CVEs published October 27, 2025
315 CVEs were published on October 27, 2025: 10 critical, 73 high.
- Published
- 315
- Critical
- 10
- High
- 73
- Medium
- 226
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 58
Most affected products
- Tenda CH22
- 11
- code-projects Client Details System
- 6
- code-projects Online Event Judging System
- 6
- Liferay Portal · Liferay DXP +1
- 6
- Tenda O3
- 6
- TOTOLINK A3300R
- 6
- code-projects Simple Food Ordering System
- 5
- GitLab
- 5
- code-projects Nero Social Networking Site
- 4
- IBM DB2 High Performance Unload
- 4
Critical 10
- CVE-2025-12364Weak Password PolicyAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12363Email Password DisclosureAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-55754Apache Tomcat: console manipulation via escape sequences in log messagesApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2025-34292BeWelcome/Rox PHP Object Injection RCEBeWelcome Rox
- CVE-2025-41009SQL injection on the virtual campus platform of Diseño de Recursos EducativosDisenno de Recursos Educativos S.L virtual campus platform
- CVE-2025-62959WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Remote Code Execution (RCE) vulnerabilityvideowhisper Paid Videochat Turnkey Site
- CVE-2025-27224TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files.
- CVE-2025-60291An issue was discovered in eTimeTrackLite Web thru 12.0 (20250704).
- CVE-2025-61385SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Pythonpg8000
- CVE-2025-61481An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an o
High 73
- CVE-2025-62258CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through upLiferay Portal · Liferay DXP +1
- CVE-2025-62260Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and Liferay Portal · Liferay DXP +1
- CVE-2025-62725Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotationsdocker compose · github.com/docker/compose/v2 +1
- CVE-2025-12322Tenda CH22 NatStaticSetting fromNatStaticSetting buffer overflowTenda CH22
- CVE-2025-59151Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injectionpi-hole web
- CVE-2025-58356Constellation allows insecure use of LUKS2 persistent storage partitionsedgelesssys constellation · github.com/edgelesssys/const… +1
- CVE-2025-36007IBM QRadar SIEM incorrect privilege assignmentIBM QRadar SIEM
- CVE-2025-55752Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabledApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2025-12295D-Link DAP-2695 Firmware Update sub_40C6B8 signature verificationD-Link DAP-2695
- CVE-2025-34133Wimi Teamwork < v7.38.17 CSRFCloud Solutions SAS Wimi Teamwork
- CVE-2025-12286VeePN AVService avservice.exe unquoted search pathVeePN
- CVE-2025-9164Multiple DLL Search Order Hijacking Vulnerabilities in Docker Desktop Installer for WindowsDocker Desktop
- CVE-2025-41068Reachable Assertion vulnerability in Open5GSNewPlane Open5GS
- CVE-2025-41067Reachable Assertion vulnerability in Open5GSNewPlane Open5GS
- CVE-2025-12274Tenda CH22 P2pListFilter fromP2pListFilter buffer overflowTenda CH22
- CVE-2025-12273Tenda CH22 webExcptypemanFilter fromwebExcptypemanFilter buffer overflowTenda CH22
- CVE-2025-12272Tenda CH22 addressNat fromAddressNat buffer overflowTenda CH22
- CVE-2025-12271Tenda CH22 RouteStatic fromRouteStatic buffer overflowTenda CH22
- CVE-2025-11955Incorrect validation of OCSP certificates in TheGreenBow VPN Client Windows EnterpriseTheGreenBow VPN Client Windows Enterprise
- CVE-2025-12265Tenda CH22 VirtualSer fromVirtualSer buffer overflowTenda CH22
- CVE-2025-59461API does not require authenticationSICK AG TLOC100-100 all Firmware versions
- CVE-2025-59460Unsecure access configurationSICK AG TLOC100-100 with Firmware <7.1.1 · SICK AG TLOC100-…
- CVE-2025-8432CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRONCentreon Infra Monitoring
- CVE-2025-12260TOTOLINK A3300R POST Parameter cstecgi.cgi setSyslogCfg stack-based overflowTOTOLINK A3300R
- CVE-2025-12259TOTOLINK A3300R POST Parameter cstecgi.cgi setScheduleCfg stack-based overflowTOTOLINK A3300R
- CVE-2025-12258TOTOLINK A3300R POST Parameter cstecgi.cg setOpModeCfg stack-based overflowTOTOLINK A3300R
- CVE-2025-46582Private Key Disclosure Vulnerability in ZTE ZXMP M721 ProductZTE ZXMP M721
- CVE-2025-12247Hasleo Backup Suite HasleoImageMountService/HasleoBackupSuiteService unquoted search pathHasleo Backup Suite
- CVE-2025-11682Stored Cross-Site Scripting in Perx Customer Engagement & Loyalty PlatformPerx Technologies Customer Engagement & Loyalty Platform
- CVE-2025-12241TOTOLINK A3300R POST Parameter cstecgi.cgi setLanguageCfg stack-based overflowTOTOLINK A3300R
- CVE-2025-12055Unauthenticated Local File Disclosure in MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing Execution SystemMPDV Mikrolab MIP · MPDV Mikrolab FEDRA +1
- CVE-2025-12240TOTOLINK A3300R cstecgi.cgi setDmzCfg buffer overflowTOTOLINK A3300R
- CVE-2025-12239TOTOLINK A3300R cstecgi.cgi setDdnsCfg buffer overflowTOTOLINK A3300R
- CVE-2025-12236Tenda CH22 DhcpListClient fromDhcpListClient buffer overflowTenda CH22
- CVE-2025-12235Tenda CH22 SetIpBind fromSetIpBind buffer overflowTenda CH22
- CVE-2025-12234Tenda CH22 SafeMacFilter fromSafeMacFilter buffer overflowTenda CH22
- CVE-2025-12233Tenda CH22 SafeUrlFilter fromSafeUrlFilter buffer overflowTenda CH22
- CVE-2025-12232Tenda CH22 SafeClientFilter fromSafeClientFilter buffer overflowTenda CH22
- CVE-2025-12225Tenda AC6 HTTP Request WifiGuestSet stack-based overflowTenda AC6
- CVE-2025-12214Tenda O3 sysAutoReboot GetValue stack-based overflowTenda O3
- CVE-2025-12213Tenda O3 setVlanConfig GetValue stack-based overflowTenda O3
- CVE-2025-12212Tenda O3 setNetworkService GetValue stack-based overflowTenda O3
- CVE-2025-12211Tenda O3 setDmzInfo GetValue stack-based overflowTenda O3
- CVE-2025-12210Tenda O3 AdvSetLanip GetValue stack-based overflowTenda O3
- CVE-2025-12209Tenda O3 setDhcpConfig GetValue stack-based overflowTenda O3
- CVE-2025-62986WordPress FanBridge signup plugin <= 0.6 - Cross Site Request Forgery (CSRF) vulnerabilityFanBridge signup
- CVE-2025-62962WordPress CloudSearch plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityAndrea Landonio CloudSearch
- CVE-2025-62957WordPress NikanWP WooCommerce Reporting plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityNikanWP WooCommerce Reporting
- CVE-2025-62956WordPress Reloadly plugin <= 2.0.1 - Cross Site Request Forgery (CSRF) vulnerabilityiseremet Reloadly
- CVE-2025-62945WordPress Did Prestashop Display plugin <= 1.0.30 - Cross Site Request Forgery (CSRF) vulnerabilityEduard Pinuaga Linares Did Prestashop Display
- CVE-2025-62934WordPress WP Business Hours plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabilityMejar WP Business Hours
- CVE-2025-62933WordPress Awesome Testimonials plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityPrakash Awesome Testimonials
- CVE-2025-62896WordPress Multilang Contact Form plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerabilitydigitaldonkey Multilang Contact Form
- CVE-2025-62886WordPress Pricing Table builder plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerabilitywpdevart Pricing Table builder
- CVE-2025-10497Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-11447Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2023-49440AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter."
- CVE-2025-27222TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files.
- CVE-2025-27223TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPor
- CVE-2025-27225TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users.
- CVE-2025-52263An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to
- CVE-2025-52264StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a stack overflow via the cgiMain function at download.cgi.
- CVE-2025-52268StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid
- CVE-2025-54968An issue was discovered in BAE SOCET GXP before 4.6.0.2.
- CVE-2025-60424A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication v
- CVE-2025-60425Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enab
- CVE-2025-61099FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the opaque_info_detail function at ospf_opa
- CVE-2025-61100FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the ospf_opaque_lsa_dump function at ospf_o
- CVE-2025-61101FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_rmt_itf_addr function
- CVE-2025-61102FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_adj_sid function at o
- CVE-2025-61105FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_link_info function at ospf_ext
- CVE-2025-61247indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php.
- CVE-2025-61482Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root a
Medium, low and unrated 232
- CVE-2025-33133Fixes to common vulnerabilities found in IBM Db2 High Performance UnloadIBM DB2 High Performance Unload
- CVE-2025-33132Fixes to common vulnerabilities found in IBM Db2 High Performance UnloadIBM DB2 High Performance Unload
- CVE-2025-33131Fixes to common vulnerabilities found in IBM Db2 High Performance UnloadIBM DB2 High Performance Unload
- CVE-2025-33126Fixes to common vulnerabilities found in IBM Db2 High Performance UnloadIBM DB2 High Performance Unload
- CVE-2025-12335code-projects E-Commerce Website supplier_update.php cross site scriptingcode-projects E-Commerce Website
- CVE-2025-12332SourceCodester Student Grades Management System admin.php delete_user cross site scriptingSourceCodester Student Grades Management System
- CVE-2025-43024HP ThinPro 8.1 SP8 Security UpdatesHP ThinPro
- CVE-2025-12334code-projects E-Commerce Website product_add.php cross site scriptingcode-projects E-Commerce Website
- CVE-2025-12333code-projects E-Commerce Website supplier_add.php cross site scriptingcode-projects E-Commerce Website
- CVE-2025-62259Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 9Liferay Portal · Liferay DXP +1
- CVE-2025-12331Willow CMS add unrestricted uploadWillow CMS
- CVE-2025-12330Willow CMS Add Post add cross site scriptingWillow CMS
- CVE-2025-12329shawon100 RUET OJ details.php sql injectionshawon100 RUET OJ
- CVE-2025-12328shawon100 RUET OJ contestproblem.php sql injectionshawon100 RUET OJ
- CVE-2025-62793eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads to Credential Theft / Clickjackingelabftw
- CVE-2025-62781PILOS is missing session regeneration after password changeTHM-Health PILOS
- CVE-2025-62779Frappe Learning users were able to add HTML through input fields in the Job Formfrappe lms
- CVE-2025-62778Frappe Learning allowed students to access the Quiz Form via direct URLfrappe lms
- CVE-2025-62261Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92Liferay Portal · Liferay DXP +2
- CVE-2025-12327shawon100 RUET OJ description.php sql injectionshawon100 RUET OJ
- CVE-2025-12326shawon100 RUET OJ POST Request process.php sql injectionshawon100 RUET OJ
- CVE-2025-62784InventoryGui allows item duplication in GUIs which use GuiStorageElementPhoenix616 InventoryGui · de.themoep:inventorygui
- CVE-2025-62783InventoryGui affected by item duplication in GUIs which use GuiStorageElementPhoenix616 InventoryGui · de.themoep:inventorygui
- CVE-2025-62782InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElementPhoenix616 InventoryGui · de.themoep:inventorygui
- CVE-2025-62262Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported vLiferay Portal · Liferay DXP +1
- CVE-2025-12325SourceCodester Best Salon Management System forgot-password.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-12316code-projects Courier Management System edit-courier.php sql injectioncode-projects Courier Management System
- CVE-2025-62524PILOS Exposes PHP versionTHM-Health PILOS
- CVE-2025-62523PILOS Misconfigured the Access-Control-Allow-Origin HeaderTHM-Health PILOS
- CVE-2025-12315code-projects Food Ordering System menu.php sql injectioncode-projects Food Ordering System
- CVE-2025-12314code-projects Food Ordering System deleteitem.php sql injectioncode-projects Food Ordering System
- CVE-2025-12313D-Link DI-7001 MINI msp_info.htm command injectionD-Link DI-7001 MINI
- CVE-2025-62594ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)ImageMagick · Magick.NET-Q16-x64 +11
- CVE-2025-62263Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, Liferay Portal · Liferay DXP +1
- CVE-2025-12312PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross site scriptingPHPGurukul Curfew e-Pass Management System
- CVE-2025-12311PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross site scriptingPHPGurukul Curfew e-Pass Management System
- CVE-2025-12310VirtFusion Email Change _settings excessive authenticationVirtFusion
- CVE-2025-53533Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error pagepi-hole web
- CVE-2025-12309code-projects Nero Social Networking Site friendprofile.php sql injectioncode-projects Nero Social Networking Site
- CVE-2025-12308code-projects Nero Social Networking Site deletemessage.php sql injectioncode-projects Nero Social Networking Site
- CVE-2025-12307code-projects Nero Social Networking Site addfriend.php sql injectioncode-projects Nero Social Networking Site
- CVE-2025-62253Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXPLiferay Portal · Liferay DXP +1
- CVE-2025-36138IBM QRadar SIEM cross-site scriptingIBM QRadar SIEM
- CVE-2025-36170IBM QRadar SIEM cross-site scriptingIBM QRadar SIEM
- CVE-2025-32785Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field)pi-hole web
- CVE-2025-46602Dell SupportAssist OS Recovery, versions prior to 5.5.15.0, contain an Insertion of Sensitive Information into Externally-Accessible File orDell SupportAssist OS Recovery
- CVE-2025-12306code-projects Nero Social Networking Site acceptoffres.php sql injectioncode-projects Nero Social Networking Site
- CVE-2025-12305quequnlong shiyi-blog Job SysJobController.java deserializationquequnlong shiyi-blog
- CVE-2025-12304dulaiduwang003 TIME-SEA-PLUS Order Status PayController.java alipayIsSucceed improper authorizationdulaiduwang003 TIME-SEA-PLUS
- CVE-2025-12365Error Messages Wrapped In HTTP HeaderAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12303PHPGurukul Curfew e-Pass Management System admin-profile.php cross site scriptingPHPGurukul Curfew e-Pass Management System
- CVE-2025-12302code-projects Simple Food Ordering System editproduct.php cross site scriptingcode-projects Simple Food Ordering System
- CVE-2025-12301code-projects Simple Food Ordering System editproduct.php unrestricted uploadcode-projects Simple Food Ordering System
- CVE-2025-12300code-projects Simple Food Ordering System addcategory.php cross site scriptingcode-projects Simple Food Ordering System
- CVE-2025-61795Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoSApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2025-12299code-projects Simple Food Ordering System addproduct.php cross site scriptingcode-projects Simple Food Ordering System
- CVE-2025-12298code-projects Simple Food Ordering System editcategory.php cross site scriptingcode-projects Simple Food Ordering System
- CVE-2025-12297atjiu pybbs UserApiController.java information disclosureatjiu pybbs
- CVE-2025-12296D-Link DAP-2695 Firmware Update sub_4174B0 os command injectionD-Link DAP-2695
- CVE-2025-12294SourceCodester Point of Sales delete_category.php sql injectionSourceCodester Point of Sales
- CVE-2025-12293SourceCodester Point of Sales category.php sql injectionSourceCodester Point of Sales
- CVE-2025-12292SourceCodester Point of Sales index.php sql injectionSourceCodester Point of Sales
- CVE-2025-12291ashymuzuro Full-Ecommece-Website/Muzuro Ecommerce System Add Product index.php unrestricted uploadashymuzuro Full-Ecommece-Website · ashymuzuro Muzuro Ecomme…
- CVE-2025-10023A user with elevated privileges can inject XSS in the Services Meta-services configuration pageCentreon Infra Monitoring
- CVE-2025-12351Inadequate access control measure allows unauthorized users to access restricted administrative functionsHoneywell S35 3M/5M/8M/Pinhole/Kit Camera · Honeywell S3… +1
- CVE-2025-12290Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scriptingSui Shang Information Technology Suishang Enterprise-Level…
- CVE-2025-12289Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scriptingSui Shang Information Technology Suishang Enterprise-Level…
- CVE-2025-36121HTML Injection Vulnerability in a Specific URL Endpoint of the IBM OpenPages ApplicationIBM OpenPages
- CVE-2025-26862PingFederate unexpected browser flow initiation in redirectless modePing Identity PingFederate
- CVE-2025-12288Bdtask Pharmacy Management System User Profile edit_user authorizationBdtask Pharmacy Management System
- CVE-2025-12287Bdtask Wholesale Inventory Control and Inventory Management System edit_profile sql injectionBdtask Wholesale Inventory Control and Inventory Management…
- CVE-2025-12283code-projects Client Details System authorizationcode-projects Client Details System
- CVE-2025-50055Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows conOpenVPN Access Server
- CVE-2025-12282code-projects Client Details System manage-users.php cross site scriptingcode-projects Client Details System
- CVE-2025-12281code-projects Client Details System clientview.php cross site scriptingcode-projects Client Details System
- CVE-2025-12280code-projects Client Details System update-clients.php cross site scriptingcode-projects Client Details System
- CVE-2025-12279code-projects Client Details System welcome.php cross site scriptingcode-projects Client Details System
- CVE-2025-12277Abdullah-Hasan-Sajjad Online-School studentLogin.php sql injectionAbdullah-Hasan-Sajjad Online-School
- CVE-2025-12276LearnHouse Image information disclosureLearnHouse
- CVE-2025-11248Sensitive Information LoggedZohocorp ManageEngine Endpoint Central
- CVE-2025-41384Reflected Cross-Site Scripting (XSS) in SuiteCRMSuiteCRM
- CVE-2025-12270LearnHouse Student Assignment Submission sub_file resource injectionLearnHouse
- CVE-2025-12269LearnHouse Account Setting previews cross site scriptingLearnHouse
- CVE-2025-12268LearnHouse Course Thumbnail courses unrestricted uploadLearnHouse
- CVE-2025-12267abhicodebox ModernShop search cross site scriptingabhicodebox ModernShop
- CVE-2025-12266Zytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injectionZytec Dalian Zhuoyun Technology Central Authentication Serv…
- CVE-2025-12264Wisencode Create Support Ticket create cross site scriptingWisencode
- CVE-2025-12263code-projects Online Event Judging System edit_judge.php sql injectioncode-projects Online Event Judging System
- CVE-2025-12262code-projects Online Event Judging System edit_criteria.php sql injectioncode-projects Online Event Judging System
- CVE-2025-59463Denial-of-service (DoS) via chunk size mismatchSICK AG TLOC100-100 all Firmware versions
- CVE-2025-59462Denial-of-service (DoS) via delayed or missing client responseSICK AG TLOC100-100 all Firmware versions
- CVE-2025-59459Denial-of-service (DoS) via resource consumptionSICK AG TLOC100-100
- CVE-2025-12261CodeAstro Gym Management System remove-announcement.php sql injectionCodeAstro Gym Management System
- CVE-2025-12257SourceCodester Online Student Result System view_result.php sql injectionSourceCodester Online Student Result System
- CVE-2025-12256code-projects Online Event Judging System edit_contestant.php sql injectioncode-projects Online Event Judging System
- CVE-2025-46583DOS Vulnerability in ZTE MC889A Pro productZTE MC889A Pro
- CVE-2025-12255code-projects Online Event Judging System add_contestant.php sql injectioncode-projects Online Event Judging System
- CVE-2025-12254code-projects Online Event Judging System add_judge.php sql injectioncode-projects Online Event Judging System
- CVE-2025-12253AMTT Hotel Broadband Operation System get_expiredtime.php sql injectionAMTT Hotel Broadband Operation System
- CVE-2025-12080Intent Abuse in Google Messages for Wear OS for Silent Message SendingGoogle WearOS
- CVE-2025-12252code-projects Online Event Judging System action.php sql injectioncode-projects Online Event Judging System
- CVE-2025-12251OpenWGA Admin UI cross site scriptingOpenWGA
- CVE-2025-12250OpenWGA TMLScript API WGA.File path traversalOpenWGA
- CVE-2025-12249Axosoft Scrum and Bug Tracking Edit Ticket csv injectionAxosoft Scrum and Bug Tracking
- CVE-2025-12248CLTPHP search.html sql injectionCLTPHP
- CVE-2025-12246chatwoot Admin IframeLoader.vue cross site scriptingchatwoot
- CVE-2025-12245chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validationchatwoot
- CVE-2025-12244code-projects Simple E-Banking System register.php cross site scriptingcode-projects Simple E-Banking System
- CVE-2025-12243code-projects Client Details System GET Parameter welcome.php sql injectioncode-projects Client Details System
- CVE-2025-12242CodeAstro Gym Management System check-attendance.php sql injectionCodeAstro Gym Management System
- CVE-2025-12238code-projects Automated Voting System user.php sql injectioncode-projects Automated Voting System
- CVE-2025-12237projectworlds Advanced Library Management System index.php sql injectionprojectworlds Advanced Library Management System
- CVE-2025-12231projectworlds Expense Management System Expense Categories create cross site scriptingprojectworlds Expense Management System
- CVE-2025-12230projectworlds Expense Management System Currency create cross site scriptingprojectworlds Expense Management System
- CVE-2025-11154IDonate < 2.1.13 - Unauthenticated User DeletionIDonate
- CVE-2025-12229projectworlds Expense Management System Roles Page create cross site scriptingprojectworlds Expense Management System
- CVE-2025-12228projectworlds Expense Management System Users Page create cross site scriptingprojectworlds Expense Management System
- CVE-2025-12227projectworlds Gate Pass Management System add-pass.php cross site scriptingprojectworlds Gate Pass Management System
- CVE-2025-12226SourceCodester Best House Rental Management System admin_class.php save_house sql injectionSourceCodester Best House Rental Management System
- CVE-2025-12224Iqbolshoh php-business-website contact.php cross site scriptingIqbolshoh php-business-website
- CVE-2025-12223Bdtask Flight Booking Software Package Information package-information unrestricted uploadBdtask Flight Booking Software
- CVE-2025-12222Bdtask Flight Booking Software Deposit deposit unrestricted uploadBdtask Flight Booking Software
- CVE-2025-12215projectworlds Online Shopping System login_submit.php sql injectionprojectworlds Online Shopping System
- CVE-2025-12208SourceCodester Best House Rental Management System admin_class.php login2 sql injectionSourceCodester Best House Rental Management System
- CVE-2025-12207Kamailio Grammar Rule cfg.y yyerror_at null pointer dereferenceKamailio
- CVE-2025-12206Kamailio rvalue.c rve_is_constant null pointer dereferenceKamailio
- CVE-2025-12205Kamailio Configuration File cfg.lex sr_push_yy_state use after freeKamailio
- CVE-2025-48088WordPress Ultimate Addons for WPBakery Page Builder plugin < 3.21.1 - Cross Site Scripting (XSS) vulnerabilityBrainstorm_Force Ultimate Addons for WPBakery Page Builder
- CVE-2025-58918WordPress Entrada theme <= 5.7.7 - Cross Site Request Forgery (CSRF) vulnerabilityWaituk Entrada
- CVE-2025-12204Kamailio Configuration File rvalue.c rve_destroy heap-based overflowKamailio
- CVE-2025-12203givanz Vvveb Code Editor functions.php sanitizeFileName path traversalgivanz Vvveb
- CVE-2025-62988WordPress Slider Templates plugin <= 1.0.3 - Server Side Request Forgery (SSRF) vulnerabilityCodeless Slider Templates
- CVE-2025-62987WordPress Builderall Builder for WordPress plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerabilityBuilderall Builder for WordPress
- CVE-2025-62985WordPress Simple Pull Quote plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerabilityllamaman Simple Pull Quote
- CVE-2025-62984WordPress WP AdCenter plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerabilityWPeka WP AdCenter
- CVE-2025-62983WordPress Posts By Tag plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilitySudar Muthu Posts By Tag
- CVE-2025-62982WordPress Dynamic User Directory plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilitySarah Giles Dynamic User Directory
- CVE-2025-62981WordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.8 - Open Redirection vulnerabilityCRM Perks WP Gravity Forms Zoho CRM and Bigin
- CVE-2025-62980WordPress Persian Admnin Fonts plugin <= 4.1.03 - Broken Access Control vulnerabilityMDZ Persian Admnin Fonts
- CVE-2025-62979WordPress ACF to REST API plugin <= 3.3.4 - Sensitive Data Exposure vulnerabilityairesvsg ACF to REST API
- CVE-2025-62978WordPress KiotViet Sync plugin <= 1.8.5 - Broken Access Control vulnerabilityKiotViet Sync
- CVE-2025-62977WordPress 百度站长SEO合集(支持百度/神马/Bing/头条推送) plugin <= 2.1.4 - Broken Access Control vulnerability沃之涛 百度站长SEO合集
- CVE-2025-62976WordPress Sendle Shipping plugin <= 6.02 - Broken Access Control vulnerabilityJoovii Sendle Shipping
- CVE-2025-62975WordPress Raychat plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityRaychat
- CVE-2025-62974WordPress Headline Analyzer plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityCoSchedule Headline Analyzer
- CVE-2025-62973WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerabilityThemekraft BuddyForms
- CVE-2025-62972WordPress WebinarPress plugin <= 1.33.28 - Broken Access Control vulnerabilityWPWebinarSystem WebinarPress
- CVE-2025-62971WordPress Attesa Extra plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerabilityCrestaProject Attesa Extra
- CVE-2025-62970WordPress Link Whisper Free plugin <= 0.9.2 - Broken Access Control vulnerabilitySpencer Haws Link Whisper Free
- CVE-2025-62969WordPress NextMove Lite plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerabilityXLPlugins NextMove Lite
- CVE-2025-62968WordPress WP Last Modified Info plugin <= 1.9.2 - Cross Site Scripting (XSS) vulnerabilitySayan Datta WP Last Modified Info
- CVE-2025-62967WordPress DirectoryPress plugin <= 3.6.25 - Cross Site Scripting (XSS) vulnerabilityDesigninvento DirectoryPress
- CVE-2025-62966WordPress GoCache plugin <= 1.3.6 - Broken Access Control vulnerabilityApiki GoCache
- CVE-2025-62965WordPress Admin Management Xtended plugin <= 2.5.1 - Broken Access Control vulnerabilitywpseek Admin Management Xtended
- CVE-2025-62964WordPress MDTF plugin <= 1.3.6 - Broken Access Control vulnerabilityRealMag777 MDTF
- CVE-2025-62963WordPress Estatik plugin <= 4.3.1 - Cross Site Scripting (XSS) vulnerabilityEstatik
- CVE-2025-62958WordPress Simple Content Templates for Blog Posts & Pages plugin <= 2.2.61 - Cross Site Request Forgery (CSRF) vulnerabilityClifton Griffin Simple Content Templates for Blog Posts & P…
- CVE-2025-62954WordPress Revive Old Posts plugin <= 9.3.3 - Broken Access Control vulnerabilityrsocial Revive Old Posts
- CVE-2025-62953WordPress Welcart e-Commerce plugin <= 2.11.24 - Broken Access Control vulnerabilityinfo@welcart Welcart e-Commerce
- CVE-2025-62952WordPress ChatBot plugin <= 7.7.3 - Broken Access Control vulnerabilityQuantumCloud ChatBot
- CVE-2025-62951WordPress H5P plugin <= 1.16.0 - Cross Site Scripting (XSS) vulnerabilityicc0rz H5P
- CVE-2025-62949WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityBuddyDev Activity Plus Reloaded for BuddyPress
- CVE-2025-62948WordPress Date counter plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityKonstantin Pankratov Date counter
- CVE-2025-62947WordPress Publitio plugin <= 2.2.5 - Sensitive Data Exposure vulnerabilityPublitio
- CVE-2025-62946WordPress Everest Backup plugin <= 2.3.8 - Broken Access Control vulnerabilityeverestthemes Everest Backup
- CVE-2025-62944WordPress MSTW CSV EXPORTER plugin <= 1.4 - Broken Access Control vulnerabilityMark O'Donnell MSTW CSV EXPORTER
- CVE-2025-62943WordPress Next Page, Not Next Post plugin <= 0.3.0 - Cross Site Scripting (XSS) vulnerabilityMatt McInvale Next Page, Not Next Post
- CVE-2025-62942WordPress WP Mapbox GL JS Maps plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerabilitytempranova WP Mapbox GL JS Maps
- CVE-2025-62941WordPress Events Maker by dFactory plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerabilityEvents Maker by dFactory
- CVE-2025-62940WordPress Blox Lite plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerabilityNick Diego Blox Lite
- CVE-2025-62939WordPress Open Currency Converter plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityJoe Open Currency Converter
- CVE-2025-62938WordPress Reoon Email Verifier plugin <= 2.0.1 - Broken Access Control vulnerabilityReoon Technology Reoon Email Verifier
- CVE-2025-62937WordPress Post List Featured Image plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerabilityJohnny Post List Featured Image
- CVE-2025-62936WordPress xSmart theme <= 1.2.9.4 - Content Injection vulnerabilityJthemes xSmart
- CVE-2025-62935WordPress Open Close WooCommerce Store plugin <= 5.0.0 - Broken Access Control vulnerabilityStackWC Open Close WooCommerce Store
- CVE-2025-62932WordPress Table Block by RioVizual plugin <= 3.0.0 - Broken Access Control vulnerabilitywprio Table Block by RioVizual
- CVE-2025-62931WordPress MSN Partner Hub plugin <= 2.9 - Broken Access Control vulnerabilitymicrosoftstart MSN Partner Hub
- CVE-2025-62930WordPress MapSVG plugin <= 8.7.22 - Cross Site Scripting (XSS) vulnerabilityRomanCode MapSVG
- CVE-2025-62929WordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerabilityPickPlugins Testimonial Slider
- CVE-2025-62928WordPress SEO Meta Description Updater plugin <= 1.2.0 - Broken Access Control vulnerabilityJoby Joseph SEO Meta Description Updater
- CVE-2025-62927WordPress Nelio Content plugin <= 4.0.5 - Broken Access Control vulnerabilityNelio Software Nelio Content
- CVE-2025-62925WordPress Conversios.io plugin <= 7.2.13 - Broken Access Control vulnerabilityConversios.io
- CVE-2025-62924WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerabilityPickPlugins Post Grid and Gutenberg Blocks
- CVE-2025-62923WordPress Marquee Addons for Elementor plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerabilityDebuggers Studio Marquee Addons for Elementor
- CVE-2025-62922WordPress Export Categories plugin <= 1.0 - Broken Access Control vulnerabilityShambhu Patnaik Export Categories
- CVE-2025-62921WordPress Bulk Auto Image Title Attribute plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityPagup Bulk Auto Image Title Attribute
- CVE-2025-62920WordPress USERCENTRICS CMP plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerabilitywebnique USERCENTRICS CMP
- CVE-2025-62919WordPress TS Demo Importer plugin <= 0.1.3 - Broken Access Control vulnerabilitythemeshopy TS Demo Importer
- CVE-2025-62918WordPress IgnitionDeck plugin <= 2.0.15 - Broken Access Control vulnerabilityignitionwp IgnitionDeck
- CVE-2025-62917WordPress Tooltipy plugin <= 5.5.9 - Cross Site Scripting (XSS) vulnerabilityJamel.Z Tooltipy
- CVE-2025-62916WordPress Flights & Hotels Booking WP Plugin plugin <= 3.1 - Broken Access Control vulnerabilityTravon WP Flights & Hotels Booking WP Plugin
- CVE-2025-62915WordPress SMS Contact Form 7 Notifications by ClickSend plugin <= 1.4.0 - Broken Access Control vulnerabilitySMS Contact Form 7 Notifications by ClickSend
- CVE-2025-62913WordPress Opal Service plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilitywpopal Opal Service
- CVE-2025-62912WordPress SiteGround Email Marketing plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerabilitySiteGround Email Marketing
- CVE-2025-62911WordPress Rock Convert plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerabilityRock Content Rock Convert
- CVE-2025-62910WordPress Video Gallery by Huzzaz plugin <= 10.5 - Cross Site Scripting (XSS) vulnerabilitydeshine Video Gallery by Huzzaz
- CVE-2025-62909WordPress Smart WeTransfer plugin <= 1.3 - Broken Access Control vulnerabilitymrityunjay Smart WeTransfer
- CVE-2025-62907WordPress Custom Post Type Attachment plugin <= 3.4.6 - Cross Site Scripting (XSS) vulnerabilityaviplugins.com Custom Post Type Attachment
- CVE-2025-62906WordPress Referral Link Tracker plugin <= 1.1.4 - Broken Access Control vulnerabilityepiphanyit321 Referral Link Tracker
- CVE-2025-62905WordPress Query Posts plugin <= 0.3.2 - Cross Site Scripting (XSS) vulnerabilityJustin Tadlock Query Posts
- CVE-2025-62904WordPress WP Geo plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerabilityBen Huson WP Geo
- CVE-2025-62903WordPress WPC Smart Messages for WooCommerce plugin <= 4.2.8 - Cross Site Scripting (XSS) vulnerabilityWPClever WPC Smart Messages for WooCommerce
- CVE-2025-62902WordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerabilityThemeHunk WP Popup Builder
- CVE-2025-62900WordPress Popular Posts by Webline plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityWeblineIndia Popular Posts by Webline
- CVE-2025-62899WordPress Photospace Responsive plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityTHRIVE - Web Design Gold Coast Photospace Responsive
- CVE-2025-62898WordPress Links shortcode plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerabilityMaarten Links shortcode
- CVE-2025-62897WordPress WP Recipe Maker plugin < 10.1.0 - Content Injection vulnerabilityBrecht WP Recipe Maker
- CVE-2025-62895WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerabilityVito Peleg Atarim
- CVE-2025-62894WordPress ACF Recent Posts Widget plugin <= 5.9.3 - Cross Site Scripting (XSS) vulnerabilitymagicoders ACF Recent Posts Widget
- CVE-2025-62892WordPress Sunshine Photo Cart plugin <= 3.5.3 - Broken Access Control vulnerabilitysunshinephotocart Sunshine Photo Cart
- CVE-2025-62891WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.5 - Cross Site Request Forgery (CSRF) vulnerabilityJory Hogeveen Off-Canvas Sidebars & Menus
- CVE-2025-62890WordPress Premmerce Brands for WooCommerce plugin <= 1.2.13 - Cross Site Request Forgery (CSRF) vulnerabilityPremmerce Brands for WooCommerce
- CVE-2025-62889WordPress King Addons for Elementor plugin <= 51.1.61 - Broken Access Control vulnerabilityKingAddons.com King Addons for Elementor
- CVE-2025-62887WordPress King Addons for Elementor plugin <= 51.1.61 - Cross Site Scripting (XSS) vulnerabilityKingAddons.com King Addons for Elementor
- CVE-2025-62885WordPress WP VR plugin <= 8.5.48 - Cross Site Scripting (XSS) vulnerabilityRexTheme WP VR
- CVE-2025-62884WordPress Coupon Affiliates plugin <= 7.2.0 - Broken Access Control vulnerabilityElliot Sowersby / RelyWP Coupon Affiliates
- CVE-2025-62883WordPress Premmerce User Roles plugin <= 1.0.13 - Broken Access Control vulnerabilityPremmerce User Roles
- CVE-2025-62882WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerabilityCraig Hewitt Seriously Simple Podcasting
- CVE-2025-62881WordPress WP-Lister Lite for eBay plugin <= 3.8.3 - Broken Access Control vulnerabilityWP Lab WP-Lister Lite for eBay
- CVE-2025-12202ajayrandhawa User-Management-PHP-MYSQL web cross-site request forgeryajayrandhawa User-Management-PHP-MYSQL web
- CVE-2025-12201ajayrandhawa User-Management-PHP-MYSQL User Management edit-user.php unrestricted uploadajayrandhawa User-Management-PHP-MYSQL
- CVE-2025-6601Business Logic Errors in GitLabGitLab
- CVE-2025-11971Incorrect Authorization in GitLabGitLab
- CVE-2025-11974Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2023-37749Incorrect access control in the REST API endpoint of HubSpot v1.29441 allows unauthenticated attackers to view users' data without proper au
- CVE-2025-54965An XSS issue was discovered in BAE SOCET GXP before 4.6.0.2.
- CVE-2025-54967An issue was discovered in BAE SOCET GXP before 4.6.0.3.
- CVE-2025-54969An issue was discovered in BAE SOCET GXP before 4.6.0.2.
- CVE-2025-54970An issue was discovered in BAE SOCET GXP before 4.6.0.2.
- CVE-2025-60791Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory.
- CVE-2025-60982IDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data via manipulated object references.
- CVE-2025-60983Reflected Cross Site Scripting vulnerability in Rubikon Banking Solution 4.0.3 in the "Search For Customers Information" endpoints.