2025 CVEs (page 94)
Page 94 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13637 | Medium | 4.3 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2025-13636 | Medium | 4.3 | 2025-12-02 | Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-13635 | Medium | 4.4 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2025-13634 | Medium | 4.4 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the web via a crafted H… |
CVE-2025-13633 | High | 8.8 | 2025-12-02 | Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2025-13632 | Medium | 5.4 | 2025-12-02 | Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a user to install a malicious extension to p… |
CVE-2025-13631 | High | 8.8 | 2025-12-02 | Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform privilege escalation via a c… |
CVE-2025-13630 | High | 8.8 | 2025-12-02 | Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-66399 | High | 8.8 | 2025-12-02 | Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functio… |
CVE-2025-65881 | Medium | 6.1 | 2025-12-02 | Sourcecodester Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /classes/Login.php. |
CVE-2025-65844 | High | 7.5 | 2025-12-02 | EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessib… |
CVE-2025-65215 | Medium | 6.1 | 2025-12-02 | Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier.php via the Suppli… |
CVE-2025-65105 | Medium | 4.5 | 2025-12-02 | Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security o… |
CVE-2025-64750 | Medium | 4.5 | 2025-12-02 | SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5, if a user relies on LSM… |
CVE-2025-60854 | Critical | 9.8 | 2025-12-02 | A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web a… |
CVE-2025-58386 | Critical | 9.8 | 2025-12-02 | In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power U… |
CVE-2025-52622 | Medium | 5.4 | 2025-12-02 | The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, makin… |
CVE-2025-65656 | Critical | 9.8 | 2025-12-02 | dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php. |
CVE-2025-65358 | Critical | 9.8 | 2025-12-02 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php. |
CVE-2025-65186 | Medium | 6.1 | 2025-12-02 | Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor… |
CVE-2025-64070 | Medium | 5.4 | 2025-12-02 | Sourcecodester Student Grades Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Add New Subject Description field. |
CVE-2025-13828 | | 2025-12-02 | SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for ena… | |
CVE-2025-13827 | | 2025-12-02 | Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf the media folder is… | |
CVE-2025-65187 | Medium | 6.1 | 2025-12-02 | A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScrip… |
CVE-2025-64460 | High | 7.5 | 2025-12-02 | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInn… |
CVE-2025-63872 | Medium | 6.1 | 2025-12-02 | DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated SVG content. |
CVE-2025-59704 | Medium | 4.6 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow an attacker to gain access… |
CVE-2025-59703 | Critical | 9.1 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physically Proximate Att… |
CVE-2025-58113 | Medium | 6.5 | 2025-12-02 | An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co. Ltd PDF-XChange Editor 10.7.3.401. By using a specially crafted EMF fil… |
CVE-2025-13877 | Medium | 5.6 | 2025-12-02 | A vulnerability was detected in nocobase up to 1.9.4/2.0.0-alpha.37. The affected element is an unknown function of the file nocobase\packages\core\auth\src\ba… |
CVE-2025-13372 | Medium | 4.3 | 2025-12-02 | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using… |
CVE-2025-12630 | Medium | 4.9 | 2025-12-02 | The Upload.am WordPress plugin before 1.0.1 is vulnerable to arbitrary option disclosure due to a missing capability check on its AJAX request handler, allowi… |
CVE-2025-59705 | Medium | 6.8 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physically Proximate Att… |
CVE-2025-59702 | High | 7.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate att… |
CVE-2025-59701 | Medium | 4.1 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate att… |
CVE-2025-59700 | Low | 3.9 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate att… |
CVE-2025-59699 | Medium | 6.8 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate att… |
CVE-2025-59698 | Medium | 6.8 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), might allow a physically proxima… |
CVE-2025-59697 | High | 7.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate att… |
CVE-2025-59696 | Low | 3.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate att… |
CVE-2025-59695 | Critical | 9.8 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a user with OS root access… |
CVE-2025-59694 | Medium | 6.8 | 2025-12-02 | The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS))… |
CVE-2025-59693 | Critical | 9.8 | 2025-12-02 | The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS))… |
CVE-2025-13876 | Medium | 5.3 | 2025-12-02 | A security vulnerability has been detected in Rareprob HD Video Player All Formats App 12.1.372 on Android. Impacted is an unknown function of the component co… |
CVE-2025-13875 | Medium | 6.3 | 2025-12-02 | A weakness has been identified in Yohann0617 oci-helper up to 3.2.4. This issue affects the function addCfg of the file src/main/java/com/yohann/ocihelper/serv… |
CVE-2025-13505 | Medium | 4.8 | 2025-12-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Neutralization of Script-Related HTML Tags in a Web Page… |
CVE-2025-65858 | Low | 3.5 | 2025-12-02 | A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user… |
CVE-2025-41086 | Medium | 6.5 | 2025-12-02 | Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions… |
CVE-2025-41066 | Medium | 5.3 | 2025-12-02 | Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system… |
CVE-2025-41015 | High | 7.5 | 2025-12-02 | User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on t… |
CVE-2025-41014 | High | 7.5 | 2025-12-02 | User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on t… |
CVE-2025-41013 | Critical | 9.8 | 2025-12-02 | SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by se… |
CVE-2025-13731 | Medium | 6.4 | 2025-12-02 | The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nxt-year' shortcode in all… |
CVE-2025-13295 | High | 7.5 | 2025-12-02 | Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier. This issue affects BILGER… |
CVE-2025-41012 | Medium | 5.3 | 2025-12-02 | Unauthorized access vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists o… |
CVE-2025-40700 | Medium | 6.1 | 2025-12-02 | Reflected Cross-Site Scripting (XSS) in IDI Eikon's Governalia. The vulnerability allows an attacker to execute JavaScript code in the victim's browser when a… |
CVE-2025-13879 | Low | 2.7 | 2025-12-02 | Directory traversal vulnerability in SOLIDserver IPAM v8.2.3. This vulnerability allows an authenticated user with administrator privileges to list directories… |
CVE-2025-12465 | | 2025-12-02 | A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allo… | |
CVE-2025-11789 | High | 7.5 | 2025-12-02 | Out-of-bounds read vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'DownloadFile' function converts a parameter to an integer using 'atoi()' and th… |
CVE-2025-11788 | Critical | 9.8 | 2025-12-02 | Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowSupervisorParameters()' function, there is an unlimited user inp… |
CVE-2025-11787 | High | 8.8 | 2025-12-02 | Command injection vulnerability in the operating system in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 through the 'GetDNS()', 'CheckPing()' and 'TraceRoute()' funct… |
CVE-2025-11786 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'SetUserPassword()' function, the 'newPassword' parameter is directl… |
CVE-2025-11785 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowMeterPasswords()' function, there is an unlimited user input th… |
CVE-2025-11784 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowMeterDatabase()' function, there is an unlimited user input tha… |
CVE-2025-11783 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The vulnerability is found in the 'AddEvent()' function when copying the us… |
CVE-2025-11782 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'ShowDownload()' function uses “sprintf()” to format a string that incl… |
CVE-2025-11781 | High | 7.8 | 2025-12-02 | Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The affected firmware contains a hardcoded static authentication key. An attacker… |
CVE-2025-11780 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'showMeterReport()' function, there is an unlimited user input that… |
CVE-2025-11779 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in CircutorSGE-PLC1000/SGE-PLC50 v9.0.2. The 'SetLan' function is invoked when a new configuration is applied. This n… |
CVE-2025-11778 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 v0.9.2. This vulnerability allows an attacker to remotely exploit memory corruption through the '… |
CVE-2025-13090 | Medium | 4.9 | 2025-12-02 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insuffic… |
CVE-2025-41744 | Critical | 9.1 | 2025-12-02 | Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereb… |
CVE-2025-41743 | Medium | 4.0 | 2025-12-02 | Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to extract data from up… |
CVE-2025-41742 | Critical | 9.8 | 2025-12-02 | Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use… |
CVE-2025-13353 | Medium | 5.5 | 2025-12-02 | In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM… |
CVE-2025-13873 | Medium | 5.4 | 2025-12-02 | Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary J… |
CVE-2025-13872 | Critical | 9.1 | 2025-12-02 | Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to fo… |
CVE-2025-13871 | High | 8.8 | 2025-12-02 | Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connecte… |
CVE-2025-13870 | Low | 3.1 | 2025-12-02 | Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards… |
CVE-2025-13724 | High | 7.5 | 2025-12-02 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'month' parameter in all versions up t… |
CVE-2025-13534 | Medium | 6.3 | 2025-12-02 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2… |
CVE-2025-13516 | High | 8.1 | 2025-12-02 | The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0… |
CVE-2025-10543 | Medium | 5.3 | 2025-12-02 | In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their le… |
CVE-2025-13696 | Medium | 5.3 | 2025-12-02 | The Zigaform plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.6.5. This is due to the plugin exposing a… |
CVE-2025-11726 | Medium | 4.3 | 2025-12-02 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4. This is du… |
CVE-2025-10971 | | 2025-12-02 | Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Data. This issue affects MeetMe: through v… | |
CVE-2025-13685 | Medium | 4.3 | 2025-12-02 | The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8. This is due to missing n… |
CVE-2025-13140 | Medium | 4.3 | 2025-12-02 | The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20… |
CVE-2025-13007 | Medium | 6.1 | 2025-12-02 | The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up t… |
CVE-2025-12483 | Medium | 6.5 | 2025-12-02 | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'query' parameter in all versions up to, an… |
CVE-2025-13001 | Medium | 4.1 | 2025-12-02 | The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as a… |
CVE-2025-13000 | High | 7.7 | 2025-12-02 | The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscriber to perform SQL… |
CVE-2025-13606 | Medium | 6.5 | 2025-12-02 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2025-13387 | High | 7.2 | 2025-12-02 | The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and inclu… |
CVE-2025-20792 | Medium | 5.3 | 2025-12-02 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20791 | Medium | 6.5 | 2025-12-02 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20790 | Medium | 5.3 | 2025-12-02 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20789 | Medium | 4.4 | 2025-12-02 | In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execu… |
CVE-2025-20788 | Medium | 4.4 | 2025-12-02 | In GPU pdma, there is a possible memory corruption due to a missing permission check. This could lead to local denial of service with no additional execution p… |
CVE-2025-20777 | Medium | 6.7 | 2025-12-02 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |