CVEs published May 19, 2025
244 CVEs were published on May 19, 2025: 28 critical, 79 high. Browse them by severity, product and exploitation status.
- Published
- 244
- Critical
- 28
- High
- 79
- Medium
- 133
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- FUJI ELECTRIC CO. V-SFT
- 11
- mojoomla WPAMS
- 7
- PHPGurukul Auto Taxi Stand Management System
- 5
- ThemeGoods Grand Restaurant
- 5
- appleple a-blog cms
- 4
- mojoomla Hospital Management System
- 4
- D-Link DI-7003GV2
- 3
- Ninja Forms
- 3
- nodejs node
- 3
- PHPGurukul Daily Expense Tracker System
- 3
Critical 28
- CVE-2025-48340WordPress User Profile Meta Manager plugin <= 1.02 - CSRF to Privilege Escalation vulnerabilityDanny Vink User Profile Meta Manager
- CVE-2025-32926WordPress Grand Restaurant WordPress theme <= 7.0 - Path Traversal to PHP Object Injection vulnerabilityThemeGoods Grand Restaurant
- CVE-2025-32927WordPress FoodBakery plugin <= 3.3 - PHP Object Injection vulnerabilityChimpstudio FoodBakery
- CVE-2025-32928WordPress Altair theme <= 5.2.2 - PHP Object Injection vulnerabilityThemeGoods Altair
- CVE-2025-39348WordPress Grand Restaurant WordPress theme <= 7.0 - PHP Object Injection vulnerabilityThemeGoods Grand Restaurant
- CVE-2025-39349WordPress CiyaShop theme <= 4.18.0 - PHP Object Injection vulnerabilityPotenzaglobalsolutions CiyaShop
- CVE-2025-39354WordPress Grand Conference theme <= 5.3 - PHP Object Injection vulnerabilityThemeGoods Grand Conference
- CVE-2025-39356WordPress Foodbakery Sticky Cart plugin <= 3.2 - PHP Object Injection vulnerabilityChimpstudio Foodbakery Sticky Cart
- CVE-2025-39380WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Arbitrary File Upload vulnerabilitymojoomla Hospital Management System
- CVE-2025-39386WordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerabilitymojoomla Hospital Management System
- CVE-2025-39389WordPress AnalyticsWP <= 2.1.2 - SQL Injection VulnerabilitySolid Plugins AnalyticsWP
- CVE-2025-47949samlify SAML Signature Wrapping attacktngan samlify · samlify
- CVE-2025-39395WordPress WPAMS plugin <= 44.0 (17-08-2023) - SQL Injection vulnerabilitymojoomla WPAMS
- CVE-2025-39401WordPress WPAMS plugin <= 44.0 (17-08-2023) - Arbitrary File Upload vulnerabilitymojoomla WPAMS
- CVE-2025-39402WordPress WPAMS plugin <= 44.0 (17-08-2023) - Arbitrary File Upload vulnerabilitymojoomla WPAMS
- CVE-2025-39406WordPress WPAMS plugin <= 44.0 - Local File Inclusion to Privilege Escalation vulnerabilitymojoomla WPAMS
- CVE-2025-39410WordPress Smart Sections Theme Builder - WPBakery Page Builder Addon plugin <= 1.7.8 - PHP Object Injection vulnerabilitythemegusta Smart Sections Theme Builder - WPBakery Page Bui…
- CVE-2025-39445WordPress Super Store Finder <= 7.2 - SQL Injection Vulnerabilityhighwarden Super Store Finder
- CVE-2025-47284Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalationgardener · github.com/gardener/gardener
- CVE-2025-47283Bypassing project secret validation can lead to privilege escalationgardener · github.com/gardener/gardener
- CVE-2025-47577WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerabilitytemplateinvaders TI WooCommerce Wishlist
- CVE-2025-47581WordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - PHP Object Injection vulnerabilityelbisnero WordPress Events Calendar Registration & Tickets
- CVE-2025-47582WordPress WPBot Pro Wordpress Chatbot <= 12.7.0 - PHP Object Injection VulnerabilityQuantumCloud WPBot Pro Wordpress Chatbot
- CVE-2025-26892WordPress Celestial Aura plugin <= 2.2 - Arbitrary File Upload vulnerabilitydkszone Celestial Aura
- CVE-2025-26872WordPress Eximius theme <= 2.2 - Arbitrary File Upload vulnerabilitydkszone Eximius
Show all 28 entriesShow fewer entries
- CVE-2025-47282Malicious google credential in DNS secret can lead to privilege escalationgardener external-dns-management · github.com/gardener/e… +1
- CVE-2025-46801Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability.PgPool Global Development Group Pgpool-II
- CVE-2025-23123A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow…Ubiquiti UniFi Protect Cameras
High 79
- CVE-2025-4971Broadcom Automic Automation Agent Unix privilege escalationBroadcom Automic Automation
- CVE-2025-1308PX Backup Improper Sanitization VulnerabilityPure Storage PX Backup
- CVE-2025-31027WordPress Tiger theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityjocoxdesign Tiger
- CVE-2025-32924WordPress Revy plugin <= 2.1 - SQL Injection vulnerabilityroninwp Revy
- CVE-2025-32925WordPress SUMO Reward Points plugin <= 30.7.0 - Local File Inclusion vulnerabilityFantasticPlugins SUMO Reward Points
- CVE-2025-39350WordPress wProject theme < 5.8.0 - Unauthenticated Post/Comment/Attachment Modification/Deletion vulnerabilityRocket Apps wProject
- CVE-2025-39352WordPress Grand Restaurant WordPress theme <= 7.0 - Arbitrary Options Deletion vulnerabilityThemeGoods Grand Restaurant
- CVE-2025-39355WordPress FAT Services Booking plugin <= 5.6 - SQL Injection vulnerabilityroninwp FAT Services Booking
- CVE-2025-39357WordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerabilitymojoomla Hospital Management System
- CVE-2025-39365WordPress wProject theme < 5.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityRocket Apps wProject
- CVE-2025-39366WordPress wProject theme < 5.8.0 - Subscriber+ Privilege Escalation vulnerabilityRocket Apps wProject
- CVE-2025-39372WordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - Reflected Cross Site Scripting (XSS) vulnerabilityelbisnero WordPress Events Calendar Registration & Tickets
- CVE-2025-39392WordPress WPAMS plugin <= 44.0 (17-08-2023) - Cross Site Scripting (XSS) vulnerabilitymojoomla WPAMS
- CVE-2025-39393WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Cross Site Scripting (XSS) vulnerabilitymojoomla Hospital Management System
- CVE-2025-47944Multer vulnerable to Denial of Service from maliciously crafted requestsexpressjs multer · multer
- CVE-2025-47935Multer vulnerable to Denial of Service via memory leaks from unclosed streamsexpressjs multer · multer
- CVE-2025-39403WordPress WPAMS plugin <= 44.0 (17-08-2023) - SQL Injection vulnerabilitymojoomla WPAMS
- CVE-2025-39405WordPress WPAMS plugin <= 44.0 (17-08-2023) - Privilege Escalation vulnerabilitymojoomla WPAMS
- CVE-2025-39407WordPress Memberpress plugin < 1.12.0 - Reflected Cross Site Scripting (XSS) vulnerabilityCaseproof Memberpress
- CVE-2025-39409WordPress WordPress Video Robot - The Ultimate Video Importer plugin <= 1.20.0 - Reflected Cross Site Scripting (XSS) vulnerabilitypressaholic WordPress Video Robot - The Ultimate Video Impo…
- CVE-2025-39411WordPress WhatsApp Click to Chat Plugin for WordPress plugin <= 2.2.12 - Local File Inclusion vulnerabilityIndie_Plugins WhatsApp Click to Chat Plugin for WordPress
- CVE-2025-47934OpenPGP.js's message signature verification can be spoofedopenpgpjs · openpgp
- CVE-2025-39446WordPress Booster Plus for WooCommerce plugin <= 7.2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityPluggabl Booster Plus for WooCommerce
- CVE-2025-39447WordPress JetElements For Elementor plugin <= 2.7.4.1 - Broken Access Control VulnerabilityCrocoblock JetElements For Elementor
- CVE-2025-39449WordPress JetWooBuilder plugin <= 2.1.18 - Broken Access Control VulnerabilityCrocoblock JetWooBuilder
Show all 79 entriesShow fewer entries
- CVE-2025-39451WordPress JetBlocks For Elementor plugin <= 1.3.16 - Broken Access Control VulnerabilityCrocoblock JetBlocks For Elementor
- CVE-2025-39458WordPress Foton theme <= 2.5.2 - Local File Inclusion vulnerabilityMikado-Themes Foton
- CVE-2025-39459WordPress Real Estate 7 theme <= 3.5.2 - Privilege Escalation vulnerabilitycontempoinc Real Estate
- CVE-2025-43832WordPress Remote Images Grabber plugin <= 0.6 - Reflected Cross Site Scripting (XSS) vulnerabilityandreyk Remote Images Grabber
- CVE-2025-43836WordPress Syndicate Out <= 0.9 - Cross Site Scripting (XSS) Vulnerabilityconfuzzledduck Syndicate Out
- CVE-2025-43837WordPress Total Donations <= 3.0.8 - Cross Site Scripting (XSS) Vulnerabilitybinti76 Total Donations
- CVE-2025-43839WordPress BP Messages Tool plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityshanebp BP Messages Tool
- CVE-2025-27010WordPress Tastyc < 2.5.2 - Local File Inclusion Vulnerabilitybslthemes Tastyc
- CVE-2025-26997WordPress Wireless Butler plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerabilityvalidas Wireless Butler
- CVE-2025-26735WordPress Grip theme <= 1.0.9 - Local File Inclusion vulnerabilityCandid themes Grip
- CVE-2025-43833WordPress Absolute Links plugin <= 1.1.1 - SQL Injection vulnerabilityAmir Helzer Absolute Links
- CVE-2025-39396WordPress JetReviews plugin <= 2.3.6 - Local File Inclusion vulnerabilityCrocoblock JetReviews
- CVE-2025-43840WordPress CheckBot plugin <= 1.05 - CSRF to Stored XSS vulnerabilityref CheckBot
- CVE-2025-39374WordPress Best Posts Summary plugin <= 1.0 - CSRF to Stored XSS vulnerabilityaseem1234 Best Posts Summary
- CVE-2025-39370WordPress iCafe Library plugin <= 1.8.3 - SQL Injection vulnerabilitycnilsson iCafe Library
- CVE-2025-39364WordPress Product Category Slider for WooCommerce plugin <= 4.3.4 - Local File Inclusion vulnerabilityPluginEver Product Category Slider for WooCommerce
- CVE-2025-47576WordPress Bimber - Viral Magazine WordPress Theme theme <= 9.2.5 - Local File Inclusion vulnerabilityBringthepixel Bimber - Viral Magazine WordPress Theme
- CVE-2025-23988WordPress ghostwriter theme <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityBruno Cavalcante Ghostwriter
- CVE-2025-23986WordPress Tiki Time theme <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityfyrewurks Tiki Time
- CVE-2025-23983WordPress Tijaji theme <= 1.43 - Reflected Cross Site Scripting (XSS) vulnerabilityTijaji
- CVE-2025-26621OpenCTI vulnerable to Denial of Service through web hookOpenCTI-Platform opencti · pycti
- CVE-2025-23981WordPress CarZine theme <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerabilityTakimi Themes CarZine
- CVE-2025-23979WordPress Flashy theme <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityduwasai Flashy
- CVE-2025-22792WordPress Js O3 Lite theme <= 1.5.8.2 - Reflected Cross Site Scripting (XSS) vulnerabilityjinwen Js O3 Lite
- CVE-2025-22791WordPress offset writing theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilitytwh offset writing
- CVE-2025-24189The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-22790WordPress moseter theme <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityasmedia moseter
- CVE-2025-22789WordPress polka dots theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityfyrewurks polka dots
- CVE-2025-22687WordPress tuaug4 theme <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityAsmedia Tuaug4
- CVE-2025-22678WordPress my white theme <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilitymythemes my white
- CVE-2025-4948Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsouplibsoup · Red Hat Enterprise Linux
- CVE-2025-48280WordPress AutomatorWP plugin <= 5.2.1.3 - SQL Injection VulnerabilityRuben Garcia AutomatorWP
- CVE-2025-48278WordPress RSVPMarker plugin <= 11.5.6 - SQL Injection Vulnerabilitydavidfcarr RSVPMarker
- CVE-2025-48238WordPress AWcode Toolkit plugin <= 1.0.18 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityAWcode Toolkit
- CVE-2025-48236WordPress bunny.net plugin <= 2.3.0 - Cross Site Scripting (XSS) Vulnerabilitybunny.net
- CVE-2025-48233WordPress Affiliates Manager Google reCAPTCHA Integration plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityaffmngr Affiliates Manager Google reCAPTCHA Integration
- CVE-2025-36560Server-side request forgery vulnerability exists in a-blog cms multiple versions.appleple a-blog cms
- CVE-2025-47760V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6MemInIF!set_temp_type_default function.FUJI ELECTRIC CO. V-SFT
- CVE-2025-47759V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6ComFile!CV7BaseMap::WriteV7DataToRom function.FUJI ELECTRIC CO. S-SFT
- CVE-2025-47758V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6File!CTxSubFile::get_ProgramFile_name function.FUJI ELECTRIC CO. V-SFT
- CVE-2025-47757V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6MemInIF.dll!set_plc_type_default function.FUJI ELECTRIC CO. V-SFT
- CVE-2025-47756V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!CGamenDataRom::set_mr400_strc function.FUJI ELECTRIC CO. V-SFT
- CVE-2025-47755V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!VS4_SaveEnvFile function.FUJI ELECTRIC CO. V-SFT
- CVE-2025-47754V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!Conv_Macro_Data function.FUJI ELECTRIC CO. V-SFT
- CVE-2025-47753V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!CDrawSLine::GetRectArea function.FUJI ELECTRIC CO. V-SFT
- CVE-2025-47752V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6ComFile!MakeItemGlidZahyou function.FUJI ELECTRIC CO. V-SFT
- CVE-2025-47751V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6EditData!CDataRomErrorCheck::MacroCommandCheck function.FUJI ELECTRIC CO. V-SFT
- CVE-2025-47750V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6MemInIF!set_temp_type_default function.FUJI ELECTRIC CO. V-SFT
- CVE-2025-47749V-SFT v6.2.5.0 and earlier contains an issue with free of pointer not at start of buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck…FUJI ELECTRIC CO. V-SFT
- CVE-2025-37891ALSA: ump: Fix buffer overflow at UMP SysEx message conversionLinux
- CVE-2025-4477TeamT5 ThreatSonar Anti-Ransomware - Privilege EscalationTeamT5 ThreatSonar Anti-Ransomware
- CVE-2025-23166The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background…nodejs node
- CVE-2024-55063Multiple Code Injection vulnerabilities in EasyVirt DC NetScope <= 8.7.0 allows remote authenticated attackers to execute arbitrary code…
- CVE-2025-30072Tiiwee X1 Alarm System TWX1HAKV2 allows Authentication Bypass by Capture-replay, leading to physical Access to the protected facilities…
Medium, low and unrated 137
- CVE-2025-3079A passback vulnerability which relates to office/small office multifunction printers and laser printers.Canon imageRUNNER Series · Canon imageCLASS Series +2
- CVE-2025-3078A passback vulnerability which relates to production printers and office multifunction printers.Canon imageRUNNER ADVANCE Series · Canon imageRUNNER Ser… +3
- CVE-2025-3223WorkstationST EGD Configuration Server Path Traversal VulnerabilityGE Vernova WorkstationST
- CVE-2025-46441WordPress Section Widget plugin <= 3.3.1 - Path Traversal vulnerabilityctltwp Section Widget
- CVE-2025-47946symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributessymfony ux · symfony/ux-twig-component +1
- CVE-2025-43838WordPress Custom PC Builder Lite for WooCommerce <= 1.0.1 - Settings Change VulnerabilityChoPlugins.com Custom PC Builder Lite for WooCommerce
- CVE-2025-22287WordPress LTL Freight Quotes – FreightQuote Edition plugin <= 2.3.11 - Broken Access Control vulnerabilityenituretechnology LTL Freight Quotes – FreightQuote Edition
- CVE-2025-39448WordPress JetElements For Elementor plugin <= 2.7.4.1 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetElements For Elementor
- CVE-2025-39450WordPress JetTabs plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetTabs
- CVE-2025-39454WordPress Name Directory plugin <= 1.30.0 - Broken Access Control vulnerabilityJeroen Peters Name Directory
- CVE-2025-39460WordPress Eduma theme <= 5.6.4 - Broken Access Control vulnerabilityThimPress Eduma
- CVE-2025-43834WordPress cookieBAR plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilitytox82 cookieBAR
- CVE-2025-43835WordPress wp-cyr-cho plugin <= 0.1 - Cross Site Request Forgery (CSRF) vulnerabilityktsvetkov wp-cyr-cho
- CVE-2025-39412WordPress Master Slider plugin <= 3.11.0 - Broken Access Control vulnerabilityaverta Master Slider
- CVE-2025-39398WordPress Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue theme <= 4.2.2 - Broken Access Control vulnerabilityThemovation Bellevue
- CVE-2025-43841WordPress WP Vegas plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityjamesdbruner WP Vegas
- CVE-2025-46262WordPress Mad Mimi for WordPress plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityZack Katz Mad Mimi for WordPress
- CVE-2025-46263WordPress Author Box After Posts plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityLloyd Saunders Author Box After Posts
- CVE-2025-46543WordPress Enhanced Paypal Shortcodes plugin <= 0.5a - Cross Site Scripting (XSS) vulnerabilityCharlyLeetham Enhanced Paypal Shortcodes
- CVE-2025-4945Libsoup: integer overflow in cookie expiration date handling in libsouplibsoup · Red Hat Enterprise Linux
- CVE-2025-4941PHPGurukul Credit Card Application Management System index.php sql injectionPHPGurukul Credit Card Application Management System
- CVE-2025-39394WordPress AnalyticsWP plugin <= 2.1.2 - Sensitive Data Exposure vulnerabilitySolid Plugins AnalyticsWP
- CVE-2025-26920WordPress Customify theme <= 0.4.8 - Broken Access Control vulnerabilitypressmaximum Customify
- CVE-2025-26867WordPress Bulk theme <= 1.0.11 - Broken Access Control vulnerabilityThemes4WP Bulk
- CVE-2025-39388WordPress AnalyticsWP plugin <= 2.0.0 - Broken Access Control vulnerabilitySolid Plugins AnalyticsWP
Show all 137 entriesShow fewer entries
- CVE-2025-39376WordPress Car Park Booking System for WordPress plugin <= 2.6 - Broken Access Control vulnerabilityQuanticaLabs Car Park Booking System for WordPress
- CVE-2025-39375WordPress Easy Child Theme Creator plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityAshok G Easy Child Theme Creator
- CVE-2025-39373WordPress JNews Theme <= 11.6.16 - Broken Access Control Vulnerabilityjegtheme JNews
- CVE-2025-39371WordPress Author Box Plugin With Different Description plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerabilitySanjeev Mohindra Author Box Plugin With Different Descripti…
- CVE-2025-39369WordPress Posts for Page plugin <= 2.1 - Cross Site Scripting (XSS) vulnerabilitysihibbs Posts for Page
- CVE-2025-39368WordPress Rootspersona plugin <= 3.7.5 - Broken Access Control vulnerabilityed4becky Rootspersona
- CVE-2025-49401000 Projects Daily College Class Work Report Book admin_info.php sql injection1000 Projects Daily College Class Work Report Book
- CVE-2025-39353WordPress Grand Restaurant WordPress theme <= 7.0 - Broken Access Control vulnerabilityThemeGoods Grand Restaurant
- CVE-2025-39351WordPress Grand Restaurant WordPress theme <= 7.0 - Cross Site Request Forgery (CSRF) vulnerabilityThemeGoods Grand Restaurant
- CVE-2025-47583WordPress Salon booking system plugin <= 10.16 - CSRF to Arbitrary Content Deletion vulnerabilityDimitri Grassi Salon booking system
- CVE-2025-32920WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerabilitytemplateinvaders TI WooCommerce Wishlist
- CVE-2025-4876Hardcoded Key Revealed in ConnectWise Password Encryption UtilityConnectWise Risk Assessment
- CVE-2025-24184The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24183The issue was addressed with improved checks.Apple macOS
- CVE-2025-31185A logic issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2025-31262A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-4939PHPGurukul Credit Card Application Management System new-ccapplication.php cross site scriptingPHPGurukul Credit Card Application Management System
- CVE-2024-33939WordPress LMS by Masteriyo plugin <= 1.7.3 - Broken Authentication vulnerabilityMasteriyo - LMS
- CVE-2025-4938PHPGurukul Employee Record Management System registererms.php sql injectionPHPGurukul Employee Record Management System
- CVE-2025-4937SourceCodester Apartment Visitor Management System profile.php sql injectionSourceCodester Apartment Visitor Management System
- CVE-2025-3908The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an…OpenVPN 3 Linux
- CVE-2025-48346WordPress Embed and Integrate Etsy Shop plugin <= 1.0.8 - Broken Access Control vulnerabilityEmbed360 Embed and Integrate Etsy Shop
- CVE-2025-48344WordPress Rootspersona plugin <= 3.7.5 - Cross Site Request Forgery (CSRF) Vulnerabilityed4becky Rootspersona
- CVE-2025-48342WordPress Dynamic Pricing & Discounts Lite for WooCommerce plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) vulnerabilityRedefiningTheWeb Dynamic Pricing & Discounts Lite for WooCo…
- CVE-2025-48341WordPress Form Maker by 10Web plugin <= 1.15.33 - Cross Site Scripting (XSS) VulnerabilityForm Maker by 10Web
- CVE-2025-48288WordPress ElementInvader Addons for Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) VulnerabilityElement Invader ElementInvader Addons for Elementor
- CVE-2025-48285WordPress Falang multilanguage plugin <= 1.3.61 - Cross Site Request Forgery (CSRF) Vulnerabilitysbouey Falang multilanguage
- CVE-2025-48284WordPress Japanized For WooCommerce plugin <= 2.6.40 - Cross Site Request Forgery (CSRF) Vulnerabilityshohei.tanaka Japanized For WooCommerce
- CVE-2025-48282WordPress Majestic Support plugin <= 1.1.0 - Broken Access Control VulnerabilityMajestic Support
- CVE-2025-48277WordPress Cost Calculator Builder plugin <= 3.2.74 - Cross Site Scripting (XSS) VulnerabilityStylemix Cost Calculator Builder
- CVE-2025-48276WordPress Visual Composer Website Builder plugin <= 45.11.0 - Cross Site Scripting (XSS) VulnerabilityVisual Composer Website Builder
- CVE-2025-48272WordPress WP Job Portal plugin <= 2.3.2 - Insecure Direct Object References (IDOR) Vulnerabilitywpjobportal WP Job Portal
- CVE-2025-48270WordPress SKT Blocks plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerabilitysonalsinha21 SKT Blocks
- CVE-2025-48269WordPress WPAdverts plugin <= 2.2.3 - Cross Site Scripting (XSS) VulnerabilityGreg Winiarski WPAdverts
- CVE-2025-48268WordPress Bot for Telegram on WooCommerce plugin <= 1.2.6 - Broken Access Control VulnerabilityGuru Team Bot for Telegram on WooCommerce
- CVE-2025-48266WordPress Active Products Tables for WooCommerce plugin <= 1.0.6.8 - Cross Site Scripting (XSS) VulnerabilityRealMag777 Active Products Tables for WooCommerce
- CVE-2025-48265WordPress Year Make Model Search for WooCommerce plugin <= 1.0.11 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityPektsekye Year Make Model Search for WooCommerce
- CVE-2025-48264WordPress Product Code for WooCommerce plugin <= 1.5.0 - CSRF to Database Update vulnerabilityartiosmedia Product Code for WooCommerce
- CVE-2025-48263WordPress MultiVendorX plugin <= 4.2.22 - Cross Site Scripting (XSS) VulnerabilityMultiVendorX
- CVE-2025-48262WordPress Url Rewrite Analyzer plugin <= 1.3.3 - Broken Access Control VulnerabilityM.Code Url Rewrite Analyzer
- CVE-2025-48260WordPress GDPR CCPA Compliance Support plugin <= 2.7.3 - Broken Access Control VulnerabilityNinja Team GDPR CCPA Compliance Support
- CVE-2025-48259WordPress WP Mapa Politico España plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityJuan Carlos WP Mapa Politico España
- CVE-2025-48258WordPress Mega Menu Block plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerabilityjetmonsters Mega Menu Block
- CVE-2025-48257WordPress Projectopia plugin <= 5.1.17 - Broken Access Control VulnerabilityProjectopia
- CVE-2025-48256WordPress Import Social Events plugin <= 1.8.5 - Cross Site Scripting (XSS) VulnerabilityXylus Themes Import Social Events
- CVE-2025-48255WordPress Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP plugin <= 6.2.4 - Cross Site Request Forgery (CSRF) Vulnerabilityvideowhisper Broadcast Live Video
- CVE-2025-48254WordPress Change Add to Cart Button Text for WooCommerce plugin <= 2.2.2 - Cross Site Scripting (XSS) VulnerabilityWPFactory Change Add to Cart Button Text for WooCommerce
- CVE-2025-48253WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.6 - Cross Site Scripting (XSS) VulnerabilityWPFactory Free Shipping Bar: Amount Left for Free Shipping…
- CVE-2025-48252WordPress Back Button Widget plugin <= 1.6.8 - Cross Site Scripting (XSS) VulnerabilityWPFactory Back Button Widget
- CVE-2025-48251WordPress Additional Custom Emails & Recipients for WooCommerce plugin <= 3.5.1 - Cross Site Scripting (XSS) VulnerabilityWPFactory Additional Custom Emails & Recipients for WooComm…
- CVE-2025-48250WordPress Coupons & Add to Cart by URL Links for WooCommerce plugin <= 1.7.7 - Cross Site Scripting (XSS) VulnerabilityWPFactory Coupons & Add to Cart by URL Links for WooCommerce
- CVE-2025-48249WordPress EAN for WooCommerce plugin <= 5.4.6 - Cross Site Scripting (XSS) VulnerabilityWPFactory EAN for WooCommerce
- CVE-2025-48248WordPress Sitewide Discount for WooCommerce: Apply Discount to All Products plugin <= 2.2.1 - Cross Site Scripting (XSS) VulnerabilityWPFactory Sitewide Discount for WooCommerce: Apply Discount…
- CVE-2025-48247WordPress Shortlinks by Pretty Links plugin <= 3.6.15 - Broken Access Control VulnerabilityBlair Williams Shortlinks by Pretty Links
- CVE-2025-48246WordPress The Events Calendar plugin <= 6.11.2.1 - Broken Access Control VulnerabilityStellarWP The Events Calendar
- CVE-2025-48244WordPress Exclusive Addons Elementor plugin <= 2.7.9 - Cross Site Scripting (XSS) VulnerabilityTim Strifler Exclusive Addons Elementor
- CVE-2025-48243WordPress reCAPTCHA for all plugin <= 2.26 - Cross Site Request Forgery (CSRF) Vulnerabilitysminozzi reCAPTCHA for all
- CVE-2025-48242WordPress Legal Pages plugin <= 1.4.5 - Broken Access Control VulnerabilitywpWax Legal Pages
- CVE-2025-48240WordPress Cost of Goods for WooCommerce plugin <= 3.7.0 - Cross Site Scripting (XSS) VulnerabilityWPFactory Cost of Goods for WooCommerce
- CVE-2025-48239WordPress Product Notes Tab & Private Admin Notes for WooCommerce plugin <= 3.1.0 - Cross Site Scripting (XSS) VulnerabilityWPFactory Product Notes Tab & Private Admin Notes for WooCo…
- CVE-2025-48237WordPress Wishlist for WooCommerce plugin <= 3.2.2 - Cross Site Scripting (XSS) VulnerabilityWPFactory Wishlist for WooCommerce
- CVE-2025-48235WordPress WP Image Mask plugin <= 3.1.2 - Cross Site Scripting (XSS) VulnerabilityBogdan Bendziukov WP Image Mask
- CVE-2025-48234WordPress Ultimate Blocks plugin <= 3.3.0 - Cross Site Scripting (XSS) VulnerabilityUltimate Blocks
- CVE-2025-48232WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.5 - Cross Site Scripting (XSS) VulnerabilityXpro Addons For Beaver Builder – Lite
- CVE-2025-4936projectworlds Online Food Ordering System admin-page.php sql injectionprojectworlds Online Food Ordering System
- CVE-2025-4935SourceCodester Stock Management System changePassword.php sql injectionSourceCodester Stock Management System
- CVE-2025-4934PHPGurukul User Registration & Login and User Management System edit-profile.php sql injectionPHPGurukul User Registration & Login and User Management Sy…
- CVE-2025-4933ponaravindb Hospital-Management-System doctor-panel.php sql injectionponaravindb Hospital-Management-System
- CVE-2025-4932projectworlds Online Lawyer Management System lawyer_registation.php sql injectionprojectworlds Online Lawyer Management System
- CVE-2025-4931projectworlds Online Lawyer Management System user_registation.php sql injectionprojectworlds Online Lawyer Management System
- CVE-2025-4930Campcodes Online Shopping Portal my-cart.php sql injectionCampcodes Online Shopping Portal
- CVE-2025-2099Regular Expression Denial of Service (ReDoS) in huggingface/transformershuggingface/transformers · transformers
- CVE-2025-4929Campcodes Online Shopping Portal my-account.php sql injectionCampcodes Online Shopping Portal
- CVE-2025-4928projectworlds Online Lawyer Management System save_lawyer_edit_profile.php sql injectionprojectworlds Online Lawyer Management System
- CVE-2025-4927PHPGurukul Online Marriage Registration System between-dates-application-report.php sql injectionPHPGurukul Online Marriage Registration System
- CVE-2025-4926PHPGurukul Car Rental Project post-avehical.php unrestricted uploadPHPGurukul Car Rental Project
- CVE-2025-4925PHPGurukul Daily Expense Tracker System expense-monthwise-reports-detailed.php sql injectionPHPGurukul Daily Expense Tracker System
- CVE-2025-4924SourceCodester Client Database Management System user_void_transaction.php sql injectionSourceCodester Client Database Management System
- CVE-2025-27566Path traversal vulnerability exists in a-blog cms versions prior to Ver.appleple a-blog cms
- CVE-2025-32999Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver.appleple a-blog cms
- CVE-2025-41429a-blog cms multiple versions neutralize logs improperly.appleple a-blog cms
- CVE-2025-4923SourceCodester Client Database Management System user_delivery_update.php unrestricted uploadSourceCodester Client Database Management System
- CVE-2025-4917PHPGurukul Auto Taxi Stand Management System new-autoortaxi-entry-form.php sql injectionPHPGurukul Auto Taxi Stand Management System
- CVE-2025-4916PHPGurukul Auto Taxi Stand Management System admin-profile.php sql injectionPHPGurukul Auto Taxi Stand Management System
- CVE-2025-4915PHPGurukul Auto Taxi Stand Management System auto-taxi-entry-detail.php sql injectionPHPGurukul Auto Taxi Stand Management System
- CVE-2025-4914PHPGurukul Auto Taxi Stand Management System forgot-password.php sql injectionPHPGurukul Auto Taxi Stand Management System
- CVE-2025-2561Ninja Forms < 3.10.1 - Admin+ Stored XSSNinja Forms
- CVE-2025-2560Ninja Forms < 3.10.1 - Admin+ Stored XSSNinja Forms
- CVE-2025-2524Ninja Forms < 3.10.1 - Admin+ Stored XSSNinja Forms
- CVE-2025-1627Qi Blocks < 1.4 - Contributor+ Stored XSS via ToC BlockQi Blocks
- CVE-2025-1626Qi Blocks < 1.4 - Contributor+ Stored XSS vi Countdown BlockQi Blocks
- CVE-2025-1625Qi Blocks < 1.4 - Contributor+ Stored XSS via Counter BlockQi Blocks
- CVE-2025-4913PHPGurukul Auto Taxi Stand Management System index.php sql injectionPHPGurukul Auto Taxi Stand Management System
- CVE-2025-4912SourceCodester Student Result Management System Image File update_student.php path traversalSourceCodester Student Result Management System
- CVE-2025-4911PHPGurukul Zoo Management System view-foreigner-ticket.php sql injectionPHPGurukul Zoo Management System
- CVE-2025-2892All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URLsmub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…
- CVE-2025-4910PHPGurukul Zoo Management System edit-animal-details.php sql injectionPHPGurukul Zoo Management System
- CVE-2025-4909SourceCodester Client Database Management System exposure of information through directory listingSourceCodester Client Database Management System
- CVE-2025-4908PHPGurukul Daily Expense Tracker System expense-datewise-reports-detailed.php sql injectionPHPGurukul Daily Expense Tracker System
- CVE-2025-4907PHPGurukul Daily Expense Tracker System forgot-password.php sql injectionPHPGurukul Daily Expense Tracker System
- CVE-2025-4906PHPGurukul Notice Board System login.php sql injectionPHPGurukul Notice Board System
- CVE-2025-4905iop-apl-uw basestation3 QC.py load_qc_pickl deserializationiop-apl-uw basestation3
- CVE-2025-23165In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is…nodejs node
- CVE-2025-23164A misconfigured access token mechanism in the Unifi Protect Application (Version 5.3.41 and earlier) could permit the recipient of a…Ubiquiti UniFi Protect Application
- CVE-2025-23167A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`.nodejs node
- CVE-2025-4904D-Link DI-7003GV2 webgl.data sub_41F0FC information disclosureD-Link DI-7003GV2
- CVE-2025-4903D-Link DI-7003GV2 webgl.asp sub_41F4F0 unverified password changeD-Link DI-7003GV2
- CVE-2025-4902D-Link DI-7003GV2 versionupdate.data sub_48F4F0 information disclosureD-Link DI-7003GV2
- CVE-2024-51106A cross-site scripting (XSS) vulnerability in the component mcgs/admin/aboutus.php of PHPGURUKUL Medical Card Generation System using PHP…
- CVE-2025-28371EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function.
- CVE-2025-43714The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a…
- CVE-2025-44108A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions…