2025 CVEs (page 56)
Page 56 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69008 | Medium | 5.9 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inboxify Inboxify Sign Up Form inboxify-sign-up-form allo… |
CVE-2025-69007 | Medium | 5.9 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-side… |
CVE-2025-69006 | Medium | 5.9 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atte Moisio AM Events am-events allows Stored XSS.This is… |
CVE-2025-68998 | Medium | 5.4 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affec… |
CVE-2025-68997 | Medium | 5.3 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-68996 | High | 7.5 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carous… |
CVE-2025-68995 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-68994 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in XforWooCommerce Product Loops for WooCommerce product-loops allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-68993 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in XforWooCommerce Share, Print and PDF Products for WooCommerce share-print-pdf-woocommerce allows Exploiting Incorrectly… |
CVE-2025-68992 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Knowledge Base Manager bwl-kb-manager allow… |
CVE-2025-68991 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager a… |
CVE-2025-68990 | High | 8.5 | 2025-12-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager a… |
CVE-2025-68989 | Medium | 4.3 | 2025-12-30 | Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows R… |
CVE-2025-68988 | Medium | 5.3 | 2025-12-30 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Em… |
CVE-2025-68987 | High | 7.5 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Cinerama cinerama allows P… |
CVE-2025-68985 | High | 7.5 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local Fil… |
CVE-2025-68984 | High | 7.5 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Puca puca allows PHP Local Fil… |
CVE-2025-68983 | High | 7.5 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Greenmart greenmart allows PHP… |
CVE-2025-68982 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-68981 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-68980 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-68979 | Medium | 5.3 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in SimpleCalendar Google Calendar Events google-calendar-events allows Exploiting Incorrectly Co… |
CVE-2025-68978 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows D… |
CVE-2025-68977 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-po… |
CVE-2025-68976 | Medium | 5.4 | 2025-12-30 | Missing Authorization vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-68975 | Medium | 4.3 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-68974 | Medium | 6.6 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and… |
CVE-2025-15245 | Low | 3.5 | 2025-12-30 | A vulnerability was found in D-Link DCS-850L 1.02.09. Affected is the function uploadfirmware of the component Firmware Update Service. The manipulation of the… |
CVE-2025-15244 | Low | 3.7 | 2025-12-30 | A vulnerability has been found in PHPEMS up to 11.0. This impacts an unknown function of the component Purchase Request Handler. The manipulation leads to race… |
CVE-2025-15359 | Critical | 9.1 | 2025-12-30 | DVP-12SE11T - Out-of-bound memory write Vulnerability |
CVE-2025-15243 | High | 7.3 | 2025-12-30 | A flaw has been found in code-projects Simple Stock System 1.0. This affects an unknown function of the file /market/login.php. Executing a manipulation of the… |
CVE-2025-15242 | Low | 3.1 | 2025-12-30 | A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function of the component Coupon Handler. Performing a manipulation resul… |
CVE-2025-15358 | High | 7.5 | 2025-12-30 | DVP-12SE11T - Denial of Service Vulnerability |
CVE-2025-15241 | Low | 3.5 | 2025-12-30 | A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1. The affected element is an unknown function of the file /admin/users of… |
CVE-2025-15234 | High | 8.8 | 2025-12-30 | A weakness has been identified in Tenda M3 1.0.0.13(4903). Impacted is the function formSetRemoteInternetLanInfo of the file /goform/setInternetLanInfo. This m… |
CVE-2025-15103 | High | 8.1 | 2025-12-30 | DVP-12SE11T - Authentication Bypass via Partial Password Disclosure |
CVE-2025-15102 | Critical | 9.1 | 2025-12-30 | DVP-12SE11T - Password Protection Bypass |
CVE-2025-15355 | Medium | 6.1 | 2025-12-30 | ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrar… |
CVE-2025-15233 | High | 8.8 | 2025-12-30 | A security flaw has been discovered in Tenda M3 1.0.0.13(4903). This issue affects the function formSetAdInfoDetails of the file /goform/setAdInfoDetail. The m… |
CVE-2025-15232 | High | 8.8 | 2025-12-30 | A vulnerability was identified in Tenda M3 1.0.0.13(4903). This vulnerability affects the function formSetAdPushInfo of the file /goform/setAdPushInfo. The man… |
CVE-2025-15231 | High | 8.8 | 2025-12-30 | A vulnerability was determined in Tenda M3 1.0.0.13(4903). This affects the function formSetRemoteVlanInfo of the file /goform/setVlanInfo. Executing a manipul… |
CVE-2025-15230 | High | 8.8 | 2025-12-30 | A vulnerability was found in Tenda M3 1.0.0.13(4903). Affected by this issue is the function formSetVlanPolicy of the file /goform/setVlanPolicyData. Performin… |
CVE-2025-15229 | Medium | 5.3 | 2025-12-30 | A vulnerability has been found in Tenda CH22 up to 1.0.0.1. Affected by this vulnerability is the function fromDhcpListClient of the file /goform/DhcpListClien… |
CVE-2025-15222 | Medium | 5.0 | 2025-12-30 | A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateF… |
CVE-2025-14313 | Medium | 6.1 | 2025-12-30 | The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a… |
CVE-2025-14312 | Medium | 6.1 | 2025-12-30 | The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a… |
CVE-2025-15221 | Low | 3.5 | 2025-12-30 | A flaw has been found in SohuTV CacheCloud up to 3.2.0. This vulnerability affects the function index of the file src/main/java/com/sohu/cache/web/controller/A… |
CVE-2025-15220 | Medium | 4.3 | 2025-12-30 | A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. This affects the function init of the file src/main/java/com/sohu/cache/web/controller/LoginCont… |
CVE-2025-15219 | Low | 3.5 | 2025-12-30 | A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doMachineList/doPodList of the file src/mai… |
CVE-2025-15218 | High | 8.8 | 2025-12-30 | A weakness has been identified in Tenda AC10U 15.03.06.48/15.03.06.49. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/AdvSe… |
CVE-2025-15217 | High | 8.8 | 2025-12-30 | A security flaw has been discovered in Tenda AC23 16.03.07.52. Affected is the function formSetPPTPUserList of the component HTTP POST Request Handler. Perform… |
CVE-2025-15216 | High | 8.8 | 2025-12-30 | A vulnerability was identified in Tenda AC23 16.03.07.52. This impacts the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of the… |
CVE-2025-15215 | High | 8.8 | 2025-12-30 | A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49. This affects the function formSetPPTPUserList of the file /goform/setPptpUserList of the… |
CVE-2025-69235 | High | 7.5 | 2025-12-30 | Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment. |
CVE-2025-69234 | Critical | 9.1 | 2025-12-30 | Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment. |
CVE-2025-15214 | Low | 2.4 | 2025-12-30 | A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function save_pricing of the file admin_class.php. The manipulati… |
CVE-2025-69217 | High | 7.7 | 2025-12-30 | coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port r… |
CVE-2025-15213 | Medium | 4.3 | 2025-12-30 | A vulnerability has been found in code-projects Student File Management System 1.0. The affected element is an unknown function of the file /download.php of th… |
CVE-2025-15212 | Medium | 6.3 | 2025-12-30 | A vulnerability was detected in code-projects Refugee Food Management System 1.0. This issue affects some unknown processing of the file /home/regfood.php. Per… |
CVE-2025-15211 | Medium | 6.3 | 2025-12-30 | A flaw has been found in code-projects Refugee Food Management System 1.0. Impacted is an unknown function of the file /home/refugee.php. Executing manipulatio… |
CVE-2025-68499 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This iss… |
CVE-2025-68498 | Medium | 6.5 | 2025-12-30 | Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects J… |
CVE-2025-68120 | Medium | 5.4 | 2025-12-30 | To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode. |
CVE-2025-68040 | Medium | 6.5 | 2025-12-30 | Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2025-68036 | High | 7.5 | 2025-12-30 | Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2025-23554 | High | 7.1 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakub Glos Off Page SEO off-page-seo allows Reflected XSS… |
CVE-2025-23550 | High | 7.1 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kemal YAZICI Product Puller product-puller allows Reflect… |
CVE-2025-23469 | High | 7.1 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sleekplan Sleekplan sleekplan allows Reflected XSS.This i… |
CVE-2025-23458 | High | 7.1 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rakessh Ads24 Lite wp-ad-management allows Reflected XSS… |
CVE-2025-15210 | Medium | 6.3 | 2025-12-30 | A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. This vulnerability affects unknown code of the file /home/editr… |
CVE-2025-15284 | Low | 3.7 | 2025-12-29 | Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not e… |
CVE-2025-15209 | Medium | 6.3 | 2025-12-29 | A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown part of the file /home/editfood.php. This manipulat… |
CVE-2025-15208 | High | 7.3 | 2025-12-29 | A security flaw has been discovered in code-projects Refugee Food Management System 1.0. Affected by this issue is some unknown functionality of the file /home… |
CVE-2025-68860 | Critical | 9.8 | 2025-12-29 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue a… |
CVE-2025-68607 | Medium | 6.5 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template custom-field-temp… |
CVE-2025-68562 | Critical | 9.9 | 2025-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a… |
CVE-2025-68504 | Medium | 6.5 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This… |
CVE-2025-68503 | Medium | 6.5 | 2025-12-29 | Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects J… |
CVE-2025-68502 | Medium | 4.3 | 2025-12-29 | Authorization Bypass Through User-Controlled Key vulnerability in Crocoblock JetPopup jet-popup allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-15207 | High | 7.3 | 2025-12-29 | A vulnerability has been found in Campcodes Supplier Management System 1.0. Affected is an unknown function of the file /admin/view_products.php. The manipulat… |
CVE-2025-15206 | High | 7.3 | 2025-12-29 | A flaw has been found in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /admin/add_area.php. Executing a manipulation o… |
CVE-2025-69205 | Medium | 6.3 | 2025-12-29 | Micro Registration Utility (µURU) is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d5… |
CVE-2025-15205 | Medium | 6.3 | 2025-12-29 | A vulnerability was identified in code-projects Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /dow… |
CVE-2025-15204 | Low | 2.4 | 2025-12-29 | A vulnerability was determined in SohuTV CacheCloud up to 3.2.0. Affected is the function doQuartzList of the file src/main/java/com/sohu/cache/web/controller/… |
CVE-2025-69202 | Medium | 6.5 | 2025-12-29 | Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-c… |
CVE-2025-15203 | Low | 2.4 | 2025-12-29 | A vulnerability was found in SohuTV CacheCloud up to 3.2.0. This impacts the function index of the file src/main/java/com/sohu/cache/web/controller/ResourceCon… |
CVE-2025-15202 | Low | 2.4 | 2025-12-29 | A vulnerability has been found in SohuTV CacheCloud up to 3.2.0. This affects the function taskQueueList of the file src/main/java/com/sohu/cache/web/controlle… |
CVE-2025-14175 | Medium | 6.5 | 2025-12-29 | A vulnerability in the SSH server of TP-Link TL-WR820N v2.80 allows the use of a weak cryptographic algorithm, enabling an adjacent attacker to intercept and d… |
CVE-2025-68706 | Critical | 9.8 | 2025-12-29 | A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handle… |
CVE-2025-68431 | Medium | 6.5 | 2025-12-29 | libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap… |
CVE-2025-67255 | High | 8.8 | 2025-12-29 | In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability. |
CVE-2025-67254 | High | 7.5 | 2025-12-29 | NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php. |
CVE-2025-15201 | Low | 3.5 | 2025-12-29 | A flaw has been found in SohuTV CacheCloud up to 3.2.0. The impacted element is the function redirectNoPower of the file src/main/java/com/sohu/cache/web/contr… |
CVE-2025-15200 | Low | 2.4 | 2025-12-29 | A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. The affected element is the function getExceptionStatisticsByClient/getCommandStatisticsByClient… |
CVE-2025-15199 | Medium | 6.3 | 2025-12-29 | A security vulnerability has been detected in code-projects College Notes Uploading System 1.0. Impacted is an unknown function of the file /dashboard/userprof… |
CVE-2025-14728 | Medium | 6.8 | 2025-12-29 | Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written ou… |
CVE-2025-14280 | Medium | 5.3 | 2025-12-29 | The PixelYourSite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.5 through publicly exposed lo… |
CVE-2025-13592 | High | 7.2 | 2025-12-29 | The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-ad__content' shortcode pa… |
CVE-2025-68861 | High | 7.1 | 2025-12-29 | Missing Authorization vulnerability in pluginoptimizer Plugin Optimizer plugin-optimizer allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-66877 | High | 7.5 | 2025-12-29 | Buffer overflow vulnerability in function dcputchar in decompile.c in libming 0.4.8. |