# CVEs published 2025-05-06

166 CVEs were published on May 6, 2025: 16 critical, 62 high. Days are UTC.

- [CVE-2025-0856](https://cve.now/CVE-2025-0856.md): PGS Core \<= 5.8.0 - Missing Authorization via Multiple Functions (CVSS 7.3, Potenza Global Solutions PGS Core)
- [CVE-2025-0855](https://cve.now/CVE-2025-0855.md): PGS Core \<= 5.8.0 - Unauthenticated PHP Object Injection (CVSS 9.8, Potenza Global Solutions PGS Core)
- [CVE-2025-4372](https://cve.now/CVE-2025-4372.md): Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 8.8, Google Chrome)
- [CVE-2025-47420](https://cve.now/CVE-2025-47420.md): User Permissions on Network API (CVSS 8.7, Crestron Automate VX)
- [CVE-2025-0853](https://cve.now/CVE-2025-0853.md): PGS Core \<= 5.8.0 - Unauthenticated SQL Injection (CVSS 7.5, Potenza Global Solutions PGS Core)
- [CVE-2025-47419](https://cve.now/CVE-2025-47419.md): Non-Secure Access (CVSS 10.0, Crestron Automate VX)
- [CVE-2025-46573](https://cve.now/CVE-2025-46573.md): passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling (CVSS 8.6, auth0 passport-wsfed-saml2 · passport-wsfed-saml2)
- [CVE-2025-0649](https://cve.now/CVE-2025-0649.md): Stack Exhaustion In Tensorflow Serving (CVSS 8.9, Google Tensorflow)
- [CVE-2025-46572](https://cve.now/CVE-2025-46572.md): passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping (CVSS 9.3, auth0 passport-wsfed-saml2 · passport-wsfed-saml2)
- [CVE-2025-47418](https://cve.now/CVE-2025-47418.md): Recording (CVSS 5.3, Crestron Automate VX)
- [CVE-2024-12225](https://cve.now/CVE-2024-12225.md): Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass (CVSS 9.1, quarkus · Red Hat build of Quarkus)
- [CVE-2025-47417](https://cve.now/CVE-2025-47417.md): Enable Debug Images (CVSS 5.1, Crestron Automate VX)
- [CVE-2025-46820](https://cve.now/CVE-2025-46820.md): phpgt/Dom exposes the GITHUB\_TOKEN in Dom workflow run artifact (CVSS 7.1, phpgt Dom)
- [CVE-2025-46816](https://cve.now/CVE-2025-46816.md): goshs route not protected, allows command execution (CVSS 9.4, patrickhener goshs · github.com/patrickhener/goshs)
- [CVE-2025-4388](https://cve.now/CVE-2025-4388.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-25014](https://cve.now/CVE-2025-25014.md): Kibana arbitrary code execution via prototype pollution (CVSS 9.1, Elastic Kibana)
- [CVE-2025-37730](https://cve.now/CVE-2025-37730.md): Logstash Improper Certificate Validation in TCP output (CVSS 6.5, Elastic Logstash)
- [CVE-2025-46815](https://cve.now/CVE-2025-46815.md): ZITADEL Allows IdP Intent Token Reuse (CVSS 8.0, zitadel · github.com/zitadel/zitadel)
- [CVE-2025-46736](https://cve.now/CVE-2025-46736.md): Umbraco Makes User Enumeration Feasible Based on Timing of Login Response (CVSS 5.3, Umbraco-CMS · Umbraco.Cms)
- [CVE-2025-46735](https://cve.now/CVE-2025-46735.md): Terraform WinDNS Provider improperly sanitizes input variables in \`windns\_record\` (CVSS 1.1, nrkno terraform-provider-windns · github.com/nrkno/terrafor…)
- [CVE-2025-32022](https://cve.now/CVE-2025-32022.md): Finit has heap based buffer overwrite in urandom.so plugin (CVSS 4.6, troglobit finit)
- [CVE-2025-30165](https://cve.now/CVE-2025-30165.md): Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration (CVSS 8.0, vllm-project vllm · vllm)
- [CVE-2025-4041](https://cve.now/CVE-2025-4041.md): Use of Hard-coded Credentials Optigo Networks ONS NC600 (CVSS 9.3, Optigo Networks ONS NC600)
- [CVE-2025-22476](https://cve.now/CVE-2025-22476.md): Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Neutralization of Special Elements used in a Command (CVSS 5.5, Dell Storage Center - Dell Storage Manager)
- [CVE-2025-22477](https://cve.now/CVE-2025-22477.md): Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Authentication vulnerability. (CVSS 8.3, Dell Storage Center - Dell Storage Manager)
- [CVE-2025-4384](https://cve.now/CVE-2025-4384.md): Certificate validity not properly verified (CVSS 6.0, arcinfo PcVue)
- [CVE-2025-22478](https://cve.now/CVE-2025-22478.md): Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerab (CVSS 8.1, Dell Storage Center - Dell Storage Manager)
- [CVE-2025-22479](https://cve.now/CVE-2025-22479.md): Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory (' (CVSS 3.5, Dell Storage Center - Dell Storage Manager)
- [CVE-2025-4368](https://cve.now/CVE-2025-4368.md): Tenda AC8 MtuSetMacWan formGetRouterStatus buffer overflow (CVSS 8.7, Tenda AC8)
- [CVE-2025-4363](https://cve.now/CVE-2025-4363.md): itsourcecode Gym Management System ajax.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-23379](https://cve.now/CVE-2025-23379.md): Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation (' (CVSS 3.5, Dell Storage Center - Dell Storage Manager)
- [CVE-2025-4362](https://cve.now/CVE-2025-4362.md): itsourcecode Gym Management System ajax.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-46814](https://cve.now/CVE-2025-46814.md): FastAPI Guard Remote Header Injection via X-Forwarded-For Manipulation (CVSS 3.4, rennf93 fastapi-guard · fastapi-guard)
- [CVE-2025-4374](https://cve.now/CVE-2025-4374.md): Quay: incorrect privilege assignment (CVSS 6.5, Project Quay quay · Red Hat Quay)
- [CVE-2025-4373](https://cve.now/CVE-2025-4373.md): Glib: buffer underflow on glib through glib/gstring.c via function g\_string\_insert\_unichar (CVSS 4.8, glib · Red Hat Enterprise Linux +2)
- [CVE-2025-2898](https://cve.now/CVE-2025-2898.md): IBM Maximo Application Suite privilege escalation (CVSS 7.5, IBM Maximo Application Suite)
- [CVE-2025-4361](https://cve.now/CVE-2025-4361.md): PHPGurukul Company Visitor Management System department.php sql injection (CVSS 6.9, PHPGurukul Company Visitor Management System)
- [CVE-2025-4360](https://cve.now/CVE-2025-4360.md): itsourcecode Gym Management System view\_member.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-4359](https://cve.now/CVE-2025-4359.md): itsourcecode Gym Management System ajax.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-4358](https://cve.now/CVE-2025-4358.md): PHPGurukul Company Visitor Management System admin-profile.php sql injection (CVSS 6.9, PHPGurukul Company Visitor Management System)
- [CVE-2025-4357](https://cve.now/CVE-2025-4357.md): Tenda RX3 telnet command injection (CVSS 5.1, Tenda RX3)
- [CVE-2025-4356](https://cve.now/CVE-2025-4356.md): Tenda DAP-1520 Authentication storage mod\_graph\_auth\_uri\_handler stack-based overflow (CVSS 8.7, Tenda DAP-1520)
- [CVE-2025-4355](https://cve.now/CVE-2025-4355.md): Tenda DAP-1520 api set\_ws\_action heap-based overflow (CVSS 8.7, Tenda DAP-1520)
- [CVE-2025-4354](https://cve.now/CVE-2025-4354.md): Tenda DAP-1520 storage check\_dws\_cookie stack-based overflow (CVSS 8.7, Tenda DAP-1520)
- [CVE-2025-4353](https://cve.now/CVE-2025-4353.md): Brilliance Golden Link Secondary System queryTsDictionaryType.htm sql injection (CVSS 5.3, Brilliance Golden Link Secondary System)
- [CVE-2025-4352](https://cve.now/CVE-2025-4352.md): Brilliance Golden Link Secondary System tcEntrFlowSelect.htm sql injection (CVSS 5.3, Brilliance Golden Link Secondary System)
- [CVE-2025-4350](https://cve.now/CVE-2025-4350.md): D-Link DIR-600L wake\_on\_lan command injection (CVSS 8.7, D-Link DIR-600L)
- [CVE-2025-4349](https://cve.now/CVE-2025-4349.md): D-Link DIR-600L formSysCmd command injection (CVSS 8.7, D-Link DIR-600L)
- [CVE-2025-0984](https://cve.now/CVE-2025-0984.md): Arbitrary File Upload in Netoloji Software's E-Flow (CVSS 8.2, Netoloji Software E-Flow)
- [CVE-2025-4348](https://cve.now/CVE-2025-4348.md): D-Link DIR-600L formSetWanL2TP buffer overflow (CVSS 8.7, D-Link DIR-600L)
- [CVE-2025-40625](https://cve.now/CVE-2025-40625.md): Multiple vulnerabilities in TCMAN's GIM (CVSS 9.3, TCMAN GIM)
- [CVE-2025-40624](https://cve.now/CVE-2025-40624.md): Multiple vulnerabilities in TCMAN's GIM (CVSS 9.3, TCMAN GIM)
- [CVE-2025-40623](https://cve.now/CVE-2025-40623.md): Multiple vulnerabilities in TCMAN's GIM (CVSS 9.3, TCMAN GIM)
- [CVE-2025-40622](https://cve.now/CVE-2025-40622.md): Multiple vulnerabilities in TCMAN's GIM (CVSS 9.3, TCMAN GIM)
- [CVE-2025-40621](https://cve.now/CVE-2025-40621.md): Multiple vulnerabilities in TCMAN's GIM (CVSS 9.3, TCMAN GIM)
- [CVE-2025-40620](https://cve.now/CVE-2025-40620.md): Multiple vulnerabilities in TCMAN's GIM (CVSS 9.3, TCMAN GIM)
- [CVE-2025-4347](https://cve.now/CVE-2025-4347.md): D-Link DIR-600L formWlSiteSurvey buffer overflow (CVSS 8.7, D-Link DIR-600L)
- [CVE-2025-4346](https://cve.now/CVE-2025-4346.md): D-Link DIR-600L formSetWAN\_Wizard534 buffer overflow (CVSS 8.7, D-Link DIR-600L)
- [CVE-2025-4345](https://cve.now/CVE-2025-4345.md): D-Link DIR-600L formSetLog buffer overflow (CVSS 8.7, D-Link DIR-600L)
- [CVE-2025-4344](https://cve.now/CVE-2025-4344.md): D-Link DIR-600L formLogin buffer overflow (CVSS 8.7, D-Link DIR-600L)
- [CVE-2025-3782](https://cve.now/CVE-2025-3782.md): Cision Block \<= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, cyclonecode Cision Block)
- [CVE-2025-2011](https://cve.now/CVE-2025-2011.md): Slider & Popup Builder by Depicter \<= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter (CVSS 7.5, averta Depicter — Popup & Slider Builder)
- [CVE-2025-46762](https://cve.now/CVE-2025-46762.md): Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata (CVSS 7.1, Apache Software Foundation Apache Parquet Java · org.apache…)
- [CVE-2025-25052](https://cve.now/CVE-2025-25052.md): arkcompiler\_ets\_runtime has a buffer overflow vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-27241](https://cve.now/CVE-2025-27241.md): multimedia\_av\_codec has a NULL pointer dereference vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-27248](https://cve.now/CVE-2025-27248.md): ai\_neural\_network\_runtime has a NULL pointer dereference vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22886](https://cve.now/CVE-2025-22886.md): distributeddatamgr\_udmf has a memory leak vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-27132](https://cve.now/CVE-2025-27132.md): arkcompiler\_ets\_runtime has an out-of-bounds write vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-4343](https://cve.now/CVE-2025-4343.md): D-Link DIR-600L formEasySetupWizard buffer overflow (CVSS 8.7, D-Link DIR-600L)
- [CVE-2025-25218](https://cve.now/CVE-2025-25218.md): third\_party\_mksh has a NULL pointer dereference vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-21475](https://cve.now/CVE-2025-21475.md): Buffer Over-read in Display (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21470](https://cve.now/CVE-2025-21470.md): Improper Access Control in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21469](https://cve.now/CVE-2025-21469.md): Improper Access Control in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21468](https://cve.now/CVE-2025-21468.md): Out-of-bounds Write in Computer Vision (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21467](https://cve.now/CVE-2025-21467.md): Out-of-bounds Write in Computer Vision (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21462](https://cve.now/CVE-2025-21462.md): Out-of-bounds Write in Computer Vision (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21460](https://cve.now/CVE-2025-21460.md): Improper Input Validation in Automotive Software platform based on QNX (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21459](https://cve.now/CVE-2025-21459.md): Buffer Over-read in WLAN Host Communication (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-21453](https://cve.now/CVE-2025-21453.md): Use After Free in GPS HLOS Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-49847](https://cve.now/CVE-2024-49847.md): Buffer Over-read in Multi-Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-49846](https://cve.now/CVE-2024-49846.md): Buffer Over-read in Multi-Mode Call Processor (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2024-49845](https://cve.now/CVE-2024-49845.md): Improper Input Validation in HLOS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-49844](https://cve.now/CVE-2024-49844.md): Improper Input Validation in Automotive (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-49842](https://cve.now/CVE-2024-49842.md): Improper Access Control in Hypervisor (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-49841](https://cve.now/CVE-2024-49841.md): Detection of Error Condition Without Action in Hypervisor (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-49835](https://cve.now/CVE-2024-49835.md): Out-of-bounds Write in SPS Applications (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-49830](https://cve.now/CVE-2024-49830.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Audio (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-49829](https://cve.now/CVE-2024-49829.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Camera (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-45583](https://cve.now/CVE-2024-45583.md): Use After Free in Secure Processor (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-45581](https://cve.now/CVE-2024-45581.md): Out-of-bounds Write in Audio (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-45579](https://cve.now/CVE-2024-45579.md): Improper Input Validation in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45578](https://cve.now/CVE-2024-45578.md): Improper Validation of Array Index in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45577](https://cve.now/CVE-2024-45577.md): Improper Input Validation in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45576](https://cve.now/CVE-2024-45576.md): Improper Validation of Array Index in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45575](https://cve.now/CVE-2024-45575.md): Integer Overflow or Wraparound in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45574](https://cve.now/CVE-2024-45574.md): Improper Validation of Array Index in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45570](https://cve.now/CVE-2024-45570.md): Use of Out-of-range Pointer Offset in Camera Driver (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-45568](https://cve.now/CVE-2024-45568.md): Buffer Over-read in Camera Driver (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-45567](https://cve.now/CVE-2024-45567.md): Use After Free in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45566](https://cve.now/CVE-2024-45566.md): Use After Free in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45565](https://cve.now/CVE-2024-45565.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45564](https://cve.now/CVE-2024-45564.md): Use After Free in HLOS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45563](https://cve.now/CVE-2024-45563.md): Out-of-bounds Write in Camera Driver (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-45562](https://cve.now/CVE-2024-45562.md): Use After Free in HLOS (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-45554](https://cve.now/CVE-2024-45554.md): Use After Free in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-4342](https://cve.now/CVE-2025-4342.md): D-Link DIR-600L formEasySetupWizard3 buffer overflow (CVSS 8.7, D-Link DIR-600L)
- [CVE-2025-4341](https://cve.now/CVE-2025-4341.md): D-Link DIR-880L Request Header ssdpcgi sub\_16570 command injection (CVSS 5.3, D-Link DIR-880L)
- [CVE-2025-3020](https://cve.now/CVE-2025-3020.md): Wiesemann & Theis: Multiple W&T Products are vulnerable to cross-site-scripting (CVSS 5.4, Wiesemann & Theis ERP-Gateway 12x Digital Input, 6x Dig… +13)
- [CVE-2025-4340](https://cve.now/CVE-2025-4340.md): D-Link DIR-890L/DIR-806A1 soap.cgi sub\_175C8 command injection (CVSS 5.3, D-Link DIR-890L · D-Link DIR-806A1)
- [CVE-2025-4333](https://cve.now/CVE-2025-4333.md): feng\_ha\_ha/megagao ssm-erp/production\_ssm FileServiceImpl.java uploadFile unrestricted upload (CVSS 5.3, feng\_ha\_ha ssm-erp · feng\_ha\_ha production\_ssm +2)
- [CVE-2025-4332](https://cve.now/CVE-2025-4332.md): PHPGurukul Company Visitor Management System visitor-detail.php sql injection (CVSS 6.9, PHPGurukul Company Visitor Management System)
- [CVE-2025-4331](https://cve.now/CVE-2025-4331.md): SourceCodester Online Student Clearance System login.php sql injection (CVSS 6.9, SourceCodester Online Student Clearance System)
- [CVE-2025-3281](https://cve.now/CVE-2025-3281.md): User Registration & Membership – Custom Registration Form, Login Form, and User Profile \<= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion (CVSS 5.3, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2025-46593](https://cve.now/CVE-2025-46593.md): Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect a (CVSS 5.1, Huawei HarmonyOS)
- [CVE-2025-46592](https://cve.now/CVE-2025-46592.md): Null pointer dereference vulnerability in the USB HDI driver module Impact: Successful exploitation of this vulnerability may affect availab (CVSS 4.4, Huawei HarmonyOS)
- [CVE-2025-46591](https://cve.now/CVE-2025-46591.md): Out-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability may affect service c (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2025-46590](https://cve.now/CVE-2025-46590.md): Bypass vulnerability in the network search instruction authentication module Impact: Successful exploitation of this vulnerability can bypas (CVSS 6.3, Huawei HarmonyOS)
- [CVE-2025-46589](https://cve.now/CVE-2025-46589.md): Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and (CVSS 4.4, Huawei HarmonyOS)
- [CVE-2025-46588](https://cve.now/CVE-2025-46588.md): Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and (CVSS 4.4, Huawei HarmonyOS)
- [CVE-2024-58252](https://cve.now/CVE-2024-58252.md): Vulnerability of insufficient information protection in the media library module Impact: Successful exploitation of this vulnerability may a (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2025-46587](https://cve.now/CVE-2025-46587.md): Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confid (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2025-46586](https://cve.now/CVE-2025-46586.md): Permission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 5.1, Huawei HarmonyOS)
- [CVE-2025-46585](https://cve.now/CVE-2025-46585.md): Out-of-bounds array read/write vulnerability in the kernel module Impact: Successful exploitation of this vulnerability may affect availabil (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2025-46584](https://cve.now/CVE-2025-46584.md): Vulnerability of improper authentication logic implementation in the file system module Impact: Successful exploitation of this vulnerabilit (CVSS 7.8, Huawei HarmonyOS)
- [CVE-2025-4329](https://cve.now/CVE-2025-4329.md): 74CMS index path traversal (CVSS 5.3, 74CMS)
- [CVE-2025-4328](https://cve.now/CVE-2025-4328.md): fp2952 spring-cloud-base HTTP Header MvcController.java sendBack redirect (CVSS 5.1, fp2952 spring-cloud-base)
- [CVE-2025-4327](https://cve.now/CVE-2025-4327.md): MRCMS cross-site request forgery (CVSS 5.3, MRCMS)
- [CVE-2025-4326](https://cve.now/CVE-2025-4326.md): MRCMS Add Fragment Page add.do cross site scripting (CVSS 4.8, MRCMS)
- [CVE-2025-4325](https://cve.now/CVE-2025-4325.md): MRCMS Category Management Page add.do cross site scripting (CVSS 4.8, MRCMS)
- [CVE-2025-4324](https://cve.now/CVE-2025-4324.md): MRCMS External Link Management Page edit.do cross site scripting (CVSS 4.8, MRCMS)
- [CVE-2025-4323](https://cve.now/CVE-2025-4323.md): MRCMS Edit Article Page cross site scripting (CVSS 4.8, MRCMS)
- [CVE-2025-4314](https://cve.now/CVE-2025-4314.md): SourceCodester Advanced Web Store index.php sql injection (CVSS 6.9, SourceCodester Advanced Web Store)
- [CVE-2025-4313](https://cve.now/CVE-2025-4313.md): SourceCodester Advanced Web Store admin\_addnew\_product.php sql injection (CVSS 6.9, SourceCodester Advanced Web Store)
- [CVE-2025-2802](https://cve.now/CVE-2025-2802.md): LayoutBoxx \<= 0.3.1 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, LayoutBoxx)
- [CVE-2025-4337](https://cve.now/CVE-2025-4337.md): AHAthat Plugin \<= 1.6 - Cross-Site Request Forgery to AHA Page Deletion (CVSS 4.3, mitchelllevy AHAthat Plugin)
- [CVE-2025-4312](https://cve.now/CVE-2025-4312.md): SourceCodester Advanced Web Store productdetail.php sql injection (CVSS 6.9, SourceCodester Advanced Web Store)
- [CVE-2025-4311](https://cve.now/CVE-2025-4311.md): itsourcecode Content Management System update\_main\_topic\_img.php sql injection (CVSS 6.9, itsourcecode Content Management System)
- [CVE-2025-4310](https://cve.now/CVE-2025-4310.md): itsourcecode Content Management System add\_topic.php unrestricted upload (CVSS 5.1, itsourcecode Content Management System)
- [CVE-2025-4309](https://cve.now/CVE-2025-4309.md): PHPGurukul Art Gallery Management System add-art-type.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System)
- [CVE-2025-4308](https://cve.now/CVE-2025-4308.md): PHPGurukul Art Gallery Management System add-art-type.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System)
- [CVE-2025-4307](https://cve.now/CVE-2025-4307.md): PHPGurukul Art Gallery Management System add-art-medium.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System)
- [CVE-2025-4306](https://cve.now/CVE-2025-4306.md): PHPGurukul Nipah Virus Testing Management System edit-phlebotomist.php sql injection (CVSS 6.9, PHPGurukul Nipah Virus Testing Management System)
- [CVE-2025-3609](https://cve.now/CVE-2025-3609.md): Reales WP STPT \<= 2.1.2 - Unauthorized User Registration (CVSS 5.3, pixel\_prime Reales WP STPT)
- [CVE-2025-3610](https://cve.now/CVE-2025-3610.md): Reales WP STPT \<= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update (CVSS 8.8, pixel\_prime Reales WP STPT)
- [CVE-2025-4305](https://cve.now/CVE-2025-4305.md): kefaming mayi File.php upload unrestricted upload (CVSS 5.3, kefaming mayi)
- [CVE-2025-4304](https://cve.now/CVE-2025-4304.md): PHPGurukul Cyber Cafe Management System adminprofile.php sql injection (CVSS 6.9, PHPGurukul Cyber Cafe Management System)
- [CVE-2024-39442](https://cve.now/CVE-2024-39442.md): In sprd ssense service, there is a possible missing permission check. (CVSS 6.2, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2025-4303](https://cve.now/CVE-2025-4303.md): PHPGurukul Human Metapneumovirus Testing Management System add-phlebotomist.php sql injection (CVSS 6.9, PHPGurukul Human Metapneumovirus Testing Management System)
- [CVE-2025-2509](https://cve.now/CVE-2025-2509.md): Out-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to achieve arbitrary address access within the crosv (CVSS 7.8, Google ChromeOS)
- [CVE-2025-46728](https://cve.now/CVE-2025-46728.md): cpp-httplib has Unbounded Memory Allocation in Chunked/No-Length Requests (CVSS 7.5, yhirose cpp-httplib)
- [CVE-2025-4301](https://cve.now/CVE-2025-4301.md): itsourcecode Content Management System search-notice.php sql injection (CVSS 6.9, itsourcecode Content Management System)
- [CVE-2025-4300](https://cve.now/CVE-2025-4300.md): itsourcecode Content Management System search\_list.php sql injection (CVSS 6.9, itsourcecode Content Management System)
- [CVE-2025-4299](https://cve.now/CVE-2025-4299.md): Tenda AC1206 openSchedWifi setSchedWifi buffer overflow (CVSS 8.7, Tenda AC1206)
- [CVE-2023-33770](https://cve.now/CVE-2023-33770.md): Real Estate Management System v1.0 was discovered to contain a SQL injection vulnerability via the message parameter at /contact.php. (CVSS 5.1)
- [CVE-2025-26262](https://cve.now/CVE-2025-26262.md): An issue in the component /internals/functions of R-fx Networks Linux Malware Detect v1.6.5 allows attackers to escalate privileges and exec (CVSS 6.5)
- [CVE-2025-44073](https://cve.now/CVE-2025-44073.md): SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin\_comment\_news.php. (CVSS 9.8)
- [CVE-2025-44899](https://cve.now/CVE-2025-44899.md): There is a stack overflow vulnerability in Tenda RX3 V1.0br\_V16.03.13.11 In the fromSetWifiGusetBasic function of the web url /goform/ WifiG (CVSS 9.8)
- [CVE-2025-44900](https://cve.now/CVE-2025-44900.md): In Tenda RX3 V1.0br\_V16.03.13.11 in the GetParentControlInfo function of the web url /goform/GetParentControlInfo, the manipulation of the p (CVSS 6.5)
- [CVE-2025-45250](https://cve.now/CVE-2025-45250.md): MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate\_url function of the app\_doc/utils.py file. (CVSS 5.5)
- [CVE-2025-45487](https://cve.now/CVE-2025-45487.md): Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function. (CVSS 6.5)
- [CVE-2025-45488](https://cve.now/CVE-2025-45488.md): Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailex (CVSS 6.5)
- [CVE-2025-45489](https://cve.now/CVE-2025-45489.md): Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostna (CVSS 6.5)
- [CVE-2025-45490](https://cve.now/CVE-2025-45490.md): Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the passwo (CVSS 6.5)
- [CVE-2025-45491](https://cve.now/CVE-2025-45491.md): Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the userna (CVSS 9.8)
- [CVE-2025-45492](https://cve.now/CVE-2025-45492.md): Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action\_wireless function. (CVSS 6.5)
- [CVE-2025-47256](https://cve.now/CVE-2025-47256.md): Libxmp through 4.6.2 has a stack-based buffer overflow in depack\_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in (CVSS 5.6, Libxmp)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.