2025 CVEs (page 63)
Page 63 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12049 | Critical | 9.8 | 2025-12-22 | Missing Authentication for Critical Function vulnerability in Sharp Display Solutions Media Player MP-01 All Verisons allows a attacker may access to the web i… |
CVE-2025-11543 | Critical | 9.8 | 2025-12-22 | Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware. |
CVE-2025-11542 | Critical | 9.8 | 2025-12-22 | Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and programs. |
CVE-2025-11541 | Critical | 9.8 | 2025-12-22 | Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and programs. |
CVE-2025-11540 | High | 7.5 | 2025-12-22 | Path Traversal vulnerability in Sharp Display Solutions projectors allows a attacker may access and read any files within the projector. |
CVE-2025-59301 | Medium | 4.0 | 2025-12-22 | Delta Electronics DVP15MC11T lacks proper validation of the modbus/tcp packets and can lead to denial of service. |
CVE-2025-15016 | Critical | 9.8 | 2025-12-22 | Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed k… |
CVE-2025-15015 | High | 7.5 | 2025-12-22 | Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traver… |
CVE-2025-15011 | High | 7.3 | 2025-12-22 | A vulnerability was found in code-projects Simple Stock System 1.0. Impacted is an unknown function of the file /logout.php. The manipulation of the argument u… |
CVE-2025-15010 | Critical | 9.8 | 2025-12-22 | A vulnerability has been found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/SafeUrlFilter. The manipulation of the a… |
CVE-2025-15009 | Medium | 6.3 | 2025-12-22 | A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload… |
CVE-2025-15008 | High | 7.3 | 2025-12-22 | A vulnerability was detected in Tenda WH450 1.0.0.18. This affects an unknown part of the file /goform/L7Port of the component HTTP Request Handler. Performing… |
CVE-2025-15007 | Critical | 9.8 | 2025-12-22 | A security vulnerability has been detected in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/L7Im of the compon… |
CVE-2025-15006 | Critical | 9.8 | 2025-12-22 | A weakness has been identified in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/CheckTools of the compon… |
CVE-2025-15005 | Low | 3.7 | 2025-12-22 | A security flaw has been discovered in CouchCMS up to 2.4. Affected is an unknown function of the file couch/config.example.php of the component reCAPTCHA Hand… |
CVE-2025-15004 | Medium | 6.3 | 2025-12-22 | A vulnerability was identified in DedeCMS up to 5.7.118. This impacts an unknown function of the file /freelist_main.php. The manipulation of the argument orde… |
CVE-2025-15003 | Medium | 4.7 | 2025-12-22 | A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Performing a manipulation of the argum… |
CVE-2025-15002 | High | 7.3 | 2025-12-21 | A vulnerability has been found in SeaCMS up to 13.3. The affected element is an unknown function of the file js/player/dmplayer/dmku/class/mysqli.class.php. Su… |
CVE-2025-62926 | Medium | 6.5 | 2025-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyDevs TempTool [Show Current Template Info] current-… |
CVE-2025-62901 | Medium | 6.5 | 2025-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten WP Microdata wp-microdata allows Stored XSS.Thi… |
CVE-2025-62955 | Medium | 4.3 | 2025-12-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HappyDevs TempTool [Show Current Template Info] current-template-n… |
CVE-2025-14995 | High | 8.8 | 2025-12-21 | A vulnerability has been found in Tenda FH1201 1.2.0.14(408). Affected is the function sprintf of the file /goform/SetIpBind. Such manipulation of the argument… |
CVE-2025-14994 | High | 8.8 | 2025-12-21 | A flaw has been found in Tenda FH1201 and FH1206 1.2.0.14(408)/1.2.0.8(8155). This impacts the function strcat of the file /goform/webtypelibrary of the compon… |
CVE-2025-14855 | High | 7.2 | 2025-12-21 | The SureForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form field parameters in all versions up to, and including, 2.2.0 due t… |
CVE-2025-14800 | High | 8.1 | 2025-12-21 | The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload… |
CVE-2025-14993 | High | 8.8 | 2025-12-21 | A vulnerability was detected in Tenda AC18 15.03.05.05. This affects the function sprintf of the file /goform/SetDlnaCfg of the component HTTP Request Handler… |
CVE-2025-9343 | High | 7.2 | 2025-12-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions u… |
CVE-2025-68644 | High | 7.4 | 2025-12-21 | Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication… |
CVE-2025-14992 | High | 8.8 | 2025-12-21 | A security vulnerability has been detected in Tenda AC18 15.03.05.05. The impacted element is the function strcpy of the file /goform/GetParentControlInfo of t… |
CVE-2025-14991 | Low | 2.4 | 2025-12-21 | A weakness has been identified in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin… |
CVE-2025-14990 | High | 7.3 | 2025-12-21 | A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1.0. Impacted is an unknown function of the file /admin/view-a… |
CVE-2025-13693 | Medium | 6.4 | 2025-12-21 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom scripts' setting in all versions up… |
CVE-2025-13361 | Medium | 4.3 | 2025-12-21 | The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing n… |
CVE-2025-13220 | Medium | 6.4 | 2025-12-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2025-12654 | Low | 2.7 | 2025-12-21 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory creation in all versions up to, and inclu… |
CVE-2025-12398 | Medium | 6.1 | 2025-12-21 | The Product Table for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_key' parameter in all versions up to, an… |
CVE-2025-14080 | Medium | 5.3 | 2025-12-21 | The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due… |
CVE-2025-14071 | High | 7.5 | 2025-12-21 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.2 via d… |
CVE-2025-14054 | Medium | 4.4 | 2025-12-21 | The WC Builder – WooCommerce Page Builder for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'heading_color' parameter (and… |
CVE-2025-14043 | Medium | 5.3 | 2025-12-21 | The Tainacan plugin for WordPress is vulnerable to unauthorized metadata section creation due to missing authorization checks in all versions up to, and includ… |
CVE-2025-13838 | Medium | 6.4 | 2025-12-21 | The WishSuite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter of the 'wishsuite_button' shortcode in all vers… |
CVE-2025-12980 | High | 7.5 | 2025-12-21 | The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized access of data due to a missing ca… |
CVE-2025-11496 | Medium | 6.1 | 2025-12-21 | The Five Star Restaurant Reservations – WordPress Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rtb-name' parameter… |
CVE-2025-14989 | High | 7.3 | 2025-12-21 | A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/… |
CVE-2025-34290 | High | 7.8 | 2025-12-20 | Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionalit… |
CVE-2025-7782 | High | 7.6 | 2025-12-20 | The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the '… |
CVE-2025-7733 | Medium | 4.3 | 2025-12-20 | The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.7 v… |
CVE-2025-14298 | Medium | 5.4 | 2025-12-20 | The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `thegem_te_search` shortcode in… |
CVE-2025-12492 | Medium | 5.3 | 2025-12-20 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Sensit… |
CVE-2025-13619 | Critical | 9.8 | 2025-12-20 | The Flex Store Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.0. This is due to the 'fsUserHandle… |
CVE-2025-12820 | Medium | 5.3 | 2025-12-20 | The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authentica… |
CVE-2025-14735 | Medium | 4.4 | 2025-12-20 | The "Amazon affiliate lite Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1… |
CVE-2025-14734 | Medium | 5.4 | 2025-12-20 | The Amazon affiliate lite Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to m… |
CVE-2025-14721 | Medium | 5.5 | 2025-12-20 | The Responsive and Swipe slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rsSlider shortcode in all versions up to, an… |
CVE-2025-14633 | Medium | 5.3 | 2025-12-20 | The F70 Lead Document Download plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'file_download' funct… |
CVE-2025-14591 | High | 7.5 | 2025-12-20 | In Delphix Continuous Compliance version 2025.3.0 and later, following a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) charact… |
CVE-2025-14168 | Medium | 4.3 | 2025-12-20 | The WP DB Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce va… |
CVE-2025-14164 | Medium | 4.3 | 2025-12-20 | The Quran Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce vali… |
CVE-2025-13624 | Medium | 6.1 | 2025-12-20 | The Overstock Affiliate Links plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up… |
CVE-2025-13365 | Medium | 6.1 | 2025-12-20 | The WP Hallo Welt plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorre… |
CVE-2025-13329 | Critical | 9.8 | 2025-12-20 | The File Uploader for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the callback function for… |
CVE-2025-12898 | Medium | 5.3 | 2025-12-20 | The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() func… |
CVE-2025-12581 | Medium | 6.1 | 2025-12-20 | The Attachments Handler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 1.1.7 due to insuffi… |
CVE-2025-8065 | Medium | 6.5 | 2025-12-20 | A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespac… |
CVE-2025-14300 | High | 8.1 | 2025-12-20 | The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the s… |
CVE-2025-14299 | Medium | 6.5 | 2025-12-20 | The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on th… |
CVE-2025-68613 | Critical | 9.9 | 2025-12-19 | n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Ex… |
CVE-2025-68481 | Medium | 5.9 | 2025-12-19 | FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tok… |
CVE-2025-67712 | Medium | 4.7 | 2025-12-19 | There is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30 that allows a remote, unauthenticated attacker to poten… |
CVE-2025-14968 | High | 7.3 | 2025-12-19 | A security flaw has been discovered in code-projects Simple Stock System 1.0. Affected by this issue is some unknown functionality of the file /market/update.p… |
CVE-2025-14967 | High | 7.3 | 2025-12-19 | A vulnerability was identified in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /candidate… |
CVE-2025-14966 | Medium | 4.7 | 2025-12-19 | A vulnerability was determined in FastAdmin up to 1.7.0.20250506. Affected is the function selectpage of the file application/common/controller/Backend.php of… |
CVE-2025-12874 | | 2025-12-19 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Quest Coexistence Manager for Notes (Free/Busy Connector modu… | |
CVE-2025-14965 | Medium | 5.5 | 2025-12-19 | A vulnerability was found in 1541492390c yougou-mall up to 0a771fa817c924efe52c8fe0a9a6658eee675f9f. This impacts the function upload/delete of the file src/ma… |
CVE-2025-14964 | Critical | 9.8 | 2025-12-19 | A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083_B20200521. This affects the function sprintf of the file /cgi-bin/cstecgi.cgi. Such manipulation of… |
CVE-2025-14962 | Medium | 4.3 | 2025-12-19 | A flaw has been found in code-projects Simple Stock System 1.0. The impacted element is an unknown function of the file /market/chatuser.php. This manipulation… |
CVE-2025-14961 | High | 7.3 | 2025-12-19 | A vulnerability was detected in code-projects Simple Blood Donor Management System 1.0. The affected element is an unknown function of the file /editedcampaign… |
CVE-2025-68478 | High | 7.1 | 2025-12-19 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's… |
CVE-2025-68430 | Medium | 4.3 | 2025-12-19 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT… |
CVE-2025-14960 | High | 7.3 | 2025-12-19 | A security vulnerability has been detected in code-projects Simple Blood Donor Management System 1.0. Impacted is an unknown function of the file /editeddonor… |
CVE-2025-14959 | High | 7.3 | 2025-12-19 | A weakness has been identified in code-projects Simple Stock System 1.0. This issue affects some unknown processing of the file /market/signup.php. Executing a… |
CVE-2025-14958 | Medium | 5.3 | 2025-12-19 | A security flaw has been discovered in floooh sokol up to 33e2271c431bf21de001e972f72da17a984da932. This vulnerability affects the function _sg_pipeline_common… |
CVE-2025-68477 | High | 7.7 | 2025-12-19 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, Langflow provides an API Request component that can issu… |
CVE-2025-68457 | Medium | 6.1 | 2025-12-19 | Orejime is a consent manager that focuses on accessibility. On HTML elements handled by Orejime prior to version 2.3.2, one could run malicious code by embeddi… |
CVE-2025-66580 | Critical | 9.6 | 2025-12-19 | Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. A critical Stored Cross-Site Scripting (XSS) vulnerabi… |
CVE-2025-65035 | Medium | 6.4 | 2025-12-19 | pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Pr… |
CVE-2025-63665 | Critical | 9.8 | 2025-12-19 | An issue in GT Edge AI Community Edition Versions before v2.0.12 allows attackers to execute arbitrary code via injecting a crafted JSON payload into the Promp… |
CVE-2025-58053 | Critical | 9.8 | 2025-12-19 | Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account with a self forged… |
CVE-2025-58052 | High | 8.1 | 2025-12-19 | Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group man… |
CVE-2025-14957 | Low | 3.3 | 2025-12-19 | A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLoca… |
CVE-2025-14956 | Medium | 5.3 | 2025-12-19 | A vulnerability was determined in WebAssembly Binaryen up to 125. Affected by this issue is the function WasmBinaryReader::readExport of the file src/wasm/wasm… |
CVE-2025-14955 | Low | 3.7 | 2025-12-19 | A vulnerability was found in Open5GS up to 2.7.5. Affected by this vulnerability is the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c o… |
CVE-2025-14812 | High | 7.5 | 2025-12-19 | ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-schem… |
CVE-2025-14809 | High | 7.4 | 2025-12-19 | ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing… |
CVE-2025-67442 | High | 7.6 | 2025-12-19 | EVE-NG 6.4.0-13-PRO is vulnerable to Directory Traversal. The /api/export interface allows authenticated users to export lab files. This interface lacks effect… |
CVE-2025-66906 | Medium | 6.1 | 2025-12-19 | Cross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT allows attackers to gain escalated privileges. |
CVE-2025-66905 | High | 7.5 | 2025-12-19 | The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attack… |
CVE-2025-53922 | Medium | 4.9 | 2025-12-19 | Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in… |
CVE-2025-34433 | | 2025-12-19 | AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt us… | |
CVE-2025-14954 | Low | 3.7 | 2025-12-19 | A vulnerability has been found in Open5GS up to 2.7.6. Affected is the function ogs_pfcp_pdr_find_or_add/ogs_pfcp_far_find_or_add/ogs_pfcp_urr_find_or_add/ogs_… |