2025 CVEs (page 62)
Page 62 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14966 | Medium | 4.7 | 2025-12-19 | A vulnerability was determined in FastAdmin up to 1.7.0.20250506. Affected is the function selectpage of the file application/common/controller/Backend.php of… |
CVE-2025-12874 | | 2025-12-19 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Quest Coexistence Manager for Notes (Free/Busy Connector modu… | |
CVE-2025-14965 | Medium | 5.5 | 2025-12-19 | A vulnerability was found in 1541492390c yougou-mall up to 0a771fa817c924efe52c8fe0a9a6658eee675f9f. This impacts the function upload/delete of the file src/ma… |
CVE-2025-14964 | Critical | 9.8 | 2025-12-19 | A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083_B20200521. This affects the function sprintf of the file /cgi-bin/cstecgi.cgi. Such manipulation of… |
CVE-2025-14962 | Medium | 4.3 | 2025-12-19 | A flaw has been found in code-projects Simple Stock System 1.0. The impacted element is an unknown function of the file /market/chatuser.php. This manipulation… |
CVE-2025-14961 | High | 7.3 | 2025-12-19 | A vulnerability was detected in code-projects Simple Blood Donor Management System 1.0. The affected element is an unknown function of the file /editedcampaign… |
CVE-2025-68478 | High | 7.1 | 2025-12-19 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's… |
CVE-2025-68430 | Medium | 4.3 | 2025-12-19 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT… |
CVE-2025-14960 | High | 7.3 | 2025-12-19 | A security vulnerability has been detected in code-projects Simple Blood Donor Management System 1.0. Impacted is an unknown function of the file /editeddonor… |
CVE-2025-14959 | High | 7.3 | 2025-12-19 | A weakness has been identified in code-projects Simple Stock System 1.0. This issue affects some unknown processing of the file /market/signup.php. Executing a… |
CVE-2025-14958 | Medium | 5.3 | 2025-12-19 | A security flaw has been discovered in floooh sokol up to 33e2271c431bf21de001e972f72da17a984da932. This vulnerability affects the function _sg_pipeline_common… |
CVE-2025-68477 | High | 7.7 | 2025-12-19 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, Langflow provides an API Request component that can issu… |
CVE-2025-68457 | Medium | 6.1 | 2025-12-19 | Orejime is a consent manager that focuses on accessibility. On HTML elements handled by Orejime prior to version 2.3.2, one could run malicious code by embeddi… |
CVE-2025-66580 | Critical | 9.6 | 2025-12-19 | Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. A critical Stored Cross-Site Scripting (XSS) vulnerabi… |
CVE-2025-65035 | Medium | 6.4 | 2025-12-19 | pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Pr… |
CVE-2025-63665 | Critical | 9.8 | 2025-12-19 | An issue in GT Edge AI Community Edition Versions before v2.0.12 allows attackers to execute arbitrary code via injecting a crafted JSON payload into the Promp… |
CVE-2025-58053 | Critical | 9.8 | 2025-12-19 | Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account with a self forged… |
CVE-2025-58052 | High | 8.1 | 2025-12-19 | Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group man… |
CVE-2025-14957 | Low | 3.3 | 2025-12-19 | A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLoca… |
CVE-2025-14956 | Medium | 5.3 | 2025-12-19 | A vulnerability was determined in WebAssembly Binaryen up to 125. Affected by this issue is the function WasmBinaryReader::readExport of the file src/wasm/wasm… |
CVE-2025-14955 | Low | 3.7 | 2025-12-19 | A vulnerability was found in Open5GS up to 2.7.5. Affected by this vulnerability is the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c o… |
CVE-2025-14812 | High | 7.5 | 2025-12-19 | ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-schem… |
CVE-2025-14809 | High | 7.4 | 2025-12-19 | ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing… |
CVE-2025-67442 | High | 7.6 | 2025-12-19 | EVE-NG 6.4.0-13-PRO is vulnerable to Directory Traversal. The /api/export interface allows authenticated users to export lab files. This interface lacks effect… |
CVE-2025-66906 | Medium | 6.1 | 2025-12-19 | Cross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT allows attackers to gain escalated privileges. |
CVE-2025-66905 | High | 7.5 | 2025-12-19 | The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attack… |
CVE-2025-53922 | Medium | 4.9 | 2025-12-19 | Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in… |
CVE-2025-34433 | | 2025-12-19 | AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt us… | |
CVE-2025-14954 | Low | 3.7 | 2025-12-19 | A vulnerability has been found in Open5GS up to 2.7.6. Affected is the function ogs_pfcp_pdr_find_or_add/ogs_pfcp_far_find_or_add/ogs_pfcp_urr_find_or_add/ogs_… |
CVE-2025-14953 | Low | 3.1 | 2025-12-19 | A flaw has been found in Open5GS up to 2.7.5. This impacts the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c of the component FAR-ID Ha… |
CVE-2025-66911 | Medium | 6.5 | 2025-12-19 | Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserO… |
CVE-2025-66910 | Medium | 6.0 | 2025-12-19 | Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService… |
CVE-2025-66909 | High | 7.5 | 2025-12-19 | Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability. The ExtendedOpenCVImage class in ai/… |
CVE-2025-66908 | Medium | 5.3 | 2025-12-19 | Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality. The OcrCont… |
CVE-2025-50681 | High | 7.5 | 2025-12-19 | igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service (application crash) via a crafted IGMPv3 membership report packet with… |
CVE-2025-14952 | High | 7.3 | 2025-12-19 | A vulnerability was detected in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_category.php. Performing a ma… |
CVE-2025-14951 | High | 7.3 | 2025-12-19 | A security vulnerability has been detected in code-projects Scholars Tracking System 1.0. The impacted element is an unknown function of the file /home.php. Su… |
CVE-2025-14950 | High | 7.3 | 2025-12-19 | A weakness has been identified in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /delete_post.php. This ma… |
CVE-2025-1928 | Critical | 9.1 | 2025-12-19 | Improper Restriction of Excessive Authentication Attempts vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Password R… |
CVE-2025-14946 | Medium | 4.8 | 2025-12-19 | A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulne… |
CVE-2025-14882 | | 2025-12-19 | An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only. | |
CVE-2025-14881 | | 2025-12-19 | Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only. | |
CVE-2025-1927 | High | 7.1 | 2025-12-19 | Cross-Site Request Forgery (CSRF) vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Cross Site Request Forgery. This… |
CVE-2025-1885 | Medium | 5.4 | 2025-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Phishing, Forcef… |
CVE-2025-14847 | High | 7.5 | 2025-12-19 | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all… |
CVE-2025-66524 | High | 8.8 | 2025-12-19 | Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for s… |
CVE-2025-14455 | Medium | 5.4 | 2025-12-19 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to… |
CVE-2025-12361 | Medium | 4.3 | 2025-12-19 | The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versi… |
CVE-2025-14151 | High | 7.2 | 2025-12-19 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outbound_resource' parameter in the slimtrack AJAX action in… |
CVE-2025-11747 | Medium | 6.4 | 2025-12-19 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the colibri_blog_posts shortcode in all versions up to, and incl… |
CVE-2025-66522 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in the Digital IDs functionality of the Foxit PDF Editor Cloud (pdfonline.foxit.com). The application… |
CVE-2025-66521 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Trusted Certificates feature. A crafted payload can be injected as t… |
CVE-2025-66520 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in the Portfolio feature of the Foxit PDF Editor cloud (pdfonline.foxit.com). User-supplied SVG files… |
CVE-2025-66519 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. A crafted payload can be injected into t… |
CVE-2025-66502 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature. A crafted payload can be stored as the templ… |
CVE-2025-66501 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Predefined Text feature of the Foxit eSign section. A crafted payloa… |
CVE-2025-66500 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in webplugins.foxit.com. A postMessage handler fails to validate the message origin and directly assig… |
CVE-2025-66499 | High | 7.8 | 2025-12-19 | A heap-based buffer overflow vulnerability exists in the PDF parsing of Foxit PDF Reader when processing specially crafted JBIG2 data. An integer overflow in t… |
CVE-2025-66498 | Medium | 5.3 | 2025-12-19 | A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing U3D data. When open… |
CVE-2025-66497 | Medium | 5.3 | 2025-12-19 | A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing PRC data. When open… |
CVE-2025-66496 | Medium | 5.3 | 2025-12-19 | A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing PRC data. When open… |
CVE-2025-66495 | High | 7.8 | 2025-12-19 | A use-after-free vulnerability exists in the annotation handling of Foxit PDF Reader before 2025.2.1, 14.0.1, and 13.2.1 on Windows and MacOS. When opening a P… |
CVE-2025-66494 | High | 7.8 | 2025-12-19 | A use-after-free vulnerability exists in the PDF file parsing of Foxit PDF Reader before 2025.2.1, 14.0.1, and 13.2.1 on Windows. A PDF object managed by multi… |
CVE-2025-66493 | High | 7.8 | 2025-12-19 | A use-after-free vulnerability exists in the AcroForm handling of Foxit PDF Reader and Foxit PDF Editor before 2025.2.1,14.0.1 and 13.2.1 on Windows . When… |
CVE-2025-66174 | Medium | 6.5 | 2025-12-19 | There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an… |
CVE-2025-66173 | Medium | 6.2 | 2025-12-19 | There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an atta… |
CVE-2025-14449 | Medium | 6.4 | 2025-12-19 | The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's babe-search-form shortcode in all versions up to, and… |
CVE-2025-14267 | Medium | 4.9 | 2025-12-19 | Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions be… |
CVE-2025-13999 | High | 7.2 | 2025-12-19 | The HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions fro… |
CVE-2025-13754 | Medium | 5.3 | 2025-12-19 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… |
CVE-2025-13008 | | 2025-12-19 | An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated at… | |
CVE-2025-13307 | High | 7.2 | 2025-12-19 | The Ocean Modal Window WordPress plugin before 2.3.3 is vulnerable to Remote Code Execution via the modal display logic. These modals can be displayed under us… |
CVE-2025-14546 | Medium | 6.3 | 2025-12-19 | Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state paramet… |
CVE-2025-14940 | High | 7.3 | 2025-12-19 | A vulnerability was determined in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /admin/delete_user.php. T… |
CVE-2025-14939 | Medium | 4.7 | 2025-12-19 | A vulnerability was found in code-projects Online Appointment Booking System 1.0. Impacted is an unknown function of the file /admin/deletemanager.php. The man… |
CVE-2025-67846 | Medium | 4.9 | 2025-12-19 | The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgrade attacks via predi… |
CVE-2025-67845 | Medium | 6.4 | 2025-12-19 | A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web s… |
CVE-2025-67844 | Medium | 5.0 | 2025-12-19 | The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and… |
CVE-2025-67843 | High | 8.3 | 2025-12-19 | A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arb… |
CVE-2025-67842 | Medium | 6.4 | 2025-12-19 | The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because… |
CVE-2025-52692 | High | 8.8 | 2025-12-19 | Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration… |
CVE-2025-14910 | Medium | 4.3 | 2025-12-19 | A vulnerability was detected in Edimax BR-6208AC 1.02. This impacts the function handle_retr of the component FTP Daemon Service. The manipulation results in p… |
CVE-2025-14909 | Medium | 4.3 | 2025-12-19 | A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-syste… |
CVE-2025-13941 | High | 8.8 | 2025-12-19 | A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions… |
CVE-2025-14908 | Medium | 6.3 | 2025-12-19 | A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-syst… |
CVE-2025-14900 | Medium | 4.7 | 2025-12-19 | A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /admin/userdelete.php of… |
CVE-2025-14899 | Medium | 4.7 | 2025-12-19 | A weakness has been identified in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /admin/stateadd.php of the componen… |
CVE-2025-14733 | Critical | 9.8 | 2025-12-19 | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vul… |
CVE-2025-11774 | High | 8.2 | 2025-12-19 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the software keyboard function (hereinafter referre… |
CVE-2025-64675 | High | 8.3 | 2025-12-19 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauthorized attacker to perform spoofing ove… |
CVE-2025-14898 | Medium | 4.7 | 2025-12-19 | A security flaw has been discovered in CodeAstro Real Estate Management System 1.0. This affects an unknown function of the file /admin/userbuilderdelete.php o… |
CVE-2025-14897 | Medium | 4.7 | 2025-12-19 | A vulnerability was identified in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of the file /admin/useragentdelete.p… |
CVE-2025-68422 | Medium | 4.3 | 2025-12-18 | Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restric… |
CVE-2025-68398 | Critical | 9.1 | 2025-12-18 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavio… |
CVE-2025-68390 | Medium | 4.9 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Exces… |
CVE-2025-68389 | Medium | 6.5 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130… |
CVE-2025-68387 | Medium | 6.1 | 2025-12-18 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in con… |
CVE-2025-68386 | Medium | 4.3 | 2025-12-18 | Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type t… |
CVE-2025-68385 | High | 7.2 | 2025-12-18 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in conte… |
CVE-2025-68279 | High | 7.7 | 2025-12-18 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbol… |