CVEs published May 9, 2025
152 CVEs were published on May 9, 2025: 24 critical, 41 high.
- Published
- 152
- Critical
- 24
- High
- 41
- Medium
- 46
- Low
- 3
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Linux
- 52
- itsourcecode Gym Management System
- 10
- D-Link DIR-619L
- 7
- ATEN CL5708IM
- 5
- Campcodes Online Food Ordering System
- 4
- SourceCodester Online Student Clearance System
- 4
- GitLab
- 3
- Sparx Systems Pro Cloud Server
- 3
- TOTOLINK N150RT
- 3
- ASUS DriverHub
- 2
Critical 24
- CVE-2024-12442Command injection in EnerSys AMPA versions 24.04 through 24.16, inclusiveEnerSys AMPA
- CVE-2024-11861Command injection in EnerSys AMPA 22.09 and prior versionsEnerSys AMPA
- CVE-2025-1087Arbitrary Code Execution in Kong Insomnia Desktop ApplicationKong Insomnia
- CVE-2025-4403Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Functionglenwpcoder Drag and Drop Multiple File Upload for WooComme…
- CVE-2025-378799p/net: fix improper handling of bogus negative read/write repliesLinux
- CVE-2024-11617Envolve Plugin <= 1.0 - Unauthenticated Arbitrary File Upload via language_file and fonts_fileThemeKalia Envolve Plugin
- CVE-2025-2253IMITHEMES Listing <= 3.3 - Unauthenticated Privilege Escalation via Unverified Password ResetIMITHEMES Listing
- CVE-2025-3605Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeoverarkenon Login, Registration and Lost Password Blocks
- CVE-2025-3463"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulneASUS DriverHub
- CVE-2025-3714ATEN LCD KVM over IP Switch CL5708IM - Stack-based Buffer OverflowATEN CL5708IM
- CVE-2025-3711ATEN LCD KVM over IP Switch CL5708IM - Stack-based Buffer OverflowATEN CL5708IM
- CVE-2025-3710ATEN LCD KVM over IP Switch CL5708IM - Stack-based Buffer OverflowATEN CL5708IM
- CVE-2025-3811WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Updateiqonicdesign WPBookit
- CVE-2025-3810WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeoveriqonicdesign WPBookit
- CVE-2025-28200Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address.
- CVE-2025-45513Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.P2pListFilter.
- CVE-2025-45885PHPGURUKUL Vehicle Parking Management System v1.13 is vulnerable to SQL injection in the /vpms/users/login.php file.
- CVE-2025-45887Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent.
- CVE-2025-46188SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in superadmin_phpmyadmin.php.
- CVE-2025-46189SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_order_customer_update.php via the order_id POST
- CVE-2025-46190SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_delivery_update.php via the order_id POST parame
- CVE-2025-46191Arbitrary File Upload in user_payment_update.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upl
- CVE-2025-46192SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_payment_update.php via the order_id POST paramet
- CVE-2025-46193SourceCodester Client Database Management System 1.0 is vulnerable to Remote code execution via Arbitrary file upload in user_proposal_updat
High 41
- CVE-2025-47269code-server session cookie can be extracted by having user visit specially crafted proxy URLcoder code-server · code-server
- CVE-2025-4447Buffer Overflow in Eclipse OpenJ9Eclipse Foundation OpenJ9
- CVE-2024-9524Privilege Escalation Vulnerability in Avira Prime Version 1.1.96.2Aira Prime
- CVE-2024-13962Link Following Local Privilege Escalation Vulnerability in Avast Cleanup Premium Version 24.2.16593.17810Avast CleanUp Premium
- CVE-2024-13961Avast Cleanup Premium TuneupSvc Link Following Local Privilege Escalation VulnerabilityAvast CleanUp Premium
- CVE-2024-13960Link Following Local Privilege Escalation Vulnerability in AVG TuneUp Version 23.4AVG TuneUp
- CVE-2024-13959Link Following Local Privilege Escalation Vulnerability in AVG TuneUp 24.2.16593.9844AVG TuneUp
- CVE-2024-13759Local Privilege Escalation in Avira Prime 1.1.96.2 on Windows 10 x64Avira Prime
- CVE-2024-13944Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate (Also affects Avast CleanUp and AVG TuneUp)Norton Utilities Ultimate · Avast CleanUp +1
- CVE-2025-3528Mirror-registry: local privilege escalation due to incorrect permissions in mirror-registrymirror-registry · Red Hat MIRROR-REGISTRY-2.0-RHEL-8 +1
- CVE-2025-4206WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletiontrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2025-37887pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL resultLinux
- CVE-2025-37886pds_core: make wait_context part of q_infoLinux
- CVE-2025-37885KVM: x86: Reset IRTE to host control if *new* route isn't postableLinux
- CVE-2025-37882usb: xhci: Fix isochronous Ring Underrun/Overrun event handlingLinux
- CVE-2025-37876netfs: Only create /proc/fs/netfs with CONFIG_PROC_FSLinux
- CVE-2025-37873eth: bnxt: fix missing ring index trim on error pathLinux
- CVE-2025-37871nfsd: decrease sc_count directly if fail to queue dl_recallLinux
- CVE-2025-37869drm/xe: Use local fence in error path of xe_migrate_clearLinux
- CVE-2025-34551 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload1clickmigration 1 Click Migration & Backup: Free WordPress…
- CVE-2025-37861scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queueLinux
- CVE-2025-37856btrfs: harden block_group::bg_list against list_del() racesLinux
- CVE-2025-37854drm/amdkfd: Fix mode1 reset crash issueLinux
- CVE-2025-37849KVM: arm64: Tear down vGIC on failed vCPU creationLinux
- CVE-2025-37845tracing: fprobe events: Fix possible UAF on modulesLinux
- CVE-2025-3462"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASASUS DriverHub
- CVE-2025-4377Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.phpSparx Systems Pro Cloud Server
- CVE-2025-4462TOTOLINK N150RT formWsc buffer overflowTOTOLINK N150RT
- CVE-2025-3713ATEN LCD KVM over IP Switch CL5708IM - Heap-based Buffer OverflowATEN CL5708IM
- CVE-2025-3712ATEN LCD KVM over IP Switch CL5708IM - Heap-based Buffer OverflowATEN CL5708IM
- CVE-2025-4455Patch My PC Home Updater System.IO uncontrolled search pathPatch My PC Home Updater
- CVE-2025-4452D-Link DIR-619L formSetWizard2 buffer overflowD-Link DIR-619L
- CVE-2025-4451D-Link DIR-619L formSetWAN_Wizard52 buffer overflowD-Link DIR-619L
- CVE-2025-4450D-Link DIR-619L formSetEasy_Wizard buffer overflowD-Link DIR-619L
- CVE-2025-4449D-Link DIR-619L formEasySetupWizard3 buffer overflowD-Link DIR-619L
- CVE-2025-4448D-Link DIR-619L formEasySetupWizard buffer overflowD-Link DIR-619L
- CVE-2025-4446H3C GR-5400AX aspForm Edit_List_SSID buffer overflowH3C GR-5400AX
- CVE-2025-28202Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services without authentication.
- CVE-2025-28203Victure RX1800 EN_V1.0.0_r12_110933 was discovered to contain a command injection vulnerability.
- CVE-2025-29509Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to open
- CVE-2025-47424Retool (self-hosted) before 3.196.0 allows Host header injection.Retool
Medium, low and unrated 87
- CVE-2025-3794WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parametersmub WPForms – Easy Form Builder for WordPress – Contact Fo…
- CVE-2025-4494JAdmin-JAVA JAdmin Admin Backend NoNeedLoginController.java toLogin improper authenticationJAdmin-JAVA JAdmin
- CVE-2025-4492Campcodes Online Food Ordering System ticket-message.php sql injectionCampcodes Online Food Ordering System
- CVE-2025-4491Campcodes Online Food Ordering System ticket-status.php sql injectionCampcodes Online Food Ordering System
- CVE-2025-4490Campcodes Online Food Ordering System view-ticket-admin.php sql injectionCampcodes Online Food Ordering System
- CVE-2025-4489Campcodes Online Food Ordering System user-router.php sql injectionCampcodes Online Food Ordering System
- CVE-2025-4488itsourcecode Gym Management System ajax.php sql injectionitsourcecode Gym Management System
- CVE-2025-4487itsourcecode Gym Management System ajax.php sql injectionitsourcecode Gym Management System
- CVE-2025-4486itsourcecode Gym Management System ajax.php sql injectionitsourcecode Gym Management System
- CVE-2025-4485itsourcecode Gym Management System ajax.php sql injectionitsourcecode Gym Management System
- CVE-2025-4484itsourcecode Gym Management System ajax.php sql injectionitsourcecode Gym Management System
- CVE-2025-4483itsourcecode Gym Management System view_pdetails.php sql injectionitsourcecode Gym Management System
- CVE-2025-4482Project Worlds Student Project Allocation System forgot_password_sql.php sql injectionProject Worlds Student Project Allocation System
- CVE-2025-1993IBM App Connect Enterprise Certified Container information disclosureIBM App Connect Enterprise Certified Container
- CVE-2025-4481SourceCodester Apartment Visitor Management System search-result.php sql injectionSourceCodester Apartment Visitor Management System
- CVE-2025-4480code-projects Simple College Management System Add New Student input stack-based overflowcode-projects Simple College Management System
- CVE-2024-8973Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-0549Authentication Bypass Using an Alternate Path or Channel in GitLabGitLab
- CVE-2025-1278Insufficient Granularity of Access Control in GitLabGitLab
- CVE-2025-4432Ring: some aes functions may panic when overflow checking is enabled in ringring · Red Hat Enterprise Linux +5
- CVE-2025-4382Grub2: grub allow access to encrypted device through cli once root device is unlocked via tpmgrub2 · Red Hat Enterprise Linux +1
- CVE-2025-3897EUCookieLaw <= 2.7.2 - Unauthenticated Arbitrary File Readdiego-la-monica EUCookieLaw
- CVE-2025-46392Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.xApache Software Foundation Apache Commons Configuration · c…
- CVE-2025-3949Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.18.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information ExposureWebsite Builder by SeedProd — Theme Builder, Landing Page B…
- CVE-2025-4472code-projects Departmental Store Management System bill stack-based overflowcode-projects Departmental Store Management System
- CVE-2025-4471code-projects Jewelery Store Management system Search Item View stack-based overflowcode-projects Jewelery Store Management system
- CVE-2025-4470SourceCodester Online Student Clearance System add-student.php cross site scriptingSourceCodester Online Student Clearance System
- CVE-2025-4469SourceCodester Online Student Clearance System add-admin.php cross site scriptingSourceCodester Online Student Clearance System
- CVE-2025-37889ASoC: ops: Consistently treat platform_max as control valueLinux
- CVE-2025-37888net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()Linux
- CVE-2025-37884bpf: Fix deadlock between rcu_tasks_trace and event_mutex.Linux
- CVE-2025-37883s390/sclp: Add check for get_zeroed_page()Linux
- CVE-2025-37881usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()Linux
- CVE-2025-37880um: work around sched_yield not yielding in time-travel modeLinux
- CVE-2025-37878perf/core: Fix WARN_ON(!ctx) in __free_event() for partial initLinux
- CVE-2025-37877iommu: Clear iommu-dma ops on cleanupLinux
- CVE-2025-37875igc: fix PTM cycle trigger logicLinux
- CVE-2025-37874net: ngbe: fix memory leak in ngbe_probe() error pathLinux
- CVE-2025-37872net: txgbe: fix memory leak in txgbe_probe() error pathLinux
- CVE-2025-37870drm/amd/display: prevent hang on link training failLinux
- CVE-2025-37868drm/xe/userptr: fix notifier vs folio deadlockLinux
- CVE-2025-37867RDMA/core: Silence oversized kvmalloc() warningLinux
- CVE-2025-37866mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show()Linux
- CVE-2025-37865net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupportedLinux
- CVE-2025-37864net: dsa: clean up FDB, MDB, VLAN entries on unbindLinux
- CVE-2025-37863ovl: don't allow datadir onlyLinux
- CVE-2025-37862HID: pidff: Fix null pointer dereference in pidff_find_fieldsLinux
- CVE-2025-37859page_pool: avoid infinite loop to schedule delayed workerLinux
- CVE-2025-37858fs/jfs: Prevent integer overflow in AG size calculationLinux
- CVE-2025-37857scsi: st: Fix array overflow in st_setup()Linux
- CVE-2025-37855drm/amd/display: Guard Possible Null Pointer DereferenceLinux
- CVE-2025-37853drm/amdkfd: debugfs hang_hws skip GPU with MESLinux
- CVE-2025-37852drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create()Linux
- CVE-2025-37851fbdev: omapfb: Add 'plane' value checkLinux
- CVE-2025-37850pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()Linux
- CVE-2025-37848accel/ivpu: Fix PM related deadlocks in MS IOCTLsLinux
- CVE-2025-37847accel/ivpu: Fix deadlock in ivpu_ms_cleanup()Linux
- CVE-2025-37846arm64: mops: Do not dereference src reg for a set operationLinux
- CVE-2025-37844cifs: avoid NULL pointer dereference in dbg callLinux
- CVE-2025-37843PCI: pciehp: Avoid unnecessary device replacement checkLinux
- CVE-2025-37842spi: fsl-qspi: use devm function instead of driver removeLinux
- CVE-2025-37841pm: cpupower: bench: Prevent NULL dereference on malloc failureLinux
- CVE-2025-37840mtd: rawnand: brcmnand: fix PM resume warningLinux
- CVE-2025-37839jbd2: remove wrong sb->s_sequence checkLinux
- CVE-2025-37837iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent()Linux
- CVE-2025-37836PCI: Fix reference leak in pci_register_host_bridge()Linux
- CVE-2025-4468SourceCodester Online Student Clearance System edit-photo.php unrestricted uploadSourceCodester Online Student Clearance System
- CVE-2025-4467SourceCodester Online Student Clearance System edit-admin.php sql injectionSourceCodester Online Student Clearance System
- CVE-2025-4466itsourcecode Gym Management System ajax.php sql injectionitsourcecode Gym Management System
- CVE-2025-4465itsourcecode Gym Management System ajax.php sql injectionitsourcecode Gym Management System
- CVE-2025-4464itsourcecode Gym Management System ajax.php sql injectionitsourcecode Gym Management System
- CVE-2025-4376Cross-Site Scripting vulnerability in Model Search in Pro Cloud Server's WebEASparx Systems Pro Cloud Server
- CVE-2025-4375Cross-Site Request Forgery vulnerability in Pro Cloud Server's WebEASparx Systems Pro Cloud Server
- CVE-2025-4463itsourcecode Gym Management System ajax.php sql injectionitsourcecode Gym Management System
- CVE-2025-4461TOTOLINK N150RT Virtual Server Page cross site scriptingTOTOLINK N150RT
- CVE-2025-4460TOTOLINK N150RT URL Filtering Page cross site scriptingTOTOLINK N150RT
- CVE-2025-4459code-projects Patient Record Management System fecalysis_form.php sql injectioncode-projects Patient Record Management System
- CVE-2025-4458code-projects Patient Record Management System edit_upatient.php sql injectioncode-projects Patient Record Management System
- CVE-2025-4457Project Worlds Car Rental Project approve.php sql injectionProject Worlds Car Rental Project
- CVE-2025-4456Project Worlds Car Rental Project signup.php sql injectionProject Worlds Car Rental Project
- CVE-2025-4454D-Link DIR-619L wake_on_lan command injectionD-Link DIR-619L
- CVE-2025-4453D-Link DIR-619L formSysCmd command injectionD-Link DIR-619L
- CVE-2025-4445D-Link DIR-605L wake_on_lan command injectionD-Link DIR-605L
- CVE-2025-28201An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access.
- CVE-2025-47735inner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization.Nugine wgp · wgp
- CVE-2025-47736dialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8.gwenn libsql-sqlite3-parser · libsql-sqlite3-parser
- CVE-2025-47737lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.Geal trailer · trailer