# CVEs published 2025-05-03 31 CVEs were published on May 3, 2025: 1 critical, 5 high. Days are UTC. - [CVE-2025-4244](https://cve.now/CVE-2025-4244.md): code-projects Online Bus Reservation System seatlocation.php sql injection (CVSS 5.3, code-projects Online Bus Reservation System) - [CVE-2025-4243](https://cve.now/CVE-2025-4243.md): code-projects Online Bus Reservation System print.php sql injection (CVSS 5.3, code-projects Online Bus Reservation System) - [CVE-2025-4242](https://cve.now/CVE-2025-4242.md): PHPGurukul Online Birth Certificate System between-dates-report.php sql injection (CVSS 6.9, PHPGurukul Online Birth Certificate System) - [CVE-2025-1838](https://cve.now/CVE-2025-1838.md): IBM Cloud Pak for Business Automation denial of service (CVSS 6.5, IBM Cloud Pak for Business Automation) - [CVE-2025-4241](https://cve.now/CVE-2025-4241.md): PHPGurukul Teacher Subject Allocation Management System search.php sql injection (CVSS 6.9, PHPGurukul Teacher Subject Allocation Management System) - [CVE-2025-4240](https://cve.now/CVE-2025-4240.md): PCMan FTP Server LCD Command buffer overflow (CVSS 6.9, PCMan FTP Server) - [CVE-2025-4239](https://cve.now/CVE-2025-4239.md): PCMan FTP Server TYPE Command buffer overflow (CVSS 6.9, PCMan FTP Server) - [CVE-2025-1495](https://cve.now/CVE-2025-1495.md): IBM Business Automation Workflow missing authentication (CVSS 4.3, IBM Business Automation Workflow) - [CVE-2025-4238](https://cve.now/CVE-2025-4238.md): PCMan FTP Server MGET Command buffer overflow (CVSS 6.9, PCMan FTP Server) - [CVE-2024-58134](https://cve.now/CVE-2024-58134.md): Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default (CVSS 8.1, SRI Mojolicious) - [CVE-2024-41753](https://cve.now/CVE-2024-41753.md): IBM Cloud Pak for Business Automation cross-site scripting (CVSS 6.1, IBM Cloud Pak for Business Automation) - [CVE-2025-4237](https://cve.now/CVE-2025-4237.md): PCMan FTP Server MDELETE Command buffer overflow (CVSS 6.9, PCMan FTP Server) - [CVE-2025-4236](https://cve.now/CVE-2025-4236.md): PCMan FTP Server MDIR Command buffer overflow (CVSS 6.9, PCMan FTP Server) - [CVE-2025-37799](https://cve.now/CVE-2025-37799.md): vmxnet3: Fix malformed packet sizing in vmxnet3\_process\_xdp (CVSS 8.6, Linux) - [CVE-2025-4226](https://cve.now/CVE-2025-4226.md): PHPGurukul/Campcodes Cyber Cafe Management System add-computer.php sql injection (CVSS 6.9, PHPGurukul Cyber Cafe Management System · Campcodes Cyber C…) - [CVE-2024-58135](https://cve.now/CVE-2024-58135.md): Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default (CVSS 5.3, SRI Mojolicious) - [CVE-2025-3815](https://cve.now/CVE-2025-3815.md): SurveyJS \<= 1.12.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, devsoftbaltic SurveyJS: Drag & Drop Form Builder) - [CVE-2024-13738](https://cve.now/CVE-2024-13738.md): Motors - Car Dealer, Rental & Listing WordPress theme \<= 5.6.65 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, StylemixThemes Motors - Car Dealer, Rental & Listing WordPr…) - [CVE-2025-4222](https://cve.now/CVE-2025-4222.md): Database Toolset \<= 1.8.4 - Unauthenticated Sensitive Information Exposure via Backup Files (CVSS 5.9, neoslab Database Toolset) - [CVE-2025-3779](https://cve.now/CVE-2025-3779.md): Personizely \<= 0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via widgetId Parameter (CVSS 6.4, Personizely — A/B Testing, Personalization, Popups & CRO) - [CVE-2025-4199](https://cve.now/CVE-2025-4199.md): Abundatrade Plugin \<= 1.8.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, withinboredom Abundatrade Plugin) - [CVE-2025-3918](https://cve.now/CVE-2025-3918.md): Job Listings 0.1 - 0.1.1 - Unauthenticated Privilege Escalation via register\_action Function (CVSS 9.8, nootheme Job Listings) - [CVE-2025-4198](https://cve.now/CVE-2025-4198.md): Alink Tap \<= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, todoapuestas Alink Tap) - [CVE-2025-4168](https://cve.now/CVE-2025-4168.md): Subpage List \<= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, codework Subpage List) - [CVE-2025-4188](https://cve.now/CVE-2025-4188.md): Advanced Reorder Image Text Slider \<= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, balasahebbhise Advanced Reorder Image Text Slider) - [CVE-2025-4170](https://cve.now/CVE-2025-4170.md): Xavin's Review Ratings \<= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, xavinnydek Xavin's Review Ratings) - [CVE-2025-4172](https://cve.now/CVE-2025-4172.md): VerticalResponse Newsletter Widget \<= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, katzwebdesign VerticalResponse Newsletter Widget) - [CVE-2025-47229](https://cve.now/CVE-2025-47229.md): libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var\_set\_leave\_quiet assertion failure and applicatio (CVSS 2.9, GNU PSPP) - [CVE-2025-47241](https://cve.now/CVE-2025-47241.md): In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed\_domains is mishandled because userinfo can be placed in the authority (CVSS 4.0, browser-use) - [CVE-2025-47244](https://cve.now/CVE-2025-47244.md): Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by c (CVSS 7.3, Inedo ProGet) - [CVE-2025-47245](https://cve.now/CVE-2025-47245.md): In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role. (CVSS 8.1, BlueWave Checkmate) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-05-03 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.