2025

48,153 vulnerabilities published in 2025.

All 48,153 CRITICAL 3,891 HIGH 16,974 MEDIUM 22,410 LOW 2,109 UNKNOWN 2,765 KEV 195

Results

22,410 of 48,153· Page 109/449

6.5

CVE-2025-27236

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have

Oct 3 4.9

CVE-2025-27231

The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host

Oct 3 4.3

CVE-2025-10311

The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in

Oct 3 4.3

CVE-2025-10309

The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,

Oct 3 4.3

CVE-2025-10302

The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl

Oct 3 5.3

CVE-2025-10212

The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing ca

Oct 3 6.4

CVE-2025-10192

The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect' sh

Oct 3 6.4

CVE-2025-10165

The AP Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adv_parallax_back'

Oct 3 4.4

CVE-2025-10053

The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings

Oct 3 4.1

CVE-2025-0876

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi A

Oct 3 5.4

CVE-2025-61599

Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitte

Oct 3 5.9

CVE-2025-61589

Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid (a to render diagrams) allows

Oct 3 6.4

CVE-2025-11241

The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to

Oct 3 6.1

CVE-2025-61606

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open R

Oct 2 6.1

CVE-2025-54088

CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the c

Oct 2 6.5

CVE-2025-56019

An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobil

Oct 2 5.3

CVE-2025-60661

Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the cloneType parameter in the fromAdvSetMacMtuWa

Oct 2 6.2

CVE-2025-59406

The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow Li

Oct 2 5.5

CVE-2025-34210

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store a large number o

Oct 2 6.5

CVE-2025-57305

VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.

Oct 2 6.5

CVE-2025-56162

YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint.

Oct 2 6.1

CVE-2025-56154

htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The

Oct 2 6.5

CVE-2025-61096

PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname pa

Oct 2 6.1

CVE-2025-61087

SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name fi

Oct 2 5.4

CVE-2025-60782

PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability i

Oct 2 6.1

CVE-2025-59774