2025 CVEs (page 92)
Page 92 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13448 | Medium | 6.4 | 2025-12-03 | The CSSIgniter Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' shortcode attribute in all versions up to, and in… |
CVE-2025-65955 | Medium | 4.9 | 2025-12-02 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in Imag… |
CVE-2025-66476 | High | 7.8 | 2025-12-02 | Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute maliciou… |
CVE-2025-55181 | Medium | 5.3 | 2025-12-02 | Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing ev… |
CVE-2025-65657 | Medium | 6.5 | 2025-12-02 | FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers… |
CVE-2025-65380 | Medium | 6.5 | 2025-12-02 | PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts unvalidated user inp… |
CVE-2025-64778 | High | 7.3 | 2025-12-02 | NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow una… |
CVE-2025-64642 | High | 8.0 | 2025-12-02 | NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can en… |
CVE-2025-64298 | High | 8.4 | 2025-12-02 | NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clie… |
CVE-2025-62575 | High | 8.3 | 2025-12-02 | NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have t… |
CVE-2025-61940 | High | 8.3 | 2025-12-02 | NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is res… |
CVE-2025-65877 | High | 7.5 | 2025-12-02 | Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in com.wanli.lvzhoucms… |
CVE-2025-65379 | Medium | 6.5 | 2025-12-02 | PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php endpoint. Specifically, the username and mobileno parameters a… |
CVE-2025-13658 | | 2025-12-02 | A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code sig… | |
CVE-2025-13542 | Critical | 9.8 | 2025-12-02 | The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register… |
CVE-2025-13510 | | 2025-12-02 | The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to ac… | |
CVE-2025-66468 | High | 7.6 | 2025-12-02 | The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 202… |
CVE-2025-66460 | Medium | 6.1 | 2025-12-02 | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo pass… |
CVE-2025-66459 | Medium | 6.1 | 2025-12-02 | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnera… |
CVE-2025-66458 | Medium | 6.1 | 2025-12-02 | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are mul… |
CVE-2025-66454 | Medium | 6.5 | 2025-12-02 | Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worker secret ("dev") th… |
CVE-2025-66416 | High | 8.1 | 2025-12-02 | The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol… |
CVE-2025-66414 | High | 8.1 | 2025-12-02 | MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript… |
CVE-2025-66409 | Critical | 9.1 | 2025-12-02 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, rec… |
CVE-2025-65896 | Critical | 9.8 | 2025-12-02 | SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys. |
CVE-2025-61729 | High | 7.5 | 2025-12-02 | Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error stri… |
CVE-2025-60736 | Critical | 9.8 | 2025-12-02 | code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter. |
CVE-2025-57850 | Medium | 6.4 | 2025-12-02 | A container privilege escalation flaw was found in certain CodeReady Workspaces images. This issue stems from the /etc/passwd file being created with group-wri… |
CVE-2025-34352 | | 2025-12-02 | JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\SYSTEM duri… | |
CVE-2025-13721 | High | 7.5 | 2025-12-02 | Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security… |
CVE-2025-13720 | High | 8.8 | 2025-12-02 | Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corru… |
CVE-2025-13640 | Low | 3.5 | 2025-12-02 | Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physical access to the… |
CVE-2025-13639 | High | 8.1 | 2025-12-02 | Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pag… |
CVE-2025-13638 | High | 8.8 | 2025-12-02 | Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2025-13637 | Medium | 4.3 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2025-13636 | Medium | 4.3 | 2025-12-02 | Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-13635 | Medium | 4.4 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2025-13634 | Medium | 4.4 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the web via a crafted H… |
CVE-2025-13633 | High | 8.8 | 2025-12-02 | Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2025-13632 | Medium | 5.4 | 2025-12-02 | Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a user to install a malicious extension to p… |
CVE-2025-13631 | High | 8.8 | 2025-12-02 | Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform privilege escalation via a c… |
CVE-2025-13630 | High | 8.8 | 2025-12-02 | Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-66399 | High | 8.8 | 2025-12-02 | Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functio… |
CVE-2025-65881 | Medium | 6.1 | 2025-12-02 | Sourcecodester Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /classes/Login.php. |
CVE-2025-65844 | High | 7.5 | 2025-12-02 | EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessib… |
CVE-2025-65215 | Medium | 6.1 | 2025-12-02 | Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier.php via the Suppli… |
CVE-2025-65105 | Medium | 4.5 | 2025-12-02 | Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security o… |
CVE-2025-64750 | Medium | 4.5 | 2025-12-02 | SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5, if a user relies on LSM… |
CVE-2025-60854 | Critical | 9.8 | 2025-12-02 | A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web a… |
CVE-2025-58386 | Critical | 9.8 | 2025-12-02 | In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power U… |
CVE-2025-52622 | Medium | 5.4 | 2025-12-02 | The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, makin… |
CVE-2025-65656 | Critical | 9.8 | 2025-12-02 | dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php. |
CVE-2025-65358 | Critical | 9.8 | 2025-12-02 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php. |
CVE-2025-65186 | Medium | 6.1 | 2025-12-02 | Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor… |
CVE-2025-64070 | Medium | 5.4 | 2025-12-02 | Sourcecodester Student Grades Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Add New Subject Description field. |
CVE-2025-13828 | | 2025-12-02 | SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for ena… | |
CVE-2025-13827 | | 2025-12-02 | Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf the media folder is… | |
CVE-2025-65187 | Medium | 6.1 | 2025-12-02 | A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScrip… |
CVE-2025-64460 | High | 7.5 | 2025-12-02 | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInn… |
CVE-2025-63872 | Medium | 6.1 | 2025-12-02 | DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated SVG content. |
CVE-2025-59704 | Medium | 4.6 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow an attacker to gain access the the BIOS menu because is has no passwor… |
CVE-2025-59703 | Critical | 9.1 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to access the internal components of t… |
CVE-2025-58113 | Medium | 6.5 | 2025-12-02 | An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co. Ltd PDF-XChange Editor 10.7.3.401. By using a specially crafted EMF fil… |
CVE-2025-13877 | Medium | 5.6 | 2025-12-02 | A vulnerability was detected in nocobase up to 1.9.4/2.0.0-alpha.37. The affected element is an unknown function of the file nocobase\packages\core\auth\src\ba… |
CVE-2025-13372 | Medium | 4.3 | 2025-12-02 | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using… |
CVE-2025-12630 | Medium | 4.9 | 2025-12-02 | The Upload.am WordPress plugin before 1.0.1 is vulnerable to arbitrary option disclosure due to a missing capability check on its AJAX request handler, allowi… |
CVE-2025-59705 | Medium | 6.8 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to Escalate Privileges by enabling the… |
CVE-2025-59702 | High | 7.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with elevated privileges to falsify ta… |
CVE-2025-59701 | Medium | 4.1 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker (with elevated privileges) to read and… |
CVE-2025-59700 | Low | 3.9 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with root access to modify the Recover… |
CVE-2025-59699 | Medium | 6.8 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to escalate privileges by booting from… |
CVE-2025-59698 | Medium | 6.8 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, might allow a physically proximate attacker to gain access to the EOL legacy… |
CVE-2025-59697 | High | 7.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to escalate privileges by editing the… |
CVE-2025-59696 | Low | 3.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to modify or erase tamper events via t… |
CVE-2025-59695 | Critical | 9.8 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a user with OS root access to alter firmware on the Chassis Management… |
CVE-2025-59694 | Medium | 6.8 | 2025-12-02 | The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allows a physically proximate attacker to pe… |
CVE-2025-59693 | Critical | 9.8 | 2025-12-02 | The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allows a physically proximate attacker to ob… |
CVE-2025-13876 | Medium | 5.3 | 2025-12-02 | A security vulnerability has been detected in Rareprob HD Video Player All Formats App 12.1.372 on Android. Impacted is an unknown function of the component co… |
CVE-2025-13875 | Medium | 6.3 | 2025-12-02 | A weakness has been identified in Yohann0617 oci-helper up to 3.2.4. This issue affects the function addCfg of the file src/main/java/com/yohann/ocihelper/serv… |
CVE-2025-13505 | Medium | 4.8 | 2025-12-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Neutralization of Script-Related HTML Tags in a Web Page… |
CVE-2025-65858 | Low | 3.5 | 2025-12-02 | A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user… |
CVE-2025-41086 | Medium | 6.5 | 2025-12-02 | Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions… |
CVE-2025-41066 | Medium | 5.3 | 2025-12-02 | Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system… |
CVE-2025-41015 | High | 7.5 | 2025-12-02 | User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on t… |
CVE-2025-41014 | High | 7.5 | 2025-12-02 | User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on t… |
CVE-2025-41013 | Critical | 9.8 | 2025-12-02 | SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by se… |
CVE-2025-13731 | Medium | 6.4 | 2025-12-02 | The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nxt-year' shortcode in all… |
CVE-2025-13295 | High | 7.5 | 2025-12-02 | Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier. This issue affects BILGER… |
CVE-2025-41012 | Medium | 5.3 | 2025-12-02 | Unauthorized access vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists o… |
CVE-2025-40700 | Medium | 6.1 | 2025-12-02 | Reflected Cross-Site Scripting (XSS) in IDI Eikon's Governalia. The vulnerability allows an attacker to execute JavaScript code in the victim's browser when a… |
CVE-2025-13879 | Low | 2.7 | 2025-12-02 | Directory traversal vulnerability in SOLIDserver IPAM v8.2.3. This vulnerability allows an authenticated user with administrator privileges to list directories… |
CVE-2025-12465 | | 2025-12-02 | A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allo… | |
CVE-2025-11789 | High | 7.5 | 2025-12-02 | Out-of-bounds read vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'DownloadFile' function converts a parameter to an integer using 'atoi()' and th… |
CVE-2025-11788 | Critical | 9.8 | 2025-12-02 | Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowSupervisorParameters()' function, there is an unlimited user inp… |
CVE-2025-11787 | High | 8.8 | 2025-12-02 | Command injection vulnerability in the operating system in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 through the 'GetDNS()', 'CheckPing()' and 'TraceRoute()' funct… |
CVE-2025-11786 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'SetUserPassword()' function, the 'newPassword' parameter is directl… |
CVE-2025-11785 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowMeterPasswords()' function, there is an unlimited user input th… |
CVE-2025-11784 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowMeterDatabase()' function, there is an unlimited user input tha… |
CVE-2025-11783 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The vulnerability is found in the 'AddEvent()' function when copying the us… |
CVE-2025-11782 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'ShowDownload()' function uses “sprintf()” to format a string that incl… |