CVEs published May 15, 2025
306 CVEs were published on May 15, 2025: 11 critical, 39 high.
- Published
- 306
- Critical
- 11
- High
- 39
- Medium
- 238
- Low
- 18
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 145
Most affected products
- Campcodes Sales and Inventory System
- 12
- itsourcecode Placement Management System
- 6
- NI Circuit Design Suite
- 5
- emlog
- 4
- illi Link Party!
- 4
- PHPGurukul Vehicle Parking Management System
- 4
- EKC Tournament Manager
- 3
- Hitachi JP1/IT Desktop Management 2 - Smart Device Manager
- 3
- Mattermost · github.com/mattermost/mattermost-server +3
- 3
- Z-Downloads
- 3
Critical 11
- CVE-2025-47275Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDKauth0-PHP · auth0/auth0-php
- CVE-2025-47928Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`spotipy-dev spotipy
- CVE-2024-8673Z-Downloads < 1.11.7 - Admin+ Stored XSS via SVG UploadZ-Downloads
- CVE-2024-6809Simple Video Directory < 1.4.3 - Unauthenticated SQLiSimple Video Directory
- CVE-2024-6584Jetpack Boost < 3.4.7 - Admin+ SSRFJetpack Boost
- CVE-2024-6159Push Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLiPush Notification for Post and BuddyPress
- CVE-2025-47788Missing Path Validation Enables Path Traversal in Controller.phpAtheos
- CVE-2025-4564TicketBAI Facturas para WooCommerce <= 3.18 - Unauthenticated Arbitrary File Deletionfacturaone TicketBAI Facturas para WooCommerce
- CVE-2025-32002Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard diI-O DATA DEVICE HDL-TC1 · I-O DATA DEVICE HDL-TC500 +6
- CVE-2025-3917百度站长SEO合集(支持百度/神马/Bing/头条推送) <= 2.0.6 - Unauthenticated Arbitrary File Uploadkelerkgibo SEO合集
- CVE-2025-46052An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive
High 39
- CVE-2025-47287Tornado vulnerable to excessive logging caused by malformed multipart form datatornadoweb tornado · tornado
- CVE-2024-0852coreActivity < 1.8.1 - Unauthenticated Stored XSScoreActivity: Activity Logging for WordPress
- CVE-2024-0249Advanced Schedule Posts <= 2.1.8 - Reflected XSSAdvanced Schedule Posts
- CVE-2023-7239wp-dashboard-notes < 1.0.11 - Contributor+ Arbitrary Private Notes Update via IDORWP Dashboard Notes
- CVE-2023-7231illi Link Party! <= 1.0 - Unauthenticated Arbitrary Link Deletionilli Link Party!
- CVE-2023-7197Marketing Twitter Bot <= 1.11 - Settings Update to Stored XSS via CSRFMarketing Twitter Bot
- CVE-2023-7174aBitGone CommentSafe <= 1.0.0 - Settings Update to Stored XSS via CSRFaBitGone CommentSafe
- CVE-2023-5934Travelpayouts < 1.1.13 - Settings Update via CSRFTravelpayouts: All Travel Brands in One Place
- CVE-2024-9831Taskbuilder < 3.0.9 - Admin+ SQL InjectionTaskbuilder
- CVE-2024-8700Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar DeletionEvent Calendar
- CVE-2024-8699Z-Downloads < 1.11.5 - Admin+ Arbitrary File UploadZ-Downloads
- CVE-2024-6719Offload Videos – Bunny.net, AWS S3 <= 1.0.1 Subscriber+ CSRFOffload Videos
- CVE-2024-6486ImageMagick Engine < 1.7.11 - Administrator+ OS Command InjectionImageMagick Engine
- CVE-2024-12812WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee InformationWP ERP | Complete HR solution with recruitment & job listin…
- CVE-2024-12735Advance Post Prefix <= 1.1.1 - Admin+ SQL InjectionAdvance Post Prefix
- CVE-2024-11372Connexion Logs <= 3.0.2 - Admin+ SQL InjectionConnexion Logs
- CVE-2024-11269AHAthat Plugin <= 1.6 - Admin+ SQL InjectionAHAthat Plugin
- CVE-2024-11267JSP Store Locator <= 1.0 - Contributor+ SQL InjectionJSP Store Locator
- CVE-2025-47785EMLOG SQL Injection Vulnerabilityemlog
- CVE-2025-47787Emlog Pro Contains a File Upload Vulnerabilityemlog
- CVE-2025-47161Microsoft Defender for Endpoint Elevation of Privilege VulnerabilityMicrosoft Defender for Endpoint for Linux
- CVE-2025-26481Dell PowerScale OneFS, versions 9.4.0.0 through 9.9.0.0, contains an uncontrolled resource consumption vulnerability.Dell PowerScale OneFS
- CVE-2025-30475Dell PowerScale InsightIQ, versions 5.0 through 5.2, contains an improper privilege management vulnerability.Dell PowerScale InsightIQ
- CVE-2025-32922WordPress WP2LEADS plugin <= 3.5.0 - Cross Site Request Forgery (CSRF) vulnerabilitySaleswonder Team: Tobias WP2LEADS
- CVE-2025-43853iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi featurebytecodealliance wasm-micro-runtime
- CVE-2025-30421Stack-based Buffer Overflow in DrObjectStorage::XML_Serialize() in NI Circuit Design SuiteNI Circuit Design Suite
- CVE-2025-30420Out of Bounds Read in Bitmap::InternalDraw() in NI Circuit Design SuiteNI Circuit Design Suite
- CVE-2025-30419Out of Bounds Read in GetSymbolBorderRectSize() in NI Circuit Design SuiteNI Circuit Design Suite
- CVE-2025-30418Out of Bounds Write in CheckPins() in NI Circuit Design SuiteNI Circuit Design Suite
- CVE-2025-30417Out of Bounds Write in Library!DecodeBase64() in NI Circuit Design SuiteNI Circuit Design Suite
- CVE-2025-27523XXE vulnerability in JP1/IT Desktop Management 2 - Smart Device ManagerHitachi JP1/IT Desktop Management 2 - Smart Device Manager
- CVE-2024-13914File Manager Advanced Shortcode <= Multiple Versions - Authenticated (Administrator+) Local JavaScript File Inclusion via ShortcodeWP Experts File Manager Advanced Shortcode
- CVE-2025-3053UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.07 - Authenticated (Subscriber+) Remote Code Executionadmintwentytwenty UiPress lite | Effortless custom dashboar…
- CVE-2025-4579WP Content Security Plugin <= 2.3 - Unauthenticated Stored Cross-Site Scripting via CSP-Report Fieldsdyland WP Content Security Plugin
- CVE-2024-52877An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before versio
- CVE-2024-52878An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before versio
- CVE-2024-52879An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before versio
- CVE-2024-52880An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before versio
- CVE-2025-48050In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory.Cure53 DOMPurify
Medium, low and unrated 256
- CVE-2025-4729TOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injectionTOTOLINK A3002R · TOTOLINK A3002RU
- CVE-2025-47930Zulip Server has access control bypass for restrictions on creation of specific channel typeszulip
- CVE-2025-4728SourceCodester Best Online News Portal search.php sql injectionSourceCodester Best Online News Portal
- CVE-2025-4727Meteor livedata_server.js Object.assign redosMeteor
- CVE-2025-0921Information Tampering Vulnerability in Multiple Services of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, GENESIS, GENESIS32, and BizVizMitsubishi Electric GENESIS64 · Mitsubishi Electric ICO… +17
- CVE-2025-4726itsourcecode Placement Management System view_student.php sql injectionitsourcecode Placement Management System
- CVE-2025-4725itsourcecode Placement Management System view_drive.php sql injectionitsourcecode Placement Management System
- CVE-2025-4724itsourcecode Placement Management System student_profile.php sql injectionitsourcecode Placement Management System
- CVE-2025-4723itsourcecode Placement Management System all_student.php sql injectionitsourcecode Placement Management System
- CVE-2025-4722itsourcecode Placement Management System edit_profile.php sql injectionitsourcecode Placement Management System
- CVE-2025-4721itsourcecode Placement Management System drive.php sql injectionitsourcecode Placement Management System
- CVE-2025-4720SourceCodester Student Result Management System drop_student.php path traversalSourceCodester Student Result Management System
- CVE-2025-4719Campcodes Sales and Inventory System cash_transaction.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-4718Campcodes Sales and Inventory System customer_add.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-47929DumbDrop vulnerable to DOM XSS via file uploadDumbWareio DumbDrop
- CVE-2025-1138IBM Information Server information disclosureIBM InfoSphere Information Server
- CVE-2024-8009Sensei LMS < 4.20.0 - Teacher+ Users Email Address DisclosureSensei LMS
- CVE-2024-6711Event Tickets with Ticket Scanner < 2.3.8 - Admin+ Stored XSSEvent Tickets with Ticket Scanner
- CVE-2024-4665EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings updateEventPrime
- CVE-2024-4091Responsive Gallery Grid < 2.3.15 - Admin+ Stored XSSResponsive Gallery Grid
- CVE-2024-4004Advanced Cron Manager < 2.5.7 - Admin+ Stored XSSAdvanced Cron Manager
- CVE-2024-4002Carousel, Slider, Gallery by WP Carousel < 2.6.9 - Editor+ Stored XSSCarousel, Slider, Gallery by WP Carousel
- CVE-2024-3996Post Grid, Post Carousel, & List Category Posts < 2.4.28 - Editor+ Stored XSSSmart Post Show
- CVE-2024-3901Genesis Blocks <= 3.1.3 - Contributor+ Stored XSSGenesis Blocks
- CVE-2024-3062Save as PDF by Pdfcrowd < 3.2.2 - Admin+ Stored XSSSave as Image Plugin by Pdfcrowd
- CVE-2024-2869Easy Property Listings <= 3.5.3 - Admin+ Stored XSSEasy Property Listings
- CVE-2024-2643My Sticky Bar < 2.6.8 - Admin+ Stored XSSFloating Notification Bar, Sticky Menu on Scroll, Announcem…
- CVE-2024-1663Ultimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSSUltimate Noindex Nofollow Tool II
- CVE-2024-12767BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDORbuddyboss-platform
- CVE-2024-0970User Activity Tracking and Log < 4.1.4 - IP SpoofingUser Activity Tracking and Log
- CVE-2023-7297TwitterPosts <= 1.0.2 - Settings Update via CSRFTwitterPosts
- CVE-2023-7230illi Link Party! <= 1.0 - Admin+ Stored Cross-Site Scriptingilli Link Party!
- CVE-2023-7229illi Link Party! <= 1.0 - Settings Update via CSRFilli Link Party!
- CVE-2023-7228illi Link Party! <= 1.0 - Unauthenticated Stored XSSilli Link Party!
- CVE-2023-7196Ultimate Noindex Nofollow Tool <= 1.1.2 - Settings Update via CSRFUltimate Noindex Nofollow Tool
- CVE-2023-7195WP-Reply Notify <= 1.1 - Settings Update via CSRFWP-Reply Notify
- CVE-2023-7168Better Follow Button for Jetpack <= 8.0 - Admin+ Stored XSSBetter Follow Button for Jetpack
- CVE-2023-7088Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVGAdd SVG Support for Media Uploader | inventivo
- CVE-2023-7086SVG Uploads Support <= 2.1.1 - Author+ Stored XSS via SVGSVG Uploads Support
- CVE-2023-6786Payment Gateway for Telcell <= 2.0.1 - Unauthenticated Open RedirectPayment Gateway for Telcell
- CVE-2023-6783WolfNet IDX for WordPress <= 1.19.1 - Admin+ Stored XSSWolfNet IDX for WordPress
- CVE-2023-6541Allow SVG < 1.2.0 - Author+ Stored XSS via SVGAllow SVG
- CVE-2023-6030LogDash Activity Log < 1.1.4 - Unauthenticated SQLiLogDash Activity Log
- CVE-2023-5932Travelpayouts < 1.1.14 - Reflected XSSTravelpayouts: All Travel Brands in One Place
- CVE-2023-5529Advanced Page Visit Counter <= 8.0.6 - Admin+ Stored XSSAdvanced Page Visit Counter
- CVE-2023-2334Easy Digital Downloads Google Sheet Connector < 1.6.6 - Access Code Update via CSRFedd-google-sheet-connector-pro · Easy Digital Downloads Goo…
- CVE-2025-2248WP-PManager <= 1.2 - Admin+ SQL InjectionWP-PManager
- CVE-2025-2247WP-PManager <= 1.2 - Category Deletion via CSRFWP-PManager
- CVE-2025-2203WooCommerce Checkout & Funnel Builder by FunnelKit < 3.10.2 - Admin+ SQL InjectionFunnelKit
- CVE-2025-1454Ninja Pages <= 1.4.2 - Admin+ Stored XSSNinja Pages
- CVE-2025-1303Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Unauthenticated Reflected XSSPlugin Oficial
- CVE-2025-1289Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Admin+ Stored XSSPlugin Oficial
- CVE-2025-1288wooexim <= 5.0.0 - CSRF to Reflected XSSWOOEXIM
- CVE-2025-1286Download HTML TinyMCE Button <= 1.2 - Reflected XSSDownload HTML TinyMCE Button
- CVE-2025-1033Badgearoo <= 1.0.14 - Admin+ Stored XSSBadgearoo
- CVE-2025-0688Spiritual Gifts Survey <= 0.9.10 - Unauthenticated CSRF to XSSSpiritual Gifts Survey
- CVE-2025-0687Spiritual Gifts Survey <= 0.9.10 - Unauthenticated CSRF to XSSSpiritual Gifts Survey
- CVE-2025-0329AI ChatBot for WordPress – WPBot < 6.2.4 - Admin+ Stored XSSAI ChatBot for WordPress
- CVE-2024-9882Salon Booking System < 10.9.4 - Admin+ Stored XSSSalon Booking System, Appointment Scheduling for Salons, Sp…
- CVE-2024-9879Website File Changes < 2.1.1 - Authenticated SQL InjectionMelapress File Monitor
- CVE-2024-9838Auto Affiliate Links < 6.4.7 - Admin+ SQL InjectionAuto Affiliate Links
- CVE-2024-9765EKC Tournament Manager < 2.2.2 - Local File Download VulnerabilityEKC Tournament Manager
- CVE-2024-9711EKC Tournament Manager < 2.2.2 - Delete Tournaments via CSRFEKC Tournament Manager
- CVE-2024-9709EKC Tournament Manager < 2.2.2 - Create Tournaments/Teams via CSRFEKC Tournament Manager
- CVE-2024-9663CYAN Backup < 2.5.3 - Admin+ Stored XSS via Remote Storage SettingsCYAN Backup
- CVE-2024-9662CYAN Backup < 2.5.3 - Admin+ Stored XSS via General SettingsCYAN Backup
- CVE-2024-9645Post Grid and Gutenberg Blocks < 2.2.93 - Contributor+ Stored XSSPost Grid, Posts Slider, Posts Carousel, Post Filter, Post…
- CVE-2024-9599Popup Box < 4.7.8 - Admin+ Stored XSSPopup Box
- CVE-2024-9450Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking < 1.3.15 - Subscriber+ PayPal Settings UpdateFree Booking Plugin for Hotels, Restaurants and Car Rentals
- CVE-2024-9390RegistrationMagic < 6.0.2.1 - Stored XSSRegistrationMagic
- CVE-2024-9238AVIF & SVG Uploader <= 1.1.0 - Author+ Stored XSS via SVG UplaodAVIF Uploader
- CVE-2024-9236Team Members Showcase < 4.4.2 - Editor+ Stored XSSTeam
- CVE-2024-9233GS Logo Slider < 3.7.1 - Settings Update via Cross-Site Request ForgeryLogo Slider
- CVE-2024-9227PowerPress Podcasting < 11.9.18 - Author+ XSSPowerPress Podcasting plugin by Blubrry
- CVE-2024-9182Maspik - Advanced Spam protection < 2.1.3 - Admin+ Stored XSSMaspik
- CVE-2024-8854Polls CP <= 1.0.75 - Admin+ Stored XSS via Custom StylesPolls CP
- CVE-2024-8851Polls CP <= 1.0.75 - Admin+ Stored Cross-Site ScriptingPolls CP
- CVE-2024-8759Nested Pages <= 3.2.8 - Editor+ Stored XSSNested Pages
- CVE-2024-8703Z-Downloads < 1.11.6 - Unauthenticated Stored XSSZ-Downloads
- CVE-2024-8702Backup Database <= 4.9 - Admin+ Stored XSSBackup Database
- CVE-2024-8701Event Calendar <= 1.0.4 - Admin+ Stored XSSevents-calendar
- CVE-2024-8670Photo Gallery by 10Web < 1.8.29 - Admin+ Stored XSSPhoto Gallery by 10Web
- CVE-2024-8620MapPress Maps for WordPress < 2.93 - Admin+ Stored XSS via Map SettingsMapPress Maps for WordPress
- CVE-2024-8619Ajax Search Lite <= 4.12.2 - Admin+ Stored XSSAjax Search Lite
- CVE-2024-8618Page Builder: Pagelayer < 1.9.0- Admin+ Stored XSSPage Builder: Pagelayer
- CVE-2024-8617Quiz Maker <= 6.5.9.8 - Admin+ Stored XSSQuiz Maker
- CVE-2024-8542Everest Forms < 3.0.3.1 - Admin+ Stored XSSEverest Forms
- CVE-2024-8493The Events Calendar < 6.6.4 - Admin+ Stored XSSThe Events Calendar
- CVE-2024-8492Hustle < 7.8.5 - Admin+ Stored XSSHustle
- CVE-2024-8426Pagelayer < 1.8.8 - Admin+ Stored XSSPage Builder: Pagelayer
- CVE-2024-8398Simple Nav Archives <= 2.1.3 - Settings Update via CSRFSimple Nav Archives
- CVE-2024-8397GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSSwebtoffee-gdpr-cookie-consent
- CVE-2024-8286GDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRFwebtoffee-gdpr-cookie-consent
- CVE-2024-8284Download Manager <= 3.2.98 - Admin+ Stored XSSDownload Manager
- CVE-2024-8245GamiPress - Reset User <= 1.0.0 - GamiPress User Data Removal via CSRFGamiPress
- CVE-2024-8187Smart Post Show <= 3.0.0 - Editor+ Stored XSSSmart Post Show
- CVE-2024-8095BabelZ – Google Translate Widget <= 1.1.5 - CSRF to Stored XSSBabelZ
- CVE-2024-8094Ntz Antispam <= 2.0e - Settings Update via CSRFNtz Antispam
- CVE-2024-8090JavaScript Logic <= 0.1 - CSRF to Stored XSSJavaScript Logic
- CVE-2024-8085PeoplePond <= 1.1.9 - CSRF to Stored XSSPeoplePond
- CVE-2024-8082Widgets Reset <= 0.1 - Settings Update via CSRFWidgets Reset
- CVE-2024-8050Custom Author Base <= 1.1.1 - Settings Update via CSRFCustom Author Base
- CVE-2024-8032Smooth Gallery Replacement <= 1.0 - CSRF to Stored XSSSmooth Gallery Replacement
- CVE-2024-8031Secure Downloads < 1.2.3 - Admin+ Arbitrary File DownloadSecure Downloads
- CVE-2024-7984Joy Of Text Lite – SMS messaging for WordPress <= 2.3.1 - Settings Update via CSRFJoy Of Text Lite
- CVE-2024-7769Wordpress Clicksold IDX Plugin <= 1.90 - Admin+ XSSClickSold IDX
- CVE-2024-7762Simple Job Board < 2.12.6 - Unauthenticated Resumes DownloadSimple Job Board
- CVE-2024-7761Simple Job Board < 2.12.2 - Admin+ Stored XSSSimple Job Board
- CVE-2024-7759PWA For WP & AMP < 1.7.72 Administrator+ Stored XSSPWA for WP
- CVE-2024-7758Stylish Price List < 7.1.8 - Contributor+ Stored XSSStylish Price List
- CVE-2024-7556Wordpress Simple Share Plugin <=0.5.3 - Admin+ XSSSimple Share
- CVE-2024-6798DL Verification <= 1.2 - Admin+ Stored XSSDL Verification
- CVE-2024-6797DL Robots.txt <= 1.2 - Admin+ Stored XSSDL Robots.txt
- CVE-2024-6718PVN Auth Popup <= 1.0.0 - Contributor+ XSS via ShortcodePVN Auth Popup
- CVE-2024-6713PVN Auth Popup <= 1.0.0 - Admin+ Stored XSSPVN Auth Popup
- CVE-2024-6712MapFig Studio <= 0.2.1 - Stored XSS via CSRFMapFig Studio
- CVE-2024-6708Profile Builder <= 3.12.0 - Admin+ Stored Cross Site ScriptingUser Profile Builder
- CVE-2024-6693WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSSwccp-pro
- CVE-2024-6690WP Content Copy Protection & No Right Click (premium) < 15.3 - Open Redirectwccp-pro
- CVE-2024-6668profilepro <= 1.3 - Subscriber+ Stored Cross Site ScriptingProfilePro
- CVE-2024-6667kbucket < 4.1.5 - Reflected XSSKBucket: Your Curated Content in WordPress
- CVE-2024-6665kbucket < 4.1.6 - Admin+ Stored XSSKBucket: Your Curated Content in WordPress
- CVE-2024-6478CTT Expresso para WooCommerce < 3.2.13 - Admin+ Stored XSSCTT Expresso para WooCommerce
- CVE-2024-6462DL Yandex Metrika <= 1.2 - Admin+ Stored XSSDL Yandex Metrika
- CVE-2024-6335Tracking Code Manager < 2.3.0- Admin+ Stored Cross-Site ScriptingTracking Code Manager
- CVE-2024-5440If-So Dynamic Content Personalization < 1.8.0.3 - Contributor+ Shortcode Stored XSSIf-So Dynamic Content Personalization
- CVE-2024-5026CM Tooltip Glossary < 4.3.4 - Admin+ Stored XSSCM Tooltip Glossary
- CVE-2024-13865drm-protected-video-streaming <= 4.2.1 - Reflected XSSS3Player
- CVE-2024-13828Badgearoo <= 1.0.14 - Reflected XSSBadgearoo
- CVE-2024-13823360 Product Rotation <= 1.5.8 - Reflected XSS360 Product Rotation
- CVE-2024-13730Podlove Podcast Publisher < 4.2.1 - Admin+ Stored XSSPodlove Podcast Publisher
- CVE-2024-13729Podlove Podcast Publisher < 4.1.24 - Admin+ Stored XSSPodlove Podcast Publisher
- CVE-2024-13727MemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSSMemberSpace
- CVE-2024-13621The GDPR Framework By Data443 < 2.2.0 - Admin+ Stored XSSThe GDPR Framework By Data443
- CVE-2024-13619LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSSLifterLMS
- CVE-2024-13616VikBooking < 1.7.2 - Admin+ Stored XSSVikBooking Hotel Booking Engine & PMS
- CVE-2024-13486Icegram Engage < 3.1.32 - Admin+ Stored XSSIcegram Engage
- CVE-2024-13482Icegram Engage < 3.1.32 - Admin+ Stored XSSIcegram Engage
- CVE-2024-13384Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.24 - Admin+ Stored XSSPhoto Gallery, Images, Slider in Rbs Image Gallery
- CVE-2024-13383HD Quiz < 2.0.0 - Editor+ Stored XSSHD Quiz
- CVE-2024-13382Calculated Fields Form < 5.2.64 - Admin+ Stored XSSCalculated Fields Form
- CVE-2024-13357Ditty – Responsive News Tickers, Sliders, and Lists < 3.1.52 - Author+ Stored XSSDitty
- CVE-2024-13313AWeber <= 7.3.20 - Admin+ Stored XSSAWeber
- CVE-2024-13128LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSSLearnPress
- CVE-2024-13127LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSSLearnPress
- CVE-2024-13053Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS via Theme TitleForm Maker by 10Web
- CVE-2024-12874Top Comments <= 1.0 - Admin+ Stored Cross-Site ScriptingTop Comments
- CVE-2024-12873Custom Field Manager <= 1.0 - Reflected XSS VulnerabilityCustom Field Manager
- CVE-2024-12808WP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSSWP ERP | Complete HR solution with recruitment & job listin…
- CVE-2024-12800IP Based Login < 2.4.1 - Admin+ Stored XSSIP Based Login
- CVE-2024-12770WP ULike < 4.7.6 - Admin+ Stored XSSWP ULike
- CVE-2024-12750Competition Form <= 2.0 - Competition Deletion via CSRFCompetition Form
- CVE-2024-12743MailPoet < 5.5.2 - Admin+ Stored XSSMailPoet
- CVE-2024-12739Mobile Contact Bar < 3.0.5 - Admin+ Stored XSSMobile Contact Bar
- CVE-2024-12734Advance Post Prefix <= 1.1.1 - Reflected XSSAdvance Post Prefix
- CVE-2024-12733AffiliateImporterEb <= 1.0.6 - Reflected XSS via SearchAffiliateImporterEb
- CVE-2024-12732AffiliateImporterEb <= 1.0.6 - Reflected XSSAffiliateImporterEb
- CVE-2024-12726ClipArt <= 0.2 - Reflected XSSClipArt
- CVE-2024-12725Clasify Classified Listing <= 1.0.7 - Reflected XSSClasify Classified Listing
- CVE-2024-12724WP DeskLite <= 1.0.0 - Reflected XSSWP DeskLite
- CVE-2024-12722Twitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Stored XSS via ShortcodeTwitter Bootstrap Collapse aka Accordian Shortcode
- CVE-2024-12716Simple Basic Contact Form < 20250114 - Admin+ Stored XSSSimple Basic Contact Form
- CVE-2024-12680Prisna GWT < 1.4.14 - Admin+ Stored XSSPrisna GWT
- CVE-2024-12679Prisna GWT < 1.4.14 - Admin+ Stored XSSPrisna GWT
- CVE-2024-12301JSP Store Locator <= 1.0 - Deletion via Missing CSRFJSP Store Locator
- CVE-2024-12282WordPress连接微博 <= 2.5.6 - Stored XSS via CSRFWordPress连接微博
- CVE-2024-11843Panorama – WordPress Project Management Plugin <= 1.5.1 - Admin+ Stored XSSPanorama
- CVE-2024-11719tarteaucitron.js for WordPress < 0.3.0 - Stored XSS via CSRFtarteaucitron-wp
- CVE-2024-11718tarteaucitron.js for WordPress < 0.3.0 - Author+ Stored XSStarteaucitron-wp · couleurcitron/tarteaucitron-wp
- CVE-2024-11502Planning Center Online Giving <= 1.0.0 - Contributor+ XSS via ShortcodePlanning Center Online Giving
- CVE-2024-11373Connexion Logs <= 3.0.2 - Log Deletion via CSRFConnexion Logs
- CVE-2024-11266Geocache Stat Bar Widget <= 0.911 - Admin+ Stored XSSGeocache Stat Bar Widget
- CVE-2024-11221Full Screen (Page) Background Image Slideshow <= 1.1 - Admin+ Stored XSSFull Screen (Page) Background Image Slideshow
- CVE-2024-11190jwp-a11y <= 4.1.7 - Admin+ Stored XSSjwp-a11y
- CVE-2024-11189Social Share And Social Locker – ARSocial < 1.4.2 - Admin+ Stored XSSSocial Share And Social Locker
- CVE-2024-11141Sailthru Triggermail < 1.1 - Subscriber+ Stored XSSSailthru Triggermail
- CVE-2024-11140Real WP Shop Lite Ajax eCommerce Shopping Cart <= 2.0.8 - Admin+ Stored XSSReal WP Shop Lite Ajax eCommerce Shopping Cart
- CVE-2024-11109WP Google Review Slider < 15.6 - Admin+ Stored XSSWP Google Review Slider
- CVE-2024-10818JSFiddle Shortcode < 1.1.3 - Contributor+ XSS via ShortcodeJSFiddle Shortcode
- CVE-2024-10677BTEV <= 2.0.2 - Settings Update via CSRFBTEV
- CVE-2024-10639Auto Prune Posts < 3.0.0- Admin+ Stored XSSAuto Prune Posts
- CVE-2024-10634Nokaut Offers Box <= 1.4.0 - Plugin Reset via CSRFNokaut Offers Box
- CVE-2024-10632Nokaut Offers Box <= 1.4.0 - Admin+ Stored XSSNokaut Offers Box
- CVE-2024-10631Countdown Timer <= 1.0.5 - Contributor+ Stored XSSCountdown Timer for WordPress Block Editor
- CVE-2024-10504ARForms Builder < 1.7.1 - Unauthenticated Stored XSSContact Form, Survey, Quiz & Popup Form Builder
- CVE-2024-10475Lead Form Builder < 1.9.8 - Admin+ Stored XSSResponsive Contact Form Builder & Lead Generation Plugin
- CVE-2024-10362Social Media Share Buttons < 2.9.0 - Admin+ Stored XSSSocial Media Share Buttons & Social Sharing Icons
- CVE-2024-10149Social Slider Feed < 2.2.9 - Admin+ Stored XSS via WidgetsSocial Slider Feed
- CVE-2024-10145Hubbub Lite < 1.34.4 - Admin+ Stored XSSHubbub Lite
- CVE-2024-10144Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSSPhoto Gallery, Images, Slider in Rbs Image Gallery
- CVE-2024-10143MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSSMB Custom Post Types & Custom Taxonomies
- CVE-2024-10107Giveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSSGiveaways and Contests by RafflePress
- CVE-2024-10098ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File AccessApplyOnline
- CVE-2024-10076Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSSJetpack
- CVE-2024-10075Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode ExecutionJetpack
- CVE-2024-10054Happyforms < 1.26.3 - Admin+ Stored XSSHappyforms
- CVE-2024-10009Website File Changes < 2.1.0 - Admin+ Authenticated SQL InjectionMelapress File Monitor
- CVE-2025-4717PHPGurukul Company Visitor Management System visitors-form.php sql injectionPHPGurukul Company Visitor Management System
- CVE-2025-47789Horilla Open Redirect Vulnerability in Loginhorilla-opensource horilla
- CVE-2025-46834Alchemy's Modular Account can use executeUserOp to bypass allowlist prevalidation hookalchemyplatform modular-account
- CVE-2025-47786Emlog vulnerable to Stored Cross-site Scriptingemlog
- CVE-2025-4716Campcodes Sales and Inventory System credit_transaction_add.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-4715Campcodes Sales and Inventory System view_application.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-47784Emlog vulnerable to Deserialization of Untrusted Dataemlog
- CVE-2025-4714Campcodes Sales and Inventory System reprint.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-30476Dell PowerScale InsightIQ, version 5.2, contains an uncontrolled resource consumption vulnerability.Dell PowerScale InsightIQ
- CVE-2025-4713Campcodes Sales and Inventory System print.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-4712Campcodes Sales and Inventory System account_summary.php sql injectionCampcodes Sales and Inventory System
- CVE-2024-51666WordPress Tours plugin <= 1.0.0 - Broken Access Control vulnerabilityTosin Oguntuyi Tours
- CVE-2024-56006WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerabilityAutomattic Jetpack Debug Tools
- CVE-2025-4711Campcodes Sales and Inventory System stockin_add.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-47774Vyper's `slice()` may elide side-effects when output length is 0vyperlang vyper · vyper
- CVE-2025-4710Campcodes Sales and Inventory System transaction.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-4709Campcodes Sales and Inventory System transaction_del.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-47285Vyper's `concat()` builtin may elide side-effects for zero-length argumentsvyperlang vyper · vyper
- CVE-2025-47279undici Denial of Service attack via bad certificate datanodejs undici · undici
- CVE-2025-47580WordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerabilityRustaurius Front End Users
- CVE-2025-4708Campcodes Sales and Inventory System sales_add.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-4707Campcodes Sales and Inventory System transaction_add.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-4706projectworlds Online Examination System Procedure3b_yearwiseVisit.php sql injectionprojectworlds Online Examination System
- CVE-2025-1647XSS in Bootstrap title attribute for Tooltip and PopoverBootstrap
- CVE-2025-4705PHPGurukul Vehicle Parking Management System view-incomingvehicle-detail.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-3440IBM Security Guardium cross-site scriptingIBM Security Guardium
- CVE-2025-4704PHPGurukul Vehicle Parking Management System edit-category.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-4703PHPGurukul Vehicle Parking Management System admin-profile.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-2570System Admin Cannot Access Environment settings in System Console While System Manager CanMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-2527Improper access control to group informationMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-4702PHPGurukul Vehicle Parking Management System add-category.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-4701VITA-MLLM Freeze-Omni utils.py torch.load deserializationVITA-MLLM Freeze-Omni
- CVE-2025-4699PHPGurukul Apartment Visitors Management System visitors-form.php sql injectionPHPGurukul Apartment Visitors Management System
- CVE-2025-4698PHPGurukul Directory Management System forget-password.php sql injectionPHPGurukul Directory Management System
- CVE-2025-4516Use-after-free in "unicode_escape" decoder with error handlerPython Software Foundation CPython
- CVE-2025-4697PHPGurukul Directory Management System edit-directory.php sql injectionPHPGurukul Directory Management System
- CVE-2025-4696PHPGurukul/Campcodes Cyber Cafe Management System search.php sql injectionPHPGurukul Cyber Cafe Management System · Campcodes Cyber C…
- CVE-2025-4695PHPGurukul/Campcodes Cyber Cafe Management System add-users.php sql injectionPHPGurukul Cyber Cafe Management System · Campcodes Cyber C…
- CVE-2025-4762Insecure Direct Object Reference (IDOR) vulnerability in eSignaViewerLleidanet PKI eSigna
- CVE-2025-3446Members Without Guest Invite Permissions Can Add Guests to TeamsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-31947Repeated LDAP login failures can lock an LDAP accountMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-32738Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlieI-O DATA DEVICE HDL-TC1 · I-O DATA DEVICE HDL-TC500 +6
- CVE-2025-4737Insufficient encryption vulnerability in the mobile application (com.transsion.aivoiceassistant) may lead to the risk of sensitive informatiTECNO com.transsion.aivoiceassistant
- CVE-2025-27525Information Exposure vulnerability in JP1/IT Desktop Management 2 - Smart Device ManagerHitachi JP1/IT Desktop Management 2 - Smart Device Manager
- CVE-2025-27524Weak encryption vulnerability in JP1/IT Desktop Management 2 - Smart Device ManagerHitachi JP1/IT Desktop Management 2 - Smart Device Manager
- CVE-2025-3742Responsive Lightbox & Gallery < 2.5.1 - Contributor+ Stored XSSResponsive Lightbox & Gallery
- CVE-2025-4591Weluka Lite <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingwelukame Weluka Lite
- CVE-2025-4126EG-Series <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeemmanuelg EG-Series
- CVE-2025-4589Bon Toolkit <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingnackle2k10 Bon Toolkit
- CVE-2025-44110FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.
- CVE-2025-44180Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit-brand.php?bid={brandId}.
- CVE-2025-44181Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/add-brand.php via the brandname param
- CVE-2025-44182Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the vehiclename, modelnumber, regnumber, ve
- CVE-2025-44183Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the name, email, and
- CVE-2025-44185SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/change_pass.php via the pas
- CVE-2025-46053A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a
- CVE-2025-48024In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint.BlueWave Checkmate
- CVE-2025-48027The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginservMutonUfoAI pGina.Fork
- CVE-2025-48051powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extrLichess Lila