CVEs published May 3, 2025
31 CVEs were published on May 3, 2025: 1 critical, 5 high.
- Published
- 31
- Critical
- 1
- High
- 5
- Medium
- 24
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- PCMan FTP Server
- 5
- code-projects Online Bus Reservation System
- 2
- IBM Cloud Pak for Business Automation
- 2
- SRI Mojolicious
- 2
- balasahebbhise Advanced Reorder Image Text Slider
- 1
- BlueWave Checkmate
- 1
- browser-use
- 1
- codework Subpage List
- 1
- devsoftbaltic SurveyJS: Drag & Drop Form Builder
- 1
- GNU PSPP
- 1
Critical 1
High 5
- CVE-2024-58134Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by defaultSRI Mojolicious
- CVE-2025-37799vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdpLinux
- CVE-2024-13738Motors - Car Dealer, Rental & Listing WordPress theme <= 5.6.65 - Unauthenticated Arbitrary Shortcode ExecutionStylemixThemes Motors - Car Dealer, Rental & Listing WordPr…
- CVE-2025-47244Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by cInedo ProGet
- CVE-2025-47245In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.BlueWave Checkmate
Medium, low and unrated 25
- CVE-2025-4244code-projects Online Bus Reservation System seatlocation.php sql injectioncode-projects Online Bus Reservation System
- CVE-2025-4243code-projects Online Bus Reservation System print.php sql injectioncode-projects Online Bus Reservation System
- CVE-2025-4242PHPGurukul Online Birth Certificate System between-dates-report.php sql injectionPHPGurukul Online Birth Certificate System
- CVE-2025-1838IBM Cloud Pak for Business Automation denial of serviceIBM Cloud Pak for Business Automation
- CVE-2025-4241PHPGurukul Teacher Subject Allocation Management System search.php sql injectionPHPGurukul Teacher Subject Allocation Management System
- CVE-2025-4240PCMan FTP Server LCD Command buffer overflowPCMan FTP Server
- CVE-2025-4239PCMan FTP Server TYPE Command buffer overflowPCMan FTP Server
- CVE-2025-1495IBM Business Automation Workflow missing authenticationIBM Business Automation Workflow
- CVE-2025-4238PCMan FTP Server MGET Command buffer overflowPCMan FTP Server
- CVE-2024-41753IBM Cloud Pak for Business Automation cross-site scriptingIBM Cloud Pak for Business Automation
- CVE-2025-4237PCMan FTP Server MDELETE Command buffer overflowPCMan FTP Server
- CVE-2025-4236PCMan FTP Server MDIR Command buffer overflowPCMan FTP Server
- CVE-2025-4226PHPGurukul/Campcodes Cyber Cafe Management System add-computer.php sql injectionPHPGurukul Cyber Cafe Management System · Campcodes Cyber C…
- CVE-2024-58135Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by defaultSRI Mojolicious
- CVE-2025-3815SurveyJS <= 1.12.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameterdevsoftbaltic SurveyJS: Drag & Drop Form Builder
- CVE-2025-4222Database Toolset <= 1.8.4 - Unauthenticated Sensitive Information Exposure via Backup Filesneoslab Database Toolset
- CVE-2025-3779Personizely <= 0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via widgetId ParameterPersonizely — A/B Testing, Personalization, Popups & CRO
- CVE-2025-4199Abundatrade Plugin <= 1.8.02 - Cross-Site Request Forgery to Stored Cross-Site Scriptingwithinboredom Abundatrade Plugin
- CVE-2025-4198Alink Tap <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scriptingtodoapuestas Alink Tap
- CVE-2025-4168Subpage List <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingcodework Subpage List
- CVE-2025-4188Advanced Reorder Image Text Slider <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scriptingbalasahebbhise Advanced Reorder Image Text Slider
- CVE-2025-4170Xavin's Review Ratings <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingxavinnydek Xavin's Review Ratings
- CVE-2025-4172VerticalResponse Newsletter Widget <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingkatzwebdesign VerticalResponse Newsletter Widget
- CVE-2025-47229libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet assertion failure and applicatioGNU PSPP
- CVE-2025-47241In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authoritybrowser-use