CVE-2025-13xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

913 records · Page 10 of 10

• CVE-2025-13016: Incorrect boundary conditions in the JavaScript: WebAssembly component 7.5 High

  Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

  Updated 2026-04-13
• CVE-2025-13015: Spoofing issue in Firefox 3.4 Low

  Spoofing issue in Firefox. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30.

  Updated 2026-04-13
• CVE-2025-13014: Use-after-free in the Audio/Video component 8.8 High

  Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

  Updated 2026-04-13
• CVE-2025-13013: Mitigation bypass in the DOM: Core & HTML component 6.1 Medium

  Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

  Updated 2026-04-13
• CVE-2025-13012: Race condition in the Graphics component 7.5 High

  Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

  Updated 2026-04-13
• CVE-2025-13008: Session Token Disclosure in M-Files Web 8.6 High

  An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.

  Updated 2026-02-23
• CVE-2025-13007: WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import 6.1 Medium

  The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping on externally-sourced content. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a use

  Updated 2026-04-08
• CVE-2025-13006: SurveyFunnel – Survey Plugin for WordPress <= 1.1.5 - Unauthenticated Information Exposure 5.3 Medium

  The SurveyFunnel – Survey Plugin for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via several unprotected /wp-json/surveyfunnel/v2/ REST API endpoints. This makes it possible for unauthenticated attackers to extract sensitive data from survey responses.

  Updated 2026-04-08
• CVE-2025-13004: IDOR in Farktor Software's E-Commerce Package 6.3 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Manipulating User-Controlled Variables. This issue affects E-Commerce Package: through 27112025.

  Updated 2026-06-04
• CVE-2025-13003: IDOR in Aksis Computer's AxOnboard 7.6 High

  Authorization Bypass Through User-Controlled Key vulnerability in Aksis Computer Services and Consulting Inc. AxOnboard allows Exploitation of Trusted Identifiers. This issue affects AxOnboard: from 3.2.0 before 3.3.0.

  Updated 2026-06-04
• CVE-2025-13002: XSS in Farktor Software's E-Commerce Package 8.2 High

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Cross-Site Scripting (XSS). This issue affects E-Commerce Package: through 27112025.

  Updated 2026-06-04
• CVE-2025-13001: Donation <= 1.0 - Admin+ SQLi 4.1 Medium

  The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL injection attacks

  Updated 2026-04-02
• CVE-2025-13000: DB Access <= 0.8.7 - Subscriber+ SQLi 7.7 High

  The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscriber to perform SQLI attacks

  Updated 2026-04-02

Search a CVE ID or check dependency files →