2025 CVEs (page 94)
Page 94 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-66298 | High | 7.5 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin confi… |
CVE-2025-65622 | Medium | 5.4 | 2025-12-01 | Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in a… |
CVE-2025-66297 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig p… |
CVE-2025-66296 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username un… |
CVE-2025-66295 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a u… |
CVE-2025-66294 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attac… |
CVE-2025-66206 | Medium | 6.8 | 2025-12-01 | Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files… |
CVE-2025-66205 | High | 7.1 | 2025-12-01 | Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of v… |
CVE-2025-65840 | High | 8.8 | 2025-12-01 | PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController. |
CVE-2025-65621 | Medium | 5.4 | 2025-12-01 | Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enablin… |
CVE-2025-58044 | Medium | 6.1 | 2025-12-01 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses… |
CVE-2025-55749 | High | 7.5 | 2025-12-01 | XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a c… |
CVE-2025-65838 | High | 7.5 | 2025-12-01 | PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method. |
CVE-2025-65836 | Critical | 9.1 | 2025-12-01 | PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController. |
CVE-2025-63317 | Medium | 5.4 | 2025-12-01 | Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes… |
CVE-2025-51683 | Critical | 9.8 | 2025-12-01 | A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request… |
CVE-2025-51682 | Critical | 9.8 | 2025-12-01 | mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features. A… |
CVE-2025-12756 | Medium | 4.3 | 2025-12-01 | Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boa… |
CVE-2025-65407 | Medium | 6.5 | 2025-12-01 | A use-after-free in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS… |
CVE-2025-63365 | High | 7.1 | 2025-12-01 | SoftSea EPUB File Reader 1.0.0.0 is vulnerable to Directory Traversal. The vulnerability resides in the EPUB file processing component, specifically in the fun… |
CVE-2025-34297 | | 2025-12-01 | KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. The nfft p… | |
CVE-2025-11772 | Medium | 6.6 | 2025-12-01 | A carefully crafted DLL, copied to C:\ProgramData\Synaptics folder, allows a local user to execute arbitrary code with elevated privileges during driver i… |
CVE-2025-13837 | Medium | 5.5 | 2025-12-01 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues |
CVE-2025-13836 | High | 7.5 | 2025-12-01 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server… |
CVE-2025-13835 | Medium | 6.5 | 2025-12-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allo… |
CVE-2025-13653 | Medium | 4.3 | 2025-12-01 | In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use speci… |
CVE-2025-7007 | High | 7.5 | 2025-12-01 | NULL Pointer Dereference vulnerability in Avast Antivirus on MacOS, Avast Anitvirus on Linux when scanning a malformed Windows PE file causes the antivirus pro… |
CVE-2025-65408 | Medium | 6.5 | 2025-12-01 | A NULL pointer dereference in the ADTSAudioFileServerMediaSubsession::createNewRTPSink() function of Live555 Streaming Media v2018.09.02 allows attackers to ca… |
CVE-2025-65406 | Medium | 6.5 | 2025-12-01 | A heap overflow in the MatroskaFile::createRTPSinkForTrackNumber() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Servic… |
CVE-2025-8351 | High | 7.8 | 2025-12-01 | Heap-based Buffer Overflow, Out-of-bounds Read vulnerability in Avira Antivirus engine when scanning a malformed file may allow Local Execution of Code or Deni… |
CVE-2025-65405 | Medium | 6.5 | 2025-12-01 | A use-after-free in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service… |
CVE-2025-65404 | Medium | 6.5 | 2025-12-01 | A buffer overflow in the getSideInfo2() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via a crafted MP3 s… |
CVE-2025-65403 | Medium | 6.5 | 2025-12-01 | A buffer overflow in the g_cfg.MaxUsers component of LightFTP v2.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-64775 | High | 7.5 | 2025-12-01 | Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0… |
CVE-2025-63535 | Critical | 9.6 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php component. The application fails to properly sanitize usersuppl… |
CVE-2025-63534 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the login.php component. The application fails to properly san… |
CVE-2025-63533 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and rprofile.php components. The applica… |
CVE-2025-63532 | Critical | 9.6 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the cancel.php component. The application fails to properly sanitize user-s… |
CVE-2025-63095 | Medium | 6.5 | 2025-12-01 | Improper input validation in the BitstreamWriter::write_bits() function of Tempus Ex hello-video-codec v0.1.0 allows attackers to cause a Denial of Service (Do… |
CVE-2025-61229 | High | 7.8 | 2025-12-01 | An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script wit… |
CVE-2025-61228 | High | 7.8 | 2025-12-01 | An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism |
CVE-2025-57489 | High | 8.1 | 2025-12-01 | Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privileges to root due to the improper use of… |
CVE-2025-55222 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially… |
CVE-2025-55221 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially… |
CVE-2025-54851 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-54850 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-54849 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-54848 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-3500 | Critical | 9.0 | 2025-12-01 | Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981… |
CVE-2025-26858 | High | 8.6 | 2025-12-01 | A buffer overflow vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted set of network packets can lea… |
CVE-2025-23417 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can… |
CVE-2025-20085 | High | 7.2 | 2025-12-01 | A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can… |
CVE-2025-13829 | | 2025-12-01 | Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Cri… | |
CVE-2025-11699 | High | 7.1 | 2025-12-01 | nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a va… |
CVE-2025-10101 | High | 7.8 | 2025-12-01 | Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Mach-O file may allow Local Execution of Code or Denial-of-Service of… |
CVE-2025-64030 | Medium | 5.4 | 2025-12-01 | Eximbills Enterprise 4.1.5 (Built on 2020-10-30) is vulnerable to authenticated stored cross-site scripting (CWE-79) via the /EximBillWeb/servlets/WSTrxManager… |
CVE-2025-63531 | Critical | 10.0 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. The application fails to properly sanitize… |
CVE-2025-63529 | Medium | 6.1 | 2025-12-01 | A session fixation vulnerability exists in Blood Bank Management System 1.0 in login.php that allows an attacker to set or predict a user's session identifier… |
CVE-2025-63528 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the blooddinfo.php component. The application fails to properl… |
CVE-2025-63527 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and hprofile.php components. The applica… |
CVE-2025-63526 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System within the abs.php component. The application fails to properly sanitize… |
CVE-2025-63525 | Critical | 9.6 | 2025-12-01 | An issue was discovered in Blood Bank Management System 1.0 allowing authenticated attackers to perform actions with escalated privileges via crafted request t… |
CVE-2025-63523 | Medium | 6.5 | 2025-12-01 | FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can int… |
CVE-2025-63522 | Medium | 4.6 | 2025-12-01 | Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function |
CVE-2025-63520 | Medium | 6.1 | 2025-12-01 | Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate). |
CVE-2025-13129 | Medium | 4.3 | 2025-12-01 | Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylarım… |
CVE-2025-49643 | Medium | 6.5 | 2025-12-01 | An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore… |
CVE-2025-49642 | | 2025-12-01 | Library loading on AIX Zabbix Agent builds can be hijacked by local users with write access to the /home/cecuser directory. | |
CVE-2025-27232 | Medium | 4.9 | 2025-12-01 | An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss. |
CVE-2025-12106 | Critical | 9.1 | 2025-12-01 | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses |
CVE-2025-58408 | Medium | 5.9 | 2025-12-01 | Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and… |
CVE-2025-13296 | Medium | 5.4 | 2025-12-01 | Cross-Site Request Forgery (CSRF) vulnerability in Tekrom Technology Inc. T-Soft E-Commerce allows Cross Site Request Forgery. This issue affects T-Soft E-Com… |
CVE-2025-8045 | Medium | 4.0 | 2025-12-01 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
CVE-2025-6349 | Medium | 5.1 | 2025-12-01 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
CVE-2025-59789 | High | 7.5 | 2025-12-01 | Uncontrolled recursion in the json2pb component in Apache bRPC (version < 1.15.0) on all platforms allows remote attackers to make the server crash via sending… |
CVE-2025-41070 | | 2025-12-01 | Reflected Cross-site Scripting (XSS) vulnerability in Sanoma's Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim's brows… | |
CVE-2025-2879 | Medium | 5.1 | 2025-12-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driv… |
CVE-2025-41739 | Medium | 5.9 | 2025-12-01 | An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux… |
CVE-2025-41738 | High | 7.5 | 2025-12-01 | An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type… |
CVE-2025-41700 | High | 7.8 | 2025-12-01 | An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS deve… |
CVE-2025-13819 | Medium | 6.1 | 2025-12-01 | Open redirect in the web server component of MiR Robot and Fleet software allows a remote attacker to redirect users to arbitrary external websites via a craft… |
CVE-2025-13816 | Medium | 6.3 | 2025-12-01 | A security vulnerability has been detected in moxi159753 Mogu Blog v2 up to 5.2. The impacted element is the function FileOperation.unzip of the file /networkD… |
CVE-2025-13815 | Medium | 6.3 | 2025-12-01 | A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the file /file/pictures. This manipulation… |
CVE-2025-61619 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61618 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61617 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61610 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61609 | High | 7.5 | 2025-12-01 | In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privilege… |
CVE-2025-61608 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61607 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-3012 | High | 7.5 | 2025-12-01 | In dpc modem, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-13814 | High | 7.3 | 2025-12-01 | A security flaw has been discovered in moxi159753 Mogu Blog v2 up to 5.2. Impacted is the function LocalFileServiceImpl.uploadPictureByUrl of the file /file/up… |
CVE-2025-11133 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-11132 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-11131 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-13813 | Medium | 5.6 | 2025-12-01 | A vulnerability was identified in moxi159753 Mogu Blog v2 up to 5.2. This issue affects some unknown processing of the file /storage/ of the component Storage… |
CVE-2025-13811 | Medium | 6.3 | 2025-12-01 | A vulnerability was determined in jsnjfz WebStack-Guns 1.0. This vulnerability affects unknown code of the file src/main/java/com/jsnjfz/manage/core/common/con… |
CVE-2025-13810 | Medium | 5.3 | 2025-12-01 | A vulnerability was found in jsnjfz WebStack-Guns 1.0. This affects the function renderPicture of the file src/main/java/com/jsnjfz/manage/modular/system/contr… |
CVE-2025-13809 | Medium | 6.3 | 2025-12-01 | A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown functionality of th… |
CVE-2025-13808 | High | 7.3 | 2025-12-01 | A flaw has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this vulnerability is the function update of the file o… |