03. Affected by this issue is the function formALGSetup of the file /goform/formALGSetup of the compo… |
CVE-2025-69204 | Medium | 5.3 | 2025-12-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using… |
CVE-2025-68950 | Medium | 4.0 | 2025-12-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular re… |
CVE-2025-68926 | Critical | 9.8 | 2025-12-30 | RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded stati… |
CVE-2025-68618 | Medium | 5.3 | 2025-12-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG… |
CVE-2025-66848 | Critical | 9.8 | 2025-12-30 | JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER… |
CVE-2025-66103 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx WPCal.io wpcal allows DOM-Based XSS.This issue af… |
CVE-2025-66094 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dmccan Yada Wiki yada-wiki allows Stored XSS.This issue a… |
CVE-2025-65925 | Medium | 6.5 | 2025-12-30 | An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. A legacy user creation API pathway allowed accounts to be created without completing the inte… |
CVE-2025-62128 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configu… |
CVE-2025-62112 | Medium | 4.3 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in Merv Barrett Import into Easy Property Listings easy-property-listings-xml-csv-import allows Cross Site Requ… |
CVE-2025-59129 | High | 7.6 | 2025-12-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appointify Appointify appointify allows Blind SQL Injecti… |
CVE-2025-52835 | Critical | 9.6 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING WordPress Migrator wing-migrator allows Upload a Web Shell to a Web Server.This issue aff… |
CVE-2025-15257 | High | 7.3 | 2025-12-30 | A security flaw has been discovered in Edimax BR-6208AC 1.02/1.03. Affected by this vulnerability is the function formRoute of the file /gogorm/formRoute of th… |
CVE-2025-15256 | High | 7.3 | 2025-12-30 | A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component Web… |
CVE-2025-67746 | Medium | 4.3 | 2025-12-30 | Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads… |
CVE-2025-66080 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Conf… |
CVE-2025-64528 | Medium | 5.3 | 2025-12-30 | Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user… |
CVE-2025-64190 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.Th… |
CVE-2025-63027 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcreations907 WBC907 Core wbc907-core allows Stored XSS… |
CVE-2025-62746 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeFlavors Featured Video for WordPress – VideographyWP… |
CVE-2025-61557 | High | 7.5 | 2025-12-30 | nixseparatedebuginfod before v0.4.1 is vulnerable to Directory Traversal. |
CVE-2025-15255 | Critical | 9.8 | 2025-12-30 | A vulnerability was determined in Tenda W6-S 1.0.0.4(510). This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Exe… |
CVE-2025-15254 | Medium | 6.3 | 2025-12-30 | A vulnerability was found in Tenda W6-S 1.0.0.4(510). This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a man… |
CVE-2025-15253 | High | 8.8 | 2025-12-30 | A vulnerability has been found in Tenda M3 1.0.0.13(4903). The impacted element is an unknown function of the file /goform/exeCommand. Such manipulation of the… |
CVE-2025-15252 | High | 8.8 | 2025-12-30 | A flaw has been found in Tenda M3 1.0.0.13(4903). The affected element is the function formSetRemoteDhcpForAp of the file /goform/setDhcpAP. This manipulation… |
CVE-2025-15251 | Medium | 5.6 | 2025-12-30 | A vulnerability was detected in beecue FastBee up to 2.1. Impacted is the function getRootElement of the file springboot/fastbee-server/sip-server/src/main/jav… |
CVE-2025-15250 | Medium | 4.7 | 2025-12-30 | A security vulnerability has been detected in 08CMS Novel System up to 3.4. This issue affects some unknown processing of the file admina/mtpls.inc.php of the… |
CVE-2025-15249 | Low | 3.5 | 2025-12-30 | A weakness has been identified in zhujunliang3 work_platform up to 6bc5a50bb527ce27f7906d11ea6ec139beb79c31. This vulnerability affects unknown code of the com… |
CVE-2025-15248 | Low | 3.5 | 2025-12-30 | A security flaw has been discovered in sunhailin12315 product-review 商品评价系统 up to 91ead6890b4065bb45b7602d0d73348e75cb4639. This affects an unknown part of the… |
CVE-2025-14426 | Medium | 4.3 | 2025-12-30 | The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function… |
CVE-2025-15247 | High | 7.3 | 2025-12-30 | A vulnerability was identified in gmg137 snap7-rs up to 153d3e8c16decd7271e2a5b2e3da4d6f68589424. Affected by this issue is the function snap7_rs::client::S7Cl… |
CVE-2025-15246 | Medium | 6.3 | 2025-12-30 | A vulnerability was determined in aizuda snail-job up to 1.7.0 on macOS. Affected by this vulnerability is the function FurySerializer.deserialize of the compo… |
CVE-2025-14509 | High | 7.2 | 2025-12-30 | The Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.1.13. This is du… |
CVE-2025-69093 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-69092 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addo… |
CVE-2025-69091 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-69089 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in autolistings Auto Listings auto-listings allows Stored XS… |
CVE-2025-69088 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows D… |
CVE-2025-69034 | High | 8.1 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Lekker lekker allows PHP… |
CVE-2025-69033 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.Th… |
CVE-2025-69032 | Medium | 5.4 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-69031 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arca… |
CVE-2025-69030 | Medium | 5.4 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Acc… |
CVE-2025-69029 | Medium | 5.4 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in Select-Themes Struktur struktur allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-69028 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weFo… |
CVE-2025-69027 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting… |
CVE-2025-69026 | Medium | 4.3 | 2025-12-30 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roxnor PopupKit popup-builder-block allows Retrieve Embedded Sensit… |
CVE-2025-69025 | Medium | 4.3 | 2025-12-30 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.Th… |
CVE-2025-69024 | Medium | 6.5 | 2025-12-30 | Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-69023 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-69022 | Medium | 5.4 | 2025-12-30 | Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Acce… |
CVE-2025-69021 | Medium | 5.4 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a thr… |
CVE-2025-69020 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows St… |
CVE-2025-69019 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlippingBook FlippingBook flippingbook allows DOM-Based X… |
CVE-2025-69018 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM… |
CVE-2025-69017 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This… |
CVE-2025-69016 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-69015 | Low | 3.8 | 2025-12-30 | Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-69014 | Medium | 4.9 | 2025-12-30 | Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <=… |
CVE-2025-69013 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects S… |
CVE-2025-69012 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-69010 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in themebeez Themebeez Toolkit themebeez-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-69009 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in kamleshyadav Medicalequipment medicalequipment allows Exploiting Incorrectly Configured Access Control Security Levels.T… |