2025 CVEs (page 88)
Page 88 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13308 | Medium | 5.4 | 2025-12-06 | The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reject_url' parameter in all versions up to, and includ… |
CVE-2025-13137 | Medium | 6.1 | 2025-12-06 | The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woomotiv_limit' parameter… |
CVE-2025-12721 | Medium | 5.3 | 2025-12-06 | The g-FFL Cockpit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the /server_status REST… |
CVE-2025-12720 | Medium | 5.3 | 2025-12-06 | The g-FFL Cockpit plugin for WordPress is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enque… |
CVE-2025-12717 | Medium | 6.4 | 2025-12-06 | The List Attachments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_list' parameter in the [list-attachments] shor… |
CVE-2025-12715 | Medium | 6.4 | 2025-12-06 | The Canadian Nutrition Facts Label plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'percentage' field in the Nutrition Label custom p… |
CVE-2025-12673 | Critical | 9.8 | 2025-12-06 | The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in… |
CVE-2025-12577 | Medium | 4.3 | 2025-12-06 | The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili… |
CVE-2025-12574 | Medium | 4.3 | 2025-12-06 | The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check… |
CVE-2025-12091 | Medium | 4.3 | 2025-12-06 | The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2025-13922 | Medium | 6.5 | 2025-12-06 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_term… |
CVE-2025-13292 | | 2025-12-06 | A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other Api… | |
CVE-2025-12505 | Medium | 5.4 | 2025-12-06 | The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verif… |
CVE-2025-12510 | High | 7.2 | 2025-12-06 | The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficie… |
CVE-2025-11263 | Medium | 6.1 | 2025-12-06 | The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 d… |
CVE-2025-66629 | Low | 3.7 | 2025-12-05 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login provide… |
CVE-2025-34291 | High | 8.8 | 2025-12-05 | Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS… |
CVE-2025-14116 | Medium | 4.7 | 2025-12-05 | A vulnerability was detected in xerrors Yuxi-Know up to 0.4.0. This vulnerability affects the function OtherEmbedding.aencode of the file /src/models/embed.py… |
CVE-2025-14111 | Medium | 5.0 | 2025-12-05 | A security vulnerability has been detected in Rarlab RAR App up to 7.11 Build 127 on Android. This affects an unknown part of the component com.rarlab.rar. Suc… |
CVE-2025-14108 | High | 8.8 | 2025-12-05 | A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this issue is the function zfilev2_api.OpenSafe of the file /v2/file/safe/open… |
CVE-2025-14107 | High | 8.8 | 2025-12-05 | A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2_api.SafeStatus of the file /v2/… |
CVE-2025-14106 | High | 8.8 | 2025-12-05 | A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the compo… |
CVE-2025-13426 | | 2025-12-05 | A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remo… | |
CVE-2025-8148 | Medium | 4.2 | 2025-12-05 | An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH… |
CVE-2025-14105 | Medium | 4.3 | 2025-12-05 | A vulnerability was determined in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. This impacts an unknown function of the file /reqproc/proc_post of the componen… |
CVE-2025-66644 | High | 7.2 | 2025-12-05 | Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025. |
CVE-2025-66624 | High | 7.5 | 2025-12-05 | BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services. Prior to 1.5.0.rc2, The… |
CVE-2025-66623 | High | 7.4 | 2025-12-05 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some… |
CVE-2025-66581 | Medium | 6.5 | 2025-12-05 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.41.0, a flaw in the server-side authorization… |
CVE-2025-66577 | Medium | 5.3 | 2025-12-05 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to i… |
CVE-2025-66570 | Critical | 10.0 | 2025-12-05 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to i… |
CVE-2025-46603 | High | 7.0 | 2025-12-05 | Dell CloudBoost Virtual Appliance, versions 19.13.0.0 and prior, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauth… |
CVE-2025-66566 | | 2025-12-05 | yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and… | |
CVE-2025-66562 | Critical | 9.6 | 2025-12-05 | TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution (RCE) vulnerability exists in Tuu… |
CVE-2025-66558 | Low | 3.1 | 2025-12-05 | Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-a… |
CVE-2025-66557 | Medium | 5.4 | 2025-12-05 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and… |
CVE-2025-66556 | Low | 3.5 | 2025-12-05 | Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll draft… |
CVE-2025-66554 | Low | 3.5 | 2025-12-05 | Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious use… |
CVE-2025-66553 | Medium | 4.3 | 2025-12-05 | Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to view meta data of col… |
CVE-2025-66551 | Medium | 6.3 | 2025-12-05 | Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table an… |
CVE-2025-66549 | Low | 2.4 | 2025-12-05 | Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the… |
CVE-2025-66548 | Low | 3.3 | 2025-12-05 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1… |
CVE-2025-66545 | Low | 3.5 | 2025-12-05 | Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, an… |
CVE-2025-66515 | Low | 2.7 | 2025-12-05 | The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a w… |
CVE-2025-66514 | Low | 3.5 | 2025-12-05 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allow… |
CVE-2025-66513 | Medium | 4.3 | 2025-12-05 | Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is sh… |
CVE-2025-34266 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/addins/menus endpoi… |
CVE-2025-34265 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/rule-engines endpoint. When an au… |
CVE-2025-34264 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/dog/{agentId} endpoint. When an a… |
CVE-2025-34263 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/dashboards/menus en… |
CVE-2025-34262 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devices/name/{agent_id} endpoint… |
CVE-2025-34261 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicegroups/ endpoint. When an a… |
CVE-2025-34260 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/schedule endpoint. When an… |
CVE-2025-34259 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/building endpoint. When… |
CVE-2025-34258 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/plan endpoint. When an… |
CVE-2025-34257 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/defined endpoint. When an… |
CVE-2025-34256 | Critical | 9.8 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for sign… |
CVE-2025-66552 | Medium | 4.3 | 2025-12-05 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with gro… |
CVE-2025-66550 | Medium | 5.7 | 2025-12-05 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that li… |
CVE-2025-66547 | Medium | 4.3 | 2025-12-05 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on fil… |
CVE-2025-66546 | Low | 3.3 | 2025-12-05 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential I… |
CVE-2025-66512 | Medium | 5.4 | 2025-12-05 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed… |
CVE-2025-66511 | Medium | 4.8 | 2025-12-05 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function… |
CVE-2025-66510 | Medium | 4.5 | 2025-12-05 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 2… |
CVE-2025-66471 | High | 7.5 | 2025-12-05 | urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed d… |
CVE-2025-65879 | High | 8.1 | 2025-12-05 | Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled good… |
CVE-2025-65878 | High | 7.5 | 2025-12-05 | The warehouse management system version 1.2 contains an arbitrary file read vulnerability. The endpoint `/file/showImageByPath` does not sanitize user-controll… |
CVE-2025-65036 | High | 8.3 | 2025-12-05 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from t… |
CVE-2025-14104 | Medium | 6.1 | 2025-12-05 | A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` funct… |
CVE-2025-14094 | Medium | 4.7 | 2025-12-05 | A flaw has been found in Edimax BR-6478AC V3 1.0.15. The affected element is the function sub_44CCE4 of the file /boafrm/formSysCmd. This manipulation of the a… |
CVE-2025-14093 | Medium | 4.7 | 2025-12-05 | A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. Impacted is the function sub_416990 of the file /boafrm/formTracerouteDiagnosticRun. The manipulati… |
CVE-2025-66418 | High | 7.5 | 2025-12-05 | urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbo… |
CVE-2025-65897 | High | 8.8 | 2025-12-05 | zdh_web is a data collection, processing, monitoring, scheduling, and management platform. In zdh_web thru 5.6.17, insufficient validation of file upload paths… |
CVE-2025-65730 | High | 8.8 | 2025-12-05 | Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication. |
CVE-2025-64056 | Medium | 4.3 | 2025-12-05 | File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the filesystem. |
CVE-2025-64054 | Critical | 9.6 | 2025-12-05 | A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitr… |
CVE-2025-64053 | High | 7.5 | 2025-12-05 | A Buffer overflow vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via craf… |
CVE-2025-64052 | Medium | 5.1 | 2025-12-05 | An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system commands. |
CVE-2025-14092 | Medium | 4.7 | 2025-12-05 | A security vulnerability has been detected in Edimax BR-6478AC V3 1.0.15. This issue affects the function sub_416898 of the file /boafrm/formDebugDiagnosticRun… |
CVE-2025-14091 | High | 7.3 | 2025-12-05 | A weakness has been identified in TrippWasTaken PHP-Guitar-Shop up to 6ce0868889617c1975982aae6df8e49555d0d555. This vulnerability affects unknown code of the… |
CVE-2025-14090 | Medium | 4.7 | 2025-12-05 | A security flaw has been discovered in AMTT Hotel Broadband Operation System 1.0. This affects an unknown part of the file /manager/card/cardmake_down.php. Per… |
CVE-2025-14089 | Medium | 6.3 | 2025-12-05 | A vulnerability was identified in Himool ERP up to 2.2. Affected by this issue is the function update_account of the file /api/admin/update_account/ of the com… |
CVE-2025-64057 | High | 8.3 | 2025-12-05 | Directory traversal vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store files in arbitrary locations and pot… |
CVE-2025-14088 | Medium | 6.3 | 2025-12-05 | A vulnerability was determined in ketr JEPaaS up to 7.2.8. Affected by this vulnerability is an unknown functionality of the file /je/load. This manipulation o… |
CVE-2025-58098 | High | 8.3 | 2025-12-05 | Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd… |
CVE-2025-14086 | Medium | 6.3 | 2025-12-05 | A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is an unknown function of the file /app-api/v1/members/openid/. The manipulation of t… |
CVE-2025-14085 | Medium | 6.3 | 2025-12-05 | A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the… |
CVE-2025-6966 | Medium | 5.5 | 2025-12-05 | NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via… |
CVE-2025-13654 | High | 7.5 | 2025-12-05 | A stack buffer overflow vulnerability exists in the buffer_get function of duc, a disk management tool, where a condition can evaluate to true due to underflow… |
CVE-2025-66200 | Medium | 5.4 | 2025-12-05 | mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can… |
CVE-2025-65082 | Medium | 6.5 | 2025-12-05 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuratio… |
CVE-2025-59775 | High | 7.5 | 2025-12-05 | Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially… |
CVE-2025-55753 | High | 7.5 | 2025-12-05 | An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer… |
CVE-2025-13620 | Medium | 5.3 | 2025-12-05 | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is du… |
CVE-2025-13739 | Medium | 6.4 | 2025-12-05 | The CryptX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `cryptx` shortcode in all versions up to, and including, 4.0.5 du… |
CVE-2025-13682 | Medium | 4.4 | 2025-12-05 | The Trail Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insuf… |
CVE-2025-13678 | Medium | 6.4 | 2025-12-05 | The Thai Lottery Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `thailottery` shortcode in all versions up to, and including… |
CVE-2025-13614 | High | 8.1 | 2025-12-05 | The Cool Tag Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cool_tag_cloud' shortcode in all versions up to, and inc… |
CVE-2025-12879 | High | 8.8 | 2025-12-05 | The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing… |
CVE-2025-12876 | Medium | 5.3 | 2025-12-05 | The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |