CVEs published May 11, 2025
28 CVEs were published on May 11, 2025: 0 critical, 4 high.
- Published
- 28
- Critical
- 0
- High
- 4
- Medium
- 22
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Dígitro NGC Explorer
- 3
- Campcodes Online Food Ordering System
- 2
- ContiNew Admin
- 2
- Gosuncn Technology Group Audio-Visual Integrated Management…
- 2
- Seeyon Zhiyuan OA Web Application System
- 2
- 1Panel-dev MaxKB
- 1
- CTCMS Content Management System
- 1
- D-Link DI-8100
- 1
- feng_ha_ha ssm-erp · feng_ha_ha production_ssm +2
- 1
- Freeebird Hotel 酒店管理系统 API
- 1
High 4
- CVE-2025-4544D-Link DI-8100 jhttpd ddos.asp stack-based overflowD-Link DI-8100
- CVE-2025-4540MTSoftware C-Lodop CLodopPrintService unquoted search pathMTSoftware C-Lodop
- CVE-2025-4539Hainan ToDesk DLL File Parser profapi.dll uncontrolled search pathHainan ToDesk
- CVE-2025-4532Shanghai Bairui Information Technology SunloginClient sunlogin_guard.exe uncontrolled search pathShanghai Bairui Information Technology SunloginClient
Medium, low and unrated 24
- CVE-2025-4552ContiNew Admin password unverified password changeContiNew Admin
- CVE-2025-4551ContiNew Admin file cross site scriptingContiNew Admin
- CVE-2025-4550PHPGurukul Apartment Visitors Management System pass-details.php sql injectionPHPGurukul Apartment Visitors Management System
- CVE-2025-4549Campcodes Online Food Ordering System register-router.php sql injectionCampcodes Online Food Ordering System
- CVE-2025-4548Campcodes Online Food Ordering System router.php sql injectionCampcodes Online Food Ordering System
- CVE-2025-4547SourceCodester Web-based Pharmacy Product Management System Add User Page cross site scriptingSourceCodester Web-based Pharmacy Product Management System
- CVE-2025-45461Panel-dev MaxKB Knowledge Base Module csv injection1Panel-dev MaxKB
- CVE-2025-4545CTCMS Content Management System File Tpl.php del path traversalCTCMS Content Management System
- CVE-2025-4543LyLme Spage ajax_link.php sql injectionLyLme Spage
- CVE-2025-4542Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policyFreeebird Hotel 酒店管理系统 API
- CVE-2025-4541LmxCMS POST Request ZtAction.class.php manageZt sql injectionLmxCMS
- CVE-2025-4538kkFileView fileUpload unrestricted uploadkkFileView
- CVE-2025-4537yangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookieyangzongzhuan RuoYi-Vue
- CVE-2025-4536Gosuncn Technology Group Audio-Visual Integrated Management Platform listByPage information disclosureGosuncn Technology Group Audio-Visual Integrated Management…
- CVE-2025-4535Gosuncn Technology Group Audio-Visual Integrated Management Platform Configuration File config.properties information disclosureGosuncn Technology Group Audio-Visual Integrated Management…
- CVE-2025-4534SunGrow Logger1000 weak passwordSunGrow Logger1000
- CVE-2025-4533JeecgBoot Document Library Upload zip unzipFile resource consumptionJeecgBoot
- CVE-2025-4531Seeyon Zhiyuan OA Web Application System Beetl Template EhrSalaryPayrollServiceImpl.class postData code injectionSeeyon Zhiyuan OA Web Application System
- CVE-2025-4530feng_ha_ha/megagao ssm-erp/production_ssm File FileController.java handleFileDownload path traversalfeng_ha_ha ssm-erp · feng_ha_ha production_ssm +2
- CVE-2025-4529Seeyon Zhiyuan OA Web Application System ZIP File M3CoreController.class download path traversalSeeyon Zhiyuan OA Web Application System
- CVE-2025-4528Dígitro NGC Explorer session expirationDígitro NGC Explorer
- CVE-2025-4527Dígitro NGC Explorer Password Transmission client-side enforcement of server-side securityDígitro NGC Explorer
- CVE-2025-4526Dígitro NGC Explorer Configuration missing password field maskingDígitro NGC Explorer
- CVE-2025-47828Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.Lumi H5P-Nodejs-library · @lumieducation/h5p-server