# CVEs published 2025-05-09

152 CVEs were published on May 9, 2025: 24 critical, 41 high. Days are UTC.

- [CVE-2025-3794](https://cve.now/CVE-2025-3794.md): WPForms Lite \<= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start\_timestamp' Parameter (CVSS 5.4, smub WPForms – Easy Form Builder for WordPress – Contact Fo…)
- [CVE-2025-4494](https://cve.now/CVE-2025-4494.md): JAdmin-JAVA JAdmin Admin Backend NoNeedLoginController.java toLogin improper authentication (CVSS 6.9, JAdmin-JAVA JAdmin)
- [CVE-2025-4492](https://cve.now/CVE-2025-4492.md): Campcodes Online Food Ordering System ticket-message.php sql injection (CVSS 6.9, Campcodes Online Food Ordering System)
- [CVE-2025-4491](https://cve.now/CVE-2025-4491.md): Campcodes Online Food Ordering System ticket-status.php sql injection (CVSS 6.9, Campcodes Online Food Ordering System)
- [CVE-2025-4490](https://cve.now/CVE-2025-4490.md): Campcodes Online Food Ordering System view-ticket-admin.php sql injection (CVSS 6.9, Campcodes Online Food Ordering System)
- [CVE-2025-47269](https://cve.now/CVE-2025-47269.md): code-server session cookie can be extracted by having user visit specially crafted proxy URL (CVSS 8.3, coder code-server · code-server)
- [CVE-2025-4447](https://cve.now/CVE-2025-4447.md): Buffer Overflow in Eclipse OpenJ9 (CVSS 7.0, Eclipse Foundation OpenJ9)
- [CVE-2025-4489](https://cve.now/CVE-2025-4489.md): Campcodes Online Food Ordering System user-router.php sql injection (CVSS 6.9, Campcodes Online Food Ordering System)
- [CVE-2025-4488](https://cve.now/CVE-2025-4488.md): itsourcecode Gym Management System ajax.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-4487](https://cve.now/CVE-2025-4487.md): itsourcecode Gym Management System ajax.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-4486](https://cve.now/CVE-2025-4486.md): itsourcecode Gym Management System ajax.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-4485](https://cve.now/CVE-2025-4485.md): itsourcecode Gym Management System ajax.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-4484](https://cve.now/CVE-2025-4484.md): itsourcecode Gym Management System ajax.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-4483](https://cve.now/CVE-2025-4483.md): itsourcecode Gym Management System view\_pdetails.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-4482](https://cve.now/CVE-2025-4482.md): Project Worlds Student Project Allocation System forgot\_password\_sql.php sql injection (CVSS 6.9, Project Worlds Student Project Allocation System)
- [CVE-2025-1993](https://cve.now/CVE-2025-1993.md): IBM App Connect Enterprise Certified Container information disclosure (CVSS 5.1, IBM App Connect Enterprise Certified Container)
- [CVE-2025-4481](https://cve.now/CVE-2025-4481.md): SourceCodester Apartment Visitor Management System search-result.php sql injection (CVSS 6.9, SourceCodester Apartment Visitor Management System)
- [CVE-2025-4480](https://cve.now/CVE-2025-4480.md): code-projects Simple College Management System Add New Student input stack-based overflow (CVSS 4.8, code-projects Simple College Management System)
- [CVE-2024-8973](https://cve.now/CVE-2024-8973.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-0549](https://cve.now/CVE-2025-0549.md): Authentication Bypass Using an Alternate Path or Channel in GitLab (CVSS 6.8, GitLab)
- [CVE-2025-1278](https://cve.now/CVE-2025-1278.md): Insufficient Granularity of Access Control in GitLab (CVSS 5.3, GitLab)
- [CVE-2025-4432](https://cve.now/CVE-2025-4432.md): Ring: some aes functions may panic when overflow checking is enabled in ring (CVSS 5.3, ring · Red Hat Enterprise Linux +5)
- [CVE-2024-9524](https://cve.now/CVE-2024-9524.md): Privilege Escalation Vulnerability in Avira Prime Version 1.1.96.2 (CVSS 7.8, Aira Prime)
- [CVE-2024-13962](https://cve.now/CVE-2024-13962.md): Link Following Local Privilege Escalation Vulnerability in Avast Cleanup Premium Version 24.2.16593.17810 (CVSS 7.8, Avast CleanUp Premium)
- [CVE-2024-13961](https://cve.now/CVE-2024-13961.md): Avast Cleanup Premium TuneupSvc Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, Avast CleanUp Premium)
- [CVE-2024-13960](https://cve.now/CVE-2024-13960.md): Link Following Local Privilege Escalation Vulnerability in AVG TuneUp Version 23.4 (CVSS 7.8, AVG TuneUp)
- [CVE-2024-13959](https://cve.now/CVE-2024-13959.md): Link Following Local Privilege Escalation Vulnerability in AVG TuneUp 24.2.16593.9844 (CVSS 7.8, AVG TuneUp)
- [CVE-2024-13759](https://cve.now/CVE-2024-13759.md): Local Privilege Escalation in Avira Prime 1.1.96.2 on Windows 10 x64 (CVSS 7.8, Avira Prime)
- [CVE-2024-13944](https://cve.now/CVE-2024-13944.md): Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate (Also affects Avast CleanUp and AVG TuneUp) (CVSS 7.8, Norton Utilities Ultimate · Avast CleanUp +1)
- [CVE-2024-12442](https://cve.now/CVE-2024-12442.md): Command injection in EnerSys AMPA versions 24.04 through 24.16, inclusive (CVSS 9.8, EnerSys AMPA)
- [CVE-2024-11861](https://cve.now/CVE-2024-11861.md): Command injection in EnerSys AMPA 22.09 and prior versions (CVSS 9.8, EnerSys AMPA)
- [CVE-2025-4382](https://cve.now/CVE-2025-4382.md): Grub2: grub allow access to encrypted device through cli once root device is unlocked via tpm (CVSS 5.9, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2025-3528](https://cve.now/CVE-2025-3528.md): Mirror-registry: local privilege escalation due to incorrect permissions in mirror-registry (CVSS 8.2, mirror-registry · Red Hat MIRROR-REGISTRY-2.0-RHEL-8 +1)
- [CVE-2025-1087](https://cve.now/CVE-2025-1087.md): Arbitrary Code Execution in Kong Insomnia Desktop Application (CVSS 9.3, Kong Insomnia)
- [CVE-2025-3897](https://cve.now/CVE-2025-3897.md): EUCookieLaw \<= 2.7.2 - Unauthenticated Arbitrary File Read (CVSS 5.9, diego-la-monica EUCookieLaw)
- [CVE-2025-4206](https://cve.now/CVE-2025-4206.md): WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg \<= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion (CVSS 7.2, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2025-46392](https://cve.now/CVE-2025-46392.md): Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.x (CVSS 6.5, Apache Software Foundation Apache Commons Configuration · c…)
- [CVE-2025-4403](https://cve.now/CVE-2025-4403.md): Drag and Drop Multiple File Upload for WooCommerce \<= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function (CVSS 9.8, glenwpcoder Drag and Drop Multiple File Upload for WooComme…)
- [CVE-2025-3949](https://cve.now/CVE-2025-3949.md): Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode \<= 6.18.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3, Website Builder by SeedProd — Theme Builder, Landing Page B…)
- [CVE-2025-4472](https://cve.now/CVE-2025-4472.md): code-projects Departmental Store Management System bill stack-based overflow (CVSS 4.8, code-projects Departmental Store Management System)
- [CVE-2025-4471](https://cve.now/CVE-2025-4471.md): code-projects Jewelery Store Management system Search Item View stack-based overflow (CVSS 4.8, code-projects Jewelery Store Management system)
- [CVE-2025-4470](https://cve.now/CVE-2025-4470.md): SourceCodester Online Student Clearance System add-student.php cross site scripting (CVSS 4.8, SourceCodester Online Student Clearance System)
- [CVE-2025-4469](https://cve.now/CVE-2025-4469.md): SourceCodester Online Student Clearance System add-admin.php cross site scripting (CVSS 4.8, SourceCodester Online Student Clearance System)
- [CVE-2025-37889](https://cve.now/CVE-2025-37889.md): ASoC: ops: Consistently treat platform\_max as control value (no CVSS, Linux)
- [CVE-2025-37888](https://cve.now/CVE-2025-37888.md): net/mlx5: Fix null-ptr-deref in mlx5\_create\_{inner\_,}ttc\_table() (no CVSS, Linux)
- [CVE-2025-37887](https://cve.now/CVE-2025-37887.md): pds\_core: handle unsupported PDS\_CORE\_CMD\_FW\_CONTROL result (CVSS 7.1, Linux)
- [CVE-2025-37886](https://cve.now/CVE-2025-37886.md): pds\_core: make wait\_context part of q\_info (CVSS 7.8, Linux)
- [CVE-2025-37885](https://cve.now/CVE-2025-37885.md): KVM: x86: Reset IRTE to host control if \*new\* route isn't postable (CVSS 8.8, Linux)
- [CVE-2025-37884](https://cve.now/CVE-2025-37884.md): bpf: Fix deadlock between rcu\_tasks\_trace and event\_mutex. (no CVSS, Linux)
- [CVE-2025-37883](https://cve.now/CVE-2025-37883.md): s390/sclp: Add check for get\_zeroed\_page() (no CVSS, Linux)
- [CVE-2025-37882](https://cve.now/CVE-2025-37882.md): usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (CVSS 7.8, Linux)
- [CVE-2025-37881](https://cve.now/CVE-2025-37881.md): usb: gadget: aspeed: Add NULL pointer check in ast\_vhub\_init\_dev() (no CVSS, Linux)
- [CVE-2025-37880](https://cve.now/CVE-2025-37880.md): um: work around sched\_yield not yielding in time-travel mode (no CVSS, Linux)
- [CVE-2025-37879](https://cve.now/CVE-2025-37879.md): 9p/net: fix improper handling of bogus negative read/write replies (CVSS 9.8, Linux)
- [CVE-2025-37878](https://cve.now/CVE-2025-37878.md): perf/core: Fix WARN\_ON(!ctx) in \_\_free\_event() for partial init (no CVSS, Linux)
- [CVE-2025-37877](https://cve.now/CVE-2025-37877.md): iommu: Clear iommu-dma ops on cleanup (no CVSS, Linux)
- [CVE-2025-37876](https://cve.now/CVE-2025-37876.md): netfs: Only create /proc/fs/netfs with CONFIG\_PROC\_FS (CVSS 7.0, Linux)
- [CVE-2025-37875](https://cve.now/CVE-2025-37875.md): igc: fix PTM cycle trigger logic (no CVSS, Linux)
- [CVE-2025-37874](https://cve.now/CVE-2025-37874.md): net: ngbe: fix memory leak in ngbe\_probe() error path (no CVSS, Linux)
- [CVE-2025-37873](https://cve.now/CVE-2025-37873.md): eth: bnxt: fix missing ring index trim on error path (CVSS 7.8, Linux)
- [CVE-2025-37872](https://cve.now/CVE-2025-37872.md): net: txgbe: fix memory leak in txgbe\_probe() error path (no CVSS, Linux)
- [CVE-2025-37871](https://cve.now/CVE-2025-37871.md): nfsd: decrease sc\_count directly if fail to queue dl\_recall (CVSS 7.5, Linux)
- [CVE-2025-37870](https://cve.now/CVE-2025-37870.md): drm/amd/display: prevent hang on link training fail (no CVSS, Linux)
- [CVE-2025-37869](https://cve.now/CVE-2025-37869.md): drm/xe: Use local fence in error path of xe\_migrate\_clear (CVSS 7.8, Linux)
- [CVE-2025-37868](https://cve.now/CVE-2025-37868.md): drm/xe/userptr: fix notifier vs folio deadlock (no CVSS, Linux)
- [CVE-2025-37867](https://cve.now/CVE-2025-37867.md): RDMA/core: Silence oversized kvmalloc() warning (no CVSS, Linux)
- [CVE-2025-37866](https://cve.now/CVE-2025-37866.md): mlxbf-bootctl: use sysfs\_emit\_at() in secure\_boot\_fuse\_state\_show() (no CVSS, Linux)
- [CVE-2025-37865](https://cve.now/CVE-2025-37865.md): net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (no CVSS, Linux)
- [CVE-2025-37864](https://cve.now/CVE-2025-37864.md): net: dsa: clean up FDB, MDB, VLAN entries on unbind (no CVSS, Linux)
- [CVE-2025-37863](https://cve.now/CVE-2025-37863.md): ovl: don't allow datadir only (no CVSS, Linux)
- [CVE-2025-3455](https://cve.now/CVE-2025-3455.md): 1 Click WordPress Migration Plugin – 100% FREE for a limited time \<= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, 1clickmigration 1 Click Migration & Backup: Free WordPress…)
- [CVE-2024-11617](https://cve.now/CVE-2024-11617.md): Envolve Plugin \<= 1.0 - Unauthenticated Arbitrary File Upload via language\_file and fonts\_file (CVSS 9.8, ThemeKalia Envolve Plugin)
- [CVE-2025-2253](https://cve.now/CVE-2025-2253.md): IMITHEMES Listing \<= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Reset (CVSS 9.8, IMITHEMES Listing)
- [CVE-2025-3605](https://cve.now/CVE-2025-3605.md): Frontend Login and Registration Blocks \<= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8, arkenon Login, Registration and Lost Password Blocks)
- [CVE-2025-37862](https://cve.now/CVE-2025-37862.md): HID: pidff: Fix null pointer dereference in pidff\_find\_fields (no CVSS, Linux)
- [CVE-2025-37861](https://cve.now/CVE-2025-37861.md): scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (CVSS 7.8, Linux)
- [CVE-2025-37859](https://cve.now/CVE-2025-37859.md): page\_pool: avoid infinite loop to schedule delayed worker (no CVSS, Linux)
- [CVE-2025-37858](https://cve.now/CVE-2025-37858.md): fs/jfs: Prevent integer overflow in AG size calculation (no CVSS, Linux)
- [CVE-2025-37857](https://cve.now/CVE-2025-37857.md): scsi: st: Fix array overflow in st\_setup() (no CVSS, Linux)
- [CVE-2025-37856](https://cve.now/CVE-2025-37856.md): btrfs: harden block\_group::bg\_list against list\_del() races (CVSS 7.8, Linux)
- [CVE-2025-37855](https://cve.now/CVE-2025-37855.md): drm/amd/display: Guard Possible Null Pointer Dereference (no CVSS, Linux)
- [CVE-2025-37854](https://cve.now/CVE-2025-37854.md): drm/amdkfd: Fix mode1 reset crash issue (CVSS 7.8, Linux)
- [CVE-2025-37853](https://cve.now/CVE-2025-37853.md): drm/amdkfd: debugfs hang\_hws skip GPU with MES (no CVSS, Linux)
- [CVE-2025-37852](https://cve.now/CVE-2025-37852.md): drm/amdgpu: handle amdgpu\_cgs\_create\_device() errors in amd\_powerplay\_create() (no CVSS, Linux)
- [CVE-2025-37851](https://cve.now/CVE-2025-37851.md): fbdev: omapfb: Add 'plane' value check (no CVSS, Linux)
- [CVE-2025-37850](https://cve.now/CVE-2025-37850.md): pwm: mediatek: Prevent divide-by-zero in pwm\_mediatek\_config() (no CVSS, Linux)
- [CVE-2025-37849](https://cve.now/CVE-2025-37849.md): KVM: arm64: Tear down vGIC on failed vCPU creation (CVSS 8.8, Linux)
- [CVE-2025-37848](https://cve.now/CVE-2025-37848.md): accel/ivpu: Fix PM related deadlocks in MS IOCTLs (no CVSS, Linux)
- [CVE-2025-37847](https://cve.now/CVE-2025-37847.md): accel/ivpu: Fix deadlock in ivpu\_ms\_cleanup() (no CVSS, Linux)
- [CVE-2025-37846](https://cve.now/CVE-2025-37846.md): arm64: mops: Do not dereference src reg for a set operation (no CVSS, Linux)
- [CVE-2025-37845](https://cve.now/CVE-2025-37845.md): tracing: fprobe events: Fix possible UAF on modules (CVSS 7.8, Linux)
- [CVE-2025-37844](https://cve.now/CVE-2025-37844.md): cifs: avoid NULL pointer dereference in dbg call (no CVSS, Linux)
- [CVE-2025-37843](https://cve.now/CVE-2025-37843.md): PCI: pciehp: Avoid unnecessary device replacement check (no CVSS, Linux)
- [CVE-2025-37842](https://cve.now/CVE-2025-37842.md): spi: fsl-qspi: use devm function instead of driver remove (no CVSS, Linux)
- [CVE-2025-37841](https://cve.now/CVE-2025-37841.md): pm: cpupower: bench: Prevent NULL dereference on malloc failure (no CVSS, Linux)
- [CVE-2025-37840](https://cve.now/CVE-2025-37840.md): mtd: rawnand: brcmnand: fix PM resume warning (no CVSS, Linux)
- [CVE-2025-37839](https://cve.now/CVE-2025-37839.md): jbd2: remove wrong sb-\>s\_sequence check (no CVSS, Linux)
- [CVE-2025-37837](https://cve.now/CVE-2025-37837.md): iommu/tegra241-cmdqv: Fix warnings due to dmam\_free\_coherent() (no CVSS, Linux)
- [CVE-2025-37836](https://cve.now/CVE-2025-37836.md): PCI: Fix reference leak in pci\_register\_host\_bridge() (no CVSS, Linux)
- [CVE-2025-4468](https://cve.now/CVE-2025-4468.md): SourceCodester Online Student Clearance System edit-photo.php unrestricted upload (CVSS 6.9, SourceCodester Online Student Clearance System)
- [CVE-2025-4467](https://cve.now/CVE-2025-4467.md): SourceCodester Online Student Clearance System edit-admin.php sql injection (CVSS 6.9, SourceCodester Online Student Clearance System)
- [CVE-2025-4466](https://cve.now/CVE-2025-4466.md): itsourcecode Gym Management System ajax.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-3463](https://cve.now/CVE-2025-3463.md): "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulne (CVSS 9.4, ASUS DriverHub)
- [CVE-2025-3462](https://cve.now/CVE-2025-3462.md): "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in AS (CVSS 8.4, ASUS DriverHub)
- [CVE-2025-4465](https://cve.now/CVE-2025-4465.md): itsourcecode Gym Management System ajax.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-4464](https://cve.now/CVE-2025-4464.md): itsourcecode Gym Management System ajax.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-4377](https://cve.now/CVE-2025-4377.md): Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.php (CVSS 8.3, Sparx Systems Pro Cloud Server)
- [CVE-2025-4376](https://cve.now/CVE-2025-4376.md): Cross-Site Scripting vulnerability in Model Search in Pro Cloud Server's WebEA (CVSS 5.3, Sparx Systems Pro Cloud Server)
- [CVE-2025-4375](https://cve.now/CVE-2025-4375.md): Cross-Site Request Forgery vulnerability in Pro Cloud Server's WebEA (CVSS 6.9, Sparx Systems Pro Cloud Server)
- [CVE-2025-4463](https://cve.now/CVE-2025-4463.md): itsourcecode Gym Management System ajax.php sql injection (CVSS 6.9, itsourcecode Gym Management System)
- [CVE-2025-4462](https://cve.now/CVE-2025-4462.md): TOTOLINK N150RT formWsc buffer overflow (CVSS 8.7, TOTOLINK N150RT)
- [CVE-2025-4461](https://cve.now/CVE-2025-4461.md): TOTOLINK N150RT Virtual Server Page cross site scripting (CVSS 4.8, TOTOLINK N150RT)
- [CVE-2025-3714](https://cve.now/CVE-2025-3714.md): ATEN LCD KVM over IP Switch CL5708IM - Stack-based Buffer Overflow (CVSS 9.8, ATEN CL5708IM)
- [CVE-2025-3713](https://cve.now/CVE-2025-3713.md): ATEN LCD KVM over IP Switch CL5708IM - Heap-based Buffer Overflow (CVSS 7.5, ATEN CL5708IM)
- [CVE-2025-3712](https://cve.now/CVE-2025-3712.md): ATEN LCD KVM over IP Switch CL5708IM - Heap-based Buffer Overflow (CVSS 7.5, ATEN CL5708IM)
- [CVE-2025-4460](https://cve.now/CVE-2025-4460.md): TOTOLINK N150RT URL Filtering Page cross site scripting (CVSS 4.8, TOTOLINK N150RT)
- [CVE-2025-4459](https://cve.now/CVE-2025-4459.md): code-projects Patient Record Management System fecalysis\_form.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-3711](https://cve.now/CVE-2025-3711.md): ATEN LCD KVM over IP Switch CL5708IM - Stack-based Buffer Overflow (CVSS 9.8, ATEN CL5708IM)
- [CVE-2025-3710](https://cve.now/CVE-2025-3710.md): ATEN LCD KVM over IP Switch CL5708IM - Stack-based Buffer Overflow (CVSS 9.8, ATEN CL5708IM)
- [CVE-2025-4458](https://cve.now/CVE-2025-4458.md): code-projects Patient Record Management System edit\_upatient.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-4457](https://cve.now/CVE-2025-4457.md): Project Worlds Car Rental Project approve.php sql injection (CVSS 6.9, Project Worlds Car Rental Project)
- [CVE-2025-4456](https://cve.now/CVE-2025-4456.md): Project Worlds Car Rental Project signup.php sql injection (CVSS 6.9, Project Worlds Car Rental Project)
- [CVE-2025-4455](https://cve.now/CVE-2025-4455.md): Patch My PC Home Updater System.IO uncontrolled search path (CVSS 7.3, Patch My PC Home Updater)
- [CVE-2025-4454](https://cve.now/CVE-2025-4454.md): D-Link DIR-619L wake\_on\_lan command injection (CVSS 5.3, D-Link DIR-619L)
- [CVE-2025-4453](https://cve.now/CVE-2025-4453.md): D-Link DIR-619L formSysCmd command injection (CVSS 5.3, D-Link DIR-619L)
- [CVE-2025-3811](https://cve.now/CVE-2025-3811.md): WPBookit \<= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update (CVSS 9.8, iqonicdesign WPBookit)
- [CVE-2025-3810](https://cve.now/CVE-2025-3810.md): WPBookit \<= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8, iqonicdesign WPBookit)
- [CVE-2025-4452](https://cve.now/CVE-2025-4452.md): D-Link DIR-619L formSetWizard2 buffer overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-4451](https://cve.now/CVE-2025-4451.md): D-Link DIR-619L formSetWAN\_Wizard52 buffer overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-4450](https://cve.now/CVE-2025-4450.md): D-Link DIR-619L formSetEasy\_Wizard buffer overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-4449](https://cve.now/CVE-2025-4449.md): D-Link DIR-619L formEasySetupWizard3 buffer overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-4448](https://cve.now/CVE-2025-4448.md): D-Link DIR-619L formEasySetupWizard buffer overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-4446](https://cve.now/CVE-2025-4446.md): H3C GR-5400AX aspForm Edit\_List\_SSID buffer overflow (CVSS 8.6, H3C GR-5400AX)
- [CVE-2025-4445](https://cve.now/CVE-2025-4445.md): D-Link DIR-605L wake\_on\_lan command injection (CVSS 5.3, D-Link DIR-605L)
- [CVE-2025-28200](https://cve.now/CVE-2025-28200.md): Victure RX1800 EN\_V1.0.0\_r12\_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address. (CVSS 9.8)
- [CVE-2025-28201](https://cve.now/CVE-2025-28201.md): An issue in Victure RX1800 EN\_V1.0.0\_r12\_110933 allows physically proximate attackers to execute arbitrary code or gain root access. (CVSS 6.8)
- [CVE-2025-28202](https://cve.now/CVE-2025-28202.md): Incorrect access control in Victure RX1800 EN\_V1.0.0\_r12\_110933 allows attackers to enable SSH and Telnet services without authentication. (CVSS 8.8)
- [CVE-2025-28203](https://cve.now/CVE-2025-28203.md): Victure RX1800 EN\_V1.0.0\_r12\_110933 was discovered to contain a command injection vulnerability. (CVSS 8.8)
- [CVE-2025-29509](https://cve.now/CVE-2025-29509.md): Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to open (CVSS 8.8)
- [CVE-2025-45513](https://cve.now/CVE-2025-45513.md): Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.P2pListFilter. (CVSS 9.8)
- [CVE-2025-45885](https://cve.now/CVE-2025-45885.md): PHPGURUKUL Vehicle Parking Management System v1.13 is vulnerable to SQL injection in the /vpms/users/login.php file. (CVSS 9.8)
- [CVE-2025-45887](https://cve.now/CVE-2025-45887.md): Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent. (CVSS 9.1)
- [CVE-2025-46188](https://cve.now/CVE-2025-46188.md): SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in superadmin\_phpmyadmin.php. (CVSS 9.8)
- [CVE-2025-46189](https://cve.now/CVE-2025-46189.md): SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user\_order\_customer\_update.php via the order\_id POST (CVSS 9.8)
- [CVE-2025-46190](https://cve.now/CVE-2025-46190.md): SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user\_delivery\_update.php via the order\_id POST parame (CVSS 9.8)
- [CVE-2025-46191](https://cve.now/CVE-2025-46191.md): Arbitrary File Upload in user\_payment\_update.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upl (CVSS 9.8)
- [CVE-2025-46192](https://cve.now/CVE-2025-46192.md): SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user\_payment\_update.php via the order\_id POST paramet (CVSS 9.8)
- [CVE-2025-46193](https://cve.now/CVE-2025-46193.md): SourceCodester Client Database Management System 1.0 is vulnerable to Remote code execution via Arbitrary file upload in user\_proposal\_updat (CVSS 9.8)
- [CVE-2025-47424](https://cve.now/CVE-2025-47424.md): Retool (self-hosted) before 3.196.0 allows Host header injection. (CVSS 7.1, Retool)
- [CVE-2025-47735](https://cve.now/CVE-2025-47735.md): inner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop\_slow thread synchronization. (CVSS 2.9, Nugine wgp · wgp)
- [CVE-2025-47736](https://cve.now/CVE-2025-47736.md): dialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8. (CVSS 2.9, gwenn libsql-sqlite3-parser · libsql-sqlite3-parser)
- [CVE-2025-47737](https://cve.now/CVE-2025-47737.md): lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero. (CVSS 2.9, Geal trailer · trailer)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.