2025 CVEs (page 95)
Page 95 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13807 | Medium | 4.3 | 2025-12-01 | A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyController of the file or… |
CVE-2025-13806 | High | 7.3 | 2025-12-01 | A security vulnerability has been detected in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This impacts an unknown function of the file nutzboot-demo/nutzboot-demo-si… |
CVE-2025-13805 | Low | 3.7 | 2025-12-01 | A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/ma… |
CVE-2025-13804 | Medium | 4.3 | 2025-12-01 | A security flaw has been discovered in nutzam NutzBoot up to 2.6.0-SNAPSHOT. The impacted element is an unknown function of the file nutzboot-demo/nutzboot-dem… |
CVE-2025-13803 | High | 7.3 | 2025-12-01 | A vulnerability was identified in MediaCrush 1.0.0/1.0.1. The affected element is an unknown function of the file /mediacrush/paths.py of the component Header… |
CVE-2025-13802 | Medium | 4.3 | 2025-12-01 | A vulnerability was determined in jairiidriss RestaurantWebsite up to e7911f12d035e8e2f9a75e7a28b59e4ef5c1d654. Impacted is an unknown function of the componen… |
CVE-2025-13800 | Medium | 6.3 | 2025-12-01 | A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cgi. The manipulation… |
CVE-2025-64772 | High | 7.8 | 2025-12-01 | The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a… |
CVE-2025-13799 | Medium | 6.3 | 2025-12-01 | A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /send_order.cgi. The ma… |
CVE-2025-13798 | Medium | 6.3 | 2025-12-01 | A flaw has been found in ADSLR NBR1005GPEV2 250814-r037c. This affects the function ap_macfilter_add of the file /send_order.cgi. Executing manipulation of the… |
CVE-2025-13797 | Medium | 6.3 | 2025-12-01 | A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdel_swifimac of the file /send_order.cgi. Perform… |
CVE-2025-13796 | Medium | 6.3 | 2025-12-01 | A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/lo… |
CVE-2025-13795 | Low | 2.4 | 2025-11-30 | A weakness has been identified in codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01. Affected is an unknown function of t… |
CVE-2025-35028 | Critical | 9.1 | 2025-11-30 | By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP serve… |
CVE-2025-13793 | Medium | 4.3 | 2025-11-30 | A weakness has been identified in winston-dsouza Ecommerce-Website up to 87734c043269baac0b4cfe9664784462138b1b2e. Affected by this issue is some unknown funct… |
CVE-2025-13792 | High | 7.3 | 2025-11-30 | A security flaw has been discovered in Qualitor up to 8.20.104/8.24.97. Affected by this vulnerability is the function eval of the file /html/st/stdeslocamento… |
CVE-2025-13791 | Medium | 6.3 | 2025-11-30 | A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager… |
CVE-2025-13790 | Medium | 4.3 | 2025-11-30 | A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack ma… |
CVE-2025-13789 | Medium | 6.3 | 2025-11-30 | A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument… |
CVE-2025-13788 | High | 7.3 | 2025-11-30 | A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipula… |
CVE-2025-13787 | Medium | 5.4 | 2025-11-30 | A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File… |
CVE-2025-13786 | High | 7.3 | 2025-11-30 | A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /index.php. Performing… |
CVE-2025-13785 | Medium | 4.3 | 2025-11-30 | A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of the file /user… |
CVE-2025-13784 | Low | 2.4 | 2025-11-30 | A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboard/schools/1… |
CVE-2025-13783 | Medium | 6.3 | 2025-11-30 | A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file… |
CVE-2025-66433 | Medium | 4.2 | 2025-11-30 | HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on the local machine by submitting a batch job. This is fixed in 24… |
CVE-2025-66432 | Medium | 5.0 | 2025-11-30 | In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date. |
CVE-2025-13782 | High | 7.3 | 2025-11-30 | A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Affected by this issue is the function delete of the file applic… |
CVE-2025-66424 | Medium | 6.5 | 2025-11-30 | Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70. |
CVE-2025-66423 | High | 7.1 | 2025-11-30 | Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70. |
CVE-2025-66422 | Medium | 4.3 | 2025-11-30 | Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6… |
CVE-2025-66421 | Medium | 5.4 | 2025-11-30 | Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69. |
CVE-2025-66420 | Medium | 5.4 | 2025-11-30 | Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67. |
CVE-2025-13615 | Critical | 9.8 | 2025-11-30 | The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78. This is due to the plugin prov… |
CVE-2025-6666 | Low | 2.0 | 2025-11-29 | A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. Affected by this vulnerability is an unknown functionality of the component… |
CVE-2025-66291 | Medium | 4.3 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in the Recruitment mo… |
CVE-2025-66290 | Medium | 4.3 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s recruitment attachment retrieval endpoint does… |
CVE-2025-66289 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user… |
CVE-2025-66225 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username su… |
CVE-2025-66224 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail… |
CVE-2025-65892 | Medium | 6.1 | 2025-11-29 | Reflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the victim's… |
CVE-2025-65540 | Medium | 6.1 | 2025-11-29 | Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and… |
CVE-2025-66223 | | 2025-11-29 | OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even afte… | |
CVE-2025-66221 | Medium | 5.3 | 2025-11-29 | Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names… |
CVE-2025-66217 | High | 7.5 | 2025-11-29 | AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of AIS-catcher. This v… |
CVE-2025-66216 | Critical | 9.8 | 2025-11-29 | AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Message class of AIS-… |
CVE-2025-61915 | Medium | 6.0 | 2025-11-29 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can u… |
CVE-2025-58436 | Medium | 5.1 | 2025-11-29 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd b… |
CVE-2025-53939 | Medium | 6.3 | 2025-11-29 | Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly… |
CVE-2025-53900 | Medium | 6.5 | 2025-11-29 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on… |
CVE-2025-53899 | High | 7.2 | 2025-11-29 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified… |
CVE-2025-53897 | Medium | 6.8 | 2025-11-29 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to lo… |
CVE-2025-53896 | High | 7.1 | 2025-11-29 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a us… |
CVE-2025-66219 | Critical | 9.8 | 2025-11-29 | willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitme… |
CVE-2025-66201 | High | 8.1 | 2025-11-29 | LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (SSRF), by passing sp… |
CVE-2025-66036 | Medium | 6.1 | 2025-11-29 | Retro is an online platform providing items of vintage collections. Prior to version 2.4.7, Retro is vulnerable to a cross-site scripting (XSS) in the input ha… |
CVE-2025-66034 | Medium | 6.3 | 2025-11-29 | fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLi… |
CVE-2025-66027 | Medium | 6.5 | 2025-11-29 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, includ… |
CVE-2025-65113 | Medium | 6.5 | 2025-11-29 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorization bypass vulnerability in the AJAX flagging system allows… |
CVE-2025-65112 | Critical | 9.4 | 2025-11-29 | PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to uplo… |
CVE-2025-64715 | Medium | 4.0 | 2025-11-29 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys… |
CVE-2025-13683 | Medium | 6.5 | 2025-11-28 | Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8… |
CVE-2025-12183 | | 2025-11-28 | Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted… | |
CVE-2025-59792 | Medium | 5.3 | 2025-11-28 | Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.13.0. Users are… |
CVE-2025-59790 | Medium | 5.4 | 2025-11-28 | Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v2.13.0. Users are recommended to upgra… |
CVE-2025-51736 | Medium | 6.3 | 2025-11-28 | File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
CVE-2025-51735 | High | 7.5 | 2025-11-28 | CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
CVE-2025-51734 | Medium | 5.4 | 2025-11-28 | Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
CVE-2025-51733 | Medium | 5.5 | 2025-11-28 | Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
CVE-2025-12638 | High | 8.0 | 2025-11-28 | Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arise… |
CVE-2025-11156 | | 2025-11-28 | Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, a local, authenticated user wi… | |
CVE-2025-12143 | Medium | 6.1 | 2025-11-28 | Stack-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33. |
CVE-2025-13771 | Medium | 6.5 | 2025-11-28 | WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arb… |
CVE-2025-13770 | Medium | 6.5 | 2025-11-28 | WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2025-13769 | Medium | 6.5 | 2025-11-28 | WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2025-13768 | High | 7.5 | 2025-11-28 | WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log into the system as any user by modifying… |
CVE-2025-66386 | Medium | 4.1 | 2025-11-28 | app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin. |
CVE-2025-66385 | | 2025-11-28 | UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as adm… | |
CVE-2025-66384 | High | 8.2 | 2025-11-28 | app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name. |
CVE-2025-66382 | Low | 2.9 | 2025-11-28 | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. |
CVE-2025-66372 | Low | 2.8 | 2025-11-28 | Mustang before 2.16.3 allows exfiltrating files via XXE attacks. |
CVE-2025-66371 | Medium | 5.0 | 2025-11-28 | Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the file… |
CVE-2025-66370 | Medium | 5.0 | 2025-11-28 | Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the ser… |
CVE-2025-64312 | Medium | 4.9 | 2025-11-28 | Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58311 | Medium | 5.8 | 2025-11-28 | UAF vulnerability in the USB driver module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2025-58308 | High | 7.3 | 2025-11-28 | Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerability may cause features to perform abno… |
CVE-2025-58305 | Medium | 6.2 | 2025-11-28 | Identity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58304 | Medium | 4.9 | 2025-11-28 | Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58302 | High | 8.4 | 2025-11-28 | Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-13737 | Medium | 4.3 | 2025-11-28 | The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is du… |
CVE-2025-64315 | Medium | 4.4 | 2025-11-28 | Configuration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect app data confidentiality and… |
CVE-2025-64314 | Critical | 9.3 | 2025-11-28 | Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2025-64313 | Medium | 5.3 | 2025-11-28 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-64311 | Medium | 5.1 | 2025-11-28 | Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58316 | High | 7.3 | 2025-11-28 | DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58315 | Medium | 5.5 | 2025-11-28 | Permission control vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58314 | Medium | 6.6 | 2025-11-28 | Vulnerability of accessing invalid memory in the component driver module. Impact: Successful exploitation of this vulnerability will affect availability and co… |
CVE-2025-58312 | Medium | 5.1 | 2025-11-28 | Permission control vulnerability in the App Lock module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58310 | High | 8.0 | 2025-11-28 | Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58309 | Medium | 6.8 | 2025-11-28 | Permission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability will affect availability and confidentia… |