2025 CVEs (page 71)
Page 71 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64634 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n… |
CVE-2025-64633 | Medium | 5.3 | 2025-12-16 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Norebro Extra norebro-extra allows Code Injection.This… |
CVE-2025-64632 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Auctollo Google XML Sitemaps google-sitemap-generator allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-64631 | Medium | 4.9 | 2025-12-16 | Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-64630 | Medium | 4.9 | 2025-12-16 | Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-64253 | Medium | 4.9 | 2025-12-16 | Path Traversal: '.../...//' vulnerability in WordPress.org Health Check & Troubleshooting health-check allows Path Traversal.This issue affects Health Check &… |
CVE-2025-64251 | Medium | 4.9 | 2025-12-16 | Missing Authorization vulnerability in azzaroco Ultimate Learning Pro indeed-learning-pro allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-64250 | Medium | 4.7 | 2025-12-16 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wpWax Directorist directorist allows Phishing.This issue affects Directorist: from n/a thr… |
CVE-2025-64249 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in WP-EXPERTS.IN Protect WP Admin protect-wp-admin allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-64248 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-64247 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in edmon.parker Read More & Accordion expand-maker allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-64246 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-64245 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-64244 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in Codexpert, Inc Restrict Elementor Widgets, Columns and Sections restrict-elementor-widgets allows Exploiting Incorrectly… |
CVE-2025-64243 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-64242 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-64241 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in Imtiaz Rayhan WP Coupons and Deals wp-coupons-and-deals allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-64240 | Medium | 4.3 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in freshchat Freshchat freshchat allows Cross Site Request Forgery.This issue affects Freshchat: from n/a throu… |
CVE-2025-64239 | Medium | 4.3 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Yoav Farhi RTL Tester rtl-tester allows Cross Site Request Forgery.This issue affects RTL Tester: from n/a t… |
CVE-2025-64238 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-64237 | Medium | 4.3 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Graham Quick Interest Slider quick-interest-slider allows Cross Site Request Forgery.This issue affects Quic… |
CVE-2025-59009 | Medium | 4.3 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Astoundify Listify listify allows Cross Site Request Forgery.This issue affects Listify: from n/a through <=… |
CVE-2025-59001 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-58999 | Medium | 4.3 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows C… |
CVE-2025-54045 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Exploiting Incorrectly Con… |
CVE-2025-54005 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-54004 | Low | 2.7 | 2025-12-16 | Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Co… |
CVE-2025-49300 | Low | 2.7 | 2025-12-16 | Insertion of Sensitive Information Into Sent Data vulnerability in shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-13231 | Medium | 6.5 | 2025-12-16 | The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time… |
CVE-2025-13439 | Medium | 5.9 | 2025-12-16 | The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. T… |
CVE-2025-11991 | Medium | 5.3 | 2025-12-16 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2025-66635 | High | 7.2 | 2025-12-16 | Stack-based buffer overflow vulnerability exists in SEIKO EPSON Web Config. Specially crafted data input by a logged-in user may execute arbitrary code. As for… |
CVE-2025-62330 | Medium | 5.9 | 2025-12-16 | HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS a… |
CVE-2025-14252 | High | 7.8 | 2025-12-16 | An Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to read/write arbitrary memory, I/O ports, and MSRs, resulting in… |
CVE-2025-13794 | Medium | 4.3 | 2025-12-16 | The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2025-12809 | Medium | 5.3 | 2025-12-16 | The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST AP… |
CVE-2025-66357 | Medium | 5.3 | 2025-12-16 | CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. When the Video Download feature is in a specifi… |
CVE-2025-61976 | High | 7.5 | 2025-12-16 | CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. If a remote attacker sends a specially crafted… |
CVE-2025-59479 | Medium | 6.1 | 2025-12-16 | CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper restriction of rendered UI layers or frames. If a user clicks on content on a malicious web… |
CVE-2025-14777 | Medium | 6.0 | 2025-12-16 | A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifical… |
CVE-2025-13956 | Medium | 5.3 | 2025-12-16 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic func… |
CVE-2025-62849 | Critical | 9.8 | 2025-12-16 | An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to e… |
CVE-2025-62848 | High | 7.5 | 2025-12-16 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerab… |
CVE-2025-62847 | High | 7.5 | 2025-12-16 | An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote att… |
CVE-2025-59385 | Critical | 9.8 | 2025-12-16 | An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit th… |
CVE-2025-14749 | Medium | 6.3 | 2025-12-16 | A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_service of the component ONVIF PTZ Cont… |
CVE-2025-14748 | Medium | 5.4 | 2025-12-16 | A vulnerability was determined in Ningyuanda TC155 57.0.2.0. This affects an unknown function of the file /onvif/device_service of the component ONVIF Device M… |
CVE-2025-14747 | Medium | 4.3 | 2025-12-16 | A vulnerability was found in Ningyuanda TC155 57.0.2.0. The impacted element is an unknown function of the component RTSP Service. Performing manipulation resu… |
CVE-2025-14746 | Medium | 4.3 | 2025-12-16 | A vulnerability has been found in Ningyuanda TC155 57.0.2.0. The affected element is an unknown function of the component RTSP Live Video Stream Endpoint. Such… |
CVE-2025-68115 | Medium | 6.1 | 2025-12-16 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0-alpha.3, a Reflect… |
CVE-2025-68113 | Medium | 6.5 | 2025-12-16 | ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, w… |
CVE-2025-67874 | Medium | 6.5 | 2025-12-16 | ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent… |
CVE-2025-67751 | High | 7.2 | 2025-12-16 | ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the `EventEditor.php` file. When creating… |
CVE-2025-67748 | High | 7.8 | 2025-12-16 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module… |
CVE-2025-67747 | High | 7.8 | 2025-12-16 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module im… |
CVE-2025-67744 | Critical | 9.6 | 2025-12-16 | DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exis… |
CVE-2025-67736 | High | 7.2 | 2025-12-16 | The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 an… |
CVE-2025-67735 | Medium | 6.5 | 2025-12-16 | Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.Http… |
CVE-2025-67722 | High | 7.8 | 2025-12-16 | FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an au… |
CVE-2025-67715 | Medium | 4.3 | 2025-12-16 | Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version… |
CVE-2025-67492 | Medium | 5.3 | 2025-12-16 | Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook… |
CVE-2025-66449 | High | 8.8 | 2025-12-16 | ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on th… |
CVE-2025-14758 | Medium | 6.5 | 2025-12-16 | Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database co… |
CVE-2025-9460 | High | 7.8 | 2025-12-16 | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage… |
CVE-2025-9459 | High | 7.8 | 2025-12-16 | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage… |
CVE-2025-9457 | High | 7.8 | 2025-12-16 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this… |
CVE-2025-9456 | High | 7.8 | 2025-12-16 | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage t… |
CVE-2025-9455 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leve… |
CVE-2025-9454 | High | 7.8 | 2025-12-16 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage th… |
CVE-2025-9453 | High | 7.8 | 2025-12-16 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage th… |
CVE-2025-9452 | High | 7.8 | 2025-12-16 | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage t… |
CVE-2025-66482 | Medium | 6.5 | 2025-12-16 | Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate… |
CVE-2025-66407 | Medium | 5.0 | 2025-12-16 | Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying… |
CVE-2025-66402 | Medium | 6.5 | 2025-12-16 | Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permi… |
CVE-2025-58173 | High | 8.8 | 2025-12-16 | FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it… |
CVE-2025-14731 | Medium | 6.3 | 2025-12-16 | A weakness has been identified in CTCMS Content Management System up to 2.1.2. This affects an unknown function in the library /ctcms/apps/libraries/CT_Parser… |
CVE-2025-14593 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverag… |
CVE-2025-10900 | High | 7.8 | 2025-12-16 | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverag… |
CVE-2025-10899 | High | 7.8 | 2025-12-16 | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverag… |
CVE-2025-10898 | High | 7.8 | 2025-12-16 | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverag… |
CVE-2025-10889 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage… |
CVE-2025-10888 | High | 7.8 | 2025-12-16 | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverag… |
CVE-2025-10887 | High | 7.8 | 2025-12-16 | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage th… |
CVE-2025-10886 | High | 7.8 | 2025-12-16 | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage th… |
CVE-2025-10884 | High | 7.8 | 2025-12-16 | AA maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may lever… |
CVE-2025-10883 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can lev… |
CVE-2025-10882 | High | 7.8 | 2025-12-16 | AA maliciously crafted X_T file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage… |
CVE-2025-10881 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leve… |
CVE-2025-9122 | Medium | 5.3 | 2025-12-15 | Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full s… |
CVE-2025-9121 | High | 8.8 | 2025-12-15 | Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data… |
CVE-2025-14730 | Medium | 4.7 | 2025-12-15 | A security flaw has been discovered in CTCMS Content Management System up to 2.1.2. The impacted element is an unknown function in the library /ctcms/libs/Ct_C… |
CVE-2025-14729 | Medium | 4.7 | 2025-12-15 | A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of… |
CVE-2025-64725 | Critical | 9.8 | 2025-12-15 | Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains… |
CVE-2025-59947 | Critical | 9.0 | 2025-12-15 | NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscri… |
CVE-2025-55895 | Critical | 9.1 | 2025-12-15 | TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control. Attackers can… |
CVE-2025-14722 | Low | 2.4 | 2025-12-15 | A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/Ad… |
CVE-2025-67809 | Medium | 4.7 | 2025-12-15 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet… |
CVE-2025-55703 | Low | 2.5 | 2025-12-15 | An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint that applied arrays w… |
CVE-2025-36360 | Medium | 5.0 | 2025-12-15 | IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.10, and 8… |
CVE-2025-14503 | High | 7.2 | 2025-12-15 | An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumpt… |