# CVEs published 2025-05-10 33 CVEs were published on May 10, 2025: 0 critical, 7 high. Days are UTC. - [CVE-2025-4525](https://cve.now/CVE-2025-4525.md): Discord WINSTA.dll uncontrolled search path (CVSS 7.3, Discord) - [CVE-2025-4515](https://cve.now/CVE-2025-4515.md): Zylon PrivateGPT settings.yaml cross-domain policy (CVSS 5.3, Zylon PrivateGPT) - [CVE-2025-4514](https://cve.now/CVE-2025-4514.md): Zhengzhou Jiuhua Electronic Technology mayicms javascript.php sql injection (CVSS 5.3, Zhengzhou Jiuhua Electronic Technology mayicms) - [CVE-2025-4513](https://cve.now/CVE-2025-4513.md): Catalyst User Key Authentication Plugin Logout logout.php redirect (CVSS 5.3, Catalyst User Key Authentication Plugin) - [CVE-2025-4512](https://cve.now/CVE-2025-4512.md): Inetum IODAS app.jsp cross site scripting (CVSS 5.3, Inetum IODAS) - [CVE-2025-4511](https://cve.now/CVE-2025-4511.md): vector4wang spring-boot-quick quick-img2txt Img2TxtController.java ResponseEntity path traversal (CVSS 5.3, vector4wang spring-boot-quick) - [CVE-2025-4510](https://cve.now/CVE-2025-4510.md): Changjietong UFIDA CRM optntyday.php sql injection (CVSS 5.3, Changjietong UFIDA CRM) - [CVE-2025-4509](https://cve.now/CVE-2025-4509.md): PHPGurukul e-Diary Management System manage-notes.php sql injection (CVSS 6.9, PHPGurukul e-Diary Management System) - [CVE-2025-4508](https://cve.now/CVE-2025-4508.md): PHPGurukul e-Diary Management System my-profile.php sql injection (CVSS 6.9, PHPGurukul e-Diary Management System) - [CVE-2025-4507](https://cve.now/CVE-2025-4507.md): Campcodes Online Food Ordering System add-item.php sql injection (CVSS 6.9, Campcodes Online Food Ordering System) - [CVE-2025-4506](https://cve.now/CVE-2025-4506.md): Campcodes Online Food Ordering System menu-router.php sql injection (CVSS 6.9, Campcodes Online Food Ordering System) - [CVE-2025-4505](https://cve.now/CVE-2025-4505.md): PHPGurukul Apartment Visitors Management System category.php sql injection (CVSS 6.9, PHPGurukul Apartment Visitors Management System) - [CVE-2025-4504](https://cve.now/CVE-2025-4504.md): SourceCodester Online College Library System index.php sql injection (CVSS 6.9, SourceCodester Online College Library System) - [CVE-2023-53145](https://cve.now/CVE-2023-53145.md): Bluetooth: btsdio: fix use after free bug in btsdio\_remove due to race condition (no CVSS, Linux) - [CVE-2025-4503](https://cve.now/CVE-2025-4503.md): Campcodes Sales and Inventory System customer\_update.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System) - [CVE-2025-4502](https://cve.now/CVE-2025-4502.md): Campcodes Sales and Inventory System creditor\_add.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System) - [CVE-2025-1752](https://cve.now/CVE-2025-1752.md): Denial of Service in run-llama/llama\_index (CVSS 7.5, run-llama/llama\_index · llama-index) - [CVE-2025-4501](https://cve.now/CVE-2025-4501.md): code-projects Album Management System Search Albums searchalbum stack-based overflow (CVSS 4.8, code-projects Album Management System) - [CVE-2025-4500](https://cve.now/CVE-2025-4500.md): code-projects Hotel Management System Edit Room edit stack-based overflow (CVSS 4.8, code-projects Hotel Management System) - [CVE-2025-4499](https://cve.now/CVE-2025-4499.md): code-projects Simple Hospital Management System Add Information add stack-based overflow (CVSS 4.8, code-projects Simple Hospital Management System) - [CVE-2025-3878](https://cve.now/CVE-2025-3878.md): SMS Alert Order Notifications – WooCommerce \<= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa\_verify Shortcode (CVSS 6.4, cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…) - [CVE-2025-3876](https://cve.now/CVE-2025-3876.md): SMS Alert Order Notifications – WooCommerce \<= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function (CVSS 8.8, cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…) - [CVE-2025-4498](https://cve.now/CVE-2025-4498.md): code-projects Simple Bus Reservation System Install Bus install stack-based overflow (CVSS 4.8, code-projects Simple Bus Reservation System) - [CVE-2025-2158](https://cve.now/CVE-2025-2158.md): WordPress Review Plugin: The Ultimate Solution for Building a Review Website \<= 5.3.5 - Authenticated (Contributor+) Local File Inclusion via Post Custom Fields (CVSS 8.8, mythemeshop WordPress Review Plugin: The Ultimate Solution…) - [CVE-2025-4497](https://cve.now/CVE-2025-4497.md): code-projects Simple Banking System Sign In buffer overflow (CVSS 4.8, code-projects Simple Banking System) - [CVE-2025-2944](https://cve.now/CVE-2025-2944.md): Jeg Elementor Kit \<= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…) - [CVE-2025-4496](https://cve.now/CVE-2025-4496.md): TOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflow (CVSS 8.7, TOTOLINK T10 · TOTOLINK A3100R +5) - [CVE-2025-1137](https://cve.now/CVE-2025-1137.md): IBM Storage Scale command injection (CVSS 7.5, IBM Storage Scale) - [CVE-2025-4495](https://cve.now/CVE-2025-4495.md): JAdmin-JAVA JAdmin save cross site scripting (CVSS 5.1, JAdmin-JAVA JAdmin) - [CVE-2025-47814](https://cve.now/CVE-2025-47814.md): libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate\_read (called indirectly from spv\_ (CVSS 4.5, GNU PSPP) - [CVE-2025-47815](https://cve.now/CVE-2025-47815.md): libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate\_read (called indirectly from zip\_ (CVSS 4.5, GNU PSPP) - [CVE-2025-47816](https://cve.now/CVE-2025-47816.md): libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml\_parse\_attributes out-of-bounds read, related t (CVSS 2.9, GNU PSPP) - [CVE-2025-47817](https://cve.now/CVE-2025-47817.md): In BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter. (CVSS 8.8, BlueWave Checkmate) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-05-10 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.