CWE-345

658 vulnerabilities with CWE-345

CVE-2025-66225 HIGH

OrangeHRM 5.0-5.7 - Unauthenticated Account Takeover via Password Reset Username Manipulation

CVSS 8.8

CVE-2025-66255 CRITICAL

DB Electronica Telecomunicazioni Mozart FM Transmitter - Unauthenticated Arbitrary File Upload via upgrade_contents.php

CVSS 9.8

CVE-2025-66016 CRITICAL

cggmp21 < 0.6.3 and cggmp24 < 0.7.0-alpha.2 - Insufficient Verification of Data Authenticity

CVE-2025-12752 MEDIUM

PayPal WordPress Plugin <1.1.7 - Info Disclosure

CVSS 5.3

CVE-2025-34337 HIGH

egovframe-common-components <4.3.1 - Info Disclosure

CVE-2025-12295 MEDIUM

D-Link DAP-2695 2.00RC13 - Insufficient Verification of Data Authenticity in Firmware Update Handler

CVSS 6.6

CVE-2025-12080 MEDIUM

Google Messages on Wear OS - Unauthorized Message Sending

CVE-2025-12245 MEDIUM

chatwoot < 4.7.0 - Origin Validation Error in Widget IFrame Helper

CVSS 5.3

CVE-2025-56438 MEDIUM

Nous W3 Smart WiFi Camera <1.33.50.82 - Privilege Escalation

CVSS 6.8

CVE-2025-59951 CRITICAL

Termix < 1.6.0 - Unauthenticated Sensitive Information Exposure via /ssh/db/host/internal Endpoint

CVSS 9.1

CVE-2025-11195 LOW

Rapid7 AppSpider Pro <7.5.021 - Info Disclosure

CVSS 3.3

CVE-2025-59934 CRITICAL

formbricks < 4.0.1 - Unauthenticated Authentication Bypass via JWT Signature Verification Missing

CVSS 9.4

CVE-2025-59420 HIGH

Authlib < 1.6.4 - Insufficient Verification of Data Authenticity via Critical Header Parameter Bypass

CVSS 7.5

CVE-2025-59160 LOW

matrix-js-sdk < 38.2.0 - Insufficient Verification of Room Predecessor Links

CVE-2025-0092 MEDIUM

Android - Permission Bypass and Information Disclosure via Bluetooth Bond State Handling

CVSS 6.5

CVE-2025-9379 HIGH

Belkin AX1800 1.1.00.016 - Info Disclosure

CVSS 7.2

CVE-2025-8980 MEDIUM

Tenda G1 16.01.7.8(3660) - Insufficient Verification of Data Authenticity in Firmware Update Handler

CVSS 6.6

CVE-2025-8979 MEDIUM

Tenda AC15 15.13.07.13 - Insufficient Verification of Data Authenticity in Firmware Update Handler

CVSS 6.6

CVE-2025-8978 MEDIUM

D-Link DIR-619L 6.02CN02 - Insufficient Firmware Verification in boa FirmwareUpgrade

CVSS 6.6

CVE-2025-54792 MEDIUM

LocalSend < 1.17.0 - Unauthenticated Man-in-the-Middle via Discovery Protocol

CVSS 6.8

CVE-2025-6504 HIGH

HDP Server <4.6.2.2978 - Privilege Escalation

CVSS 8.4

CVE-2025-8038 CRITICAL

Firefox < 141.0 and Thunderbird < 141.0 - Insufficient Verification of Data Authenticity

CVSS 9.8

CVE-2025-51471 MEDIUM

Ollama 0.6.7 - Cross-Domain Token Exposure via WWW-Authenticate Header Realm

CVSS 6.9

CVE-2025-30192 HIGH

PowerDNS Recursor - DNS Cache Poisoning via ECS Query Spoofing

CVSS 7.5

CVE-2025-7884 LOW

Eluktronics Control Center 5.23.51.41 - Info Disclosure

CVSS 3.3