2025 CVEs (page 55)
Page 55 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15209 | Medium | 6.3 | 2025-12-29 | A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown part of the file /home/editfood.php. This manipulat… |
CVE-2025-15208 | High | 7.3 | 2025-12-29 | A security flaw has been discovered in code-projects Refugee Food Management System 1.0. Affected by this issue is some unknown functionality of the file /home… |
CVE-2025-68860 | Critical | 9.8 | 2025-12-29 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue a… |
CVE-2025-68607 | Medium | 6.5 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template custom-field-temp… |
CVE-2025-68562 | Critical | 9.9 | 2025-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a… |
CVE-2025-68504 | Medium | 6.5 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This… |
CVE-2025-68503 | Medium | 6.5 | 2025-12-29 | Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects J… |
CVE-2025-68502 | Medium | 4.3 | 2025-12-29 | Authorization Bypass Through User-Controlled Key vulnerability in Crocoblock JetPopup jet-popup allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-15207 | High | 7.3 | 2025-12-29 | A vulnerability has been found in Campcodes Supplier Management System 1.0. Affected is an unknown function of the file /admin/view_products.php. The manipulat… |
CVE-2025-15206 | High | 7.3 | 2025-12-29 | A flaw has been found in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /admin/add_area.php. Executing a manipulation o… |
CVE-2025-69205 | Medium | 6.3 | 2025-12-29 | Micro Registration Utility (µURU) is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d5… |
CVE-2025-15205 | Medium | 6.3 | 2025-12-29 | A vulnerability was identified in code-projects Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /dow… |
CVE-2025-15204 | Low | 2.4 | 2025-12-29 | A vulnerability was determined in SohuTV CacheCloud up to 3.2.0. Affected is the function doQuartzList of the file src/main/java/com/sohu/cache/web/controller/… |
CVE-2025-69202 | Medium | 6.5 | 2025-12-29 | Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-c… |
CVE-2025-15203 | Low | 2.4 | 2025-12-29 | A vulnerability was found in SohuTV CacheCloud up to 3.2.0. This impacts the function index of the file src/main/java/com/sohu/cache/web/controller/ResourceCon… |
CVE-2025-15202 | Low | 2.4 | 2025-12-29 | A vulnerability has been found in SohuTV CacheCloud up to 3.2.0. This affects the function taskQueueList of the file src/main/java/com/sohu/cache/web/controlle… |
CVE-2025-14175 | Medium | 6.5 | 2025-12-29 | A vulnerability in the SSH server of TP-Link TL-WR820N v2.80 allows the use of a weak cryptographic algorithm, enabling an adjacent attacker to intercept and d… |
CVE-2025-68706 | Critical | 9.8 | 2025-12-29 | A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handle… |
CVE-2025-68431 | Medium | 6.5 | 2025-12-29 | libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap… |
CVE-2025-67255 | High | 8.8 | 2025-12-29 | In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability. |
CVE-2025-67254 | High | 7.5 | 2025-12-29 | NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php. |
CVE-2025-15201 | Low | 3.5 | 2025-12-29 | A flaw has been found in SohuTV CacheCloud up to 3.2.0. The impacted element is the function redirectNoPower of the file src/main/java/com/sohu/cache/web/contr… |
CVE-2025-15200 | Low | 2.4 | 2025-12-29 | A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. The affected element is the function getExceptionStatisticsByClient/getCommandStatisticsByClient… |
CVE-2025-15199 | Medium | 6.3 | 2025-12-29 | A security vulnerability has been detected in code-projects College Notes Uploading System 1.0. Impacted is an unknown function of the file /dashboard/userprof… |
CVE-2025-14728 | Medium | 6.8 | 2025-12-29 | Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written ou… |
CVE-2025-14280 | Medium | 5.3 | 2025-12-29 | The PixelYourSite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.5 through publicly exposed lo… |
CVE-2025-13592 | High | 7.2 | 2025-12-29 | The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-ad__content' shortcode pa… |
CVE-2025-68861 | High | 7.1 | 2025-12-29 | Missing Authorization vulnerability in pluginoptimizer Plugin Optimizer plugin-optimizer allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-66877 | High | 7.5 | 2025-12-29 | Buffer overflow vulnerability in function dcputchar in decompile.c in libming 0.4.8. |
CVE-2025-55064 | Medium | 4.8 | 2025-12-29 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-55063 | Medium | 4.8 | 2025-12-29 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-55062 | Medium | 4.8 | 2025-12-29 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-55061 | High | 8.8 | 2025-12-29 | CWE-434 Unrestricted Upload of File with Dangerous Type |
CVE-2025-55060 | Medium | 6.1 | 2025-12-29 | CWE-601 URL Redirection to Untrusted Site ('Open Redirect') |
CVE-2025-15198 | High | 7.3 | 2025-12-29 | A weakness has been identified in code-projects College Notes Uploading System 1.0. This issue affects some unknown processing of the file /login.php. Executin… |
CVE-2025-68870 | High | 7.5 | 2025-12-29 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in reDim GmbH CookieHint WP cookiehint-wp… |
CVE-2025-68868 | Medium | 6.5 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codeaffairs Wp Text Slider Widget wp-text-slider-widget a… |
CVE-2025-66869 | High | 7.5 | 2025-12-29 | Buffer overflow vulnerability in function strcat in asan_interceptors.cpp in libming 0.4.8. |
CVE-2025-66866 | High | 7.5 | 2025-12-29 | An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-66865 | High | 7.5 | 2025-12-29 | An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-66864 | High | 7.5 | 2025-12-29 | An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-66863 | High | 7.5 | 2025-12-29 | An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-66862 | High | 7.5 | 2025-12-29 | A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-66861 | Low | 2.5 | 2025-12-29 | An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE fi… |
CVE-2025-53627 | Medium | 5.3 | 2025-12-29 | Meshtastic is an open source mesh networking solution. The Meshtastic firmware (starting from version 2.5) introduces asymmetric encryption (PKI) for direct me… |
CVE-2025-15197 | Medium | 4.7 | 2025-12-29 | A security flaw has been discovered in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This vulnerability affects unknown code of the… |
CVE-2025-15196 | High | 7.3 | 2025-12-29 | A vulnerability was identified in code-projects Assessment Management 1.0. This affects an unknown part of the file login.php. Such manipulation of the argumen… |
CVE-2025-69211 | High | 7.4 | 2025-12-29 | Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS a… |
CVE-2025-69206 | Medium | 4.3 | 2025-12-29 | Hemmelig is a messing app with with client-side encryption and self-destructing messages. Prior to version 7.3.3, a Server-Side Request Forgery (SSRF) filter b… |
CVE-2025-69201 | Critical | 9.8 | 2025-12-29 | Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent… |
CVE-2025-69200 | High | 7.5 | 2025-12-29 | phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backu… |
CVE-2025-68951 | Medium | 5.4 | 2025-12-29 | phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to ex… |
CVE-2025-68897 | Critical | 9.9 | 2025-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Mohammad I. Okfie IF AS Shortcode if-as-shortcode allows Code Injection.This issue a… |
CVE-2025-68893 | Medium | 4.9 | 2025-12-29 | Server-Side Request Forgery (SSRF) vulnerability in HETWORKS WordPress Image shrinker wp-image-shrinker allows Server Side Request Forgery.This issue affects W… |
CVE-2025-68879 | High | 7.1 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in councilsoft Content Grid Slider content-grid-slider allow… |
CVE-2025-68878 | High | 7.1 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prasadkirpekar Advanced Custom CSS advanced-custom-css al… |
CVE-2025-68877 | High | 7.5 | 2025-12-29 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cedcommerce CedCommerce Integration fo… |
CVE-2025-68876 | High | 7.1 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INVELITY Invelity SPS connect invelity-sps-connect allows… |
CVE-2025-56333 | Critical | 9.8 | 2025-12-29 | An issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to escalate privileges via the 2FA component |
CVE-2025-15195 | High | 7.3 | 2025-12-29 | A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file /admin/add-module.p… |
CVE-2025-15194 | Critical | 9.8 | 2025-12-29 | A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi of the component… |
CVE-2025-68929 | Critical | 9.0 | 2025-12-29 | Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into… |
CVE-2025-68928 | Medium | 5.4 | 2025-12-29 | Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, whi… |
CVE-2025-65570 | Critical | 9.8 | 2025-12-29 | A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an array element acces… |
CVE-2025-65442 | Medium | 6.1 | 2025-12-29 | DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive… |
CVE-2025-60458 | Medium | 6.5 | 2025-12-29 | UxPlay 1.72 contains a double free vulnerability in its RTSP request handling. A specially crafted RTSP TEARDOWN request can trigger multiple calls to free() o… |
CVE-2025-57462 | Medium | 6.1 | 2025-12-29 | Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF file. |
CVE-2025-15193 | High | 8.8 | 2025-12-29 | A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. This affects the function sub_423848 of the file /boafrm/formParentControl. Performing manipulati… |
CVE-2025-15192 | Medium | 6.3 | 2025-12-29 | A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgr… |
CVE-2025-57460 | Critical | 9.8 | 2025-12-29 | File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell. |
CVE-2025-15191 | Medium | 6.3 | 2025-12-29 | A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom… |
CVE-2025-15190 | High | 8.8 | 2025-12-29 | A security flaw has been discovered in D-Link DWR-M920 up to 1.1.50. Impacted is the function sub_42261C of the file /boafrm/formFilter. The manipulation of th… |
CVE-2025-15189 | High | 8.8 | 2025-12-29 | A vulnerability was identified in D-Link DWR-M920 up to 1.1.50. This issue affects the function sub_464794 of the file /boafrm/formDefRoute. The manipulation o… |
CVE-2025-15188 | Low | 2.4 | 2025-12-29 | A vulnerability was determined in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/sea… |
CVE-2025-15187 | Low | 3.8 | 2025-12-29 | A vulnerability was found in GreenCMS up to 2.3. This affects an unknown part of the file /DataController.class.php of the component File Handler. Performing a… |
CVE-2025-15186 | High | 7.3 | 2025-12-29 | A vulnerability has been found in code-projects Refugee Food Management System 1.0. Affected by this issue is some unknown functionality of the file /home/addu… |
CVE-2025-15185 | High | 7.3 | 2025-12-29 | A flaw has been found in code-projects Refugee Food Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /home/refugee… |
CVE-2025-15184 | High | 7.3 | 2025-12-29 | A vulnerability was detected in code-projects Refugee Food Management System 1.0. Affected is an unknown function of the file /home/refugeesreport2.php. The ma… |
CVE-2025-15183 | High | 7.3 | 2025-12-29 | A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. This impacts an unknown function of the file /home/viewtakenfd… |
CVE-2025-15182 | High | 7.3 | 2025-12-29 | A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown function of the file /home/served.php. Executing ma… |
CVE-2025-15181 | High | 7.3 | 2025-12-29 | A security flaw has been discovered in code-projects Refugee Food Management System 1.0. The impacted element is an unknown function of the file /home/pagenate… |
CVE-2025-15180 | High | 7.2 | 2025-12-29 | A vulnerability was identified in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/webExcptypemanFilte of the component HT… |
CVE-2025-15228 | Critical | 9.8 | 2025-12-29 | BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web s… |
CVE-2025-15227 | High | 7.5 | 2025-12-29 | BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Trav… |
CVE-2025-15179 | High | 7.2 | 2025-12-29 | A vulnerability was determined in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/qossetting. This manipulation of the argument page… |
CVE-2025-15178 | High | 7.2 | 2025-12-29 | A vulnerability was found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/VirtualSer of the component HTTP Request Hand… |
CVE-2025-15226 | Critical | 9.8 | 2025-12-29 | WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, there… |
CVE-2025-15225 | High | 7.5 | 2025-12-29 | WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitr… |
CVE-2025-15177 | High | 7.2 | 2025-12-29 | A vulnerability has been found in Tenda WH450 1.0.0.18. This vulnerability affects unknown code of the file /goform/SetIpBind of the component HTTP Request Han… |
CVE-2025-15176 | Medium | 5.3 | 2025-12-29 | A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c o… |
CVE-2025-15175 | Low | 3.5 | 2025-12-29 | A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doAppList/appCommandAnalysis of the file src/main/java/co… |
CVE-2025-15174 | Low | 3.5 | 2025-12-29 | A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. Affected by this vulnerability is the function doAppAuditList of the file src/main… |
CVE-2025-15070 | Medium | 5.5 | 2025-12-29 | Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse. This issue af… |
CVE-2025-15069 | High | 7.1 | 2025-12-29 | Improper Authentication vulnerability in Gmission Web Fax allows Privilege Escalation.This issue affects Web Fax: from 3.0 before 3.0.1 |
CVE-2025-15068 | High | 7.7 | 2025-12-29 | Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse, Session Credential Falsification through Manipulation.This issue affects W… |
CVE-2025-13958 | Medium | 5.9 | 2025-12-29 | The YaMaps for WordPress Plugin WordPress plugin before 0.6.40 does not validate and escape some of its shortcode attributes before outputting them back in a p… |
CVE-2025-13417 | High | 8.6 | 2025-12-29 | The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perfor… |
CVE-2025-15173 | Low | 3.5 | 2025-12-29 | A weakness has been identified in SohuTV CacheCloud up to 3.2.0. Affected is the function advancedAnalysis of the file src/main/java/com/sohu/cache/web/control… |
CVE-2025-15172 | Low | 3.5 | 2025-12-29 | A security flaw has been discovered in SohuTV CacheCloud up to 3.2.0. This impacts the function preview of the file src/main/java/com/sohu/cache/web/controller… |
CVE-2025-15171 | Low | 3.5 | 2025-12-29 | A vulnerability was identified in SohuTV CacheCloud up to 3.2.0. This affects the function index of the file src/main/java/com/sohu/cache/web/controller/Server… |