2025 CVEs (page 64)
Page 64 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14953 | Low | 3.1 | 2025-12-19 | A flaw has been found in Open5GS up to 2.7.5. This impacts the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c of the component FAR-ID Ha… |
CVE-2025-66911 | Medium | 6.5 | 2025-12-19 | Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserO… |
CVE-2025-66910 | Medium | 6.0 | 2025-12-19 | Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService… |
CVE-2025-66909 | High | 7.5 | 2025-12-19 | Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability. The ExtendedOpenCVImage class in ai/… |
CVE-2025-66908 | Medium | 5.3 | 2025-12-19 | Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality. The OcrCont… |
CVE-2025-50681 | High | 7.5 | 2025-12-19 | igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service (application crash) via a crafted IGMPv3 membership report packet with… |
CVE-2025-14952 | High | 7.3 | 2025-12-19 | A vulnerability was detected in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_category.php. Performing a ma… |
CVE-2025-14951 | High | 7.3 | 2025-12-19 | A security vulnerability has been detected in code-projects Scholars Tracking System 1.0. The impacted element is an unknown function of the file /home.php. Su… |
CVE-2025-14950 | High | 7.3 | 2025-12-19 | A weakness has been identified in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /delete_post.php. This ma… |
CVE-2025-1928 | Critical | 9.1 | 2025-12-19 | Improper Restriction of Excessive Authentication Attempts vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Password R… |
CVE-2025-14946 | Medium | 4.8 | 2025-12-19 | A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulne… |
CVE-2025-14882 | | 2025-12-19 | An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only. | |
CVE-2025-14881 | | 2025-12-19 | Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only. | |
CVE-2025-1927 | High | 7.1 | 2025-12-19 | Cross-Site Request Forgery (CSRF) vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Cross Site Request Forgery. This… |
CVE-2025-1885 | Medium | 5.4 | 2025-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Phishing, Forcef… |
CVE-2025-14847 | High | 7.5 | 2025-12-19 | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all… |
CVE-2025-66524 | High | 8.8 | 2025-12-19 | Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for s… |
CVE-2025-14455 | Medium | 5.4 | 2025-12-19 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to… |
CVE-2025-12361 | Medium | 4.3 | 2025-12-19 | The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versi… |
CVE-2025-14151 | High | 7.2 | 2025-12-19 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outbound_resource' parameter in the slimtrack AJAX action in… |
CVE-2025-11747 | Medium | 6.4 | 2025-12-19 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the colibri_blog_posts shortcode in all versions up to, and incl… |
CVE-2025-66522 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in the Digital IDs functionality of the Foxit PDF Editor Cloud (pdfonline.foxit.com). The application… |
CVE-2025-66521 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Trusted Certificates feature. A crafted payload can be injected as t… |
CVE-2025-66520 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in the Portfolio feature of the Foxit PDF Editor cloud (pdfonline.foxit.com). User-supplied SVG files… |
CVE-2025-66519 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. A crafted payload can be injected into t… |
CVE-2025-66502 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature. A crafted payload can be stored as the templ… |
CVE-2025-66501 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Predefined Text feature of the Foxit eSign section. A crafted payloa… |
CVE-2025-66500 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in webplugins.foxit.com. A postMessage handler fails to validate the message origin and directly assig… |
CVE-2025-66499 | High | 7.8 | 2025-12-19 | A heap-based buffer overflow vulnerability exists in the PDF parsing of Foxit PDF Reader when processing specially crafted JBIG2 data. An integer overflow in t… |
CVE-2025-66498 | Medium | 5.3 | 2025-12-19 | A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing U3D data. When open… |
CVE-2025-66497 | Medium | 5.3 | 2025-12-19 | A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing PRC data. When open… |
CVE-2025-66496 | Medium | 5.3 | 2025-12-19 | A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing PRC data. When open… |
CVE-2025-66495 | High | 7.8 | 2025-12-19 | A use-after-free vulnerability exists in the annotation handling of Foxit PDF Reader before 2025.2.1, 14.0.1, and 13.2.1 on Windows and MacOS. When opening a P… |
CVE-2025-66494 | High | 7.8 | 2025-12-19 | A use-after-free vulnerability exists in the PDF file parsing of Foxit PDF Reader before 2025.2.1, 14.0.1, and 13.2.1 on Windows. A PDF object managed by multi… |
CVE-2025-66493 | High | 7.8 | 2025-12-19 | A use-after-free vulnerability exists in the AcroForm handling of Foxit PDF Reader and Foxit PDF Editor before 2025.2.1,14.0.1 and 13.2.1 on Windows . When… |
CVE-2025-66174 | Medium | 6.5 | 2025-12-19 | There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an… |
CVE-2025-66173 | Medium | 6.2 | 2025-12-19 | There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an atta… |
CVE-2025-14449 | Medium | 6.4 | 2025-12-19 | The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's babe-search-form shortcode in all versions up to, and… |
CVE-2025-14267 | Medium | 4.9 | 2025-12-19 | Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions be… |
CVE-2025-13999 | High | 7.2 | 2025-12-19 | The HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions fro… |
CVE-2025-13754 | Medium | 5.3 | 2025-12-19 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… |
CVE-2025-13008 | | 2025-12-19 | An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated at… | |
CVE-2025-13307 | High | 7.2 | 2025-12-19 | The Ocean Modal Window WordPress plugin before 2.3.3 is vulnerable to Remote Code Execution via the modal display logic. These modals can be displayed under us… |
CVE-2025-14546 | Medium | 6.3 | 2025-12-19 | Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state paramet… |
CVE-2025-14940 | High | 7.3 | 2025-12-19 | A vulnerability was determined in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /admin/delete_user.php. T… |
CVE-2025-14939 | Medium | 4.7 | 2025-12-19 | A vulnerability was found in code-projects Online Appointment Booking System 1.0. Impacted is an unknown function of the file /admin/deletemanager.php. The man… |
CVE-2025-67846 | Medium | 4.9 | 2025-12-19 | The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgrade attacks via predi… |
CVE-2025-67845 | Medium | 6.4 | 2025-12-19 | A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web s… |
CVE-2025-67844 | Medium | 5.0 | 2025-12-19 | The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and… |
CVE-2025-67843 | High | 8.3 | 2025-12-19 | A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arb… |
CVE-2025-67842 | Medium | 6.4 | 2025-12-19 | The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because… |
CVE-2025-52692 | High | 8.8 | 2025-12-19 | Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration… |
CVE-2025-14910 | Medium | 4.3 | 2025-12-19 | A vulnerability was detected in Edimax BR-6208AC 1.02. This impacts the function handle_retr of the component FTP Daemon Service. The manipulation results in p… |
CVE-2025-14909 | Medium | 4.3 | 2025-12-19 | A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-syste… |
CVE-2025-13941 | High | 8.8 | 2025-12-19 | A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions… |
CVE-2025-14908 | Medium | 6.3 | 2025-12-19 | A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-syst… |
CVE-2025-14900 | Medium | 4.7 | 2025-12-19 | A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /admin/userdelete.php of… |
CVE-2025-14899 | Medium | 4.7 | 2025-12-19 | A weakness has been identified in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /admin/stateadd.php of the componen… |
CVE-2025-14733 | Critical | 9.8 | 2025-12-19 | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vul… |
CVE-2025-11774 | High | 8.2 | 2025-12-19 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the software keyboard function (hereinafter referre… |
CVE-2025-64675 | High | 8.3 | 2025-12-19 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauthorized attacker to perform spoofing ove… |
CVE-2025-14898 | Medium | 4.7 | 2025-12-19 | A security flaw has been discovered in CodeAstro Real Estate Management System 1.0. This affects an unknown function of the file /admin/userbuilderdelete.php o… |
CVE-2025-14897 | Medium | 4.7 | 2025-12-19 | A vulnerability was identified in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of the file /admin/useragentdelete.p… |
CVE-2025-68422 | Medium | 4.3 | 2025-12-18 | Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restric… |
CVE-2025-68398 | Critical | 9.1 | 2025-12-18 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavio… |
CVE-2025-68390 | Medium | 4.9 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Exces… |
CVE-2025-68389 | Medium | 6.5 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130… |
CVE-2025-68387 | Medium | 6.1 | 2025-12-18 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in con… |
CVE-2025-68386 | Medium | 4.3 | 2025-12-18 | Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type t… |
CVE-2025-68385 | High | 7.2 | 2025-12-18 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in conte… |
CVE-2025-68279 | High | 7.7 | 2025-12-18 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbol… |
CVE-2025-68388 | Medium | 5.3 | 2025-12-18 | Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory an… |
CVE-2025-68384 | Medium | 6.5 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CA… |
CVE-2025-68383 | Medium | 6.5 | 2025-12-18 | Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to… |
CVE-2025-68382 | Medium | 6.5 | 2025-12-18 | Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a de… |
CVE-2025-68381 | Medium | 6.5 | 2025-12-18 | Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the appli… |
CVE-2025-65046 | Low | 3.1 | 2025-12-18 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-65041 | Critical | 10.0 | 2025-12-18 | Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-65037 | Critical | 10.0 | 2025-12-18 | Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network. |
CVE-2025-64677 | High | 8.2 | 2025-12-18 | Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform… |
CVE-2025-64676 | High | 7.2 | 2025-12-18 | '.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network. |
CVE-2025-64663 | Critical | 9.9 | 2025-12-18 | Custom Question Answering Elevation of Privilege Vulnerability |
CVE-2025-34452 | | 2025-12-18 | Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-side request forgery (SSRF) vulnerabiliti… | |
CVE-2025-34451 | High | 7.8 | 2025-12-18 | rofl0r/proxychains-ng versions up to and including 4.17 and prior to commit cc005b7 contain a stack-based buffer overflow vulnerability in the function proxy_f… |
CVE-2025-34450 | High | 7.8 | 2025-12-18 | merbanan/rtl_433 versions up to and including 25.02 and prior to commit 25e47f8 contain a stack-based buffer overflow vulnerability in the function parse_rfraw… |
CVE-2025-34449 | Critical | 9.1 | 2025-12-18 | Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() funct… |
CVE-2025-13427 | | 2025-12-18 | An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact with restricted chat agents, gaining a… | |
CVE-2025-68161 | Medium | 4.8 | 2025-12-18 | The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the v… |
CVE-2025-67653 | Medium | 4.3 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files. |
CVE-2025-63951 | High | 7.5 | 2025-12-18 | An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c4… |
CVE-2025-63950 | High | 7.5 | 2025-12-18 | An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621… |
CVE-2025-63949 | Medium | 6.1 | 2025-12-18 | A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execute arbitrary web scr… |
CVE-2025-63948 | Medium | 5.4 | 2025-12-18 | A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary SQL commands via the dbname par… |
CVE-2025-63947 | Medium | 5.4 | 2025-12-18 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary web scri… |
CVE-2025-62004 | High | 7.5 | 2025-12-18 | BullWall Server Intrusion Protection (SIP) services are initialized after login services during system startup. A local, authenticated attacker can log in afte… |
CVE-2025-62003 | High | 7.5 | 2025-12-18 | BullWall Server Intrusion Protection has a noticeable configuration-dependent delay before the MFA check for RDP connections. A remote, authenticated attacker… |
CVE-2025-62002 | Medium | 4.3 | 2025-12-18 | BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single (possibly large)… |
CVE-2025-62001 | High | 8.8 | 2025-12-18 | BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain… |
CVE-2025-62000 | High | 7.1 | 2025-12-18 | BullWall Ransomware Containment may not always detect an encrypted file. This issue affects a specific file inspection method that evaluates file content based… |
CVE-2025-59529 | Medium | 5.5 | 2025-12-18 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simpl… |