2025 CVEs (page 96)
Page 96 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-63535 | Critical | 9.6 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php component. The application fails to properly sanitize usersuppl… |
CVE-2025-63534 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the login.php component. The application fails to properly san… |
CVE-2025-63533 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and rprofile.php components. The applica… |
CVE-2025-63532 | Critical | 9.6 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the cancel.php component. The application fails to properly sanitize user-s… |
CVE-2025-63095 | Medium | 6.5 | 2025-12-01 | Improper input validation in the BitstreamWriter::write_bits() function of Tempus Ex hello-video-codec v0.1.0 allows attackers to cause a Denial of Service (Do… |
CVE-2025-61229 | High | 7.8 | 2025-12-01 | An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script wit… |
CVE-2025-61228 | High | 7.8 | 2025-12-01 | An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism |
CVE-2025-57489 | High | 8.1 | 2025-12-01 | Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privileges to root due to the improper use of… |
CVE-2025-55222 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially… |
CVE-2025-55221 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially… |
CVE-2025-54851 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-54850 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-54849 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-54848 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-3500 | Critical | 9.0 | 2025-12-01 | Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981… |
CVE-2025-26858 | High | 8.6 | 2025-12-01 | A buffer overflow vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted set of network packets can lea… |
CVE-2025-23417 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can… |
CVE-2025-20085 | High | 7.2 | 2025-12-01 | A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can… |
CVE-2025-13829 | | 2025-12-01 | Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Cri… | |
CVE-2025-11699 | High | 7.1 | 2025-12-01 | nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a va… |
CVE-2025-10101 | High | 7.8 | 2025-12-01 | Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Mach-O file may allow Local Execution of Code or Denial-of-Service of… |
CVE-2025-64030 | Medium | 5.4 | 2025-12-01 | Eximbills Enterprise 4.1.5 (Built on 2020-10-30) is vulnerable to authenticated stored cross-site scripting (CWE-79) via the /EximBillWeb/servlets/WSTrxManager… |
CVE-2025-63531 | Critical | 10.0 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. The application fails to properly sanitize… |
CVE-2025-63529 | Medium | 6.1 | 2025-12-01 | A session fixation vulnerability exists in Blood Bank Management System 1.0 in login.php that allows an attacker to set or predict a user's session identifier… |
CVE-2025-63528 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the blooddinfo.php component. The application fails to properl… |
CVE-2025-63527 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and hprofile.php components. The applica… |
CVE-2025-63526 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System within the abs.php component. The application fails to properly sanitize… |
CVE-2025-63525 | Critical | 9.6 | 2025-12-01 | An issue was discovered in Blood Bank Management System 1.0 allowing authenticated attackers to perform actions with escalated privileges via crafted request t… |
CVE-2025-63523 | Medium | 6.5 | 2025-12-01 | FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can int… |
CVE-2025-63522 | Medium | 4.6 | 2025-12-01 | Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function |
CVE-2025-63520 | Medium | 6.1 | 2025-12-01 | Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate). |
CVE-2025-13129 | Medium | 4.3 | 2025-12-01 | Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylarım… |
CVE-2025-49643 | Medium | 6.5 | 2025-12-01 | An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore… |
CVE-2025-49642 | | 2025-12-01 | Library loading on AIX Zabbix Agent builds can be hijacked by local users with write access to the /home/cecuser directory. | |
CVE-2025-27232 | Medium | 4.9 | 2025-12-01 | An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss. |
CVE-2025-12106 | Critical | 9.1 | 2025-12-01 | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses |
CVE-2025-58408 | Medium | 5.9 | 2025-12-01 | Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and… |
CVE-2025-13296 | Medium | 5.4 | 2025-12-01 | Cross-Site Request Forgery (CSRF) vulnerability in Tekrom Technology Inc. T-Soft E-Commerce allows Cross Site Request Forgery. This issue affects T-Soft E-Com… |
CVE-2025-8045 | Medium | 4.0 | 2025-12-01 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
CVE-2025-6349 | Medium | 5.1 | 2025-12-01 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
CVE-2025-59789 | High | 7.5 | 2025-12-01 | Uncontrolled recursion in the json2pb component in Apache bRPC (version < 1.15.0) on all platforms allows remote attackers to make the server crash via sending… |
CVE-2025-41070 | | 2025-12-01 | Reflected Cross-site Scripting (XSS) vulnerability in Sanoma's Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim's brows… | |
CVE-2025-2879 | Medium | 5.1 | 2025-12-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driv… |
CVE-2025-41739 | Medium | 5.9 | 2025-12-01 | An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux… |
CVE-2025-41738 | High | 7.5 | 2025-12-01 | An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type… |
CVE-2025-41700 | High | 7.8 | 2025-12-01 | An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS deve… |
CVE-2025-13819 | Medium | 6.1 | 2025-12-01 | Open redirect in the web server component of MiR Robot and Fleet software allows a remote attacker to redirect users to arbitrary external websites via a craft… |
CVE-2025-13816 | Medium | 6.3 | 2025-12-01 | A security vulnerability has been detected in moxi159753 Mogu Blog v2 up to 5.2. The impacted element is the function FileOperation.unzip of the file /networkD… |
CVE-2025-13815 | Medium | 6.3 | 2025-12-01 | A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the file /file/pictures. This manipulation… |
CVE-2025-61619 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61618 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61617 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61610 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61609 | High | 7.5 | 2025-12-01 | In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privilege… |
CVE-2025-61608 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61607 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-3012 | High | 7.5 | 2025-12-01 | In dpc modem, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-13814 | High | 7.3 | 2025-12-01 | A security flaw has been discovered in moxi159753 Mogu Blog v2 up to 5.2. Impacted is the function LocalFileServiceImpl.uploadPictureByUrl of the file /file/up… |
CVE-2025-11133 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-11132 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-11131 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-13813 | Medium | 5.6 | 2025-12-01 | A vulnerability was identified in moxi159753 Mogu Blog v2 up to 5.2. This issue affects some unknown processing of the file /storage/ of the component Storage… |
CVE-2025-13811 | Medium | 6.3 | 2025-12-01 | A vulnerability was determined in jsnjfz WebStack-Guns 1.0. This vulnerability affects unknown code of the file src/main/java/com/jsnjfz/manage/core/common/con… |
CVE-2025-13810 | Medium | 5.3 | 2025-12-01 | A vulnerability was found in jsnjfz WebStack-Guns 1.0. This affects the function renderPicture of the file src/main/java/com/jsnjfz/manage/modular/system/contr… |
CVE-2025-13809 | Medium | 6.3 | 2025-12-01 | A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown functionality of th… |
CVE-2025-13808 | High | 7.3 | 2025-12-01 | A flaw has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this vulnerability is the function update of the file o… |
CVE-2025-13807 | Medium | 4.3 | 2025-12-01 | A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyController of the file or… |
CVE-2025-13806 | High | 7.3 | 2025-12-01 | A security vulnerability has been detected in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This impacts an unknown function of the file nutzboot-demo/nutzboot-demo-si… |
CVE-2025-13805 | Low | 3.7 | 2025-12-01 | A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/ma… |
CVE-2025-13804 | Medium | 4.3 | 2025-12-01 | A security flaw has been discovered in nutzam NutzBoot up to 2.6.0-SNAPSHOT. The impacted element is an unknown function of the file nutzboot-demo/nutzboot-dem… |
CVE-2025-13803 | High | 7.3 | 2025-12-01 | A vulnerability was identified in MediaCrush 1.0.0/1.0.1. The affected element is an unknown function of the file /mediacrush/paths.py of the component Header… |
CVE-2025-13802 | Medium | 4.3 | 2025-12-01 | A vulnerability was determined in jairiidriss RestaurantWebsite up to e7911f12d035e8e2f9a75e7a28b59e4ef5c1d654. Impacted is an unknown function of the componen… |
CVE-2025-13800 | Medium | 6.3 | 2025-12-01 | A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cgi. The manipulation… |
CVE-2025-64772 | High | 7.8 | 2025-12-01 | The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a… |
CVE-2025-13799 | Medium | 6.3 | 2025-12-01 | A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /send_order.cgi. The ma… |
CVE-2025-13798 | Medium | 6.3 | 2025-12-01 | A flaw has been found in ADSLR NBR1005GPEV2 250814-r037c. This affects the function ap_macfilter_add of the file /send_order.cgi. Executing manipulation of the… |
CVE-2025-13797 | Medium | 6.3 | 2025-12-01 | A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdel_swifimac of the file /send_order.cgi. Perform… |
CVE-2025-13796 | Medium | 6.3 | 2025-12-01 | A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/lo… |
CVE-2025-13795 | Low | 2.4 | 2025-11-30 | A weakness has been identified in codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01. Affected is an unknown function of t… |
CVE-2025-35028 | Critical | 9.1 | 2025-11-30 | By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP serve… |
CVE-2025-13793 | Medium | 4.3 | 2025-11-30 | A weakness has been identified in winston-dsouza Ecommerce-Website up to 87734c043269baac0b4cfe9664784462138b1b2e. Affected by this issue is some unknown funct… |
CVE-2025-13792 | High | 7.3 | 2025-11-30 | A security flaw has been discovered in Qualitor up to 8.20.104/8.24.97. Affected by this vulnerability is the function eval of the file /html/st/stdeslocamento… |
CVE-2025-13791 | Medium | 6.3 | 2025-11-30 | A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager… |
CVE-2025-13790 | Medium | 4.3 | 2025-11-30 | A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack ma… |
CVE-2025-13789 | Medium | 6.3 | 2025-11-30 | A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument… |
CVE-2025-13788 | High | 7.3 | 2025-11-30 | A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipula… |
CVE-2025-13787 | Medium | 5.4 | 2025-11-30 | A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File… |
CVE-2025-13786 | High | 7.3 | 2025-11-30 | A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /index.php. Performing… |
CVE-2025-13785 | Medium | 4.3 | 2025-11-30 | A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of the file /user… |
CVE-2025-13784 | Low | 2.4 | 2025-11-30 | A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboard/schools/1… |
CVE-2025-13783 | Medium | 6.3 | 2025-11-30 | A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file… |
CVE-2025-66433 | Medium | 4.2 | 2025-11-30 | HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on the local machine by submitting a batch job. This is fixed in 24… |
CVE-2025-66432 | Medium | 5.0 | 2025-11-30 | In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date. |
CVE-2025-13782 | High | 7.3 | 2025-11-30 | A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Affected by this issue is the function delete of the file applic… |
CVE-2025-66424 | Medium | 6.5 | 2025-11-30 | Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70. |
CVE-2025-66423 | High | 7.1 | 2025-11-30 | Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70. |
CVE-2025-66422 | Medium | 4.3 | 2025-11-30 | Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6… |
CVE-2025-66421 | Medium | 5.4 | 2025-11-30 | Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69. |
CVE-2025-66420 | Medium | 5.4 | 2025-11-30 | Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67. |
CVE-2025-13615 | Critical | 9.8 | 2025-11-30 | The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78. This is due to the plugin prov… |