2025 CVEs (page 58)
Page 58 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15142 | High | 7.3 | 2025-12-28 | A vulnerability was identified in 9786 phpok3w up to 901d96a06809fb28b17f3a4362c59e70411c933c. Impacted is an unknown function of the file show.php. The manipu… |
CVE-2025-15141 | Low | 3.1 | 2025-12-28 | A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler… |
CVE-2025-15140 | High | 7.3 | 2025-12-28 | A vulnerability was found in saiftheboss7 onlinemcqexam up to 0e56806132971e49721db3ef01868098c7b42ada. This vulnerability affects unknown code of the file /ad… |
CVE-2025-15139 | Medium | 6.3 | 2025-12-28 | A vulnerability has been found in TRENDnet TEW-822DRE 1.00B21/1.01B06. This affects the function sub_43ACF4 of the file /boafrm/formWsc. Such manipulation of… |
CVE-2025-15138 | Medium | 4.7 | 2025-12-28 | A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php. This mani… |
CVE-2025-15137 | High | 8.8 | 2025-12-28 | A vulnerability was detected in TRENDnet TEW-800MB 1.0.1.0. Affected by this vulnerability is the function sub_F934 of the file NTPSyncWithHost.cgi. The manip… |
CVE-2025-15136 | High | 8.8 | 2025-12-28 | A security vulnerability has been detected in TRENDnet TEW-800MB 1.0.1.0. Affected is the function do_setWizard_asp of the file /goform/wizardset of the compon… |
CVE-2025-15135 | Medium | 6.3 | 2025-12-28 | A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to 3.0.0. This impacts the function tryAuthenticateWithCookies of the file Authenticat… |
CVE-2025-15134 | Low | 3.5 | 2025-12-28 | A security flaw has been discovered in yourmaileyes MOOC up to 1.17. This affects the function subreview of the file mooc/controller/MainController.java of the… |
CVE-2025-15133 | Medium | 6.3 | 2025-12-28 | A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the… |
CVE-2025-15132 | Medium | 6.3 | 2025-12-28 | A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the compon… |
CVE-2025-15131 | Medium | 6.3 | 2025-12-28 | A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP… |
CVE-2025-15130 | Medium | 4.7 | 2025-12-28 | A vulnerability has been found in shanyu SyCms up to a242ef2d194e8bb249dc175e7c49f2c1673ec921. This issue affects the function addPost of the file Application/… |
CVE-2025-15129 | Medium | 6.3 | 2025-12-28 | A flaw has been found in ChenJinchuang Lin-CMS-TP5 up to 0.3.3. This vulnerability affects the function Upload of the file application/lib/file/LocalUploader.p… |
CVE-2025-15128 | Medium | 5.3 | 2025-12-28 | A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint… |
CVE-2025-15127 | High | 7.3 | 2025-12-28 | A security vulnerability has been detected in FantasticLBP Hotels_Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. Affected by this issue is some unknown… |
CVE-2025-15126 | Low | 3.1 | 2025-12-28 | A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositi… |
CVE-2025-15125 | Low | 3.1 | 2025-12-28 | A security flaw has been discovered in JeecgBoot up to 3.9.0. Affected is the function queryDepartPermission of the file /sys/permission/queryDepartPermission… |
CVE-2025-15124 | Low | 3.1 | 2025-12-28 | A vulnerability was identified in JeecgBoot up to 3.9.0. This impacts the function getParameterMap of the file /sys/sysDepartPermission/list. The manipulation… |
CVE-2025-15123 | Low | 3.1 | 2025-12-28 | A vulnerability was determined in JeecgBoot up to 3.9.0. This affects an unknown function of the file /sys/sysDepartPermission/datarule/. Executing manipulatio… |
CVE-2025-15122 | Low | 3.1 | 2025-12-28 | A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing mani… |
CVE-2025-15121 | Low | 2.4 | 2025-12-28 | A vulnerability has been found in JeecgBoot up to 3.9.0. The affected element is the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByU… |
CVE-2025-15120 | Low | 3.1 | 2025-12-28 | A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of t… |
CVE-2025-15119 | Low | 3.1 | 2025-12-28 | A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of t… |
CVE-2025-15118 | Medium | 4.3 | 2025-12-28 | A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the c… |
CVE-2025-15117 | Low | 3.1 | 2025-12-28 | A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Execu… |
CVE-2025-15116 | Low | 3.7 | 2025-12-28 | A security flaw has been discovered in OpenCart up to 4.1.0.3. Affected by this issue is some unknown functionality of the component Single-Use Coupon Handler… |
CVE-2025-68972 | Medium | 5.9 | 2025-12-27 | In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text af… |
CVE-2025-15110 | Medium | 4.7 | 2025-12-27 | A vulnerability has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Affected is the function Upload of the file Admin/Home/Controller/… |
CVE-2025-14180 | High | 7.5 | 2025-12-27 | In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver wit… |
CVE-2025-14178 | Medium | 6.5 | 2025-12-27 | In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_… |
CVE-2025-14177 | High | 7.5 | 2025-12-27 | In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak un… |
CVE-2025-15109 | High | 7.3 | 2025-12-27 | A flaw has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. This impacts an unknown function of the file Public/javascripts/admin/plupl… |
CVE-2025-15108 | Low | 3.7 | 2025-12-27 | A vulnerability was detected in PandaXGO PandaX up to fb8ff40f7ce5dfebdf66306c6d85625061faf7e5. This affects an unknown function of the file config.yml of the… |
CVE-2025-54322 | Critical | 10.0 | 2025-12-27 | Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP param… |
CVE-2025-15107 | Low | 3.7 | 2025-12-27 | A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the… |
CVE-2025-15106 | Medium | 6.3 | 2025-12-27 | A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the com… |
CVE-2025-15105 | Low | 3.7 | 2025-12-27 | A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/… |
CVE-2025-68952 | Critical | 9.8 | 2025-12-27 | Eigent is a multi-agent Workforce. In version 0.0.60, a 1-click Remote Code Execution (RCE) vulnerability has been identified in Eigent. This vulnerability all… |
CVE-2025-68948 | High | 8.1 | 2025-12-27 | SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded crypto… |
CVE-2025-68927 | Medium | 6.1 | 2025-12-27 | Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. W… |
CVE-2025-59946 | High | 7.5 | 2025-12-27 | NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. Prior to version 0.24.2, there is a classical data racing issue about sub info list which could resu… |
CVE-2025-68932 | Critical | 9.8 | 2025-12-27 | FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid(… |
CVE-2025-68474 | High | 7.6 | 2025-12-27 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() f… |
CVE-2025-68473 | High | 8.6 | 2025-12-27 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth h… |
CVE-2025-68148 | Medium | 4.3 | 2025-12-27 | FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to… |
CVE-2025-66203 | Critical | 9.9 | 2025-12-27 | StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault applicati… |
CVE-2025-68697 | High | 7.1 | 2025-12-26 | n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy (non-task-runner) J… |
CVE-2025-68668 | Critical | 9.9 | 2025-12-26 | n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses… |
CVE-2025-67729 | High | 8.8 | 2025-12-26 | LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where… |
CVE-2025-61914 | High | 7.3 | 2025-12-26 | n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting (XSS) vulnerability may occur in n8n when using the… |
CVE-2025-66737 | Medium | 4.3 | 2025-12-26 | Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged attacker can read arbitrary files via a crafted request resul… |
CVE-2025-67015 | High | 7.5 | 2025-12-26 | Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator passw… |
CVE-2025-67014 | High | 7.5 | 2025-12-26 | Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers to access an admini… |
CVE-2025-67013 | Medium | 6.5 | 2025-12-26 | The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) pr… |
CVE-2025-66738 | High | 8.8 | 2025-12-26 | An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary code via a crafted request the ping function of th… |
CVE-2025-57403 | High | 7.5 | 2025-12-26 | Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the requested URL (or a p… |
CVE-2025-13158 | | 2025-12-26 | Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via… | |
CVE-2025-67349 | Medium | 6.1 | 2025-12-26 | A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the appli… |
CVE-2025-66947 | Medium | 6.5 | 2025-12-26 | SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigge… |
CVE-2025-65885 | Medium | 5.1 | 2025-12-26 | An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight v6.7), Nokia E7 (De… |
CVE-2025-64645 | High | 7.7 | 2025-12-26 | IBM Concert 1.0.0 through 2.1.0 could allow a local user to escalate their privileges due to a race condition of a symbolic link. |
CVE-2025-36230 | Medium | 5.4 | 2025-12-26 | IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be exe… |
CVE-2025-36229 | Low | 3.1 | 2025-12-26 | IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers. |
CVE-2025-36228 | Low | 3.8 | 2025-12-26 | IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that… |
CVE-2025-25341 | High | 7.5 | 2025-12-26 | A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document. Accessing the internal _ref property on entity_ref and entity_decl… |
CVE-2025-36192 | Medium | 6.7 | 2025-12-26 | IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could… |
CVE-2025-14687 | Medium | 4.3 | 2025-12-26 | IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side… |
CVE-2025-13915 | Critical | 9.8 | 2025-12-26 | IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the… |
CVE-2025-1721 | Medium | 5.9 | 2025-12-26 | IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. |
CVE-2025-12771 | High | 7.8 | 2025-12-26 | IBM Concert 1.0.0 through 2.1.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and… |
CVE-2025-67450 | High | 7.8 | 2025-12-26 | Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code… |
CVE-2025-59888 | Medium | 6.7 | 2025-12-26 | Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the … |
CVE-2025-59887 | High | 8.6 | 2025-12-26 | Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to… |
CVE-2025-62578 | High | 7.5 | 2025-12-26 | DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information |
CVE-2025-8075 | Medium | 5.4 | 2025-12-26 | Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered that validat… |
CVE-2025-68946 | Medium | 5.4 | 2025-12-26 | In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS. |
CVE-2025-52601 | High | 7.8 | 2025-12-26 | Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerabil… |
CVE-2025-52600 | High | 7.2 | 2025-12-26 | Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerabil… |
CVE-2025-52599 | Medium | 6.5 | 2025-12-26 | Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered Inadequate o… |
CVE-2025-52598 | Low | 3.7 | 2025-12-26 | Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has found a flaw that camer… |
CVE-2025-68945 | Medium | 5.8 | 2025-12-26 | In Gitea before 1.21.2, an anonymous user can visit a private user's project. |
CVE-2025-68944 | Medium | 5.0 | 2025-12-26 | Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries. |
CVE-2025-68943 | Medium | 5.3 | 2025-12-26 | Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order. |
CVE-2025-15099 | High | 7.3 | 2025-12-26 | A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/internal.ts of the compon… |
CVE-2025-68942 | Medium | 5.4 | 2025-12-26 | Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text. |
CVE-2025-68941 | Medium | 4.9 | 2025-12-26 | Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources. |
CVE-2025-68940 | Low | 3.1 | 2025-12-26 | In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request. |
CVE-2025-68939 | High | 8.2 | 2025-12-26 | Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API. |
CVE-2025-15098 | Medium | 6.3 | 2025-12-26 | A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger of the component… |
CVE-2025-15097 | High | 7.3 | 2025-12-26 | A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation res… |
CVE-2025-15095 | Low | 3.5 | 2025-12-26 | A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The… |
CVE-2025-68938 | Medium | 4.3 | 2025-12-26 | Gitea before 1.25.2 mishandles authorization for deletion of releases. |
CVE-2025-15094 | Medium | 4.3 | 2025-12-26 | A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted element is the function userLogin of the file s… |
CVE-2025-15093 | Medium | 4.3 | 2025-12-26 | A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The affected element is an unknown function of the file… |
CVE-2025-15092 | High | 8.8 | 2025-12-26 | A vulnerability was identified in UTT 进取 512W up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/ConfigExceptMSN. Such manipulation of the… |
CVE-2025-68937 | | 2025-12-26 | Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symli… | |
CVE-2025-15091 | High | 8.8 | 2025-12-26 | A vulnerability was determined in UTT 进取 512W up to 1.7.7-171114. This issue affects the function strcpy of the file /goform/formPictureUrl. This manipulation… |
CVE-2025-14913 | Medium | 5.3 | 2025-12-26 | The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to an incorre… |
CVE-2025-15090 | High | 8.8 | 2025-12-25 | A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This vulnerability affects the function strcpy of the file /goform/formConfigNoticeConfig. The man… |