2025 CVEs (page 75)
Page 75 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9116 | Medium | 5.8 | 2025-12-13 | The WPS Visitor Counter WordPress plugin through 1.4.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which c… |
CVE-2025-8780 | Medium | 6.4 | 2025-12-13 | The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Hero Header and Pricing Table widgets in all… |
CVE-2025-8779 | Medium | 6.4 | 2025-12-13 | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team and Countdown widgets i… |
CVE-2025-8687 | Medium | 6.4 | 2025-12-13 | The Enter Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown and Image Comparison widgets in all versions up t… |
CVE-2025-8617 | Medium | 6.4 | 2025-12-13 | The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up… |
CVE-2025-8199 | Medium | 6.4 | 2025-12-13 | The MarqueeAddons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial Marquee widget in all versions up to, and incl… |
CVE-2025-8195 | Medium | 6.4 | 2025-12-13 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison and Subscribe widgets in all v… |
CVE-2025-7960 | Medium | 6.4 | 2025-12-13 | The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Slider, Pricing Calculator, and Image… |
CVE-2025-7058 | Medium | 6.4 | 2025-12-13 | The Kingcabs theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘progressbarLayout’ parameter in all versions up to, and including, 1.1.9… |
CVE-2025-36754 | | 2025-12-13 | The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new s… | |
CVE-2025-36753 | Critical | 9.8 | 2025-12-13 | The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and t… |
CVE-2025-36752 | Critical | 9.8 | 2025-12-13 | Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, s… |
CVE-2025-36751 | | 2025-12-13 | Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept a… | |
CVE-2025-36750 | Medium | 5.4 | 2025-12-13 | ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page vi… |
CVE-2025-36748 | Medium | 5.4 | 2025-12-13 | ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the… |
CVE-2025-36747 | Critical | 9.8 | 2025-12-13 | ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the ser… |
CVE-2025-14620 | High | 7.3 | 2025-12-13 | A vulnerability was determined in code-projects Student File Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/log… |
CVE-2025-14619 | High | 7.3 | 2025-12-13 | A vulnerability was found in code-projects Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of the file login_que… |
CVE-2025-14617 | Medium | 5.3 | 2025-12-13 | A vulnerability has been found in Jehovahs Witnesses JW Library App up to 15.5.1 on Android. Affected is an unknown function of the component org.jw.jwlibrary… |
CVE-2025-14607 | Medium | 6.3 | 2025-12-13 | A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/d… |
CVE-2025-14606 | Medium | 5.0 | 2025-12-13 | A security vulnerability has been detected in tiny-rdm Tiny RDM up to 1.2.5. Affected by this vulnerability is the function pickle.loads of the file pickle_con… |
CVE-2025-14590 | High | 7.3 | 2025-12-13 | A security vulnerability has been detected in code-projects Prison Management System 2.0. Impacted is an unknown function of the file /admin/search1.php. The m… |
CVE-2025-14589 | Medium | 6.3 | 2025-12-13 | A weakness has been identified in code-projects Prison Management System 2.0. This issue affects some unknown processing of the file /admin/search.php. Executi… |
CVE-2025-14588 | High | 7.3 | 2025-12-13 | A security flaw has been discovered in itsourcecode Student Management System 1.0. This vulnerability affects unknown code of the file /update_program.php. Per… |
CVE-2025-14587 | High | 7.3 | 2025-12-13 | A vulnerability was identified in itsourcecode Online Pet Shop Management System 1.0. This affects an unknown part of the file /pet1/available.php. Such manipu… |
CVE-2025-14586 | Medium | 6.3 | 2025-12-13 | A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224. Affected by this issue is the function snprintf of the file /cgi-bin/cstecgi.cgi?acti… |
CVE-2025-14581 | Medium | 4.3 | 2025-12-13 | The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'submit_form_rep… |
CVE-2025-14542 | High | 7.5 | 2025-12-13 | The vulnerability arises when a client fetches a tools’ JSON specification, known as a Manual, from a remote Manual Endpoint. While a provider may initially se… |
CVE-2025-14540 | Medium | 4.3 | 2025-12-13 | The Userback plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the userback_get_json function in all versi… |
CVE-2025-14539 | Medium | 5.4 | 2025-12-13 | The The Shortcode Ajax plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the softwa… |
CVE-2025-14508 | Medium | 6.5 | 2025-12-13 | The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability chec… |
CVE-2025-14477 | Medium | 4.9 | 2025-12-13 | The 404 Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.0 due to insufficient escaping on the user suppl… |
CVE-2025-14476 | High | 8.8 | 2025-12-13 | The Doubly – Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via… |
CVE-2025-14475 | High | 8.1 | 2025-12-13 | The Extensive VC Addons for WPBakery page builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.1 via th… |
CVE-2025-14462 | Medium | 4.3 | 2025-12-13 | The Lucky Draw Contests plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to missing or i… |
CVE-2025-14454 | Medium | 4.3 | 2025-12-13 | The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2025-14451 | Medium | 4.7 | 2025-12-13 | The Solutions Ad Manager plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.0.0. This is due to insufficient validatio… |
CVE-2025-14447 | Medium | 4.3 | 2025-12-13 | The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu_reset_options… |
CVE-2025-14446 | Medium | 5.4 | 2025-12-13 | The Popup Builder (Easy Notify Lite) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the easynotif… |
CVE-2025-14440 | Critical | 9.8 | 2025-12-13 | The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authent… |
CVE-2025-14397 | High | 8.8 | 2025-12-13 | The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the poste… |
CVE-2025-14395 | Medium | 4.3 | 2025-12-13 | The Popover Windows plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple ajax actions (e.g., p… |
CVE-2025-14394 | Medium | 4.3 | 2025-12-13 | The Popover Windows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2. This is due to missing or incorrect… |
CVE-2025-14378 | Medium | 4.4 | 2025-12-13 | The Quick Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1 due to in… |
CVE-2025-14367 | Medium | 5.3 | 2025-12-13 | The Easy Theme Options plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0. This is due to missing authorizat… |
CVE-2025-14366 | Medium | 5.3 | 2025-12-13 | The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing a… |
CVE-2025-14365 | Medium | 5.3 | 2025-12-13 | The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing c… |
CVE-2025-14288 | Medium | 4.3 | 2025-12-13 | The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerabl… |
CVE-2025-14278 | Medium | 6.4 | 2025-12-13 | The HT Slider for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slide_title' parameter in all versions up to, and includ… |
CVE-2025-14056 | Medium | 4.4 | 2025-12-13 | The Custom Post Type UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'label' parameter during custom post type import in all versi… |
CVE-2025-14050 | Medium | 4.9 | 2025-12-13 | The Design Import/Export plugin for WordPress is vulnerable to SQL Injection via XML File Import in all versions up to, and including, 2.2 due to insufficient… |
CVE-2025-13705 | Medium | 6.4 | 2025-12-13 | The Custom Frames plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'customframe' shortcode in all versions up… |
CVE-2025-13403 | Medium | 4.3 | 2025-12-13 | The Employee Spotlight – Team Member Showcase & Meet the Team Plugin for WordPress is vulnerable to unauthorized tracking settings modification due to missing… |
CVE-2025-13094 | High | 8.8 | 2025-12-13 | The WP3D Model Import Viewer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_import_file() funct… |
CVE-2025-13093 | Medium | 5.3 | 2025-12-13 | The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil… |
CVE-2025-13092 | Medium | 5.3 | 2025-12-13 | The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch… |
CVE-2025-13089 | High | 7.5 | 2025-12-13 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'hide_fields' and the 'attr_search' parameter in all versions up to, and inclu… |
CVE-2025-13077 | High | 7.5 | 2025-12-13 | The افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' par… |
CVE-2025-12512 | Medium | 4.3 | 2025-12-13 | The GenerateBlocks plugin for WordPress is vulnerable to information exposure due to missing object-level authorization checks in versions up to, and including… |
CVE-2025-12362 | Medium | 5.3 | 2025-12-13 | The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versi… |
CVE-2025-12109 | Medium | 6.4 | 2025-12-13 | The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the script adder pr… |
CVE-2025-12077 | Medium | 6.1 | 2025-12-13 | The WP to LinkedIn Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.9… |
CVE-2025-12076 | Medium | 6.1 | 2025-12-13 | The Social Media Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage parameter in all versions up to, and includi… |
CVE-2025-11970 | Medium | 4.4 | 2025-12-13 | The Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated plugin for WordPress is vulnerable to Serve… |
CVE-2025-11707 | Medium | 5.3 | 2025-12-13 | The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key k… |
CVE-2025-11693 | Critical | 9.8 | 2025-12-13 | The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.4 throug… |
CVE-2025-11376 | Medium | 6.4 | 2025-12-13 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_loop' shortcode in all versions up to, and… |
CVE-2025-11164 | Medium | 4.3 | 2025-12-13 | The Mavix Education theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mavix_education_activate_p… |
CVE-2025-10738 | Critical | 9.8 | 2025-12-13 | The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to SQL Injection via the ‘analytic_id’ parameter in all versions up to, and including… |
CVE-2025-10289 | Medium | 5.9 | 2025-12-13 | The Filter & Grids plugin for WordPress is vulnerable to SQL Injection via the 'phrase' parameter in all versions up to, and including, 3.2.0 due to insufficie… |
CVE-2025-0969 | Medium | 6.5 | 2025-12-13 | The Brizy – Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.16 via the get_users()… |
CVE-2025-13970 | High | 8.0 | 2025-12-13 | OpenPLC_V3 is vulnerable to a cross-site request forgery (CSRF) attack due to the absence of proper CSRF validation. This issue allows an unauthenticated att… |
CVE-2025-67749 | | 2025-12-12 | PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. In versions 2.5.377 and below, an unchecked offset and size used in a memcpy operation inside PCS… | |
CVE-2025-67721 | High | 7.5 | 2025-12-12 | Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of m… |
CVE-2025-14585 | High | 7.3 | 2025-12-12 | A vulnerability was found in itsourcecode COVID Tracking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/?page=zone… |
CVE-2025-14584 | High | 7.3 | 2025-12-12 | A vulnerability has been found in itsourcecode COVID Tracking System 1.0. Affected is an unknown function of the file /admin/login.php of the component Admin L… |
CVE-2025-14583 | High | 7.3 | 2025-12-12 | A flaw has been found in campcodes Online Student Enrollment System 1.0. This impacts an unknown function of the file /admin/register.php. Executing a manipula… |
CVE-2025-14582 | Medium | 4.7 | 2025-12-12 | A vulnerability was detected in campcodes Online Student Enrollment System 1.0. This affects an unknown function of the file /admin/index.php?page=user-profile… |
CVE-2025-67750 | High | 8.4 | 2025-12-12 | Lightning Flow Scanner provides a A CLI plugin, VS Code Extension and GitHub Action for analysis and optimization of Salesforce Flows. Versions 6.10.5 and belo… |
CVE-2025-67634 | Medium | 4.4 | 2025-12-12 | The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could c… |
CVE-2025-46289 | Medium | 5.5 | 2025-12-12 | A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able… |
CVE-2025-46287 | Medium | 6.5 | 2025-12-12 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26… |
CVE-2025-46285 | High | 7.8 | 2025-12-12 | An integer overflow was addressed by adopting 64-bit timestamps. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 1… |
CVE-2025-46276 | Medium | 5.5 | 2025-12-12 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, ma… |
CVE-2025-43542 | High | 7.5 | 2025-12-12 | This issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, m… |
CVE-2025-43539 | High | 8.8 | 2025-12-12 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS… |
CVE-2025-43538 | Medium | 5.5 | 2025-12-12 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sonoma 14.8.3… |
CVE-2025-43532 | Low | 2.8 | 2025-12-12 | A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Seq… |
CVE-2025-43530 | Medium | 5.5 | 2025-12-12 | This issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2… |
CVE-2025-43527 | High | 7.8 | 2025-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may be able to gain root… |
CVE-2025-43523 | Medium | 5.5 | 2025-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may be able to access sen… |
CVE-2025-43522 | Low | 3.3 | 2025-12-12 | A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.3, mac… |
CVE-2025-43521 | Medium | 5.5 | 2025-12-12 | A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.3, mac… |
CVE-2025-43520 | Medium | 5.5 | 2025-12-12 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Seq… |
CVE-2025-43519 | Medium | 5.5 | 2025-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may… |
CVE-2025-43518 | Low | 3.3 | 2025-12-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2… |
CVE-2025-43517 | Low | 3.3 | 2025-12-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tah… |
CVE-2025-43516 | Low | 3.3 | 2025-12-12 | A session management issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. A user with… |
CVE-2025-43513 | Medium | 5.5 | 2025-12-12 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app m… |
CVE-2025-43512 | High | 7.8 | 2025-12-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 2… |