2025 CVEs (page 57)
Page 57 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55064 | Medium | 4.8 | 2025-12-29 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-55063 | Medium | 4.8 | 2025-12-29 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-55062 | Medium | 4.8 | 2025-12-29 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-55061 | High | 8.8 | 2025-12-29 | CWE-434 Unrestricted Upload of File with Dangerous Type |
CVE-2025-55060 | Medium | 6.1 | 2025-12-29 | CWE-601 URL Redirection to Untrusted Site ('Open Redirect') |
CVE-2025-15198 | High | 7.3 | 2025-12-29 | A weakness has been identified in code-projects College Notes Uploading System 1.0. This issue affects some unknown processing of the file /login.php. Executin… |
CVE-2025-68870 | High | 7.5 | 2025-12-29 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in reDim GmbH CookieHint WP cookiehint-wp… |
CVE-2025-68868 | Medium | 6.5 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codeaffairs Wp Text Slider Widget wp-text-slider-widget a… |
CVE-2025-66869 | High | 7.5 | 2025-12-29 | Buffer overflow vulnerability in function strcat in asan_interceptors.cpp in libming 0.4.8. |
CVE-2025-66866 | High | 7.5 | 2025-12-29 | An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-66865 | High | 7.5 | 2025-12-29 | An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-66864 | High | 7.5 | 2025-12-29 | An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-66863 | High | 7.5 | 2025-12-29 | An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-66862 | High | 7.5 | 2025-12-29 | A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. |
CVE-2025-66861 | Low | 2.5 | 2025-12-29 | An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE fi… |
CVE-2025-53627 | Medium | 5.3 | 2025-12-29 | Meshtastic is an open source mesh networking solution. The Meshtastic firmware (starting from version 2.5) introduces asymmetric encryption (PKI) for direct me… |
CVE-2025-15197 | Medium | 4.7 | 2025-12-29 | A security flaw has been discovered in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This vulnerability affects unknown code of the… |
CVE-2025-15196 | High | 7.3 | 2025-12-29 | A vulnerability was identified in code-projects Assessment Management 1.0. This affects an unknown part of the file login.php. Such manipulation of the argumen… |
CVE-2025-69211 | High | 7.4 | 2025-12-29 | Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS a… |
CVE-2025-69206 | Medium | 4.3 | 2025-12-29 | Hemmelig is a messing app with with client-side encryption and self-destructing messages. Prior to version 7.3.3, a Server-Side Request Forgery (SSRF) filter b… |
CVE-2025-69201 | Critical | 9.8 | 2025-12-29 | Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent… |
CVE-2025-69200 | High | 7.5 | 2025-12-29 | phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backu… |
CVE-2025-68951 | Medium | 5.4 | 2025-12-29 | phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to ex… |
CVE-2025-68897 | Critical | 9.9 | 2025-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Mohammad I. Okfie IF AS Shortcode if-as-shortcode allows Code Injection.This issue a… |
CVE-2025-68893 | Medium | 4.9 | 2025-12-29 | Server-Side Request Forgery (SSRF) vulnerability in HETWORKS WordPress Image shrinker wp-image-shrinker allows Server Side Request Forgery.This issue affects W… |
CVE-2025-68879 | High | 7.1 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in councilsoft Content Grid Slider content-grid-slider allow… |
CVE-2025-68878 | High | 7.1 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prasadkirpekar Advanced Custom CSS advanced-custom-css al… |
CVE-2025-68877 | High | 7.5 | 2025-12-29 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cedcommerce CedCommerce Integration fo… |
CVE-2025-68876 | High | 7.1 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INVELITY Invelity SPS connect invelity-sps-connect allows… |
CVE-2025-56333 | Critical | 9.8 | 2025-12-29 | An issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to escalate privileges via the 2FA component |
CVE-2025-15195 | High | 7.3 | 2025-12-29 | A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file /admin/add-module.p… |
CVE-2025-15194 | Critical | 9.8 | 2025-12-29 | A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi of the component… |
CVE-2025-68929 | Critical | 9.0 | 2025-12-29 | Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into… |
CVE-2025-68928 | Medium | 5.4 | 2025-12-29 | Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, whi… |
CVE-2025-65570 | Critical | 9.8 | 2025-12-29 | A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an array element acces… |
CVE-2025-65442 | Medium | 6.1 | 2025-12-29 | DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive… |
CVE-2025-60458 | Medium | 6.5 | 2025-12-29 | UxPlay 1.72 contains a double free vulnerability in its RTSP request handling. A specially crafted RTSP TEARDOWN request can trigger multiple calls to free() o… |
CVE-2025-57462 | Medium | 6.1 | 2025-12-29 | Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF file. |
CVE-2025-15193 | High | 8.8 | 2025-12-29 | A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. This affects the function sub_423848 of the file /boafrm/formParentControl. Performing manipulati… |
CVE-2025-15192 | Medium | 6.3 | 2025-12-29 | A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgr… |
CVE-2025-57460 | Critical | 9.8 | 2025-12-29 | File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell. |
CVE-2025-15191 | Medium | 6.3 | 2025-12-29 | A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom… |
CVE-2025-15190 | High | 8.8 | 2025-12-29 | A security flaw has been discovered in D-Link DWR-M920 up to 1.1.50. Impacted is the function sub_42261C of the file /boafrm/formFilter. The manipulation of th… |
CVE-2025-15189 | High | 8.8 | 2025-12-29 | A vulnerability was identified in D-Link DWR-M920 up to 1.1.50. This issue affects the function sub_464794 of the file /boafrm/formDefRoute. The manipulation o… |
CVE-2025-15188 | Low | 2.4 | 2025-12-29 | A vulnerability was determined in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/sea… |
CVE-2025-15187 | Low | 3.8 | 2025-12-29 | A vulnerability was found in GreenCMS up to 2.3. This affects an unknown part of the file /DataController.class.php of the component File Handler. Performing a… |
CVE-2025-15186 | High | 7.3 | 2025-12-29 | A vulnerability has been found in code-projects Refugee Food Management System 1.0. Affected by this issue is some unknown functionality of the file /home/addu… |
CVE-2025-15185 | High | 7.3 | 2025-12-29 | A flaw has been found in code-projects Refugee Food Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /home/refugee… |
CVE-2025-15184 | High | 7.3 | 2025-12-29 | A vulnerability was detected in code-projects Refugee Food Management System 1.0. Affected is an unknown function of the file /home/refugeesreport2.php. The ma… |
CVE-2025-15183 | High | 7.3 | 2025-12-29 | A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. This impacts an unknown function of the file /home/viewtakenfd… |
CVE-2025-15182 | High | 7.3 | 2025-12-29 | A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown function of the file /home/served.php. Executing ma… |
CVE-2025-15181 | High | 7.3 | 2025-12-29 | A security flaw has been discovered in code-projects Refugee Food Management System 1.0. The impacted element is an unknown function of the file /home/pagenate… |
CVE-2025-15180 | High | 7.2 | 2025-12-29 | A vulnerability was identified in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/webExcptypemanFilte of the component HT… |
CVE-2025-15228 | Critical | 9.8 | 2025-12-29 | BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web s… |
CVE-2025-15227 | High | 7.5 | 2025-12-29 | BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Trav… |
CVE-2025-15179 | High | 7.2 | 2025-12-29 | A vulnerability was determined in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/qossetting. This manipulation of the argument page… |
CVE-2025-15178 | High | 7.2 | 2025-12-29 | A vulnerability was found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/VirtualSer of the component HTTP Request Hand… |
CVE-2025-15226 | Critical | 9.8 | 2025-12-29 | WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, there… |
CVE-2025-15225 | High | 7.5 | 2025-12-29 | WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitr… |
CVE-2025-15177 | High | 7.2 | 2025-12-29 | A vulnerability has been found in Tenda WH450 1.0.0.18. This vulnerability affects unknown code of the file /goform/SetIpBind of the component HTTP Request Han… |
CVE-2025-15176 | Medium | 5.3 | 2025-12-29 | A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c o… |
CVE-2025-15175 | Low | 3.5 | 2025-12-29 | A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doAppList/appCommandAnalysis of the file src/main/java/co… |
CVE-2025-15174 | Low | 3.5 | 2025-12-29 | A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. Affected by this vulnerability is the function doAppAuditList of the file src/main… |
CVE-2025-15070 | Medium | 5.5 | 2025-12-29 | Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse. This issue af… |
CVE-2025-15069 | High | 7.1 | 2025-12-29 | Improper Authentication vulnerability in Gmission Web Fax allows Privilege Escalation.This issue affects Web Fax: from 3.0 before 3.0.1 |
CVE-2025-15068 | High | 7.7 | 2025-12-29 | Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse, Session Credential Falsification through Manipulation.This issue affects W… |
CVE-2025-13958 | Medium | 5.9 | 2025-12-29 | The YaMaps for WordPress Plugin WordPress plugin before 0.6.40 does not validate and escape some of its shortcode attributes before outputting them back in a p… |
CVE-2025-13417 | High | 8.6 | 2025-12-29 | The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perfor… |
CVE-2025-15173 | Low | 3.5 | 2025-12-29 | A weakness has been identified in SohuTV CacheCloud up to 3.2.0. Affected is the function advancedAnalysis of the file src/main/java/com/sohu/cache/web/control… |
CVE-2025-15172 | Low | 3.5 | 2025-12-29 | A security flaw has been discovered in SohuTV CacheCloud up to 3.2.0. This impacts the function preview of the file src/main/java/com/sohu/cache/web/controller… |
CVE-2025-15171 | Low | 3.5 | 2025-12-29 | A vulnerability was identified in SohuTV CacheCloud up to 3.2.0. This affects the function index of the file src/main/java/com/sohu/cache/web/controller/Server… |
CVE-2025-15170 | Medium | 4.3 | 2025-12-29 | A security vulnerability has been detected in Advaya Softech GEMS ERP Portal up to 2.1. This affects an unknown part of the file /home.jsp?isError=true of the… |
CVE-2025-15169 | Medium | 4.7 | 2025-12-29 | A weakness has been identified in BiggiDroid Simple PHP CMS 1.0. Affected by this issue is some unknown functionality of the file /admin/editsite.php. Executin… |
CVE-2025-52691 | Critical | 10.0 | 2025-12-29 | Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially… |
CVE-2025-15168 | High | 7.3 | 2025-12-29 | A vulnerability was identified in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /statistical.php. Such manipulation o… |
CVE-2025-15167 | High | 7.3 | 2025-12-29 | A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /detailtransac.php. This manipulat… |
CVE-2025-15166 | High | 7.3 | 2025-12-29 | A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. This affects an unknown function of the file /updatesupplier.php?action=edit. The ma… |
CVE-2025-15165 | High | 7.3 | 2025-12-29 | A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. The impacted element is an unknown function of the file /updatecustomer.php?act… |
CVE-2025-15164 | High | 7.2 | 2025-12-29 | A security flaw has been discovered in Tenda WH450 1.0.0.18. This affects an unknown part of the file /goform/SafeMacFilter. The manipulation of the argument p… |
CVE-2025-15163 | High | 7.2 | 2025-12-29 | A vulnerability was identified in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/SafeEmailFilter. The manipulat… |
CVE-2025-15067 | High | 7.7 | 2025-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Innorix Innorix WP allows Upload a Web Shell to a Web Server.This issue affects Innorix WP fro… |
CVE-2025-15066 | Medium | 6.2 | 2025-12-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Missing Authorization vulnerability in Innorix WP allows Path Traversal.This is… |
CVE-2025-15065 | Medium | 6.3 | 2025-12-29 | Exposure of Sensitive Information to an Unauthorized Actor, Missing Encryption of Sensitive Data, Files or Directories Accessible to External Parties vulnerabi… |
CVE-2025-15162 | High | 7.2 | 2025-12-29 | A vulnerability was determined in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/RouteStatic. Executing a… |
CVE-2025-15161 | High | 7.2 | 2025-12-28 | A vulnerability was found in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/PPTPUserSetting. Performing a manipulation of the argume… |
CVE-2025-15160 | High | 7.2 | 2025-12-28 | A vulnerability has been found in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/PPTPServer. Such manipulation of the argument ip1… |
CVE-2025-15156 | Medium | 4.3 | 2025-12-28 | A flaw has been found in omec-project UPF up to 2.1.3-dev. This affects the function handleSessionEstablishmentRequest of the file /pfcpiface/pfcpiface/message… |
CVE-2025-15155 | Medium | 5.3 | 2025-12-28 | A vulnerability was detected in floooh sokol up to 16cbcc864012898793cd2bc57f802499a264ea40. The impacted element is the function _sg_pipeline_desc_defaults in… |
CVE-2025-15154 | Medium | 5.3 | 2025-12-28 | A security vulnerability has been detected in PbootCMS up to 3.2.12. The affected element is the function get_user_ip of the file core/function/handle.php of t… |
CVE-2025-15153 | Low | 3.7 | 2025-12-28 | A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Execut… |
CVE-2025-15152 | Medium | 6.3 | 2025-12-28 | A vulnerability was identified in h-moses moga-mall up to 392d631a5ef15962a9bddeeb9f1269b9085473fa. This vulnerability affects the function addProduct of the f… |
CVE-2025-15151 | Low | 3.7 | 2025-12-28 | A vulnerability was determined in TaleLin Lin-CMS up to 0.6.0. This affects an unknown part of the file /tests/config.py of the component Tests Folder. This ma… |
CVE-2025-15150 | Medium | 5.3 | 2025-12-28 | A vulnerability was found in PX4 PX4-Autopilot up to 1.16.0. Affected by this issue is the function MavlinkLogHandler::state_listing/MavlinkLogHandler::log_ent… |
CVE-2025-15149 | Low | 2.4 | 2025-12-28 | A vulnerability has been found in rawchen ecms up to b59d7feaa9094234e8aa6c8c6b290621ca575ded. Affected by this vulnerability is the function updateProductServ… |
CVE-2025-15148 | Medium | 4.7 | 2025-12-28 | A flaw has been found in CmsEasy up to 7.7.7. Affected is the function savetemp_action in the library /lib/admin/template_admin.php of the component Backend Te… |
CVE-2025-15146 | Low | 2.4 | 2025-12-28 | A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. This impacts the function doUserList of the file src/main/java/com/sohu/cache/web/controller/Use… |
CVE-2025-68973 | High | 7.8 | 2025-12-28 | In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted… |
CVE-2025-15145 | Low | 2.4 | 2025-12-28 | A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. This affects the function doTotalList of the file src/main/java/com/sohu/cache/web… |
CVE-2025-15144 | Medium | 4.3 | 2025-12-28 | A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. The impacted element is the function dr_show_error/dr_exit_msg of the file /dayrui/Fcms/Init.ph… |
CVE-2025-15143 | Medium | 4.7 | 2025-12-28 | A security flaw has been discovered in EyouCMS up to 1.7.6. The affected element is an unknown function of the file /application/admin/logic/FilemanagerLogic.p… |