CVEs published May 16, 2025
172 CVEs were published on May 16, 2025: 4 critical, 43 high.
- Published
- 172
- Critical
- 4
- High
- 43
- Medium
- 120
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 38
Most affected products
- D-Link DI-7003GV2
- 7
- PHPGurukul Park Ticketing Management System
- 6
- FreeFloat FTP Server
- 5
- nextcloud security-advisories
- 5
- PHPGurukul Online Course Registration
- 5
- Campcodes Sales and Inventory System
- 4
- RomanCode MapSVG
- 4
- SourceCodester Stock Management System · oretnom23 Stock Ma…
- 4
- TOTOLINK A3002R · TOTOLINK A3002RU
- 4
- code-projects Employee Record System
- 3
Critical 4
- CVE-2025-32643WordPress WPGYM Plugin <= 65.0 - SQL Injection vulnerabilitymojoomla WPGYM
- CVE-2025-39481WordPress Eventer plugin < 3.11.4 - SQL Injection vulnerabilityimithemes Eventer
- CVE-2025-40906BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilitiesMONGODB BSON::XS
- CVE-2025-47916Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php.invisioncommunity Invision Power Board
High 43
- CVE-2025-4810Tenda AC7 SetRebootTimer formSetRebootTimer stack-based overflowTenda AC7
- CVE-2025-4809Tenda AC7 setMacFilterCfg fromSafeSetMacFilter stack-based overflowTenda AC7
- CVE-2025-4802Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading ofThe GNU C Library glibc
- CVE-2025-31637WordPress SHOUT plugin <= 3.5.3 - SQL Injection VulnerabilityLambertGroup SHOUT
- CVE-2025-31640WordPress Magic Responsive Slider and Carousel WordPress plugin < 1.6 - SQL Injection VulnerabilityLambertGroup Magic Responsive Slider and Carousel WordPress
- CVE-2025-31641WordPress UberSlider plugin <= 2.3 - SQL Injection VulnerabilityLambertGroup UberSlider
- CVE-2025-31922WordPress CSS3 Accordions for WordPress plugin <= 3.0 - CSRF to Stored XSS vulnerabilityQuanticaLabs CSS3 Accordions for WordPress
- CVE-2025-31926WordPress Sticky Radio Player plugin <= 3.4 - SQL Injection VulnerabilityLambertGroup Sticky Radio Player
- CVE-2025-31928WordPress Multimedia Responsive Carousel with Image Video Audio Support plugin <= 2.6.0 - SQL Injection VulnerabilityLambertGroup Multimedia Responsive Carousel with Image Vide…
- CVE-2025-32245WordPress Featured Posts Scroll plugin <= 1.25 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityChaser324 Featured Posts Scroll
- CVE-2025-32287WordPress Responsive HTML5 Audio Player PRO With Playlist plugin <= 3.5.7 - SQL Injection VulnerabilityLambertGroup Responsive HTML5 Audio Player PRO With Playlist
- CVE-2025-32290WordPress Sticky HTML5 Music Player plugin <= 3.1.6 - SQL Injection VulnerabilityLambertGroup Sticky HTML5 Music Player
- CVE-2025-32301WordPress CountDown Pro WP Plugin <= 2.7 - SQL Injection VulnerabilityLambertGroup CountDown Pro WP Plugin
- CVE-2025-32306WordPress Radio Player Shoutcast & Icecast theme <= 4.4.6 - SQL Injection VulnerabilityLambertGroup Radio Player Shoutcast & Icecast WordPress Plu…
- CVE-2025-32307WordPress Chameleon HTML5 Audio Player With/Without Playlist plugin <= 3.5.6 - SQL Injection VulnerabilityLambertGroup Chameleon HTML5 Audio Player With/Without Play…
- CVE-2025-32310WordPress QuickCal plugin <= 1.0.15 - CSRF to Privilege Escalation vulnerabilityThemeMove QuickCal - Appointment Booking Calendar for WordP…
- CVE-2025-39491WordPress WHMpress plugin <= 6.2-revision-9 - Local File Inclusion vulnerabilityWHMpress
- CVE-2025-39492WordPress WHMpress plugin <= 6.2-revision-9 - Local File Inclusion vulnerabilityWHMpress
- CVE-2025-39507WordPress Nasa Core Plugin <= 6.4.4 - Local File Inclusion vulnerabilityNasaTheme Nasa Core
- CVE-2025-39537WordPress Better Customer List for WooCommerce Plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityBlaze Concepts Better Customer List for WooCommerce
- CVE-2025-47567WordPress Video Player & FullScreen Video Background plugin <= 2.4.1 - SQL Injection vulnerabilityLambertGroup Video Player & FullScreen Video Background
- CVE-2025-47693WordPress Fat Services Booking plugin <= 5.5 - Local File Inclusion vulnerabilityroninwp FAT Services Booking
- CVE-2025-48146WordPress SEO Flow by LupsOnline plugin <= 2.2.1 - CSRF to Stored XSS vulnerabilityMichael Lups SEO Flow by LupsOnline
- CVE-2025-48144WordPress Import Export For WooCommerce plugin <= 1.6.2 - CSRF to Stored XSS vulnerabilitysidngr Import Export For WooCommerce
- CVE-2025-48137WordPress Interview plugin <= 1.01 - SQL Injection Vulnerabilityproxymis Interview
- CVE-2025-48136WordPress Mortgage Calculator Estatik plugin <= 2.0.12 - Local File Inclusion VulnerabilityMortgage Calculator Estatik
- CVE-2025-48134WordPress WP Tabs plugin <= 2.2.12 - PHP Object Injection VulnerabilityShapedPlugin WP Tabs
- CVE-2025-48114WordPress ShayanWeb Admin FontChanger plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityShayan Farhang Pazhooh ShayanWeb Admin FontChanger
- CVE-2025-48112WordPress Dot html,php,xml etc pages plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitykarimmughal Dot html,php,xml etc pages
- CVE-2025-4600HTTP Request Smuggling in Google Cloud Classic Application Load Balancer due to Improper Chunked Encoding ValidationGoogle Cloud Classic Application Load Balancer
- CVE-2025-4211Improper Link Resolution Before File Access in QFileSystemEngine on WindowsQt
- CVE-2025-37890net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdiscLinux
- CVE-2025-40629Path Traversal vulnerability in PNETLabPNETLab
- CVE-2025-2305Local file inclusion vulnerability in LIVE CONTRACTSYNCPILOT LIVE CONTRACT
- CVE-2025-4769CBEWIN Anytxt Searcher ATService.exe uncontrolled search pathCBEWIN Anytxt Searcher
- CVE-2025-1975Improper Validation of Array Index in ollama/ollamaollama/ollama · github.com/ollama/ollama
- CVE-2024-53827Ericsson Packet Core Controller (PCC) - Improper Input Validation VulnerabilityEricsson Packet Core Controller
- CVE-2025-4749D-Link DI-7003GV2 Factory Reset backup.asp sub_4983B0 denial of serviceD-Link DI-7003GV2
- CVE-2025-4733TOTOLINK A3002R/A3002RU HTTP POST Request formIpQoS buffer overflowTOTOLINK A3002R · TOTOLINK A3002RU
- CVE-2025-4732TOTOLINK A3002R/A3002RU HTTP POST Request formFilter buffer overflowTOTOLINK A3002R · TOTOLINK A3002RU
- CVE-2025-4731TOTOLINK A3002R/A3002RU HTTP POST Request formPortFw buffer overflowTOTOLINK A3002R · TOTOLINK A3002RU
- CVE-2025-4730TOTOLINK A3002R/A3002RU HTTP POST Request formMapDel buffer overflowTOTOLINK A3002R · TOTOLINK A3002RU
- CVE-2025-47809Wibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation (before a logoff or reboot).Wibu CodeMeter
Medium, low and unrated 125
- CVE-2025-4813PHPGurukul Human Metapneumovirus Testing Management System edit-phlebotomist.php sql injectionPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2025-4812PHPGurukul Human Metapneumovirus Testing Management System profile.php sql injectionPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2025-4811CodeAstro Pharmacy Management System Login index.php sql injectionCodeAstro Pharmacy Management System
- CVE-2022-4363Wholesale Market <= 2.2.2 - Settings Update via CSRFWholesale Market
- CVE-2025-4805WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Acces Portal ConfigurationWatchGuard Fireware OS
- CVE-2025-4804WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Hotpot ConfigurationWatchGuard Fireware OS
- CVE-2025-4808PHPGurukul Park Ticketing Management System add-normal-ticket.php sql injectionPHPGurukul Park Ticketing Management System
- CVE-2025-4807SourceCodester Online Student Clearance System exposure of information through directory listingSourceCodester Online Student Clearance System
- CVE-2025-22233Spring Framework DataBinder Case Sensitive Match ExceptionSpring Framework · org.springframework:spring-context
- CVE-2025-4806SourceCodester/oretnom23 Stock Management System view_bo sql injectionSourceCodester Stock Management System · oretnom23 Stock Ma…
- CVE-2025-4795gongfuxiang schoolcms index.php SaveInfo sql injectiongongfuxiang schoolcms
- CVE-2025-4794PHPGurukul Online Course Registration news.php sql injectionPHPGurukul Online Course Registration
- CVE-2025-4793PHPGurukul Online Course Registration edit-student-profile.php sql injectionPHPGurukul Online Course Registration
- CVE-2025-4476Libsoup: null pointer dereference in libsoup may lead to denial of servicelibsoup · Red Hat Enterprise Linux
- CVE-2025-4792FreeFloat FTP Server MDELETE Command buffer overflowFreeFloat FTP Server
- CVE-2025-4791FreeFloat FTP Server HASH Command buffer overflowFreeFloat FTP Server
- CVE-2025-4790FreeFloat FTP Server GLOB Command buffer overflowFreeFloat FTP Server
- CVE-2025-4789FreeFloat FTP Server LCD Command buffer overflowFreeFloat FTP Server
- CVE-2025-4788FreeFloat FTP Server DELETE Command buffer overflowFreeFloat FTP Server
- CVE-2025-4787SourceCodester/oretnom23 Stock Management System view_sale sql injectionSourceCodester Stock Management System · oretnom23 Stock Ma…
- CVE-2025-31062WordPress Wishlist plugin <= 2.1.0 - Sensitive Data Exposure Vulnerabilityredqteam Wishlist
- CVE-2025-31063WordPress Wishlist plugin <= 2.1.0 - Broken Access Control Vulnerabilityredqteam Wishlist
- CVE-2025-31065WordPress Rozario <= 1.4 - Broken Access Control Vulnerabilitythemeton Rozario
- CVE-2025-31066WordPress Acerola theme <= 1.6.5 - Broken Access Control Vulnerabilitythemeton Acerola
- CVE-2025-31068WordPress Seven Stars <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerabilitythemeton Seven Stars
- CVE-2025-31071WordPress HotStar – Multi-Purpose Business Theme <= 1.4 - Broken Access Control Vulnerabilitythemeton HotStar – Multi-Purpose Business Theme
- CVE-2025-31630WordPress The Business <= 1.6.1 - Broken Access Control Vulnerabilitythemeton The Business
- CVE-2025-31639WordPress Spare <= 1.7 - Cross Site Request Forgery (CSRF) Vulnerabilitythemeton Spare
- CVE-2025-31915WordPress Pixel Form BuilderPlugin & Autoresponder plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerabilitykamleshyadav Pixel WordPress Form BuilderPlugin & Autorespo…
- CVE-2025-31921WordPress WP Ultimate Tours Builder plugin <= 1.055 - Cross Site Request Forgery (CSRF) Vulnerabilityloopus WP Ultimate Tours Builder
- CVE-2025-31923WordPress CSS3 Accordions for WordPress plugin <= 3.0 - Broken Access Control VulnerabilityQuanticaLabs CSS3 Accordions for WordPress
- CVE-2025-32180WordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilitymojofywp Product Carousel For WooCommerce – WoorouSell
- CVE-2025-32295WordPress Salon Booking Wordpress plugin <= 10.10.2 - Broken Access Control vulnerabilitywordpresschef Salon Booking Pro
- CVE-2025-32296WordPress Simple Link Directory Pro plugin < 14.8.1 - Broken Access Control Vulnerabilityquantumcloud Simple Link Directory
- CVE-2025-32299WordPress QuickCal plugin <= 1.0.15 - Sensitive Data Exposure VulnerabilityThemovation QuickCal - Appointment Booking Calendar for Wor…
- CVE-2025-39482WordPress Eventer plugin < 3.11.4 - Broken Access Control vulnerabilityimithemes Eventer
- CVE-2025-39493WordPress Rankie plugin < 1.8.2 - Broken Access Control VulnerabilityValvePress Rankie
- CVE-2025-39509WordPress TNC FlipBook plugin <= 12.1.0 - Cross Site Scripting (XSS) vulnerabilityThemeNcode TNC FlipBook
- CVE-2025-39511WordPress Pinterest Automatic Pin plugin <= 4.19.0 - Broken Access Control VulnerabilityValvePress Pinterest Automatic Pin
- CVE-2025-46464WordPress Ads Pro plugin <= 5.0 - Cross Site Scripting (XSS) vulnerabilityscripteo Ads Pro
- CVE-2025-47534WordPress Wordpress Auto Spinner plugin <= 3.25.0 - Broken Access Control VulnerabilityValvePress Wordpress Auto Spinner
- CVE-2025-47556WordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Broken Access Control VulnerabilityQuanticaLabs CSS3 Compare Pricing Tables for WordPress
- CVE-2025-47557WordPress MapSVG plugin <= 8.5.31 - Cross Site Scripting (XSS) vulnerabilityRomanCode MapSVG
- CVE-2025-47560WordPress MapSVG plugin < 8.6.13 - Broken Access Control VulnerabilityRomanCode MapSVG
- CVE-2025-47562WordPress MapSVG plugin <= 8.5.34 - Content Injection VulnerabilityRomanCode MapSVG
- CVE-2025-47563WordPress CURCY plugin <= 2.3.7 - Arbitrary Shortcode Execution vulnerabilityvillatheme CURCY
- CVE-2025-47564WordPress EventON plugin <= 4.9.8 - Broken Access Control vulnerabilityashanjay EventON
- CVE-2025-48138WordPress BERTHA AI plugin <= 1.13 - Broken Access Control VulnerabilityBertha AI – Andrew Palmer BERTHA AI
- CVE-2025-48135WordPress Aptivada for WP plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerabilityaptivadadev Aptivada for WP
- CVE-2025-48132WordPress X Addons for Elementor plugin <= 1.0.16 - Cross Site Scripting (XSS) Vulnerabilitypencilwp X Addons for Elementor
- CVE-2025-48131WordPress UltraAddons Elementor Lite plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilitySaiful Islam UltraAddons Elementor Lite
- CVE-2025-48128WordPress Sharespine Woocommerce Connector plugin <= 4.7.55 - Broken Access Control VulnerabilitySharespine Woocommerce Connector
- CVE-2025-48127WordPress Push notification for Mobile and Web app plugin <= 2.0.3 - Broken Access Control vulnerabilityApp Cheap Push notification for Mobile and Web app
- CVE-2025-48121WordPress WP Notes Widget plugin <= 1.0.6 - Cross Site Scripting (XSS) VulnerabilitySteve Puddick WP Notes Widget
- CVE-2025-48120WordPress MapSVG Lite plugin <= 8.6.9 - Arbitrary Shortcode Execution vulnerabilityRomanCode MapSVG
- CVE-2025-48119WordPress RS WP Book Showcase plugin <= 6.7.59 - Content Injection vulnerabilityRS WP THEMES RS WP Book Showcase
- CVE-2025-48117WordPress WooCommerce POS plugin <= 1.7.8 - Broken Access Control Vulnerabilitykilbot WooCommerce POS
- CVE-2025-48116WordPress EventON plugin <= 2.4.4 - Broken Access Control VulnerabilityAshan Perera EventON
- CVE-2025-48115WordPress ValidateCertify plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerabilityJavier Revilla ValidateCertify
- CVE-2025-48113WordPress Broadstreet plugin <= 1.51.2 - Cross Site Scripting (XSS) vulnerabilityBroadstreet Ads
- CVE-2025-48080WordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.2 - Cross Site Scripting (XSS) VulnerabilityUncanny Owl Uncanny Toolkit for LearnDash
- CVE-2025-48079WordPress ProfileGrid plugin <= 5.9.5.1 - Broken Access Control VulnerabilityMetagauss ProfileGrid
- CVE-2025-4786SourceCodester/oretnom23 Stock Management System view_return sql injectionSourceCodester Stock Management System · oretnom23 Stock Ma…
- CVE-2025-4785PHPGurukul Daily Expense Tracker System user-profile.php sql injectionPHPGurukul Daily Expense Tracker System
- CVE-2025-47794Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permissionnextcloud security-advisories
- CVE-2025-47793Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text filenextcloud security-advisories
- CVE-2025-4782SourceCodester/oretnom23 Stock Management System view_receiving sql injectionSourceCodester Stock Management System · oretnom23 Stock Ma…
- CVE-2025-4781PHPGurukul Park Ticketing Management System forgot-password.php sql injectionPHPGurukul Park Ticketing Management System
- CVE-2025-4478Gnome-remote-desktop: freerdp: unauthenticated rdp packet causes segfault in freerdp leading to denial of servicefreerdp · Red Hat Enterprise Linux
- CVE-2025-47792Nextcloud Desktop 3rdparty applications can create share links via socket APInextcloud security-advisories
- CVE-2025-47791Nextcloud Server's test remote endpoint is not rate limitednextcloud security-advisories
- CVE-2025-47790Nextcloud Server doesn't request second factor after session timeoutnextcloud security-advisories
- CVE-2025-4780PHPGurukul Park Ticketing Management System foreigner-search.php sql injectionPHPGurukul Park Ticketing Management System
- CVE-2025-32962Flask-AppBuilder open redirect vulnerability using HTTP host injectiondpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2025-4778PHPGurukul Park Ticketing Management System normal-search.php sql injectionPHPGurukul Park Ticketing Management System
- CVE-2025-40907FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) libraryETHER FCGI
- CVE-2025-4777PHPGurukul Park Ticketing Management System view-foreigner-ticket.php sql injectionPHPGurukul Park Ticketing Management System
- CVE-2025-4773PHPGurukul Online Course Registration level.php sql injectionPHPGurukul Online Course Registration
- CVE-2025-2306Improper Access Control vulnerability in LIVE CONTRACTSYNCPILOT LIVE CONTRACT
- CVE-2025-4772PHPGurukul Online Course Registration department.php sql injectionPHPGurukul Online Course Registration
- CVE-2025-4771PHPGurukul Online Course Registration course.php sql injectionPHPGurukul Online Course Registration
- CVE-2025-40632Cross-site scripting (XSS) vulnerability in IceWarp Mail ServerIcewarp Mail Server
- CVE-2025-40631HTTP host header injection vulnerability in IceWarp Mail ServerIcewarp Mail Server
- CVE-2025-40630Open redirection vulnerability in IceWarp Mail ServerIcewarp Mail Server
- CVE-2025-4770PHPGurukul Park Ticketing Management System view-normal-ticket.php sql injectionPHPGurukul Park Ticketing Management System
- CVE-2025-4768feng_ha_ha/megagao ssm-erp/production_ssm PictureServiceImpl.java uploadPicture unrestricted uploadfeng_ha_ha ssm-erp · feng_ha_ha production_ssm +2
- CVE-2025-4767defog-ai introspect Test Endpoint integration_routes.py test_custom_tool code injectiondefog-ai introspect
- CVE-2025-4766PHPGurukul Zoo Management System profile.php sql injectionPHPGurukul Zoo Management System
- CVE-2025-4679A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecSynology Active Backup for Microsoft
- CVE-2025-4765PHPGurukul Zoo Management System contactus.php sql injectionPHPGurukul Zoo Management System
- CVE-2025-4761PHPGurukul Complaint Management System admin-profile.php sql injectionPHPGurukul Complaint Management System
- CVE-2025-4758PHPGurukul Beauty Parlour Management System contact.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2025-4757PHPGurukul Beauty Parlour Management System forgot-password.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2025-4756D-Link DI-7003GV2 restart.asp denial of serviceD-Link DI-7003GV2
- CVE-2025-4755D-Link DI-7003GV2 netconfig.asp sub_497DE4 improper authenticationD-Link DI-7003GV2
- CVE-2025-3624Missing Authorization Vulnerability in Hitachi Ops Center AnalyzerHitachi Ops Center Analyzer
- CVE-2024-8201Cross-Site WebSocket Hijacking Vulnerability in Hitachi Ops Center AnalyzerHitachi Ops Center Analyzer
- CVE-2025-4753D-Link DI-7003GV2 login.data information disclosureD-Link DI-7003GV2
- CVE-2025-1531Authentication credentials leakage vulnerability in Hitachi Ops Center Analyzer viewpoint OVFHitachi Ops Center Analyzer viewpoint
- CVE-2025-1245Bypass Connection Restriction Vulnerability in Hitachi Ops Center AnalyzerHitachi Infrastructure Analytics Advisor · Hitachi Ops Cent…
- CVE-2025-4752D-Link DI-7003GV2 install_base.data information disclosureD-Link DI-7003GV2
- CVE-2025-4751D-Link DI-7003GV2 index.data information disclosureD-Link DI-7003GV2
- CVE-2025-3516Simple Lightbox < 2.9.4 - Contributor+ Stored XSSSimple Lightbox
- CVE-2025-3201Kali Forms < 2.4.3 - Contributor+ Stored XSSContact Form builder with drag & drop for WordPress
- CVE-2025-4750D-Link DI-7003GV2 Configuration get_version.data information disclosureD-Link DI-7003GV2
- CVE-2025-4747Bohua NetDragon Firewall ip_status.php command injectionBohua NetDragon Firewall
- CVE-2025-4759Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribulockfile-lint-api
- CVE-2025-4746Campcodes Sales and Inventory System purchase_delete.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-4745code-projects Employee Record System current_employees.php cross site scriptingcode-projects Employee Record System
- CVE-2025-4744code-projects Employee Record System edit_employee.php cross site scriptingcode-projects Employee Record System
- CVE-2025-4743code-projects Employee Record System getData.php sql injectioncode-projects Employee Record System
- CVE-2025-4742XU-YIJIE grpo-flat grpo_vanilla.py main deserializationXU-YIJIE grpo-flat
- CVE-2025-4741Campcodes Sales and Inventory System purchase_add.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-4740BeamCtrl Airiana coef deserializationBeamCtrl Airiana
- CVE-2025-4169Posts per Cat [Unmaintained] <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingurkekg Posts per Cat
- CVE-2025-4739projectworlds Hospital Database Management System medicines_info.php sql injectionprojectworlds Hospital Database Management System
- CVE-2025-4736PHPGurukul Daily Expense Tracker register.php sql injectionPHPGurukul Daily Expense Tracker
- CVE-2025-4735Campcodes Sales and Inventory System product.php unrestricted uploadCampcodes Sales and Inventory System
- CVE-2025-4734Campcodes Sales and Inventory System ci_update.php sql injectionCampcodes Sales and Inventory System
- CVE-2024-51475IBM Content Navigator HTML injectionIBM Content Navigator
- CVE-2024-40120seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_store.go.github.com/seaweedfs/seaweedfs
- CVE-2025-32407Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, all
- CVE-2025-48174In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size.aomedia libavif
- CVE-2025-48175In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowByteaomedia libavif
- CVE-2025-48188libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib rijndaelDecrypt funGNU PSPP