# CVEs published 2025-05-11

28 CVEs were published on May 11, 2025: 0 critical, 4 high. Days are UTC.

- [CVE-2025-4552](https://cve.now/CVE-2025-4552.md): ContiNew Admin password unverified password change (CVSS 5.3, ContiNew Admin)
- [CVE-2025-4551](https://cve.now/CVE-2025-4551.md): ContiNew Admin file cross site scripting (CVSS 5.1, ContiNew Admin)
- [CVE-2025-4550](https://cve.now/CVE-2025-4550.md): PHPGurukul Apartment Visitors Management System pass-details.php sql injection (CVSS 6.9, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-4549](https://cve.now/CVE-2025-4549.md): Campcodes Online Food Ordering System register-router.php sql injection (CVSS 6.9, Campcodes Online Food Ordering System)
- [CVE-2025-4548](https://cve.now/CVE-2025-4548.md): Campcodes Online Food Ordering System router.php sql injection (CVSS 6.9, Campcodes Online Food Ordering System)
- [CVE-2025-4547](https://cve.now/CVE-2025-4547.md): SourceCodester Web-based Pharmacy Product Management System Add User Page cross site scripting (CVSS 4.8, SourceCodester Web-based Pharmacy Product Management System)
- [CVE-2025-4546](https://cve.now/CVE-2025-4546.md): 1Panel-dev MaxKB Knowledge Base Module csv injection (CVSS 5.1, 1Panel-dev MaxKB)
- [CVE-2025-4545](https://cve.now/CVE-2025-4545.md): CTCMS Content Management System File Tpl.php del path traversal (CVSS 5.3, CTCMS Content Management System)
- [CVE-2025-4544](https://cve.now/CVE-2025-4544.md): D-Link DI-8100 jhttpd ddos.asp stack-based overflow (CVSS 7.5, D-Link DI-8100)
- [CVE-2025-4543](https://cve.now/CVE-2025-4543.md): LyLme Spage ajax\_link.php sql injection (CVSS 6.9, LyLme Spage)
- [CVE-2025-4542](https://cve.now/CVE-2025-4542.md): Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy (CVSS 2.3, Freeebird Hotel 酒店管理系统 API)
- [CVE-2025-4541](https://cve.now/CVE-2025-4541.md): LmxCMS POST Request ZtAction.class.php manageZt sql injection (CVSS 5.3, LmxCMS)
- [CVE-2025-4540](https://cve.now/CVE-2025-4540.md): MTSoftware C-Lodop CLodopPrintService unquoted search path (CVSS 7.3, MTSoftware C-Lodop)
- [CVE-2025-4539](https://cve.now/CVE-2025-4539.md): Hainan ToDesk DLL File Parser profapi.dll uncontrolled search path (CVSS 7.3, Hainan ToDesk)
- [CVE-2025-4538](https://cve.now/CVE-2025-4538.md): kkFileView fileUpload unrestricted upload (CVSS 5.3, kkFileView)
- [CVE-2025-4537](https://cve.now/CVE-2025-4537.md): yangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookie (CVSS 2.3, yangzongzhuan RuoYi-Vue)
- [CVE-2025-4536](https://cve.now/CVE-2025-4536.md): Gosuncn Technology Group Audio-Visual Integrated Management Platform listByPage information disclosure (CVSS 6.9, Gosuncn Technology Group Audio-Visual Integrated Management…)
- [CVE-2025-4535](https://cve.now/CVE-2025-4535.md): Gosuncn Technology Group Audio-Visual Integrated Management Platform Configuration File config.properties information disclosure (CVSS 6.9, Gosuncn Technology Group Audio-Visual Integrated Management…)
- [CVE-2025-4534](https://cve.now/CVE-2025-4534.md): SunGrow Logger1000 weak password (CVSS 6.3, SunGrow Logger1000)
- [CVE-2025-4533](https://cve.now/CVE-2025-4533.md): JeecgBoot Document Library Upload zip unzipFile resource consumption (CVSS 5.1, JeecgBoot)
- [CVE-2025-4532](https://cve.now/CVE-2025-4532.md): Shanghai Bairui Information Technology SunloginClient sunlogin\_guard.exe uncontrolled search path (CVSS 7.3, Shanghai Bairui Information Technology SunloginClient)
- [CVE-2025-4531](https://cve.now/CVE-2025-4531.md): Seeyon Zhiyuan OA Web Application System Beetl Template EhrSalaryPayrollServiceImpl.class postData code injection (CVSS 5.3, Seeyon Zhiyuan OA Web Application System)
- [CVE-2025-4530](https://cve.now/CVE-2025-4530.md): feng\_ha\_ha/megagao ssm-erp/production\_ssm File FileController.java handleFileDownload path traversal (CVSS 5.3, feng\_ha\_ha ssm-erp · feng\_ha\_ha production\_ssm +2)
- [CVE-2025-4529](https://cve.now/CVE-2025-4529.md): Seeyon Zhiyuan OA Web Application System ZIP File M3CoreController.class download path traversal (CVSS 5.3, Seeyon Zhiyuan OA Web Application System)
- [CVE-2025-4528](https://cve.now/CVE-2025-4528.md): Dígitro NGC Explorer session expiration (CVSS 5.3, Dígitro NGC Explorer)
- [CVE-2025-4527](https://cve.now/CVE-2025-4527.md): Dígitro NGC Explorer Password Transmission client-side enforcement of server-side security (CVSS 6.3, Dígitro NGC Explorer)
- [CVE-2025-4526](https://cve.now/CVE-2025-4526.md): Dígitro NGC Explorer Configuration missing password field masking (CVSS 5.3, Dígitro NGC Explorer)
- [CVE-2025-47828](https://cve.now/CVE-2025-47828.md): Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings. (CVSS 6.4, Lumi H5P-Nodejs-library · @lumieducation/h5p-server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.