2025 CVEs (page 59)
Page 59 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15089 | High | 8.8 | 2025-12-25 | A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114. This affects the function strcpy of the file /goform/APSecurity. The manipulation of the argu… |
CVE-2025-15088 | Medium | 6.3 | 2025-12-25 | A vulnerability was detected in ketr JEPaaS up to 7.2.8. Affected by this vulnerability is the function postilService.loadPostils of the file /je/postil/postil… |
CVE-2025-15087 | Medium | 4.3 | 2025-12-25 | A security vulnerability has been detected in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function submitOrderPayment of the file mall-oms/oms-boot/src… |
CVE-2025-15086 | Medium | 4.3 | 2025-12-25 | A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/c… |
CVE-2025-68936 | Medium | 6.4 | 2025-12-25 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer. |
CVE-2025-68935 | Medium | 6.4 | 2025-12-25 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer. |
CVE-2025-15085 | Medium | 4.3 | 2025-12-25 | A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-boot/src/main/java/… |
CVE-2025-15084 | Low | 3.1 | 2025-12-25 | A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/… |
CVE-2025-15083 | Low | 2.0 | 2025-12-25 | A vulnerability was determined in TOZED ZLT M30s up to 1.47. The affected element is an unknown function of the component UART Interface. Executing manipulatio… |
CVE-2025-15082 | Medium | 5.3 | 2025-12-25 | A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web Management Interfac… |
CVE-2025-15081 | Medium | 6.3 | 2025-12-25 | A vulnerability has been found in JD Cloud BE6500 4.4.1.r4308. This issue affects the function sub_4780 of the file /jdcapi. Such manipulation of the argument… |
CVE-2025-2406 | High | 7.6 | 2025-12-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology I… |
CVE-2025-2405 | High | 7.6 | 2025-12-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology I… |
CVE-2025-2307 | High | 7.6 | 2025-12-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology I… |
CVE-2025-66443 | High | 7.5 | 2025-12-25 | Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that… |
CVE-2025-66379 | High | 7.5 | 2025-12-25 | Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort via a crafted medi… |
CVE-2025-66378 | Medium | 5.9 | 2025-12-25 | Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP streams traversing… |
CVE-2025-66377 | High | 7.5 | 2025-12-25 | Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access to execut… |
CVE-2025-59683 | High | 8.2 | 2025-12-25 | Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchang… |
CVE-2025-49088 | Medium | 5.9 | 2025-12-25 | Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Join, has Improper Input Validation in the… |
CVE-2025-48704 | High | 7.5 | 2025-12-25 | Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a de… |
CVE-2025-32096 | High | 7.5 | 2025-12-25 | Pexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort, resulting in a den… |
CVE-2025-32095 | High | 7.5 | 2025-12-25 | Pexip Infinity before 37.0 has improper input validation in signalling that allows a remote attacker to trigger a software abort via a crafted signalling messa… |
CVE-2025-15078 | High | 7.3 | 2025-12-25 | A vulnerability was detected in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /list_report.php. The manip… |
CVE-2025-15077 | High | 7.3 | 2025-12-25 | A security vulnerability has been detected in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /form137.php… |
CVE-2025-15076 | High | 7.3 | 2025-12-25 | A weakness has been identified in Tenda CH22 1.0.0.1. Impacted is an unknown function of the file /public/. Executing a manipulation can lead to path traversal… |
CVE-2025-15075 | High | 7.3 | 2025-12-25 | A security flaw has been discovered in itsourcecode Student Management System 1.0. This issue affects some unknown processing of the file /student_p.php. Perfo… |
CVE-2025-15074 | High | 7.3 | 2025-12-25 | A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /customer_details.p… |
CVE-2025-68922 | High | 7.4 | 2025-12-25 | OpenOps before 0.6.11 allows remote code execution in the Terraform block. |
CVE-2025-15073 | High | 7.3 | 2025-12-24 | A vulnerability was determined in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /contact_us.php. This manipula… |
CVE-2025-68920 | High | 8.9 | 2025-12-24 | C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve a… |
CVE-2025-8769 | Critical | 9.8 | 2025-12-24 | Telenium Online Web Application is vulnerable due to a Perl script that is called to load the login page. Due to improper input validation, an attacker can i… |
CVE-2025-68919 | Medium | 5.6 | 2025-12-24 | Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessibl… |
CVE-2025-68917 | Medium | 6.4 | 2025-12-24 | ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer. |
CVE-2025-68916 | Critical | 9.1 | 2025-12-24 | Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code execution. |
CVE-2025-68915 | Medium | 5.5 | 2025-12-24 | Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/loginbanner_w.cgi XSS via a crafted banner. |
CVE-2025-68914 | Medium | 6.5 | 2025-12-24 | Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINFAILEDTABLE table. |
CVE-2025-3232 | High | 7.5 | 2025-12-24 | A remote unauthenticated attacker may be able to bypass authentication by utilizing a specific API route to execute arbitrary OS commands. |
CVE-2025-36154 | Medium | 6.2 | 2025-12-24 | IBM Concert 1.0.0 through 2.1.0 stores sensitive information in cleartext during recursive docker builds which could be obtained by a local user. |
CVE-2025-2515 | High | 7.2 | 2025-12-24 | A vulnerability was found in BlueChi, a multi-node systemd service controller used in RHIVOS. This flaw allows a user with root privileges on a managed node (q… |
CVE-2025-68750 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: usb: potential integer overflow in usbg_make_tpg() The variable tpgt in usbg_make_tpg() i… | |
CVE-2025-43876 | | 2025-12-24 | Under certain circumstances a successful exploitation could result in access to the device. | |
CVE-2025-43875 | | 2025-12-24 | Under certain circumstances a successful exploitation could result in access to the device. | |
CVE-2025-60935 | Medium | 6.1 | 2025-12-24 | An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL. This iss… |
CVE-2025-2155 | High | 8.8 | 2025-12-24 | Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion. Thi… |
CVE-2025-2154 | Medium | 5.4 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Echo Call Center Services Trade and Industry Inc… |
CVE-2025-68749 | High | 7.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix race condition when unbinding BOs Fix 'Memory manager not clean during ta… |
CVE-2025-68748 | High | 7.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF race between device unplug and FW event processing The function pant… |
CVE-2025-68747 | High | 7.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF on kernel BO VA nodes If the MMU is down, panthor_vm_unmap_range() m… |
CVE-2025-68746 | High | 7.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Fix timeout handling When the CPU that the QSPI interrupt handler run… |
CVE-2025-68745 | Critical | 9.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f ("scsi: qla2xxx: target: F… |
CVE-2025-68744 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Free special fields when update [lru_,]percpu_hash maps As [lru_,]percpu_hash maps s… | |
CVE-2025-68743 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: mshv: Fix create memory region overlap check The current check is incorrect; it only chec… | |
CVE-2025-68742 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers… | |
CVE-2025-68741 | Critical | 9.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an ite… |
CVE-2025-68740 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: ima: Handle error code returned by ima_filter_rule_match() In ima_match_rules(), if ima_f… | |
CVE-2025-68739 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: hisi: Fix potential UAF in OPP handling Ensure all required data is acquire… | |
CVE-2025-68738 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() If a link does not have an… | |
CVE-2025-68737 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: arm64/pageattr: Propagate return value from __change_memory_common The rodata=on security… | |
CVE-2025-68736 | High | 8.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: landlock: Fix handling of disconnected directories Disconnected files or directories can… |
CVE-2025-68735 | High | 7.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Prevent potential UAF in group creation This commit prevents the possibility… |
CVE-2025-68608 | High | 7.5 | 2025-12-24 | Missing Authorization vulnerability in DeluxeThemes Userpro userpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-68606 | Medium | 5.3 | 2025-12-24 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPXPO PostX ultimate-post allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-68605 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allo… |
CVE-2025-68603 | Medium | 5.4 | 2025-12-24 | Missing Authorization vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-68602 | Medium | 4.7 | 2025-12-24 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Phishing… |
CVE-2025-68601 | Medium | 5.4 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Cross Site Request Forgery.This… |
CVE-2025-68600 | Medium | 4.9 | 2025-12-24 | Server-Side Request Forgery (SSRF) vulnerability in Yannick Lefebvre Link Library link-library allows Server Side Request Forgery.This issue affects Link Libra… |
CVE-2025-68599 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-e… |
CVE-2025-68598 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer live-compo… |
CVE-2025-68597 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings… |
CVE-2025-68596 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Bit Apps Bit Assist bit-assist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-68595 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Trustindex Widgets for Social Photo Feed social-photo-feed-widget allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-68594 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows Exploiting Incorrect… |
CVE-2025-68593 | Medium | 5.4 | 2025-12-24 | Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-68592 | Medium | 4.3 | 2025-12-24 | Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-68591 | Medium | 5.4 | 2025-12-24 | Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-68590 | High | 7.6 | 2025-12-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubs… |
CVE-2025-68589 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in WP Socio WP Telegram Widget and Join Link wptelegram-widget allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-68588 | Medium | 4.3 | 2025-12-24 | Missing Authorization vulnerability in totalsoft TS Poll poll-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS… |
CVE-2025-68587 | Medium | 4.3 | 2025-12-24 | Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz… |
CVE-2025-68586 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cooke… |
CVE-2025-68585 | Low | 2.7 | 2025-12-24 | Missing Authorization vulnerability in Ben Balter WP Document Revisions wp-document-revisions allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-68584 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This iss… |
CVE-2025-68583 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Tikweb Management Fast User Switching fast-user-switching allows Cross Site Request Forgery.This issue affec… |
CVE-2025-68582 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Funnelforms Funnelforms Free funnelforms-free allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-68581 | Medium | 5.4 | 2025-12-24 | Missing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-68580 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in pluginsware Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro allows Cross Site Re… |
CVE-2025-68579 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-68578 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Addonify Addonify addonify-quick-view allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-68577 | Medium | 4.3 | 2025-12-24 | Missing Authorization vulnerability in Virusdie Virusdie virusdie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vi… |
CVE-2025-68576 | Medium | 4.3 | 2025-12-24 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie Virusdie virusdie allows Retrieve Embedded Sensitive Data… |
CVE-2025-68575 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Wappointment team Wappointment wappointment allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-68574 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-v… |
CVE-2025-68573 | Medium | 5.4 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue… |
CVE-2025-68572 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Spider Themes BBP Core bbp-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-68571 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-68570 | High | 7.6 | 2025-12-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows… |
CVE-2025-68569 | Medium | 6.5 | 2025-12-24 | Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-68568 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture claspo allows Exploiting Incorrectly Configured Ac… |