2025 CVEs (page 7)
Page 7 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69141 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions. |
CVE-2025-69139 | High | 8.6 | 2026-06-17 | Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions. |
CVE-2025-69138 | High | 8.8 | 2026-06-17 | Subscriber Privilege Escalation in Genemy <= 1.6.6 versions. |
CVE-2025-69137 | Medium | 6.5 | 2026-06-17 | Subscriber Broken Access Control in Genemy <= 1.6.6 versions. |
CVE-2025-69136 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions. |
CVE-2025-69135 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions. |
CVE-2025-69131 | High | 7.5 | 2026-06-17 | Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions. |
CVE-2025-69129 | Critical | 10.0 | 2026-06-17 | Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions. |
CVE-2025-69125 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions. |
CVE-2025-69124 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Especio <= 1.0 versions. |
CVE-2025-69122 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions. |
CVE-2025-69121 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions. |
CVE-2025-69119 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions. |
CVE-2025-69118 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions. |
CVE-2025-69117 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions. |
CVE-2025-69116 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions. |
CVE-2025-69114 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions. |
CVE-2025-69113 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions. |
CVE-2025-69112 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions. |
CVE-2025-69110 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions. |
CVE-2025-69109 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions. |
CVE-2025-69108 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions. |
CVE-2025-69107 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions. |
CVE-2025-69105 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions. |
CVE-2025-69104 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions. |
CVE-2025-69103 | High | 7.5 | 2026-06-17 | Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions. |
CVE-2025-62340 | Low | 3.1 | 2026-06-17 | HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automaticall… |
CVE-2025-60223 | High | 7.7 | 2026-06-17 | Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot <= 13.6.5 versions. |
CVE-2025-60218 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in PT Luxa Addons <= 1.2.2 versions. |
CVE-2025-60205 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in ThemeREX Addons <= 2.36.1.1 versions. |
CVE-2025-60085 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions. |
CVE-2025-59872 | Medium | 4.3 | 2026-06-17 | HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain comman… |
CVE-2025-59563 | High | 8.8 | 2026-06-17 | Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions. |
CVE-2025-59560 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions. |
CVE-2025-58954 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions. |
CVE-2025-58953 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Joly <= 1.22.0 versions. |
CVE-2025-58952 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions. |
CVE-2025-58924 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Geya <= 1.15 versions. |
CVE-2025-49403 | High | 7.5 | 2026-06-17 | Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions. |
CVE-2025-48643 | High | 7.8 | 2026-06-17 | In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to local escalation of privilege with no additi… |
CVE-2025-48640 | High | 8.0 | 2026-06-17 | In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adja… |
CVE-2025-48617 | High | 7.8 | 2026-06-17 | In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of… |
CVE-2025-48571 | Medium | 4.3 | 2026-06-17 | In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic error in the code. This could lead to rem… |
CVE-2025-31013 | High | 7.1 | 2026-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Th… |
CVE-2025-15642 | | 2026-06-17 | Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing th… | |
CVE-2025-15641 | | 2026-06-17 | Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially… | |
CVE-2025-71261 | High | 8.6 | 2026-06-16 | An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshak… |
CVE-2025-14272 | | 2026-06-16 | A security issue was identified in Pavilion due to improper authorization enforcement in API endpoints. This vulnerability can allow an unauthorized actor to e… | |
CVE-2025-13036 | | 2026-06-16 | An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login endpoint, an attacker ma… | |
CVE-2025-11694 | | 2026-06-16 | A security issue exists within 1769 CompactLogix controllers due to the missing validation of sequence numbers and source IP addresses in the CIP protocol. Thi… | |
CVE-2025-68045 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions. |
CVE-2025-9912 | Medium | 6.3 | 2026-06-16 | Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to ex… |
CVE-2025-10262 | Medium | 6.3 | 2026-06-16 | Nokia SR Linux is vulnerable to local privilege escalation vulnerability due to unsanitized format validation. Successful exploitation of this vulnerability ma… |
CVE-2025-69332 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in Bookify <= 1.1.1 versions. |
CVE-2025-68872 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 versions. |
CVE-2025-68851 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions. |
CVE-2025-68840 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions. |
CVE-2025-68049 | Medium | 6.3 | 2026-06-15 | Subscriber Broken Access Control in bunny.net <= 2.3.6 versions. |
CVE-2025-60175 | Medium | 4.4 | 2026-06-15 | Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions. |
CVE-2025-59133 | High | 7.5 | 2026-06-15 | Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions. |
CVE-2025-70102 | Medium | 6.3 | 2026-06-15 | A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:18… |
CVE-2025-68713 | High | 8.0 | 2026-06-15 | An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted appli… |
CVE-2025-56814 | High | 7.8 | 2026-06-15 | A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters. |
CVE-2025-55663 | Medium | 5.5 | 2026-06-15 | A segmentation violation in the Track_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2025-55661 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafte… |
CVE-2025-55660 | Medium | 5.5 | 2026-06-15 | A stack overflow in the gf_opus_read_length function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via sup… |
CVE-2025-55652 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via s… |
CVE-2025-55650 | Medium | 5.5 | 2026-06-15 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-55649 | Medium | 5.5 | 2026-06-15 | A NULL pointer dereference in the gf_media_map_esd function (media_tools/isom_tools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS)… |
CVE-2025-55648 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service… |
CVE-2025-55647 | Medium | 5.5 | 2026-06-15 | An Out-of-Memory in the mp4_mux_cenc_insert_pssh function (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supp… |
CVE-2025-55645 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via sup… |
CVE-2025-55644 | Medium | 5.5 | 2026-06-15 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-55643 | Medium | 5.5 | 2026-06-15 | A NULL pointer dereference in the TrackWriter handling component (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2025-55642 | Medium | 6.5 | 2026-06-15 | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c). |
CVE-2025-55641 | Medium | 5.5 | 2026-06-15 | A NULL pointer dereference in the gf_isom_copy_sample_info function (isomedia/isom_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (… |
CVE-2025-15659 | Medium | 6.5 | 2026-06-15 | Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions. |
CVE-2025-15658 | Medium | 5.9 | 2026-06-15 | Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions. |
CVE-2025-64215 | Medium | 6.5 | 2026-06-15 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects… |
CVE-2025-15546 | Medium | 5.4 | 2026-06-14 | The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured to "maintain both… |
CVE-2025-9033 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Servic… |
CVE-2025-9032 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of… |
CVE-2025-14098 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Loca… |
CVE-2025-7019 | Medium | 5.5 | 2026-06-12 | Stack overflow vulnerability in Avast Antivirus when scanning a malformed Office Open XML file may allow Denial-of-Service of the antivirus process. This issu… |
CVE-2025-7018 | Medium | 5.5 | 2026-06-12 | Null pointer dereference vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus engine… |
CVE-2025-7017 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows MSI file may allow Local Execution of Code or Denial-o… |
CVE-2025-7011 | High | 7.8 | 2026-06-12 | Heap out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed zip file containing XML may allow Local Execution of Code or Denial-of-Servi… |
CVE-2025-7010 | Medium | 5.5 | 2026-06-12 | Stack overflow vulnerability due to uncontrolled recursion in Avast Antivirus when scanning a malformed PDF file may allow Denial-of-Service of the antivirus p… |
CVE-2025-7009 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Servic… |
CVE-2025-7008 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file with .NET metadata may allow Local Execution of Code… |
CVE-2025-7006 | Medium | 5.5 | 2026-06-12 | Use of stack memory after free vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process… |
CVE-2025-7005 | Medium | 5.5 | 2026-06-12 | Uncontrolled recursion vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process. This i… |
CVE-2025-7004 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds write vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Servi… |
CVE-2025-7003 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Servic… |
CVE-2025-7002 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Servic… |
CVE-2025-46315 | High | 7.5 | 2026-06-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data. |
CVE-2025-46313 | Medium | 5.5 | 2026-06-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2025-46308 | Medium | 5.3 | 2026-06-11 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to… |
CVE-2025-46293 | Medium | 5.5 | 2026-06-11 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data. |
CVE-2025-43339 | Medium | 5.5 | 2026-06-11 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. A malicious app may be able to access sensitive us… |