# CVEs published 2025-05-18 51 CVEs were published on May 18, 2025: 0 critical, 4 high. Days are UTC. - [CVE-2025-4901](https://cve.now/CVE-2025-4901.md): D-Link DI-7003GV2 HTTP Endpoint state\_view.data sub\_41E304 information disclosure (CVSS 5.3, D-Link DI-7003GV2) - [CVE-2025-4900](https://cve.now/CVE-2025-4900.md): Campcodes Sales and Inventory System payment.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System) - [CVE-2025-4899](https://cve.now/CVE-2025-4899.md): Campcodes Sales and Inventory System transaction\_update.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System) - [CVE-2025-4898](https://cve.now/CVE-2025-4898.md): SourceCodester Student Result Management System Logo File update\_system.php unlink path traversal (CVSS 5.3, SourceCodester Student Result Management System) - [CVE-2025-4897](https://cve.now/CVE-2025-4897.md): Tenda A15 HTTP POST Request multimodalAdd buffer overflow (CVSS 8.7, Tenda A15) - [CVE-2025-4896](https://cve.now/CVE-2025-4896.md): Tenda AC10 UserCongratulationsExec buffer overflow (CVSS 8.7, Tenda AC10) - [CVE-2025-4895](https://cve.now/CVE-2025-4895.md): SourceCodester Doctors Appointment System delete-session.php sql injection (CVSS 6.9, SourceCodester Doctors Appointment System) - [CVE-2025-4894](https://cve.now/CVE-2025-4894.md): calmkart Django-sso-server crypto.py gen\_rsa\_keys inadequate encryption (CVSS 6.3, calmkart Django-sso-server) - [CVE-2025-4893](https://cve.now/CVE-2025-4893.md): jammy928 CoinExchange\_CryptoExchange\_Java File Upload Endpoint UploadFileUtil.java uploadLocalImage path traversal (CVSS 5.3, jammy928 CoinExchange\_CryptoExchange\_Java) - [CVE-2025-4892](https://cve.now/CVE-2025-4892.md): code-projects Police Station Management System Delete Record source.cpp remove stack-based overflow (CVSS 4.8, code-projects Police Station Management System) - [CVE-2025-4891](https://cve.now/CVE-2025-4891.md): code-projects Police Station Management System Display Record source.cpp display buffer overflow (CVSS 4.8, code-projects Police Station Management System) - [CVE-2025-4890](https://cve.now/CVE-2025-4890.md): code-projects Tourism Management System Login User LoginUser stack-based overflow (CVSS 4.8, code-projects Tourism Management System) - [CVE-2025-4889](https://cve.now/CVE-2025-4889.md): code-projects Tourism Management System User Registration AddUser buffer overflow (CVSS 4.8, code-projects Tourism Management System) - [CVE-2025-4888](https://cve.now/CVE-2025-4888.md): code-projects Pharmacy Management System Add Order Details take\_order buffer overflow (CVSS 4.8, code-projects Pharmacy Management System) - [CVE-2025-4887](https://cve.now/CVE-2025-4887.md): SourceCodester Online Student Clearance System cross-site request forgery (CVSS 5.3, SourceCodester Online Student Clearance System) - [CVE-2025-4886](https://cve.now/CVE-2025-4886.md): itsourcecode Sales and Inventory System product\_update.php sql injection (CVSS 6.9, itsourcecode Sales and Inventory System) - [CVE-2025-4885](https://cve.now/CVE-2025-4885.md): itsourcecode Sales and Inventory System product\_add.php sql injection (CVSS 6.9, itsourcecode Sales and Inventory System) - [CVE-2025-4884](https://cve.now/CVE-2025-4884.md): itsourcecode Restaurant Management System assign\_save.php sql injection (CVSS 6.9, itsourcecode Restaurant Management System) - [CVE-2025-4883](https://cve.now/CVE-2025-4883.md): D-Link DI-8100 Connection Limit Page ctxz.asp ctxz\_asp stack-based overflow (CVSS 8.6, D-Link DI-8100) - [CVE-2025-4882](https://cve.now/CVE-2025-4882.md): itsourcecode Restaurant Management System team\_update.php sql injection (CVSS 6.9, itsourcecode Restaurant Management System) - [CVE-2025-4881](https://cve.now/CVE-2025-4881.md): itsourcecode Restaurant Management System user\_save.php sql injection (CVSS 6.9, itsourcecode Restaurant Management System) - [CVE-2025-4880](https://cve.now/CVE-2025-4880.md): PHPGurukul News Portal aboutus.php sql injection (CVSS 6.9, PHPGurukul News Portal) - [CVE-2025-4875](https://cve.now/CVE-2025-4875.md): Campcodes Online Shopping Portal forgot-password.php sql injection (CVSS 6.9, Campcodes Online Shopping Portal) - [CVE-2025-4874](https://cve.now/CVE-2025-4874.md): PHPGurukul News Portal Project contactus.php sql injection (CVSS 6.9, PHPGurukul News Portal Project) - [CVE-2025-4873](https://cve.now/CVE-2025-4873.md): PHPGurukul News Portal Login index.php sql injection (CVSS 6.9, PHPGurukul News Portal) - [CVE-2025-4872](https://cve.now/CVE-2025-4872.md): FreeFloat FTP Server CCC Command buffer overflow (CVSS 6.9, FreeFloat FTP Server) - [CVE-2025-4871](https://cve.now/CVE-2025-4871.md): PCMan FTP Server REST Command buffer overflow (CVSS 6.9, PCMan FTP Server) - [CVE-2025-4870](https://cve.now/CVE-2025-4870.md): itsourcecode Restaurant Management System menu\_save.php sql injection (CVSS 6.9, itsourcecode Restaurant Management System) - [CVE-2025-4869](https://cve.now/CVE-2025-4869.md): itsourcecode Restaurant Management System member\_update.php sql injection (CVSS 6.9, itsourcecode Restaurant Management System) - [CVE-2025-4868](https://cve.now/CVE-2025-4868.md): merikbest ecommerce-spring-reactjs File Upload Endpoint admin path traversal (CVSS 5.3, merikbest ecommerce-spring-reactjs) - [CVE-2025-4867](https://cve.now/CVE-2025-4867.md): Tenda A15 ArpNerworkSet formArpNerworkSet denial of service (CVSS 7.1, Tenda A15) - [CVE-2025-4866](https://cve.now/CVE-2025-4866.md): weibocom rill-flow Management Console code injection (CVSS 5.3, weibocom rill-flow) - [CVE-2025-4865](https://cve.now/CVE-2025-4865.md): itsourcecode Restaurant Management System member\_save.php sql injection (CVSS 6.9, itsourcecode Restaurant Management System) - [CVE-2025-4864](https://cve.now/CVE-2025-4864.md): itsourcecode Restaurant Management System finished.php sql injection (CVSS 6.9, itsourcecode Restaurant Management System) - [CVE-2025-4863](https://cve.now/CVE-2025-4863.md): Advaya Softech GEMS ERP Portal studentLogin.action sql injection (CVSS 5.3, Advaya Softech GEMS ERP Portal) - [CVE-2025-4862](https://cve.now/CVE-2025-4862.md): PHPGurukul Directory Management System searchdata.php cross site scripting (CVSS 5.3, PHPGurukul Directory Management System) - [CVE-2025-4861](https://cve.now/CVE-2025-4861.md): PHPGurukul Beauty Parlour Management System admin-profile.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System) - [CVE-2025-3715](https://cve.now/CVE-2025-3715.md): Bold Page Builder \<= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter (CVSS 6.4, boldthemes Bold Page Builder) - [CVE-2025-4860](https://cve.now/CVE-2025-4860.md): D-Link DAP-2695 Static Pool Settings Page adv\_dhcps.php cross site scripting (CVSS 4.8, D-Link DAP-2695) - [CVE-2025-4859](https://cve.now/CVE-2025-4859.md): D-Link DAP-2695 MAC Bypass Settings Page adv\_macbypass.php cross site scripting (CVSS 4.8, D-Link DAP-2695) - [CVE-2025-4858](https://cve.now/CVE-2025-4858.md): D-Link DAP-2695 ARP Spoofing Prevention Page adv\_arpspoofing.php cross site scripting (CVSS 4.8, D-Link DAP-2695) - [CVE-2025-4852](https://cve.now/CVE-2025-4852.md): TOTOLINK A3002R VPN Page cross site scripting (CVSS 4.8, TOTOLINK A3002R) - [CVE-2025-4851](https://cve.now/CVE-2025-4851.md): TOTOLINK N300RH cstecgi.cgi setUploadUserData command injection (CVSS 5.3, TOTOLINK N300RH) - [CVE-2025-4850](https://cve.now/CVE-2025-4850.md): TOTOLINK N300RH cstecgi.cgi setUnloadUserData command injection (CVSS 5.3, TOTOLINK N300RH) - [CVE-2025-4849](https://cve.now/CVE-2025-4849.md): TOTOLINK N300RH cstecgi.cgi CloudACMunualUpdateUserdata command injection (CVSS 5.3, TOTOLINK N300RH) - [CVE-2025-4848](https://cve.now/CVE-2025-4848.md): FreeFloat FTP Server RECV Command buffer overflow (CVSS 6.9, FreeFloat FTP Server) - [CVE-2025-4847](https://cve.now/CVE-2025-4847.md): FreeFloat FTP Server MLS Command buffer overflow (CVSS 6.9, FreeFloat FTP Server) - [CVE-2025-4846](https://cve.now/CVE-2025-4846.md): FreeFloat FTP Server MPUT Command buffer overflow (CVSS 6.9, FreeFloat FTP Server) - [CVE-2025-4845](https://cve.now/CVE-2025-4845.md): FreeFloat FTP Server TRACE Command buffer overflow (CVSS 6.9, FreeFloat FTP Server) - [CVE-2025-4844](https://cve.now/CVE-2025-4844.md): FreeFloat FTP Server CD Command buffer overflow (CVSS 6.9, FreeFloat FTP Server) - [CVE-2025-48219](https://cve.now/CVE-2025-48219.md): O2 UK before 2025-05-19 allows subscribers to determine the Cell ID of other subscribers by initiating an IMS (IP Multimedia Subsystem) call (CVSS 3.5, O2 UK O2) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-05-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.