CVEs published May 17, 2025
47 CVEs were published on May 17, 2025: 5 critical, 23 high.
- Published
- 47
- Critical
- 5
- High
- 23
- Medium
- 16
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- TOTOLINK A702R · TOTOLINK A3002R +1
- 12
- D-Link DCS-932L
- 3
- Campcodes Sales and Inventory System
- 2
- Imagination Technologies Graphics DDK
- 2
- Mozilla Firefox · Mozilla Thunderbird
- 2
- SourceCodester Doctor's Appointment System
- 2
- alti5 AlT Monitoring
- 1
- artbees Jupiter X Core
- 1
- cbutlerjr WP-Members Membership Plugin
- 1
- cocotais-bot
- 1
Critical 5
- CVE-2025-4918Out-of-bounds access when resolving Promise objectsMozilla Firefox · Mozilla Thunderbird
- CVE-2025-47945Donetick Has Weak Default JWT Secretdonetick
- CVE-2025-4391Echo RSS Feed Post Generator <= 5.4.8.1 - Unauthenticated Arbitrary File UploadCodeRevolution Echo RSS Feed Post Generator
- CVE-2025-4389Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File UploadCodeRevolution Crawlomatic Multipage Scraper Post Generator
- CVE-2025-48187RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification cinfiniflow RAGFlow
High 23
- CVE-2025-4843D-Link DCS-932L udev SubUPnPCSInit stack-based overflowD-Link DCS-932L
- CVE-2025-4842D-Link DCS-932L ucp isUCPCameraNameChanged stack-based overflowD-Link DCS-932L
- CVE-2025-4841D-Link DCS-932L gpio sub_404780 stack-based overflowD-Link DCS-932L
- CVE-2025-4919Out-of-bounds access when optimizing linear sumsMozilla Firefox · Mozilla Thunderbird
- CVE-2025-4835TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formWlanRedirect buffer overflowTOTOLINK A702R · TOTOLINK A3002R +1
- CVE-2025-4834TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSetLg buffer overflowTOTOLINK A702R · TOTOLINK A3002R +1
- CVE-2025-47948Cocotais Bot has builtin .echo command injectioncocotais-bot
- CVE-2025-4833TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formNtp buffer overflowTOTOLINK A702R · TOTOLINK A3002R +1
- CVE-2025-4832TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formDosCfg buffer overflowTOTOLINK A702R · TOTOLINK A3002R +1
- CVE-2025-4831TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSiteSurveyProfile buffer overflowTOTOLINK A702R · TOTOLINK A3002R +1
- CVE-2025-33103IBM i privilege escalationIBM i
- CVE-2025-47273setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Writepypa setuptools · setuptools
- CVE-2025-4830TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSysCmd buffer overflowTOTOLINK A702R · TOTOLINK A3002R +1
- CVE-2025-4829TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formStats sub_40BE30 buffer overflowTOTOLINK A702R · TOTOLINK A3002R +1
- CVE-2025-4827TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSaveConfig buffer overflowTOTOLINK A702R · TOTOLINK A3002R +1
- CVE-2024-13613Wise Chat <= 3.3.3 - Unauthenticated Sensitive Information Exposure Through Unprotected Directorymarcinlawrowski Wise Chat
- CVE-2025-4826TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formWirelessTbl buffer overflowTOTOLINK A702R · TOTOLINK A3002R +1
- CVE-2025-4825TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formDMZ buffer overflowTOTOLINK A702R · TOTOLINK A3002R +1
- CVE-2025-4824TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formWsc buffer overflowTOTOLINK A702R · TOTOLINK A3002R +1
- CVE-2025-4823TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formReflashClientTbl submit-url buffer overflowTOTOLINK A702R · TOTOLINK A3002R +1
- CVE-2025-4190CSV Mass Importer <= 1.2 - Admin+ Arbitrary File UploadCSV Mass Importer
- CVE-2025-3812WPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File DeletionQuantumCloud WPBot Pro Wordpress Chatbot
- CVE-2025-1706GPU DDK - Improper locking when accessing the pvr_exp_fence objectImagination Technologies Graphics DDK
Medium, low and unrated 19
- CVE-2025-4839itwanger paicoding CrossUtil.java cross-domain policyitwanger paicoding
- CVE-2025-4838kanwangzjm Funiture Login LoginServlet.java doPost redirectkanwangzjm Funiture
- CVE-2025-4837projectworlds Student Project Allocation System make_group_sql.php sql injectionprojectworlds Student Project Allocation System
- CVE-2025-4836Projectworlds Life Insurance Management System deleteAgent.php sql injectionProjectworlds Life Insurance Management System
- CVE-2025-47931LibreNMS stored Cross-site Scripting vulnerability in poller group namelibrenms · librenms/librenms
- CVE-2025-4101MultiVendorX – WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletionwcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…
- CVE-2025-4669Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcodewpdevelop Booking Calendar
- CVE-2025-3888Jupiterx Core <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVGartbees Jupiter X Core
- CVE-2025-3527EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEventON (Pro) - WordPress Virtual Event Calendar Plugin
- CVE-2025-4610WP-Members <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcodecbutlerjr WP-Members Membership Plugin
- CVE-2025-4819y_project RuoYi Offline Logout batchForceLogout improper authorizationy_project RuoYi
- CVE-2025-4818SourceCodester Doctor's Appointment System GET Parameter delete-doctor.php sql injectionSourceCodester Doctor's Appointment System
- CVE-2025-4817Sourcecodester Doctor's Appointment System GET Parameter delete-appointment.php sql injectionSourcecodester Doctor's Appointment System
- CVE-2025-4194AlT Monitoring <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scriptingalti5 AlT Monitoring
- CVE-2025-4189Audio Comments Plugin <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scriptingnaicuoctavian Audio Comments Plugin
- CVE-2025-4816SourceCodester Doctor's Appointment System GET Parameter appointment.php sql injectionSourceCodester Doctor's Appointment System
- CVE-2025-4815Campcodes Sales and Inventory System supplier_update.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-4814Campcodes Sales and Inventory System supplier_add.php sql injectionCampcodes Sales and Inventory System
- CVE-2024-47893GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups)Imagination Technologies Graphics DDK