2025 CVEs (page 56)
Page 56 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15170 | Medium | 4.3 | 2025-12-29 | A security vulnerability has been detected in Advaya Softech GEMS ERP Portal up to 2.1. This affects an unknown part of the file /home.jsp?isError=true of the… |
CVE-2025-15169 | Medium | 4.7 | 2025-12-29 | A weakness has been identified in BiggiDroid Simple PHP CMS 1.0. Affected by this issue is some unknown functionality of the file /admin/editsite.php. Executin… |
CVE-2025-52691 | Critical | 10.0 | 2025-12-29 | Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially… |
CVE-2025-15168 | High | 7.3 | 2025-12-29 | A vulnerability was identified in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /statistical.php. Such manipulation o… |
CVE-2025-15167 | High | 7.3 | 2025-12-29 | A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /detailtransac.php. This manipulat… |
CVE-2025-15166 | High | 7.3 | 2025-12-29 | A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. This affects an unknown function of the file /updatesupplier.php?action=edit. The ma… |
CVE-2025-15165 | High | 7.3 | 2025-12-29 | A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. The impacted element is an unknown function of the file /updatecustomer.php?act… |
CVE-2025-15164 | High | 7.2 | 2025-12-29 | A security flaw has been discovered in Tenda WH450 1.0.0.18. This affects an unknown part of the file /goform/SafeMacFilter. The manipulation of the argument p… |
CVE-2025-15163 | High | 7.2 | 2025-12-29 | A vulnerability was identified in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/SafeEmailFilter. The manipulat… |
CVE-2025-15067 | High | 7.7 | 2025-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Innorix Innorix WP allows Upload a Web Shell to a Web Server.This issue affects Innorix WP fro… |
CVE-2025-15066 | Medium | 6.2 | 2025-12-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Missing Authorization vulnerability in Innorix WP allows Path Traversal.This is… |
CVE-2025-15065 | Medium | 6.3 | 2025-12-29 | Exposure of Sensitive Information to an Unauthorized Actor, Missing Encryption of Sensitive Data, Files or Directories Accessible to External Parties vulnerabi… |
CVE-2025-15162 | High | 7.2 | 2025-12-29 | A vulnerability was determined in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/RouteStatic. Executing a… |
CVE-2025-15161 | High | 7.2 | 2025-12-28 | A vulnerability was found in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/PPTPUserSetting. Performing a manipulation of the argume… |
CVE-2025-15160 | High | 7.2 | 2025-12-28 | A vulnerability has been found in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/PPTPServer. Such manipulation of the argument ip1… |
CVE-2025-15156 | Medium | 4.3 | 2025-12-28 | A flaw has been found in omec-project UPF up to 2.1.3-dev. This affects the function handleSessionEstablishmentRequest of the file /pfcpiface/pfcpiface/message… |
CVE-2025-15155 | Medium | 5.3 | 2025-12-28 | A vulnerability was detected in floooh sokol up to 16cbcc864012898793cd2bc57f802499a264ea40. The impacted element is the function _sg_pipeline_desc_defaults in… |
CVE-2025-15154 | Medium | 5.3 | 2025-12-28 | A security vulnerability has been detected in PbootCMS up to 3.2.12. The affected element is the function get_user_ip of the file core/function/handle.php of t… |
CVE-2025-15153 | Low | 3.7 | 2025-12-28 | A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Execut… |
CVE-2025-15152 | Medium | 6.3 | 2025-12-28 | A vulnerability was identified in h-moses moga-mall up to 392d631a5ef15962a9bddeeb9f1269b9085473fa. This vulnerability affects the function addProduct of the f… |
CVE-2025-15151 | Low | 3.7 | 2025-12-28 | A vulnerability was determined in TaleLin Lin-CMS up to 0.6.0. This affects an unknown part of the file /tests/config.py of the component Tests Folder. This ma… |
CVE-2025-15150 | Medium | 5.3 | 2025-12-28 | A vulnerability was found in PX4 PX4-Autopilot up to 1.16.0. Affected by this issue is the function MavlinkLogHandler::state_listing/MavlinkLogHandler::log_ent… |
CVE-2025-15149 | Low | 2.4 | 2025-12-28 | A vulnerability has been found in rawchen ecms up to b59d7feaa9094234e8aa6c8c6b290621ca575ded. Affected by this vulnerability is the function updateProductServ… |
CVE-2025-15148 | Medium | 4.7 | 2025-12-28 | A flaw has been found in CmsEasy up to 7.7.7. Affected is the function savetemp_action in the library /lib/admin/template_admin.php of the component Backend Te… |
CVE-2025-15146 | Low | 2.4 | 2025-12-28 | A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. This impacts the function doUserList of the file src/main/java/com/sohu/cache/web/controller/Use… |
CVE-2025-68973 | High | 7.8 | 2025-12-28 | In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted… |
CVE-2025-15145 | Low | 2.4 | 2025-12-28 | A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. This affects the function doTotalList of the file src/main/java/com/sohu/cache/web… |
CVE-2025-15144 | Medium | 4.3 | 2025-12-28 | A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. The impacted element is the function dr_show_error/dr_exit_msg of the file /dayrui/Fcms/Init.ph… |
CVE-2025-15143 | Medium | 4.7 | 2025-12-28 | A security flaw has been discovered in EyouCMS up to 1.7.6. The affected element is an unknown function of the file /application/admin/logic/FilemanagerLogic.p… |
CVE-2025-15142 | High | 7.3 | 2025-12-28 | A vulnerability was identified in 9786 phpok3w up to 901d96a06809fb28b17f3a4362c59e70411c933c. Impacted is an unknown function of the file show.php. The manipu… |
CVE-2025-15141 | Low | 3.1 | 2025-12-28 | A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler… |
CVE-2025-15140 | High | 7.3 | 2025-12-28 | A vulnerability was found in saiftheboss7 onlinemcqexam up to 0e56806132971e49721db3ef01868098c7b42ada. This vulnerability affects unknown code of the file /ad… |
CVE-2025-15139 | Medium | 6.3 | 2025-12-28 | A vulnerability has been found in TRENDnet TEW-822DRE 1.00B21/1.01B06. This affects the function sub_43ACF4 of the file /boafrm/formWsc. Such manipulation of… |
CVE-2025-15138 | Medium | 4.7 | 2025-12-28 | A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php. This mani… |
CVE-2025-15137 | High | 8.8 | 2025-12-28 | A vulnerability was detected in TRENDnet TEW-800MB 1.0.1.0. Affected by this vulnerability is the function sub_F934 of the file NTPSyncWithHost.cgi. The manip… |
CVE-2025-15136 | High | 8.8 | 2025-12-28 | A security vulnerability has been detected in TRENDnet TEW-800MB 1.0.1.0. Affected is the function do_setWizard_asp of the file /goform/wizardset of the compon… |
CVE-2025-15135 | Medium | 6.3 | 2025-12-28 | A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to 3.0.0. This impacts the function tryAuthenticateWithCookies of the file Authenticat… |
CVE-2025-15134 | Low | 3.5 | 2025-12-28 | A security flaw has been discovered in yourmaileyes MOOC up to 1.17. This affects the function subreview of the file mooc/controller/MainController.java of the… |
CVE-2025-15133 | Medium | 6.3 | 2025-12-28 | A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the… |
CVE-2025-15132 | Medium | 6.3 | 2025-12-28 | A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the compon… |
CVE-2025-15131 | Medium | 6.3 | 2025-12-28 | A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP… |
CVE-2025-15130 | Medium | 4.7 | 2025-12-28 | A vulnerability has been found in shanyu SyCms up to a242ef2d194e8bb249dc175e7c49f2c1673ec921. This issue affects the function addPost of the file Application/… |
CVE-2025-15129 | Medium | 6.3 | 2025-12-28 | A flaw has been found in ChenJinchuang Lin-CMS-TP5 up to 0.3.3. This vulnerability affects the function Upload of the file application/lib/file/LocalUploader.p… |
CVE-2025-15128 | Medium | 5.3 | 2025-12-28 | A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint… |
CVE-2025-15127 | High | 7.3 | 2025-12-28 | A security vulnerability has been detected in FantasticLBP Hotels_Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. Affected by this issue is some unknown… |
CVE-2025-15126 | Low | 3.1 | 2025-12-28 | A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositi… |
CVE-2025-15125 | Low | 3.1 | 2025-12-28 | A security flaw has been discovered in JeecgBoot up to 3.9.0. Affected is the function queryDepartPermission of the file /sys/permission/queryDepartPermission… |
CVE-2025-15124 | Low | 3.1 | 2025-12-28 | A vulnerability was identified in JeecgBoot up to 3.9.0. This impacts the function getParameterMap of the file /sys/sysDepartPermission/list. The manipulation… |
CVE-2025-15123 | Low | 3.1 | 2025-12-28 | A vulnerability was determined in JeecgBoot up to 3.9.0. This affects an unknown function of the file /sys/sysDepartPermission/datarule/. Executing manipulatio… |
CVE-2025-15122 | Low | 3.1 | 2025-12-28 | A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing mani… |
CVE-2025-15121 | Low | 2.4 | 2025-12-28 | A vulnerability has been found in JeecgBoot up to 3.9.0. The affected element is the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByU… |
CVE-2025-15120 | Low | 3.1 | 2025-12-28 | A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of t… |
CVE-2025-15119 | Low | 3.1 | 2025-12-28 | A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of t… |
CVE-2025-15118 | Medium | 4.3 | 2025-12-28 | A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the c… |
CVE-2025-15117 | Low | 3.1 | 2025-12-28 | A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Execu… |
CVE-2025-15116 | Low | 3.7 | 2025-12-28 | A security flaw has been discovered in OpenCart up to 4.1.0.3. Affected by this issue is some unknown functionality of the component Single-Use Coupon Handler… |
CVE-2025-68972 | Medium | 5.9 | 2025-12-27 | In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text af… |
CVE-2025-15110 | Medium | 4.7 | 2025-12-27 | A vulnerability has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Affected is the function Upload of the file Admin/Home/Controller/… |
CVE-2025-14180 | High | 7.5 | 2025-12-27 | In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver wit… |
CVE-2025-14178 | Medium | 6.5 | 2025-12-27 | In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_… |
CVE-2025-14177 | High | 7.5 | 2025-12-27 | In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak un… |
CVE-2025-15109 | High | 7.3 | 2025-12-27 | A flaw has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. This impacts an unknown function of the file Public/javascripts/admin/plupl… |
CVE-2025-15108 | Low | 3.7 | 2025-12-27 | A vulnerability was detected in PandaXGO PandaX up to fb8ff40f7ce5dfebdf66306c6d85625061faf7e5. This affects an unknown function of the file config.yml of the… |
CVE-2025-54322 | Critical | 10.0 | 2025-12-27 | Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP param… |
CVE-2025-15107 | Low | 3.7 | 2025-12-27 | A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the… |
CVE-2025-15106 | Medium | 6.3 | 2025-12-27 | A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the com… |
CVE-2025-15105 | Low | 3.7 | 2025-12-27 | A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/… |
CVE-2025-68952 | Critical | 9.8 | 2025-12-27 | Eigent is a multi-agent Workforce. In version 0.0.60, a 1-click Remote Code Execution (RCE) vulnerability has been identified in Eigent. This vulnerability all… |
CVE-2025-68948 | High | 8.1 | 2025-12-27 | SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded crypto… |
CVE-2025-68927 | Medium | 6.1 | 2025-12-27 | Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. W… |
CVE-2025-59946 | High | 7.5 | 2025-12-27 | NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. Prior to version 0.24.2, there is a classical data racing issue about sub info list which could resu… |
CVE-2025-68932 | Critical | 9.8 | 2025-12-27 | FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid(… |
CVE-2025-68474 | High | 7.6 | 2025-12-27 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() f… |
CVE-2025-68473 | High | 8.6 | 2025-12-27 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth h… |
CVE-2025-68148 | Medium | 4.3 | 2025-12-27 | FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to… |
CVE-2025-66203 | Critical | 9.9 | 2025-12-27 | StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault applicati… |
CVE-2025-68697 | High | 7.1 | 2025-12-26 | n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy (non-task-runner) J… |
CVE-2025-68668 | Critical | 9.9 | 2025-12-26 | n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses… |
CVE-2025-67729 | High | 8.8 | 2025-12-26 | LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where… |
CVE-2025-61914 | High | 7.3 | 2025-12-26 | n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting (XSS) vulnerability may occur in n8n when using the… |
CVE-2025-66737 | Medium | 4.3 | 2025-12-26 | Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged attacker can read arbitrary files via a crafted request resul… |
CVE-2025-67015 | High | 7.5 | 2025-12-26 | Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator passw… |
CVE-2025-67014 | High | 7.5 | 2025-12-26 | Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers to access an admini… |
CVE-2025-67013 | Medium | 6.5 | 2025-12-26 | The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) pr… |
CVE-2025-66738 | High | 8.8 | 2025-12-26 | An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary code via a crafted request the ping function of th… |
CVE-2025-57403 | High | 7.5 | 2025-12-26 | Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the requested URL (or a p… |
CVE-2025-13158 | | 2025-12-26 | Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via… | |
CVE-2025-67349 | Medium | 6.1 | 2025-12-26 | A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the appli… |
CVE-2025-66947 | Medium | 6.5 | 2025-12-26 | SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigge… |
CVE-2025-65885 | Medium | 5.1 | 2025-12-26 | An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight v6.7), Nokia E7 (De… |
CVE-2025-64645 | High | 7.7 | 2025-12-26 | IBM Concert 1.0.0 through 2.1.0 could allow a local user to escalate their privileges due to a race condition of a symbolic link. |
CVE-2025-36230 | Medium | 5.4 | 2025-12-26 | IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be exe… |
CVE-2025-36229 | Low | 3.1 | 2025-12-26 | IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers. |
CVE-2025-36228 | Low | 3.8 | 2025-12-26 | IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that… |
CVE-2025-25341 | High | 7.5 | 2025-12-26 | A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document. Accessing the internal _ref property on entity_ref and entity_decl… |
CVE-2025-36192 | Medium | 6.7 | 2025-12-26 | IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could… |
CVE-2025-14687 | Medium | 4.3 | 2025-12-26 | IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side… |
CVE-2025-13915 | Critical | 9.8 | 2025-12-26 | IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the… |
CVE-2025-1721 | Medium | 5.9 | 2025-12-26 | IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. |
CVE-2025-12771 | High | 7.8 | 2025-12-26 | IBM Concert 1.0.0 through 2.1.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and… |