# CVEs published 2025-05-17

47 CVEs were published on May 17, 2025: 5 critical, 23 high. Days are UTC.

- [CVE-2025-4843](https://cve.now/CVE-2025-4843.md): D-Link DCS-932L udev SubUPnPCSInit stack-based overflow (CVSS 8.7, D-Link DCS-932L)
- [CVE-2025-4842](https://cve.now/CVE-2025-4842.md): D-Link DCS-932L ucp isUCPCameraNameChanged stack-based overflow (CVSS 8.7, D-Link DCS-932L)
- [CVE-2025-4841](https://cve.now/CVE-2025-4841.md): D-Link DCS-932L gpio sub\_404780 stack-based overflow (CVSS 8.7, D-Link DCS-932L)
- [CVE-2025-4839](https://cve.now/CVE-2025-4839.md): itwanger paicoding CrossUtil.java cross-domain policy (CVSS 2.3, itwanger paicoding)
- [CVE-2025-4838](https://cve.now/CVE-2025-4838.md): kanwangzjm Funiture Login LoginServlet.java doPost redirect (CVSS 5.3, kanwangzjm Funiture)
- [CVE-2025-4919](https://cve.now/CVE-2025-4919.md): Out-of-bounds access when optimizing linear sums (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-4918](https://cve.now/CVE-2025-4918.md): Out-of-bounds access when resolving Promise objects (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-4837](https://cve.now/CVE-2025-4837.md): projectworlds Student Project Allocation System make\_group\_sql.php sql injection (CVSS 6.9, projectworlds Student Project Allocation System)
- [CVE-2025-4836](https://cve.now/CVE-2025-4836.md): Projectworlds Life Insurance Management System deleteAgent.php sql injection (CVSS 6.9, Projectworlds Life Insurance Management System)
- [CVE-2025-4835](https://cve.now/CVE-2025-4835.md): TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formWlanRedirect buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +1)
- [CVE-2025-4834](https://cve.now/CVE-2025-4834.md): TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSetLg buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +1)
- [CVE-2025-47948](https://cve.now/CVE-2025-47948.md): Cocotais Bot has builtin .echo command injection (CVSS 7.2, cocotais-bot)
- [CVE-2025-47945](https://cve.now/CVE-2025-47945.md): Donetick Has Weak Default JWT Secret (CVSS 9.1, donetick)
- [CVE-2025-4833](https://cve.now/CVE-2025-4833.md): TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formNtp buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +1)
- [CVE-2025-4832](https://cve.now/CVE-2025-4832.md): TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formDosCfg buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +1)
- [CVE-2025-4831](https://cve.now/CVE-2025-4831.md): TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSiteSurveyProfile buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +1)
- [CVE-2025-33103](https://cve.now/CVE-2025-33103.md): IBM i privilege escalation (CVSS 8.5, IBM i)
- [CVE-2025-47931](https://cve.now/CVE-2025-47931.md): LibreNMS stored Cross-site Scripting vulnerability in poller group name (CVSS 2.1, librenms · librenms/librenms)
- [CVE-2025-47273](https://cve.now/CVE-2025-47273.md): setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write (CVSS 7.7, pypa setuptools · setuptools)
- [CVE-2025-4830](https://cve.now/CVE-2025-4830.md): TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSysCmd buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +1)
- [CVE-2025-4829](https://cve.now/CVE-2025-4829.md): TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formStats sub\_40BE30 buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +1)
- [CVE-2025-4827](https://cve.now/CVE-2025-4827.md): TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSaveConfig buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +1)
- [CVE-2025-4101](https://cve.now/CVE-2025-4101.md): MultiVendorX – WooCommerce Multivendor Marketplace Solutions \<= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion (CVSS 4.3, wcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…)
- [CVE-2024-13613](https://cve.now/CVE-2024-13613.md): Wise Chat \<= 3.3.3 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 7.5, marcinlawrowski Wise Chat)
- [CVE-2025-4669](https://cve.now/CVE-2025-4669.md): Booking Calendar \<= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode (CVSS 6.4, wpdevelop Booking Calendar)
- [CVE-2025-3888](https://cve.now/CVE-2025-3888.md): Jupiterx Core \<= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG (CVSS 6.4, artbees Jupiter X Core)
- [CVE-2025-3527](https://cve.now/CVE-2025-3527.md): EventON - WordPress Virtual Event Calendar Plugin \<= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, EventON (Pro) - WordPress Virtual Event Calendar Plugin)
- [CVE-2025-4826](https://cve.now/CVE-2025-4826.md): TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formWirelessTbl buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +1)
- [CVE-2025-4825](https://cve.now/CVE-2025-4825.md): TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formDMZ buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +1)
- [CVE-2025-4824](https://cve.now/CVE-2025-4824.md): TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formWsc buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +1)
- [CVE-2025-4823](https://cve.now/CVE-2025-4823.md): TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formReflashClientTbl submit-url buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +1)
- [CVE-2025-4610](https://cve.now/CVE-2025-4610.md): WP-Members \<= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem\_user\_memberships Shortcode (CVSS 6.4, cbutlerjr WP-Members Membership Plugin)
- [CVE-2025-4819](https://cve.now/CVE-2025-4819.md): y\_project RuoYi Offline Logout batchForceLogout improper authorization (CVSS 2.3, y\_project RuoYi)
- [CVE-2025-4190](https://cve.now/CVE-2025-4190.md): CSV Mass Importer \<= 1.2 - Admin+ Arbitrary File Upload (CVSS 7.2, CSV Mass Importer)
- [CVE-2025-3812](https://cve.now/CVE-2025-3812.md): WPBot Pro Wordpress Chatbot \<= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1, QuantumCloud WPBot Pro Wordpress Chatbot)
- [CVE-2025-4391](https://cve.now/CVE-2025-4391.md): Echo RSS Feed Post Generator \<= 5.4.8.1 - Unauthenticated Arbitrary File Upload (CVSS 9.8, CodeRevolution Echo RSS Feed Post Generator)
- [CVE-2025-4389](https://cve.now/CVE-2025-4389.md): Crawlomatic Multipage Scraper Post Generator \<= 2.6.8.1 - Unauthenticated Arbitrary File Upload (CVSS 9.8, CodeRevolution Crawlomatic Multipage Scraper Post Generator)
- [CVE-2025-4818](https://cve.now/CVE-2025-4818.md): SourceCodester Doctor's Appointment System GET Parameter delete-doctor.php sql injection (CVSS 6.9, SourceCodester Doctor's Appointment System)
- [CVE-2025-4817](https://cve.now/CVE-2025-4817.md): Sourcecodester Doctor's Appointment System GET Parameter delete-appointment.php sql injection (CVSS 6.9, Sourcecodester Doctor's Appointment System)
- [CVE-2025-4194](https://cve.now/CVE-2025-4194.md): AlT Monitoring \<= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, alti5 AlT Monitoring)
- [CVE-2025-4189](https://cve.now/CVE-2025-4189.md): Audio Comments Plugin \<= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, naicuoctavian Audio Comments Plugin)
- [CVE-2025-4816](https://cve.now/CVE-2025-4816.md): SourceCodester Doctor's Appointment System GET Parameter appointment.php sql injection (CVSS 6.9, SourceCodester Doctor's Appointment System)
- [CVE-2025-4815](https://cve.now/CVE-2025-4815.md): Campcodes Sales and Inventory System supplier\_update.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-4814](https://cve.now/CVE-2025-4814.md): Campcodes Sales and Inventory System supplier\_add.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2024-47893](https://cve.now/CVE-2024-47893.md): GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups) (CVSS 6.5, Imagination Technologies Graphics DDK)
- [CVE-2025-1706](https://cve.now/CVE-2025-1706.md): GPU DDK - Improper locking when accessing the pvr\_exp\_fence object (CVSS 7.5, Imagination Technologies Graphics DDK)
- [CVE-2025-48187](https://cve.now/CVE-2025-48187.md): RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification c (CVSS 9.1, infiniflow RAGFlow)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.