# CVEs published 2025-05-05

127 CVEs were published on May 5, 2025: 16 critical, 36 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-4298](https://cve.now/CVE-2025-4298.md): Tenda AC1206 setcfm formSetCfm buffer overflow (CVSS 8.7, Tenda AC1206)
- [CVE-2025-4297](https://cve.now/CVE-2025-4297.md): PHPGurukul Men Salon Management System change-password.php sql injection (CVSS 6.9, PHPGurukul Men Salon Management System)
- [CVE-2025-4293](https://cve.now/CVE-2025-4293.md): MRCMS Group Edit Page edit.do cross site scripting (CVSS 4.8, MRCMS)
- [CVE-2025-4292](https://cve.now/CVE-2025-4292.md): MRCMS Edit User Page edit.do cross site scripting (CVSS 4.8, MRCMS)
- [CVE-2025-4291](https://cve.now/CVE-2025-4291.md): IdeaCMS saveUpload unrestricted upload (CVSS 5.3, IdeaCMS)
- [CVE-2025-4290](https://cve.now/CVE-2025-4290.md): PCMan FTP Server SMNT Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-4289](https://cve.now/CVE-2025-4289.md): PCMan FTP Server RNTO Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-1493](https://cve.now/CVE-2025-1493.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-0915](https://cve.now/CVE-2025-0915.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-1000](https://cve.now/CVE-2025-1000.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2025-4288](https://cve.now/CVE-2025-4288.md): PCMan FTP Server RNFR Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-46813](https://cve.now/CVE-2025-46813.md): Private data leak on login-required Discourse sites (CVSS 5.8, discourse)
- [CVE-2025-4287](https://cve.now/CVE-2025-4287.md): PyTorch nccl.py torch.cuda.nccl.reduce denial of service (CVSS 4.8, PyTorch)
- [CVE-2025-46734](https://cve.now/CVE-2025-46734.md): league/commonmark Cross-site Scripting vulnerability in Attributes extension (CVSS 6.4, thephpleague commonmark · league/commonmark)
- [CVE-2025-1909](https://cve.now/CVE-2025-1909.md): BuddyBoss Platform Pro \<= 2.7.01 - Authentication Bypass via Apple OAuth provider (CVSS 9.8, BuddyBoss Platform Pro)
- [CVE-2025-46731](https://cve.now/CVE-2025-46731.md): Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI (CVSS 7.3, craftcms cms · craftcms/cms)
- [CVE-2025-46730](https://cve.now/CVE-2025-46730.md): Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack (CVSS 6.8, Mobile-Security-Framework-MobSF · mobsf)
- [CVE-2025-4286](https://cve.now/CVE-2025-4286.md): Intelbras InControl Dispositivos Edição Page credentials storage (CVSS 5.1, Intelbras InControl)
- [CVE-2025-46726](https://cve.now/CVE-2025-46726.md): Langroid Vulnerable to XXE Injection via XMLToolMessage (CVSS 7.8, langroid)
- [CVE-2024-42213](https://cve.now/CVE-2024-42213.md): HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment (CVSS 5.3, HCL Software HCL BigFix Compliance)
- [CVE-2025-46720](https://cve.now/CVE-2025-46720.md): Keystone has an unintended \`isFilterable\` bypass that can be used as an oracle to match hidden fields (CVSS 3.1, keystonejs keystone · @keystone-6/core)
- [CVE-2025-46719](https://cve.now/CVE-2025-46719.md): Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions (CVSS 5.4, open-webui)
- [CVE-2025-46571](https://cve.now/CVE-2025-46571.md): Open WebUI vulnerable to limited stored XSS vila uploaded html file (CVSS 5.3, open-webui)
- [CVE-2024-42212](https://cve.now/CVE-2024-42212.md): HCL BigFix Compliance is affected by an improper or missing SameSite attribute (CVSS 5.4, HCL Software HCL BigFix Compliance)
- [CVE-2025-46559](https://cve.now/CVE-2025-46559.md): Misskey Directory Traversal Vulnerability in AiScript via \`Mk:api\` (CVSS 5.4, misskey-dev misskey)
- [CVE-2025-46340](https://cve.now/CVE-2025-46340.md): Misskey CSS Style Injection Vulnerability In \`MkUrlPreview\` (CVSS 7.2, misskey-dev misskey)
- [CVE-2025-4283](https://cve.now/CVE-2025-4283.md): SourceCodester/oretnom23 Stock Management System Login.php sql injection (CVSS 6.9, SourceCodester Stock Management System · oretnom23 Stock Ma…)
- [CVE-2025-46553](https://cve.now/CVE-2025-46553.md): @misskey-dev/summaly Redirect Filter Bypass (CVSS 2.1, misskey-dev summaly · @misskey-dev/summaly)
- [CVE-2025-46335](https://cve.now/CVE-2025-46335.md): Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload (CVSS 8.6, Mobile-Security-Framework-MobSF · mobsf)
- [CVE-2025-4279](https://cve.now/CVE-2025-4279.md): External image replace \<= 1.0.8 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, muromuro External image replace)
- [CVE-2025-43852](https://cve.now/CVE-2025-43852.md): GHSL-2025-022\_Retrieval-based-Voice-Conversion-WebUI (CVSS 8.9, RVC-Project Retrieval-based-Voice-Conversion-WebUI)
- [CVE-2025-43851](https://cve.now/CVE-2025-43851.md): GHSL-2025-021\_Retrieval-based-Voice-Conversion-WebUI (CVSS 8.9, RVC-Project Retrieval-based-Voice-Conversion-WebUI)
- [CVE-2025-43850](https://cve.now/CVE-2025-43850.md): GHSL-2025-020\_Retrieval-based-Voice-Conversion-WebUI (CVSS 8.9, RVC-Project Retrieval-based-Voice-Conversion-WebUI)
- [CVE-2025-43849](https://cve.now/CVE-2025-43849.md): GHSL-2025-019\_Retrieval-based-Voice-Conversion-WebUI (CVSS 8.9, RVC-Project Retrieval-based-Voice-Conversion-WebUI)
- [CVE-2025-4318](https://cve.now/CVE-2025-4318.md): Input validation issue in AWS Amplify Studio UI component properties (CVSS 9.0, Amazon Amplify Studio · @aws-amplify/codegen-ui-react)
- [CVE-2025-4052](https://cve.now/CVE-2025-4052.md): Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in (CVSS 9.8, Google Chrome)
- [CVE-2025-4051](https://cve.now/CVE-2025-4051.md): Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in (CVSS 6.3, Google Chrome)
- [CVE-2025-4050](https://cve.now/CVE-2025-4050.md): Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in (CVSS 8.8, Google Chrome)
- [CVE-2025-4096](https://cve.now/CVE-2025-4096.md): Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2025-4282](https://cve.now/CVE-2025-4282.md): SourceCodester/oretnom23 Stock Management System Users.php cross-site request forgery (CVSS 5.3, SourceCodester Stock Management System · oretnom23 Stock Ma…)
- [CVE-2025-43848](https://cve.now/CVE-2025-43848.md): GHSL-2025-018\_Retrieval-based-Voice-Conversion-WebUI (CVSS 8.9, RVC-Project Retrieval-based-Voice-Conversion-WebUI)
- [CVE-2025-43847](https://cve.now/CVE-2025-43847.md): GHSL-2025-017\_Retrieval-based-Voice-Conversion-WebUI (CVSS 8.9, RVC-Project Retrieval-based-Voice-Conversion-WebUI)
- [CVE-2025-43846](https://cve.now/CVE-2025-43846.md): GHSL-2025-016\_Retrieval-based-Voice-Conversion-WebUI (CVSS 8.9, RVC-Project Retrieval-based-Voice-Conversion-WebUI)
- [CVE-2025-43845](https://cve.now/CVE-2025-43845.md): GHSL-2025-015\_Retrieval-based-Voice-Conversion-WebUI (CVSS 8.9, RVC-Project Retrieval-based-Voice-Conversion-WebUI)
- [CVE-2025-43844](https://cve.now/CVE-2025-43844.md): GHSL-2025-014\_Retrieval-based-Voice-Conversion-WebUI (CVSS 8.9, RVC-Project Retrieval-based-Voice-Conversion-WebUI)
- [CVE-2025-43843](https://cve.now/CVE-2025-43843.md): GHSL-2025-013\_Retrieval-based-Voice-Conversion-WebUI (CVSS 8.9, RVC-Project Retrieval-based-Voice-Conversion-WebUI)
- [CVE-2025-43842](https://cve.now/CVE-2025-43842.md): GHSL-2025-012\_Retrieval-based-Voice-Conversion-WebUI (CVSS 8.9, RVC-Project Retrieval-based-Voice-Conversion-WebUI)
- [CVE-2025-24977](https://cve.now/CVE-2025-24977.md): OpenCTI has remote code execution and sensitive secrets exposed through web hook (CVSS 9.1, OpenCTI-Platform opencti · pycti)
- [CVE-2024-51991](https://cve.now/CVE-2024-51991.md): October CMS Allows Unprotected SVG Rename in Media Manager (CVSS 1.1, octobercms october · october/system +1)
- [CVE-2025-0217](https://cve.now/CVE-2025-0217.md): Privileged Remote Access Authentication Bypass (CVSS 7.3, BeyondTrust Privileged Remote Access)
- [CVE-2025-1992](https://cve.now/CVE-2025-1992.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-11615](https://cve.now/CVE-2024-11615.md): Envolve Plugin \<= 1.0 - Unauthenticated Language File Deletion (CVSS 5.3, ThemeKalia Envolve Plugin)
- [CVE-2025-4281](https://cve.now/CVE-2025-4281.md): Shenzhen Sixun Software Sixun Shanghui Group Business Management System LoadData information disclosure (CVSS 5.3, Shenzhen Sixun Software Sixun Shanghui Group Business Manag…)
- [CVE-2024-58237](https://cve.now/CVE-2024-58237.md): bpf: consider that tail calls invalidate packet pointers (CVSS 7.8, Linux)
- [CVE-2024-58100](https://cve.now/CVE-2024-58100.md): bpf: check changes\_pkt\_data property for extension programs (CVSS 7.8, Linux)
- [CVE-2024-58098](https://cve.now/CVE-2024-58098.md): bpf: track changes\_pkt\_data property for global functions (CVSS 7.8, Linux)
- [CVE-2025-4316](https://cve.now/CVE-2025-4316.md): Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the (CVSS 4.3, Devolutions Server)
- [CVE-2025-2545](https://cve.now/CVE-2025-2545.md): Deprecated 3DES cryptographic algorithm used by Request Tracker in emails encrypted with S/MIME (CVSS 2.3, Best Practical Solutions Request Tracker)
- [CVE-2025-4272](https://cve.now/CVE-2025-4272.md): Mechrevo Control Console GCUService csCAPI.dll uncontrolled search path (CVSS 7.3, Mechrevo Control Console)
- [CVE-2025-2905](https://cve.now/CVE-2025-2905.md): An XML External Entity (XXE) vulnerability in Multiple WSO2 Products (CVSS 9.1, WSO2 API Manager · WSO2 Enterprise Integrator +4)
- [CVE-2025-4271](https://cve.now/CVE-2025-4271.md): TOTOLINK A720R cstecgi.cgi information disclosure (CVSS 6.9, TOTOLINK A720R)
- [CVE-2025-4270](https://cve.now/CVE-2025-4270.md): TOTOLINK A720R Config cstecgi.cgi information disclosure (CVSS 6.9, TOTOLINK A720R)
- [CVE-2025-4269](https://cve.now/CVE-2025-4269.md): TOTOLINK A720R Log cstecgi.cgi access control (CVSS 6.9, TOTOLINK A720R)
- [CVE-2025-4268](https://cve.now/CVE-2025-4268.md): TOTOLINK A720R cstecgi.cgi missing authentication (CVSS 6.9, TOTOLINK A720R)
- [CVE-2025-39363](https://cve.now/CVE-2025-39363.md): WordPress Custom Login and Registration \<= 1.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, AlphaEfficiencyTeam Custom Login and Registration)
- [CVE-2025-4267](https://cve.now/CVE-2025-4267.md): SourceCodester/oretnom23 Stock Management System Purchase Order Details Page view\_po sql injection (CVSS 5.1, SourceCodester Stock Management System · oretnom23 Stock Ma…)
- [CVE-2025-3583](https://cve.now/CVE-2025-3583.md): Newsletter \< 8.7.1 - Admin+ Stored XSS (CVSS 3.5, Newsletter)
- [CVE-2025-4266](https://cve.now/CVE-2025-4266.md): PHPGurukul Notice Board System bwdates-reports-details.php sql injection (CVSS 6.9, PHPGurukul Notice Board System)
- [CVE-2025-4265](https://cve.now/CVE-2025-4265.md): PHPGurukul Emergency Ambulance Hiring Portal contact-us.php sql injection (CVSS 6.9, PHPGurukul Emergency Ambulance Hiring Portal)
- [CVE-2025-4264](https://cve.now/CVE-2025-4264.md): PHPGurukul Emergency Ambulance Hiring Portal edit-ambulance.php sql injection (CVSS 6.9, PHPGurukul Emergency Ambulance Hiring Portal)
- [CVE-2025-4263](https://cve.now/CVE-2025-4263.md): PHPGurukul Online DJ Booking Management System booking-search.php sql injection (CVSS 6.9, PHPGurukul Online DJ Booking Management System)
- [CVE-2025-4262](https://cve.now/CVE-2025-4262.md): PHPGurukul Online DJ Booking Management System user-search.php sql injection (CVSS 6.9, PHPGurukul Online DJ Booking Management System)
- [CVE-2025-4261](https://cve.now/CVE-2025-4261.md): GAIR-NLP factool tool.py run\_single code injection (CVSS 4.8, GAIR-NLP factool)
- [CVE-2025-20665](https://cve.now/CVE-2025-20665.md): In devinfo, there is a possible information disclosure due to a missing SELinux policy. (CVSS 5.5, MediaTek MT6580, MT6761, MT6765, MT6768, MT6779, MT6781, MT…)
- [CVE-2025-20670](https://cve.now/CVE-2025-20670.md): In Modem, there is a possible permission bypass due to improper certificate validation. (CVSS 5.7, MediaTek MT2737, MT6813, MT6835, MT6835T, MT6878, MT6878M,…)
- [CVE-2025-20668](https://cve.now/CVE-2025-20668.md): In scp, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6878, MT6897, MT6899, MT6989, MT6991, MT8775, MT…)
- [CVE-2025-20671](https://cve.now/CVE-2025-20671.md): In thermal, there is a possible out of bounds write due to a race condition. (CVSS 6.4, MediaTek MT2718, MT6878, MT6897, MT6899, MT6989, MT6991, MT…)
- [CVE-2025-20667](https://cve.now/CVE-2025-20667.md): In Modem, there is a possible information disclosure due to incorrect error handling. (CVSS 6.5, MediaTek MT2735, MT2737, MT6739, MT6761, MT6762, MT6762D, M…)
- [CVE-2025-20666](https://cve.now/CVE-2025-20666.md): In Modem, there is a possible system crash due to an uncaught exception. (CVSS 6.5, MediaTek MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855,…)
- [CVE-2025-4260](https://cve.now/CVE-2025-4260.md): zhangyanbo2007 youkefu TemplateController.java impsave deserialization (CVSS 5.3, zhangyanbo2007 youkefu)
- [CVE-2025-4259](https://cve.now/CVE-2025-4259.md): newbee-mall UploadController.java upload unrestricted upload (CVSS 5.3, newbee-mall)
- [CVE-2025-4258](https://cve.now/CVE-2025-4258.md): zhangyanbo2007 youkefu MediaController.java upload unrestricted upload (CVSS 5.3, zhangyanbo2007 youkefu)
- [CVE-2025-4257](https://cve.now/CVE-2025-4257.md): SeaCMS admin\_pay.php cross site scripting (CVSS 5.1, SeaCMS)
- [CVE-2025-4256](https://cve.now/CVE-2025-4256.md): SeaCMS admin\_paylog.php cross site scripting (CVSS 5.1, SeaCMS)
- [CVE-2025-4255](https://cve.now/CVE-2025-4255.md): PCMan FTP Server RMD Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2024-57229](https://cve.now/CVE-2024-57229.md): NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the devname parameter in the res (CVSS 6.5)
- [CVE-2024-57230](https://cve.now/CVE-2024-57230.md): NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcl (CVSS 6.5)
- [CVE-2024-57231](https://cve.now/CVE-2024-57231.md): NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcl (CVSS 6.5)
- [CVE-2024-57232](https://cve.now/CVE-2024-57232.md): NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcl (CVSS 6.5)
- [CVE-2024-57233](https://cve.now/CVE-2024-57233.md): NETGEAR RAX5 (AX1600 WiFi Router) v1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif\_d (CVSS 6.5)
- [CVE-2024-57234](https://cve.now/CVE-2024-57234.md): NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcl (CVSS 6.5)
- [CVE-2024-57235](https://cve.now/CVE-2024-57235.md): NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif\_e (CVSS 6.5)
- [CVE-2025-25504](https://cve.now/CVE-2025-25504.md): An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with netwo (CVSS 6.5)
- [CVE-2025-26241](https://cve.now/CVE-2025-26241.md): A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket \<=1.17.5 allows authenticated attackers to exe (CVSS 6.5)
- [CVE-2025-27920](https://cve.now/CVE-2025-27920.md): Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. (CVSS 7.2, KEV, Srimax Output Messenger)
- [CVE-2025-27921](https://cve.now/CVE-2025-27921.md): A reflected cross-site scripting (XSS) vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be inje (CVSS 6.1)
- [CVE-2025-28062](https://cve.now/CVE-2025-28062.md): A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. (CVSS 8.1)
- [CVE-2025-28168](https://cve.now/CVE-2025-28168.md): The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. (CVSS 6.4, Multi Uploaders Multiple File Upload)
- [CVE-2025-29573](https://cve.now/CVE-2025-29573.md): Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module. (CVSS 6.1, mezzanine)
- [CVE-2025-43915](https://cve.now/CVE-2025-43915.md): In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16. (CVSS 6.5, github.com/linkerd/linkerd2)
- [CVE-2025-44071](https://cve.now/CVE-2025-44071.md): SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. (CVSS 9.8)
- [CVE-2025-44072](https://cve.now/CVE-2025-44072.md): SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin\_manager.php. (CVSS 9.8)
- [CVE-2025-44074](https://cve.now/CVE-2025-44074.md): SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin\_topic.php. (CVSS 9.8)
- [CVE-2025-45042](https://cve.now/CVE-2025-45042.md): Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function. (CVSS 9.8)
- [CVE-2025-45236](https://cve.now/CVE-2025-45236.md): A stored cross-site scripting (XSS) vulnerability in the Edit Profile feature of DBSyncer v2.0.6 allows attackers to execute arbitrary web s (CVSS 5.4)
- [CVE-2025-45237](https://cve.now/CVE-2025-45237.md): Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file containing sensitive (CVSS 7.5)
- [CVE-2025-45238](https://cve.now/CVE-2025-45238.md): foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method. (CVSS 9.1)
- [CVE-2025-45239](https://cve.now/CVE-2025-45239.md): An issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a directory traversal. (CVSS 5.3)
- [CVE-2025-45240](https://cve.now/CVE-2025-45240.md): foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php. (CVSS 6.5)
- [CVE-2025-45242](https://cve.now/CVE-2025-45242.md): Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin. (CVSS 7.7)
- [CVE-2025-45320](https://cve.now/CVE-2025-45320.md): A Directory Listing Vulnerability was found in the /osms/Requester/ directory of the Kashipara Online Service Management Portal V1.0. (CVSS 7.5)
- [CVE-2025-45321](https://cve.now/CVE-2025-45321.md): kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in /osms/Requester/Requesterchangepass.php via the parameter: (CVSS 8.8)
- [CVE-2025-45322](https://cve.now/CVE-2025-45322.md): kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in osms/Requester/CheckStatus.php via the checkid parameter. (CVSS 9.8)
- [CVE-2025-45607](https://cve.now/CVE-2025-45607.md): An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request. (CVSS 9.8)
- [CVE-2025-45608](https://cve.now/CVE-2025-45608.md): Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information vi (CVSS 7.5)
- [CVE-2025-45609](https://cve.now/CVE-2025-45609.md): Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a craft (CVSS 7.5)
- [CVE-2025-45610](https://cve.now/CVE-2025-45610.md): Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information v (CVSS 7.5)
- [CVE-2025-45611](https://cve.now/CVE-2025-45611.md): Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET reques (CVSS 9.8)
- [CVE-2025-45612](https://cve.now/CVE-2025-45612.md): Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index. (CVSS 9.8)
- [CVE-2025-45613](https://cve.now/CVE-2025-45613.md): Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted pay (CVSS 7.5)
- [CVE-2025-45614](https://cve.now/CVE-2025-45614.md): Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted paylo (CVSS 7.5)
- [CVE-2025-45615](https://cve.now/CVE-2025-45615.md): Incorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain access to Admin rights via a crafted reque (CVSS 9.8)
- [CVE-2025-45616](https://cve.now/CVE-2025-45616.md): Incorrect access control in the /admin/\*\* API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request. (CVSS 9.8, com.baidu.mapp:brcc-core)
- [CVE-2025-45617](https://cve.now/CVE-2025-45617.md): Incorrect access control in the component /user/list of production\_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via (CVSS 7.5)
- [CVE-2025-45618](https://cve.now/CVE-2025-45618.md): Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to acc (CVSS 6.5)
- [CVE-2025-45751](https://cve.now/CVE-2025-45751.md): SourceCodester Web Based Pharmacy Product Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add-admin.php via the Fullnam (CVSS 5.4)
- [CVE-2025-47268](https://cve.now/CVE-2025-47268.md): ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply pa (CVSS 6.5, iputils)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.