2025 CVEs (page 99)
Page 99 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-63958 | Critical | 9.8 | 2025-11-24 | MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authentication. This pa… |
CVE-2025-63953 | Medium | 6.5 | 2025-11-24 | A Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts vi… |
CVE-2025-63952 | Medium | 5.7 | 2025-11-24 | A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts vi… |
CVE-2025-63435 | Medium | 4.3 | 2025-11-24 | Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update pa… |
CVE-2025-63434 | High | 8.8 | 2025-11-24 | The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages conta… |
CVE-2025-63433 | Medium | 4.6 | 2025-11-24 | Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a stat… |
CVE-2025-63432 | Medium | 4.6 | 2025-11-24 | Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certifi… |
CVE-2025-60917 | Medium | 4.6 | 2025-11-24 | A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows at… |
CVE-2025-60916 | Medium | 5.4 | 2025-11-24 | A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows at… |
CVE-2025-60915 | High | 8.1 | 2025-11-24 | An issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute a path traversa… |
CVE-2025-60914 | Medium | 4.6 | 2025-11-24 | Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensitive information via sending a crafted G… |
CVE-2025-60638 | High | 7.5 | 2025-11-24 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability… |
CVE-2025-60633 | Medium | 6.5 | 2025-11-24 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API. |
CVE-2025-60632 | Medium | 6.5 | 2025-11-24 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl AP… |
CVE-2025-56423 | Medium | 5.3 | 2025-11-24 | An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via… |
CVE-2025-56401 | High | 7.6 | 2025-11-24 | ZIRA Group WBRM 7.0 is vulnerable to SQL Injection in referenceLookupsByTableNameAndColumnName. |
CVE-2025-44018 | High | 8.3 | 2025-11-24 | A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware dow… |
CVE-2025-40213 | High | 7.8 | 2025-11-24 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete There is a BUG: KASAN… |
CVE-2025-10555 | High | 8.7 | 2025-11-24 | A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows a… |
CVE-2025-10554 | High | 8.7 | 2025-11-24 | A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENC… |
CVE-2025-12978 | Medium | 5.4 | 2025-11-24 | Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matchin… |
CVE-2025-12977 | Critical | 9.1 | 2025-11-24 | Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write reco… |
CVE-2025-12972 | Medium | 5.3 | 2025-11-24 | Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted ta… |
CVE-2025-12970 | High | 8.8 | 2025-11-24 | The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who… |
CVE-2025-12969 | Medium | 6.5 | 2025-11-24 | Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows re… |
CVE-2025-11921 | | 2025-11-24 | iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iSt… | |
CVE-2025-65998 | High | 7.5 | 2025-11-24 | Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When A… |
CVE-2025-65503 | Medium | 5.5 | 2025-11-24 | Use after free in endpoint destructors in Redboltz async_mqtt 10.2.5 allows local users to cause a denial of service via triggering SSL initialization failure… |
CVE-2025-65502 | Medium | 4.3 | 2025-11-24 | Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL… |
CVE-2025-65501 | Medium | 4.3 | 2025-11-24 | Null pointer dereference in coap_dtls_info_callback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS handshake where SSL… |
CVE-2025-65500 | Medium | 4.3 | 2025-11-24 | NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a… |
CVE-2025-65499 | Medium | 4.3 | 2025-11-24 | Array index error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS… |
CVE-2025-65498 | Medium | 4.3 | 2025-11-24 | NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a… |
CVE-2025-65497 | Medium | 4.3 | 2025-11-24 | NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a… |
CVE-2025-65496 | Medium | 4.3 | 2025-11-24 | NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a… |
CVE-2025-65495 | High | 7.5 | 2025-11-24 | Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a craft… |
CVE-2025-65494 | High | 7.5 | 2025-11-24 | NULL pointer dereference in get_san_or_cn_from_cert() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a cr… |
CVE-2025-65493 | High | 7.5 | 2025-11-24 | NULL pointer dereference in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS/TLS connection tha… |
CVE-2025-41017 | | 2025-11-24 | Inadequate access control vulnerability in Davantis DDFUSION v6.177.7, which allows unauthorised actors to retrieve perspective parameters from security camera… | |
CVE-2025-41016 | | 2025-11-24 | Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events thr… | |
CVE-2025-40212 | Critical | 9.8 | 2025-11-24 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" w… |
CVE-2025-12628 | Medium | 6.3 | 2025-11-24 | The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them |
CVE-2025-41729 | High | 7.5 | 2025-11-24 | An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service. |
CVE-2025-41087 | | 2025-11-24 | Cross-Site Scripting (XSS) vulnerability stored in tha Taclia web application, where the uploaded SVG images are not properly sanitized. This allows to the att… | |
CVE-2025-12741 | | 2025-11-24 | A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execute a malicious comma… | |
CVE-2025-12740 | | 2025-11-24 | A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious co… | |
CVE-2025-12739 | | 2025-11-24 | An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supplied script. Explo… | |
CVE-2025-13596 | | 2025-11-24 | A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When cer… | |
CVE-2025-13588 | Medium | 6.3 | 2025-11-24 | A vulnerability was found in lKinderBueno Streamity Xtream IPTV Player up to 2.8. The impacted element is an unknown function of the file public/proxy.php. Per… |
CVE-2025-13586 | Medium | 4.7 | 2025-11-24 | A flaw has been found in SourceCodester Online Student Clearance System 1.0. Impacted is an unknown function of the file /Admin/changepassword.php. This manipu… |
CVE-2025-13585 | High | 7.3 | 2025-11-24 | A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of… |
CVE-2025-12629 | High | 7.1 | 2025-11-24 | The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2025-12569 | Medium | 4.7 | 2025-11-24 | The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before redirecting the user to its value, lead… |
CVE-2025-12394 | Medium | 5.9 | 2025-11-24 | The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users… |
CVE-2025-7402 | High | 7.5 | 2025-11-24 | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘site_id’ parameter in… |
CVE-2025-13584 | Low | 3.5 | 2025-11-24 | A security vulnerability has been detected in Eigenfocus up to 1.4.0. This vulnerability affects unknown code of the component Description Handler. The manipul… |
CVE-2025-13583 | High | 7.3 | 2025-11-24 | A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST… |
CVE-2025-13589 | | 2025-11-24 | FMS developed by Otsuka Information Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitra… | |
CVE-2025-13582 | High | 7.3 | 2025-11-24 | A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the com… |
CVE-2025-13581 | Medium | 6.3 | 2025-11-24 | A vulnerability was identified in itsourcecode Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /schedule… |
CVE-2025-13580 | Medium | 6.3 | 2025-11-24 | A vulnerability was determined in code-projects Library System 1.0. Affected is an unknown function of the file /mail.php. This manipulation of the argument ID… |
CVE-2025-13579 | Medium | 6.3 | 2025-11-24 | A vulnerability was found in code-projects Library System 1.0. This impacts an unknown function of the file /return.php. The manipulation of the argument ID re… |
CVE-2025-13578 | High | 7.3 | 2025-11-24 | A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipul… |
CVE-2025-13577 | Low | 3.5 | 2025-11-24 | A flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php. Executing a… |
CVE-2025-13576 | Medium | 6.3 | 2025-11-24 | A vulnerability was detected in code-projects Blog Site 1.0. The affected element is an unknown function of the file /admin.php. Performing manipulation result… |
CVE-2025-13575 | Medium | 6.3 | 2025-11-24 | A security vulnerability has been detected in code-projects Blog Site 1.0. Impacted is the function category_exists of the file /resources/functions/blog.php o… |
CVE-2025-13574 | Medium | 4.7 | 2025-11-24 | A weakness has been identified in code-projects Online Bidding System 1.0. This issue affects the function categoryadd of the file /administrator/addcategory.p… |
CVE-2025-13573 | Medium | 6.3 | 2025-11-24 | A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. This vulnerability affects unknown code of the file /add_book.php… |
CVE-2025-13572 | High | 7.3 | 2025-11-23 | A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /delete_admin.php. The manipul… |
CVE-2025-12800 | Medium | 6.4 | 2025-11-23 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 vi… |
CVE-2025-13571 | Medium | 6.3 | 2025-11-23 | A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /listorder.ph… |
CVE-2025-13570 | Medium | 6.3 | 2025-11-23 | A vulnerability was found in itsourcecode COVID Tracking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/?page=state… |
CVE-2025-13569 | Medium | 6.3 | 2025-11-23 | A vulnerability has been found in itsourcecode COVID Tracking System 1.0. Affected is an unknown function of the file /admin/?page=city. Such manipulation of t… |
CVE-2025-13568 | Medium | 6.3 | 2025-11-23 | A flaw has been found in itsourcecode COVID Tracking System 1.0. This impacts an unknown function of the file /admin/?page=people. This manipulation of the arg… |
CVE-2025-13567 | Medium | 6.3 | 2025-11-23 | A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This affects an unknown function of the file /admin/?page=establishment. The manipulati… |
CVE-2025-13566 | Low | 3.3 | 2025-11-23 | A security vulnerability has been detected in jarun nnn up to 5.1. The impacted element is the function show_content_in_floating_window/run_cmd_as_plugin of th… |
CVE-2025-13565 | Medium | 5.3 | 2025-11-23 | A weakness has been identified in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the file /model/user/resetPass… |
CVE-2025-13564 | Medium | 5.4 | 2025-11-23 | A security flaw has been discovered in SourceCodester Pre-School Management System 1.0. Impacted is the function removefile of the file app/controllers/Filehel… |
CVE-2025-54515 | | 2025-11-23 | The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interface (PSCI) commands… | |
CVE-2025-13562 | High | 7.3 | 2025-11-23 | A vulnerability was identified in D-Link DIR-852 1.00. This issue affects some unknown processing of the file /gena.cgi. Such manipulation of the argument serv… |
CVE-2025-13561 | High | 7.3 | 2025-11-23 | A vulnerability was determined in SourceCodester Company Website CMS 1.0. This vulnerability affects unknown code of the file /admin/index.php. This manipulati… |
CVE-2025-48507 | | 2025-11-23 | The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memorie… | |
CVE-2025-13560 | High | 7.3 | 2025-11-23 | A vulnerability was found in SourceCodester Company Website CMS 1.0. This affects an unknown part of the file /admin/reset-password.php. The manipulation of th… |
CVE-2025-13557 | High | 7.3 | 2025-11-23 | A vulnerability has been found in Campcodes Online Polling System 1.0. Affected by this issue is some unknown functionality of the file /registeracc.php. The m… |
CVE-2025-13556 | High | 7.3 | 2025-11-23 | A flaw has been found in Campcodes Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/checklogin.php. Exe… |
CVE-2025-13555 | High | 7.3 | 2025-11-23 | A vulnerability was detected in Campcodes School File Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Per… |
CVE-2025-13554 | High | 7.3 | 2025-11-23 | A security vulnerability has been detected in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /index.php of the componen… |
CVE-2025-13553 | High | 8.8 | 2025-11-23 | A weakness has been identified in D-Link DWR-M920 1.1.50. This affects the function sub_41C7FC of the file /boafrm/formPinManageSetup. This manipulation of the… |
CVE-2025-13552 | High | 8.8 | 2025-11-23 | A security flaw has been discovered in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. The impacted element is an unknown function of the file /boafrm… |
CVE-2025-13551 | High | 8.8 | 2025-11-23 | A vulnerability was identified in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. The affected element is an unknown function of the file /boafrm/form… |
CVE-2025-13550 | High | 8.8 | 2025-11-23 | A vulnerability was determined in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. Impacted is an unknown function of the file /boafrm/formVpnConfigSet… |
CVE-2025-13549 | High | 8.8 | 2025-11-23 | A vulnerability was found in D-Link DIR-822K 1.00. This issue affects the function sub_455524 of the file /boafrm/formNtp. Performing manipulation of the argum… |
CVE-2025-13548 | High | 8.8 | 2025-11-23 | A vulnerability has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. This vulnerability affects unknown code of the file /boafrm/formFire… |
CVE-2025-13547 | High | 8.8 | 2025-11-23 | A flaw has been found in D-Link DIR-822K and DWR-M920 1.00_20250513164613/1.1.50. This affects an unknown part of the file /boafrm/formDdns. This manipulation… |
CVE-2025-13546 | Medium | 6.3 | 2025-11-23 | A vulnerability was detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this issue is some unknown functionality… |
CVE-2025-13545 | Medium | 4.7 | 2025-11-23 | A security vulnerability has been detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this vulnerability is an u… |
CVE-2025-13544 | Medium | 6.3 | 2025-11-23 | A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected is an unknown function of the file /custo… |
CVE-2025-13526 | High | 7.5 | 2025-11-22 | The OneClick Chat to Order plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.8 via the 'wa_order… |
CVE-2025-13318 | Medium | 5.3 | 2025-11-22 | The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to miss… |
CVE-2025-13136 | Medium | 4.3 | 2025-11-22 | The GSheetConnector For Ninja Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'njform-google-s… |