# CVEs published 2025-05-19

244 CVEs were published on May 19, 2025: 28 critical, 79 high. Days are UTC.

- [CVE-2025-3079](https://cve.now/CVE-2025-3079.md): A passback vulnerability which relates to office/small office multifunction printers and laser printers. (CVSS 6.3, Canon imageRUNNER Series · Canon imageCLASS Series +2)
- [CVE-2025-3078](https://cve.now/CVE-2025-3078.md): A passback vulnerability which relates to production printers and office multifunction printers. (CVSS 6.3, Canon imageRUNNER ADVANCE Series · Canon imageRUNNER Ser… +3)
- [CVE-2025-4971](https://cve.now/CVE-2025-4971.md): Broadcom Automic Automation Agent Unix privilege escalation (CVSS 8.5, Broadcom Automic Automation)
- [CVE-2025-1308](https://cve.now/CVE-2025-1308.md): PX Backup Improper Sanitization Vulnerability (CVSS 8.4, Pure Storage PX Backup)
- [CVE-2025-3223](https://cve.now/CVE-2025-3223.md): WorkstationST EGD Configuration Server Path Traversal Vulnerability (CVSS 5.9, GE Vernova WorkstationST)
- [CVE-2025-48340](https://cve.now/CVE-2025-48340.md): WordPress User Profile Meta Manager plugin \<= 1.02 - CSRF to Privilege Escalation vulnerability (CVSS 9.8, Danny Vink User Profile Meta Manager)
- [CVE-2025-31027](https://cve.now/CVE-2025-31027.md): WordPress Tiger theme \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jocoxdesign Tiger)
- [CVE-2025-32924](https://cve.now/CVE-2025-32924.md): WordPress Revy plugin \<= 2.1 - SQL Injection vulnerability (CVSS 8.5, roninwp Revy)
- [CVE-2025-32925](https://cve.now/CVE-2025-32925.md): WordPress SUMO Reward Points plugin \<= 30.7.0 - Local File Inclusion vulnerability (CVSS 8.3, FantasticPlugins SUMO Reward Points)
- [CVE-2025-32926](https://cve.now/CVE-2025-32926.md): WordPress Grand Restaurant WordPress theme \<= 7.0 - Path Traversal to PHP Object Injection vulnerability (CVSS 9.8, ThemeGoods Grand Restaurant)
- [CVE-2025-32927](https://cve.now/CVE-2025-32927.md): WordPress FoodBakery plugin \<= 3.3 - PHP Object Injection vulnerability (CVSS 9.8, Chimpstudio FoodBakery)
- [CVE-2025-32928](https://cve.now/CVE-2025-32928.md): WordPress Altair theme \<= 5.2.2 - PHP Object Injection vulnerability (CVSS 9.8, ThemeGoods Altair)
- [CVE-2025-39348](https://cve.now/CVE-2025-39348.md): WordPress Grand Restaurant WordPress theme \<= 7.0 - PHP Object Injection vulnerability (CVSS 9.8, ThemeGoods Grand Restaurant)
- [CVE-2025-39349](https://cve.now/CVE-2025-39349.md): WordPress CiyaShop theme \<= 4.18.0 - PHP Object Injection vulnerability (CVSS 9.8, Potenzaglobalsolutions CiyaShop)
- [CVE-2025-39350](https://cve.now/CVE-2025-39350.md): WordPress wProject theme \< 5.8.0 - Unauthenticated Post/Comment/Attachment Modification/Deletion vulnerability (CVSS 8.2, Rocket Apps wProject)
- [CVE-2025-39352](https://cve.now/CVE-2025-39352.md): WordPress Grand Restaurant WordPress theme \<= 7.0 - Arbitrary Options Deletion vulnerability (CVSS 8.2, ThemeGoods Grand Restaurant)
- [CVE-2025-39354](https://cve.now/CVE-2025-39354.md): WordPress Grand Conference theme \<= 5.3 - PHP Object Injection vulnerability (CVSS 9.8, ThemeGoods Grand Conference)
- [CVE-2025-39355](https://cve.now/CVE-2025-39355.md): WordPress FAT Services Booking plugin \<= 5.6 - SQL Injection vulnerability (CVSS 8.5, roninwp FAT Services Booking)
- [CVE-2025-39356](https://cve.now/CVE-2025-39356.md): WordPress Foodbakery Sticky Cart plugin \<= 3.2 - PHP Object Injection vulnerability (CVSS 9.8, Chimpstudio Foodbakery Sticky Cart)
- [CVE-2025-39357](https://cve.now/CVE-2025-39357.md): WordPress Hospital Management System plugin \<= 47.0(20-11-2023) - SQL Injection vulnerability (CVSS 8.5, mojoomla Hospital Management System)
- [CVE-2025-46441](https://cve.now/CVE-2025-46441.md): WordPress Section Widget plugin \<= 3.3.1 - Path Traversal vulnerability (CVSS 5.3, ctltwp Section Widget)
- [CVE-2025-39365](https://cve.now/CVE-2025-39365.md): WordPress wProject theme \< 5.8.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rocket Apps wProject)
- [CVE-2025-39366](https://cve.now/CVE-2025-39366.md): WordPress wProject theme \< 5.8.0 - Subscriber+ Privilege Escalation vulnerability (CVSS 8.8, Rocket Apps wProject)
- [CVE-2025-39372](https://cve.now/CVE-2025-39372.md): WordPress WordPress Events Calendar Registration & Tickets plugin \<= 2.6.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, elbisnero WordPress Events Calendar Registration & Tickets)
- [CVE-2025-39380](https://cve.now/CVE-2025-39380.md): WordPress Hospital Management System plugin \<= 47.0(20-11-2023) - Arbitrary File Upload vulnerability (CVSS 10.0, mojoomla Hospital Management System)
- [CVE-2025-39386](https://cve.now/CVE-2025-39386.md): WordPress Hospital Management System plugin \<= 47.0(20-11-2023) - SQL Injection vulnerability (CVSS 9.3, mojoomla Hospital Management System)
- [CVE-2025-39389](https://cve.now/CVE-2025-39389.md): WordPress AnalyticsWP \<= 2.1.2 - SQL Injection Vulnerability (CVSS 9.3, Solid Plugins AnalyticsWP)
- [CVE-2025-39392](https://cve.now/CVE-2025-39392.md): WordPress WPAMS plugin \<= 44.0 (17-08-2023) - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mojoomla WPAMS)
- [CVE-2025-47949](https://cve.now/CVE-2025-47949.md): samlify SAML Signature Wrapping attack (CVSS 9.9, tngan samlify · samlify)
- [CVE-2025-39393](https://cve.now/CVE-2025-39393.md): WordPress Hospital Management System plugin \<= 47.0(20-11-2023) - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mojoomla Hospital Management System)
- [CVE-2025-39395](https://cve.now/CVE-2025-39395.md): WordPress WPAMS plugin \<= 44.0 (17-08-2023) - SQL Injection vulnerability (CVSS 9.3, mojoomla WPAMS)
- [CVE-2025-39401](https://cve.now/CVE-2025-39401.md): WordPress WPAMS plugin \<= 44.0 (17-08-2023) - Arbitrary File Upload vulnerability (CVSS 10.0, mojoomla WPAMS)
- [CVE-2025-47946](https://cve.now/CVE-2025-47946.md): symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes (CVSS 6.1, symfony ux · symfony/ux-twig-component +1)
- [CVE-2025-39402](https://cve.now/CVE-2025-39402.md): WordPress WPAMS plugin \<= 44.0 (17-08-2023) - Arbitrary File Upload vulnerability (CVSS 9.9, mojoomla WPAMS)
- [CVE-2025-47944](https://cve.now/CVE-2025-47944.md): Multer vulnerable to Denial of Service from maliciously crafted requests (CVSS 7.5, expressjs multer · multer)
- [CVE-2025-47935](https://cve.now/CVE-2025-47935.md): Multer vulnerable to Denial of Service via memory leaks from unclosed streams (CVSS 7.5, expressjs multer · multer)
- [CVE-2025-39403](https://cve.now/CVE-2025-39403.md): WordPress WPAMS plugin \<= 44.0 (17-08-2023) - SQL Injection vulnerability (CVSS 8.5, mojoomla WPAMS)
- [CVE-2025-39405](https://cve.now/CVE-2025-39405.md): WordPress WPAMS plugin \<= 44.0 (17-08-2023) - Privilege Escalation vulnerability (CVSS 8.8, mojoomla WPAMS)
- [CVE-2025-39406](https://cve.now/CVE-2025-39406.md): WordPress WPAMS plugin \<= 44.0 - Local File Inclusion to Privilege Escalation vulnerability (CVSS 9.8, mojoomla WPAMS)
- [CVE-2025-39407](https://cve.now/CVE-2025-39407.md): WordPress Memberpress plugin \< 1.12.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Caseproof Memberpress)
- [CVE-2025-39409](https://cve.now/CVE-2025-39409.md): WordPress WordPress Video Robot - The Ultimate Video Importer plugin \<= 1.20.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, pressaholic WordPress Video Robot - The Ultimate Video Impo…)
- [CVE-2025-39410](https://cve.now/CVE-2025-39410.md): WordPress Smart Sections Theme Builder - WPBakery Page Builder Addon plugin \<= 1.7.8 - PHP Object Injection vulnerability (CVSS 9.8, themegusta Smart Sections Theme Builder - WPBakery Page Bui…)
- [CVE-2025-39411](https://cve.now/CVE-2025-39411.md): WordPress WhatsApp Click to Chat Plugin for WordPress plugin \<= 2.2.12 - Local File Inclusion vulnerability (CVSS 7.5, Indie\_Plugins WhatsApp Click to Chat Plugin for WordPress)
- [CVE-2025-47934](https://cve.now/CVE-2025-47934.md): OpenPGP.js's message signature verification can be spoofed (CVSS 8.7, openpgpjs · openpgp)
- [CVE-2025-39445](https://cve.now/CVE-2025-39445.md): WordPress Super Store Finder \<= 7.2 - SQL Injection Vulnerability (CVSS 9.3, highwarden Super Store Finder)
- [CVE-2025-39446](https://cve.now/CVE-2025-39446.md): WordPress Booster Plus for WooCommerce plugin \<= 7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pluggabl Booster Plus for WooCommerce)
- [CVE-2025-47284](https://cve.now/CVE-2025-47284.md): Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation (CVSS 9.9, gardener · github.com/gardener/gardener)
- [CVE-2025-39447](https://cve.now/CVE-2025-39447.md): WordPress JetElements For Elementor plugin \<= 2.7.4.1 - Broken Access Control Vulnerability (CVSS 7.5, Crocoblock JetElements For Elementor)
- [CVE-2025-39449](https://cve.now/CVE-2025-39449.md): WordPress JetWooBuilder plugin \<= 2.1.18 - Broken Access Control Vulnerability (CVSS 7.5, Crocoblock JetWooBuilder)
- [CVE-2025-39451](https://cve.now/CVE-2025-39451.md): WordPress JetBlocks For Elementor plugin \<= 1.3.16 - Broken Access Control Vulnerability (CVSS 7.5, Crocoblock JetBlocks For Elementor)
- [CVE-2025-39458](https://cve.now/CVE-2025-39458.md): WordPress Foton theme \<= 2.5.2 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes Foton)
- [CVE-2025-39459](https://cve.now/CVE-2025-39459.md): WordPress Real Estate 7 theme \<= 3.5.2 - Privilege Escalation vulnerability (CVSS 7.3, contempoinc Real Estate)
- [CVE-2025-47283](https://cve.now/CVE-2025-47283.md): Bypassing project secret validation can lead to privilege escalation (CVSS 9.9, gardener · github.com/gardener/gardener)
- [CVE-2025-43832](https://cve.now/CVE-2025-43832.md): WordPress Remote Images Grabber plugin \<= 0.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, andreyk Remote Images Grabber)
- [CVE-2025-43836](https://cve.now/CVE-2025-43836.md): WordPress Syndicate Out \<= 0.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, confuzzledduck Syndicate Out)
- [CVE-2025-43837](https://cve.now/CVE-2025-43837.md): WordPress Total Donations \<= 3.0.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, binti76 Total Donations)
- [CVE-2025-43838](https://cve.now/CVE-2025-43838.md): WordPress Custom PC Builder Lite for WooCommerce \<= 1.0.1 - Settings Change Vulnerability (CVSS 6.5, ChoPlugins.com Custom PC Builder Lite for WooCommerce)
- [CVE-2025-43839](https://cve.now/CVE-2025-43839.md): WordPress BP Messages Tool plugin \<= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, shanebp BP Messages Tool)
- [CVE-2025-47577](https://cve.now/CVE-2025-47577.md): WordPress TI WooCommerce Wishlist plugin \<= 2.9.2 - Arbitrary File Upload Vulnerability (CVSS 10.0, templateinvaders TI WooCommerce Wishlist)
- [CVE-2025-47581](https://cve.now/CVE-2025-47581.md): WordPress WordPress Events Calendar Registration & Tickets plugin \<= 2.6.0 - PHP Object Injection vulnerability (CVSS 9.8, elbisnero WordPress Events Calendar Registration & Tickets)
- [CVE-2025-47582](https://cve.now/CVE-2025-47582.md): WordPress WPBot Pro Wordpress Chatbot \<= 12.7.0 - PHP Object Injection Vulnerability (CVSS 9.8, QuantumCloud WPBot Pro Wordpress Chatbot)
- [CVE-2025-27010](https://cve.now/CVE-2025-27010.md): WordPress Tastyc \< 2.5.2 - Local File Inclusion Vulnerability (CVSS 8.1, bslthemes Tastyc)
- [CVE-2025-26997](https://cve.now/CVE-2025-26997.md): WordPress Wireless Butler plugin \<= 1.0.11 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, validas Wireless Butler)
- [CVE-2025-26892](https://cve.now/CVE-2025-26892.md): WordPress Celestial Aura plugin \<= 2.2 - Arbitrary File Upload vulnerability (CVSS 9.9, dkszone Celestial Aura)
- [CVE-2025-26872](https://cve.now/CVE-2025-26872.md): WordPress Eximius theme \<= 2.2 - Arbitrary File Upload vulnerability (CVSS 9.9, dkszone Eximius)
- [CVE-2025-26735](https://cve.now/CVE-2025-26735.md): WordPress Grip theme \<= 1.0.9 - Local File Inclusion vulnerability (CVSS 7.5, Candid themes Grip)
- [CVE-2025-22287](https://cve.now/CVE-2025-22287.md): WordPress LTL Freight Quotes – FreightQuote Edition plugin \<= 2.3.11 - Broken Access Control vulnerability (CVSS 5.4, enituretechnology LTL Freight Quotes – FreightQuote Edition)
- [CVE-2025-47282](https://cve.now/CVE-2025-47282.md): Malicious google credential in DNS secret can lead to privilege escalation (CVSS 9.9, gardener external-dns-management · github.com/gardener/e… +1)
- [CVE-2025-39448](https://cve.now/CVE-2025-39448.md): WordPress JetElements For Elementor plugin \<= 2.7.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetElements For Elementor)
- [CVE-2025-39450](https://cve.now/CVE-2025-39450.md): WordPress JetTabs plugin \<= 2.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetTabs)
- [CVE-2025-39454](https://cve.now/CVE-2025-39454.md): WordPress Name Directory plugin \<= 1.30.0 - Broken Access Control vulnerability (CVSS 4.3, Jeroen Peters Name Directory)
- [CVE-2025-39460](https://cve.now/CVE-2025-39460.md): WordPress Eduma theme \<= 5.6.4 - Broken Access Control vulnerability (CVSS 5.3, ThimPress Eduma)
- [CVE-2025-43833](https://cve.now/CVE-2025-43833.md): WordPress Absolute Links plugin \<= 1.1.1 - SQL Injection vulnerability (CVSS 7.6, Amir Helzer Absolute Links)
- [CVE-2025-43834](https://cve.now/CVE-2025-43834.md): WordPress cookieBAR plugin \<= 1.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, tox82 cookieBAR)
- [CVE-2025-43835](https://cve.now/CVE-2025-43835.md): WordPress wp-cyr-cho plugin \<= 0.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ktsvetkov wp-cyr-cho)
- [CVE-2025-39412](https://cve.now/CVE-2025-39412.md): WordPress Master Slider plugin \<= 3.11.0 - Broken Access Control vulnerability (CVSS 4.3, averta Master Slider)
- [CVE-2025-39398](https://cve.now/CVE-2025-39398.md): WordPress Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue theme \<= 4.2.2 - Broken Access Control vulnerability (CVSS 4.3, Themovation Bellevue)
- [CVE-2025-39396](https://cve.now/CVE-2025-39396.md): WordPress JetReviews plugin \<= 2.3.6 - Local File Inclusion vulnerability (CVSS 7.5, Crocoblock JetReviews)
- [CVE-2025-43841](https://cve.now/CVE-2025-43841.md): WordPress WP Vegas plugin \<= 2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jamesdbruner WP Vegas)
- [CVE-2025-43840](https://cve.now/CVE-2025-43840.md): WordPress CheckBot plugin \<= 1.05 - CSRF to Stored XSS vulnerability (CVSS 7.1, ref CheckBot)
- [CVE-2025-46262](https://cve.now/CVE-2025-46262.md): WordPress Mad Mimi for WordPress plugin \<= 1.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Zack Katz Mad Mimi for WordPress)
- [CVE-2025-46263](https://cve.now/CVE-2025-46263.md): WordPress Author Box After Posts plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Lloyd Saunders Author Box After Posts)
- [CVE-2025-46543](https://cve.now/CVE-2025-46543.md): WordPress Enhanced Paypal Shortcodes plugin \<= 0.5a - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CharlyLeetham Enhanced Paypal Shortcodes)
- [CVE-2025-4945](https://cve.now/CVE-2025-4945.md): Libsoup: integer overflow in cookie expiration date handling in libsoup (CVSS 3.7, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-4941](https://cve.now/CVE-2025-4941.md): PHPGurukul Credit Card Application Management System index.php sql injection (CVSS 6.9, PHPGurukul Credit Card Application Management System)
- [CVE-2025-39394](https://cve.now/CVE-2025-39394.md): WordPress AnalyticsWP plugin \<= 2.1.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, Solid Plugins AnalyticsWP)
- [CVE-2025-26920](https://cve.now/CVE-2025-26920.md): WordPress Customify theme \<= 0.4.8 - Broken Access Control vulnerability (CVSS 5.4, pressmaximum Customify)
- [CVE-2025-26867](https://cve.now/CVE-2025-26867.md): WordPress Bulk theme \<= 1.0.11 - Broken Access Control vulnerability (CVSS 5.3, Themes4WP Bulk)
- [CVE-2025-39388](https://cve.now/CVE-2025-39388.md): WordPress AnalyticsWP plugin \<= 2.0.0 - Broken Access Control vulnerability (CVSS 5.3, Solid Plugins AnalyticsWP)
- [CVE-2025-39376](https://cve.now/CVE-2025-39376.md): WordPress Car Park Booking System for WordPress plugin \<= 2.6 - Broken Access Control vulnerability (CVSS 4.3, QuanticaLabs Car Park Booking System for WordPress)
- [CVE-2025-39375](https://cve.now/CVE-2025-39375.md): WordPress Easy Child Theme Creator plugin \<= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Ashok G Easy Child Theme Creator)
- [CVE-2025-39374](https://cve.now/CVE-2025-39374.md): WordPress Best Posts Summary plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, aseem1234 Best Posts Summary)
- [CVE-2025-39373](https://cve.now/CVE-2025-39373.md): WordPress JNews Theme \<= 11.6.16 - Broken Access Control Vulnerability (CVSS 5.3, jegtheme JNews)
- [CVE-2025-39371](https://cve.now/CVE-2025-39371.md): WordPress Author Box Plugin With Different Description plugin \<= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Sanjeev Mohindra Author Box Plugin With Different Descripti…)
- [CVE-2025-39370](https://cve.now/CVE-2025-39370.md): WordPress iCafe Library plugin \<= 1.8.3 - SQL Injection vulnerability (CVSS 7.6, cnilsson iCafe Library)
- [CVE-2025-39369](https://cve.now/CVE-2025-39369.md): WordPress Posts for Page plugin \<= 2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sihibbs Posts for Page)
- [CVE-2025-39368](https://cve.now/CVE-2025-39368.md): WordPress Rootspersona plugin \<= 3.7.5 - Broken Access Control vulnerability (CVSS 5.3, ed4becky Rootspersona)
- [CVE-2025-4940](https://cve.now/CVE-2025-4940.md): 1000 Projects Daily College Class Work Report Book admin\_info.php sql injection (CVSS 6.9, 1000 Projects Daily College Class Work Report Book)
- [CVE-2025-39353](https://cve.now/CVE-2025-39353.md): WordPress Grand Restaurant WordPress theme \<= 7.0 - Broken Access Control vulnerability (CVSS 5.3, ThemeGoods Grand Restaurant)
- [CVE-2025-39351](https://cve.now/CVE-2025-39351.md): WordPress Grand Restaurant WordPress theme \<= 7.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ThemeGoods Grand Restaurant)
- [CVE-2025-39364](https://cve.now/CVE-2025-39364.md): WordPress Product Category Slider for WooCommerce plugin \<= 4.3.4 - Local File Inclusion vulnerability (CVSS 7.5, PluginEver Product Category Slider for WooCommerce)
- [CVE-2025-47576](https://cve.now/CVE-2025-47576.md): WordPress Bimber - Viral Magazine WordPress Theme theme \<= 9.2.5 - Local File Inclusion vulnerability (CVSS 8.8, Bringthepixel Bimber - Viral Magazine WordPress Theme)
- [CVE-2025-47583](https://cve.now/CVE-2025-47583.md): WordPress Salon booking system plugin \<= 10.16 - CSRF to Arbitrary Content Deletion vulnerability (CVSS 5.4, Dimitri Grassi Salon booking system)
- [CVE-2025-32920](https://cve.now/CVE-2025-32920.md): WordPress TI WooCommerce Wishlist plugin \<= 2.10.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, templateinvaders TI WooCommerce Wishlist)
- [CVE-2025-4876](https://cve.now/CVE-2025-4876.md): Hardcoded Key Revealed in ConnectWise Password Encryption Utility (CVSS 6.0, ConnectWise Risk Assessment)
- [CVE-2025-23988](https://cve.now/CVE-2025-23988.md): WordPress ghostwriter theme \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bruno Cavalcante Ghostwriter)
- [CVE-2025-23986](https://cve.now/CVE-2025-23986.md): WordPress Tiki Time theme \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fyrewurks Tiki Time)
- [CVE-2025-23983](https://cve.now/CVE-2025-23983.md): WordPress Tijaji theme \<= 1.43 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tijaji)
- [CVE-2025-26621](https://cve.now/CVE-2025-26621.md): OpenCTI vulnerable to Denial of Service through web hook (CVSS 7.6, OpenCTI-Platform opencti · pycti)
- [CVE-2025-23981](https://cve.now/CVE-2025-23981.md): WordPress CarZine theme \<= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Takimi Themes CarZine)
- [CVE-2025-23979](https://cve.now/CVE-2025-23979.md): WordPress Flashy theme \<= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, duwasai Flashy)
- [CVE-2025-22792](https://cve.now/CVE-2025-22792.md): WordPress Js O3 Lite theme \<= 1.5.8.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jinwen Js O3 Lite)
- [CVE-2025-22791](https://cve.now/CVE-2025-22791.md): WordPress offset writing theme \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, twh offset writing)
- [CVE-2025-24184](https://cve.now/CVE-2025-24184.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24189](https://cve.now/CVE-2025-24189.md): The issue was addressed with improved checks. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-24183](https://cve.now/CVE-2025-24183.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-31185](https://cve.now/CVE-2025-31185.md): A logic issue was addressed with improved checks. (CVSS 3.3, Apple iOS and iPadOS)
- [CVE-2025-31262](https://cve.now/CVE-2025-31262.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-4939](https://cve.now/CVE-2025-4939.md): PHPGurukul Credit Card Application Management System new-ccapplication.php cross site scripting (CVSS 5.3, PHPGurukul Credit Card Application Management System)
- [CVE-2025-22790](https://cve.now/CVE-2025-22790.md): WordPress moseter theme \<= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, asmedia moseter)
- [CVE-2025-22789](https://cve.now/CVE-2025-22789.md): WordPress polka dots theme \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fyrewurks polka dots)
- [CVE-2025-22687](https://cve.now/CVE-2025-22687.md): WordPress tuaug4 theme \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Asmedia Tuaug4)
- [CVE-2025-22678](https://cve.now/CVE-2025-22678.md): WordPress my white theme \<= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mythemes my white)
- [CVE-2025-4948](https://cve.now/CVE-2025-4948.md): Libsoup: integer underflow in soup\_multipart\_new\_from\_message() leading to denial of service in libsoup (CVSS 7.5, libsoup · Red Hat Enterprise Linux)
- [CVE-2024-33939](https://cve.now/CVE-2024-33939.md): WordPress LMS by Masteriyo plugin \<= 1.7.3 - Broken Authentication vulnerability (CVSS 5.3, Masteriyo - LMS)
- [CVE-2025-4938](https://cve.now/CVE-2025-4938.md): PHPGurukul Employee Record Management System registererms.php sql injection (CVSS 5.3, PHPGurukul Employee Record Management System)
- [CVE-2025-4937](https://cve.now/CVE-2025-4937.md): SourceCodester Apartment Visitor Management System profile.php sql injection (CVSS 6.9, SourceCodester Apartment Visitor Management System)
- [CVE-2025-3908](https://cve.now/CVE-2025-3908.md): The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arb (CVSS 6.2, OpenVPN 3 Linux)
- [CVE-2025-48346](https://cve.now/CVE-2025-48346.md): WordPress Embed and Integrate Etsy Shop plugin \<= 1.0.8 - Broken Access Control vulnerability (CVSS 5.3, Embed360 Embed and Integrate Etsy Shop)
- [CVE-2025-48344](https://cve.now/CVE-2025-48344.md): WordPress Rootspersona plugin \<= 3.7.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, ed4becky Rootspersona)
- [CVE-2025-48342](https://cve.now/CVE-2025-48342.md): WordPress Dynamic Pricing & Discounts Lite for WooCommerce plugin \<= 2.0.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, RedefiningTheWeb Dynamic Pricing & Discounts Lite for WooCo…)
- [CVE-2025-48341](https://cve.now/CVE-2025-48341.md): WordPress Form Maker by 10Web plugin \<= 1.15.33 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Form Maker by 10Web)
- [CVE-2025-48288](https://cve.now/CVE-2025-48288.md): WordPress ElementInvader Addons for Elementor plugin \<= 1.3.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Element Invader ElementInvader Addons for Elementor)
- [CVE-2025-48285](https://cve.now/CVE-2025-48285.md): WordPress Falang multilanguage plugin \<= 1.3.61 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, sbouey Falang multilanguage)
- [CVE-2025-48284](https://cve.now/CVE-2025-48284.md): WordPress Japanized For WooCommerce plugin \<= 2.6.40 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, shohei.tanaka Japanized For WooCommerce)
- [CVE-2025-48282](https://cve.now/CVE-2025-48282.md): WordPress Majestic Support plugin \<= 1.1.0 - Broken Access Control Vulnerability (CVSS 5.3, Majestic Support)
- [CVE-2025-48280](https://cve.now/CVE-2025-48280.md): WordPress AutomatorWP plugin \<= 5.2.1.3 - SQL Injection Vulnerability (CVSS 7.6, Ruben Garcia AutomatorWP)
- [CVE-2025-48278](https://cve.now/CVE-2025-48278.md): WordPress RSVPMarker plugin \<= 11.5.6 - SQL Injection Vulnerability (CVSS 8.5, davidfcarr RSVPMarker)
- [CVE-2025-48277](https://cve.now/CVE-2025-48277.md): WordPress Cost Calculator Builder plugin \<= 3.2.74 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Stylemix Cost Calculator Builder)
- [CVE-2025-48276](https://cve.now/CVE-2025-48276.md): WordPress Visual Composer Website Builder plugin \<= 45.11.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Visual Composer Website Builder)
- [CVE-2025-48272](https://cve.now/CVE-2025-48272.md): WordPress WP Job Portal plugin \<= 2.3.2 - Insecure Direct Object References (IDOR) Vulnerability (CVSS 5.3, wpjobportal WP Job Portal)
- [CVE-2025-48270](https://cve.now/CVE-2025-48270.md): WordPress SKT Blocks plugin \<= 2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, sonalsinha21 SKT Blocks)
- [CVE-2025-48269](https://cve.now/CVE-2025-48269.md): WordPress WPAdverts plugin \<= 2.2.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Greg Winiarski WPAdverts)
- [CVE-2025-48268](https://cve.now/CVE-2025-48268.md): WordPress Bot for Telegram on WooCommerce plugin \<= 1.2.6 - Broken Access Control Vulnerability (CVSS 4.3, Guru Team Bot for Telegram on WooCommerce)
- [CVE-2025-48266](https://cve.now/CVE-2025-48266.md): WordPress Active Products Tables for WooCommerce plugin \<= 1.0.6.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, RealMag777 Active Products Tables for WooCommerce)
- [CVE-2025-48265](https://cve.now/CVE-2025-48265.md): WordPress Year Make Model Search for WooCommerce plugin \<= 1.0.11 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, Pektsekye Year Make Model Search for WooCommerce)
- [CVE-2025-48264](https://cve.now/CVE-2025-48264.md): WordPress Product Code for WooCommerce plugin \<= 1.5.0 - CSRF to Database Update vulnerability (CVSS 4.3, artiosmedia Product Code for WooCommerce)
- [CVE-2025-48263](https://cve.now/CVE-2025-48263.md): WordPress MultiVendorX plugin \<= 4.2.22 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, MultiVendorX)
- [CVE-2025-48262](https://cve.now/CVE-2025-48262.md): WordPress Url Rewrite Analyzer plugin \<= 1.3.3 - Broken Access Control Vulnerability (CVSS 4.3, M.Code Url Rewrite Analyzer)
- [CVE-2025-48260](https://cve.now/CVE-2025-48260.md): WordPress GDPR CCPA Compliance Support plugin \<= 2.7.3 - Broken Access Control Vulnerability (CVSS 4.3, Ninja Team GDPR CCPA Compliance Support)
- [CVE-2025-48259](https://cve.now/CVE-2025-48259.md): WordPress WP Mapa Politico España plugin \<= 3.8.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, Juan Carlos WP Mapa Politico España)
- [CVE-2025-48258](https://cve.now/CVE-2025-48258.md): WordPress Mega Menu Block plugin \<= 1.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, jetmonsters Mega Menu Block)
- [CVE-2025-48257](https://cve.now/CVE-2025-48257.md): WordPress Projectopia plugin \<= 5.1.17 - Broken Access Control Vulnerability (CVSS 6.5, Projectopia)
- [CVE-2025-48256](https://cve.now/CVE-2025-48256.md): WordPress Import Social Events plugin \<= 1.8.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Xylus Themes Import Social Events)
- [CVE-2025-48255](https://cve.now/CVE-2025-48255.md): WordPress Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP plugin \<= 6.2.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, videowhisper Broadcast Live Video)
- [CVE-2025-48254](https://cve.now/CVE-2025-48254.md): WordPress Change Add to Cart Button Text for WooCommerce plugin \<= 2.2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory Change Add to Cart Button Text for WooCommerce)
- [CVE-2025-48253](https://cve.now/CVE-2025-48253.md): WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin \<= 2.4.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory Free Shipping Bar: Amount Left for Free Shipping…)
- [CVE-2025-48252](https://cve.now/CVE-2025-48252.md): WordPress Back Button Widget plugin \<= 1.6.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory Back Button Widget)
- [CVE-2025-48251](https://cve.now/CVE-2025-48251.md): WordPress Additional Custom Emails & Recipients for WooCommerce plugin \<= 3.5.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory Additional Custom Emails & Recipients for WooComm…)
- [CVE-2025-48250](https://cve.now/CVE-2025-48250.md): WordPress Coupons & Add to Cart by URL Links for WooCommerce plugin \<= 1.7.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory Coupons & Add to Cart by URL Links for WooCommerce)
- [CVE-2025-48249](https://cve.now/CVE-2025-48249.md): WordPress EAN for WooCommerce plugin \<= 5.4.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory EAN for WooCommerce)
- [CVE-2025-48248](https://cve.now/CVE-2025-48248.md): WordPress Sitewide Discount for WooCommerce: Apply Discount to All Products plugin \<= 2.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory Sitewide Discount for WooCommerce: Apply Discount…)
- [CVE-2025-48247](https://cve.now/CVE-2025-48247.md): WordPress Shortlinks by Pretty Links plugin \<= 3.6.15 - Broken Access Control Vulnerability (CVSS 4.3, Blair Williams Shortlinks by Pretty Links)
- [CVE-2025-48246](https://cve.now/CVE-2025-48246.md): WordPress The Events Calendar plugin \<= 6.11.2.1 - Broken Access Control Vulnerability (CVSS 5.4, StellarWP The Events Calendar)
- [CVE-2025-48244](https://cve.now/CVE-2025-48244.md): WordPress Exclusive Addons Elementor plugin \<= 2.7.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Tim Strifler Exclusive Addons Elementor)
- [CVE-2025-48243](https://cve.now/CVE-2025-48243.md): WordPress reCAPTCHA for all plugin \<= 2.26 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, sminozzi reCAPTCHA for all)
- [CVE-2025-48242](https://cve.now/CVE-2025-48242.md): WordPress Legal Pages plugin \<= 1.4.5 - Broken Access Control Vulnerability (CVSS 6.5, wpWax Legal Pages)
- [CVE-2025-48240](https://cve.now/CVE-2025-48240.md): WordPress Cost of Goods for WooCommerce plugin \<= 3.7.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory Cost of Goods for WooCommerce)
- [CVE-2025-48239](https://cve.now/CVE-2025-48239.md): WordPress Product Notes Tab & Private Admin Notes for WooCommerce plugin \<= 3.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory Product Notes Tab & Private Admin Notes for WooCo…)
- [CVE-2025-48238](https://cve.now/CVE-2025-48238.md): WordPress AWcode Toolkit plugin \<= 1.0.18 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, AWcode Toolkit)
- [CVE-2025-48237](https://cve.now/CVE-2025-48237.md): WordPress Wishlist for WooCommerce plugin \<= 3.2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPFactory Wishlist for WooCommerce)
- [CVE-2025-48236](https://cve.now/CVE-2025-48236.md): WordPress bunny.net plugin \<= 2.3.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 8.5, bunny.net)
- [CVE-2025-48235](https://cve.now/CVE-2025-48235.md): WordPress WP Image Mask plugin \<= 3.1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Bogdan Bendziukov WP Image Mask)
- [CVE-2025-48234](https://cve.now/CVE-2025-48234.md): WordPress Ultimate Blocks plugin \<= 3.3.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ultimate Blocks)
- [CVE-2025-48233](https://cve.now/CVE-2025-48233.md): WordPress Affiliates Manager Google reCAPTCHA Integration plugin \<= 1.0.6 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, affmngr Affiliates Manager Google reCAPTCHA Integration)
- [CVE-2025-48232](https://cve.now/CVE-2025-48232.md): WordPress Xpro Addons For Beaver Builder – Lite plugin \<= 1.5.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Xpro Addons For Beaver Builder – Lite)
- [CVE-2025-4936](https://cve.now/CVE-2025-4936.md): projectworlds Online Food Ordering System admin-page.php sql injection (CVSS 6.9, projectworlds Online Food Ordering System)
- [CVE-2025-4935](https://cve.now/CVE-2025-4935.md): SourceCodester Stock Management System changePassword.php sql injection (CVSS 6.9, SourceCodester Stock Management System)
- [CVE-2025-4934](https://cve.now/CVE-2025-4934.md): PHPGurukul User Registration & Login and User Management System edit-profile.php sql injection (CVSS 6.9, PHPGurukul User Registration & Login and User Management Sy…)
- [CVE-2025-4933](https://cve.now/CVE-2025-4933.md): ponaravindb Hospital-Management-System doctor-panel.php sql injection (CVSS 5.3, ponaravindb Hospital-Management-System)
- [CVE-2025-4932](https://cve.now/CVE-2025-4932.md): projectworlds Online Lawyer Management System lawyer\_registation.php sql injection (CVSS 6.9, projectworlds Online Lawyer Management System)
- [CVE-2025-4931](https://cve.now/CVE-2025-4931.md): projectworlds Online Lawyer Management System user\_registation.php sql injection (CVSS 6.9, projectworlds Online Lawyer Management System)
- [CVE-2025-4930](https://cve.now/CVE-2025-4930.md): Campcodes Online Shopping Portal my-cart.php sql injection (CVSS 6.9, Campcodes Online Shopping Portal)
- [CVE-2025-2099](https://cve.now/CVE-2025-2099.md): Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 5.3, huggingface/transformers · transformers)
- [CVE-2025-4929](https://cve.now/CVE-2025-4929.md): Campcodes Online Shopping Portal my-account.php sql injection (CVSS 6.9, Campcodes Online Shopping Portal)
- [CVE-2025-4928](https://cve.now/CVE-2025-4928.md): projectworlds Online Lawyer Management System save\_lawyer\_edit\_profile.php sql injection (CVSS 6.9, projectworlds Online Lawyer Management System)
- [CVE-2025-4927](https://cve.now/CVE-2025-4927.md): PHPGurukul Online Marriage Registration System between-dates-application-report.php sql injection (CVSS 6.9, PHPGurukul Online Marriage Registration System)
- [CVE-2025-4926](https://cve.now/CVE-2025-4926.md): PHPGurukul Car Rental Project post-avehical.php unrestricted upload (CVSS 5.1, PHPGurukul Car Rental Project)
- [CVE-2025-4925](https://cve.now/CVE-2025-4925.md): PHPGurukul Daily Expense Tracker System expense-monthwise-reports-detailed.php sql injection (CVSS 6.9, PHPGurukul Daily Expense Tracker System)
- [CVE-2025-4924](https://cve.now/CVE-2025-4924.md): SourceCodester Client Database Management System user\_void\_transaction.php sql injection (CVSS 6.9, SourceCodester Client Database Management System)
- [CVE-2025-27566](https://cve.now/CVE-2025-27566.md): Path traversal vulnerability exists in a-blog cms versions prior to Ver. (CVSS 3.8, appleple a-blog cms)
- [CVE-2025-32999](https://cve.now/CVE-2025-32999.md): Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. (CVSS 5.4, appleple a-blog cms)
- [CVE-2025-36560](https://cve.now/CVE-2025-36560.md): Server-side request forgery vulnerability exists in a-blog cms multiple versions. (CVSS 8.6, appleple a-blog cms)
- [CVE-2025-41429](https://cve.now/CVE-2025-41429.md): a-blog cms multiple versions neutralize logs improperly. (CVSS 4.8, appleple a-blog cms)
- [CVE-2025-4923](https://cve.now/CVE-2025-4923.md): SourceCodester Client Database Management System user\_delivery\_update.php unrestricted upload (CVSS 6.9, SourceCodester Client Database Management System)
- [CVE-2025-47760](https://cve.now/CVE-2025-47760.md): V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6MemInIF!set\_temp\_type\_default function. (CVSS 7.8, FUJI ELECTRIC CO. V-SFT)
- [CVE-2025-47759](https://cve.now/CVE-2025-47759.md): V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6ComFile!CV7BaseMap::WriteV7DataToRom function. (CVSS 7.8, FUJI ELECTRIC CO. S-SFT)
- [CVE-2025-47758](https://cve.now/CVE-2025-47758.md): V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6File!CTxSubFile::get\_ProgramFile\_name function. (CVSS 7.8, FUJI ELECTRIC CO. V-SFT)
- [CVE-2025-47757](https://cve.now/CVE-2025-47757.md): V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6MemInIF.dll!set\_plc\_type\_default function. (CVSS 7.8, FUJI ELECTRIC CO. V-SFT)
- [CVE-2025-47756](https://cve.now/CVE-2025-47756.md): V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!CGamenDataRom::set\_mr400\_strc function. (CVSS 7.8, FUJI ELECTRIC CO. V-SFT)
- [CVE-2025-47755](https://cve.now/CVE-2025-47755.md): V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!VS4\_SaveEnvFile function. (CVSS 7.8, FUJI ELECTRIC CO. V-SFT)
- [CVE-2025-47754](https://cve.now/CVE-2025-47754.md): V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!Conv\_Macro\_Data function. (CVSS 7.8, FUJI ELECTRIC CO. V-SFT)
- [CVE-2025-47753](https://cve.now/CVE-2025-47753.md): V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!CDrawSLine::GetRectArea function. (CVSS 7.8, FUJI ELECTRIC CO. V-SFT)
- [CVE-2025-47752](https://cve.now/CVE-2025-47752.md): V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6ComFile!MakeItemGlidZahyou function. (CVSS 7.8, FUJI ELECTRIC CO. V-SFT)
- [CVE-2025-47751](https://cve.now/CVE-2025-47751.md): V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6EditData!CDataRomErrorCheck::MacroCommandCheck function. (CVSS 7.8, FUJI ELECTRIC CO. V-SFT)
- [CVE-2025-47750](https://cve.now/CVE-2025-47750.md): V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6MemInIF!set\_temp\_type\_default function. (CVSS 7.8, FUJI ELECTRIC CO. V-SFT)
- [CVE-2025-47749](https://cve.now/CVE-2025-47749.md): V-SFT v6.2.5.0 and earlier contains an issue with free of pointer not at start of buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck fun (CVSS 7.8, FUJI ELECTRIC CO. V-SFT)
- [CVE-2025-4917](https://cve.now/CVE-2025-4917.md): PHPGurukul Auto Taxi Stand Management System new-autoortaxi-entry-form.php sql injection (CVSS 6.9, PHPGurukul Auto Taxi Stand Management System)
- [CVE-2025-37891](https://cve.now/CVE-2025-37891.md): ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (CVSS 7.8, Linux)
- [CVE-2025-46801](https://cve.now/CVE-2025-46801.md): Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. (CVSS 9.8, PgPool Global Development Group Pgpool-II)
- [CVE-2025-4916](https://cve.now/CVE-2025-4916.md): PHPGurukul Auto Taxi Stand Management System admin-profile.php sql injection (CVSS 6.9, PHPGurukul Auto Taxi Stand Management System)
- [CVE-2025-4915](https://cve.now/CVE-2025-4915.md): PHPGurukul Auto Taxi Stand Management System auto-taxi-entry-detail.php sql injection (CVSS 6.9, PHPGurukul Auto Taxi Stand Management System)
- [CVE-2025-4914](https://cve.now/CVE-2025-4914.md): PHPGurukul Auto Taxi Stand Management System forgot-password.php sql injection (CVSS 6.9, PHPGurukul Auto Taxi Stand Management System)
- [CVE-2025-2561](https://cve.now/CVE-2025-2561.md): Ninja Forms \< 3.10.1 - Admin+ Stored XSS (CVSS 4.8, Ninja Forms)
- [CVE-2025-2560](https://cve.now/CVE-2025-2560.md): Ninja Forms \< 3.10.1 - Admin+ Stored XSS (CVSS 4.8, Ninja Forms)
- [CVE-2025-2524](https://cve.now/CVE-2025-2524.md): Ninja Forms \< 3.10.1 - Admin+ Stored XSS (CVSS 4.8, Ninja Forms)
- [CVE-2025-1627](https://cve.now/CVE-2025-1627.md): Qi Blocks \< 1.4 - Contributor+ Stored XSS via ToC Block (CVSS 5.4, Qi Blocks)
- [CVE-2025-1626](https://cve.now/CVE-2025-1626.md): Qi Blocks \< 1.4 - Contributor+ Stored XSS vi Countdown Block (CVSS 5.4, Qi Blocks)
- [CVE-2025-1625](https://cve.now/CVE-2025-1625.md): Qi Blocks \< 1.4 - Contributor+ Stored XSS via Counter Block (CVSS 5.4, Qi Blocks)
- [CVE-2025-4477](https://cve.now/CVE-2025-4477.md): TeamT5 ThreatSonar Anti-Ransomware - Privilege Escalation (CVSS 7.2, TeamT5 ThreatSonar Anti-Ransomware)
- [CVE-2025-4913](https://cve.now/CVE-2025-4913.md): PHPGurukul Auto Taxi Stand Management System index.php sql injection (CVSS 6.9, PHPGurukul Auto Taxi Stand Management System)
- [CVE-2025-4912](https://cve.now/CVE-2025-4912.md): SourceCodester Student Result Management System Image File update\_student.php path traversal (CVSS 5.3, SourceCodester Student Result Management System)
- [CVE-2025-4911](https://cve.now/CVE-2025-4911.md): PHPGurukul Zoo Management System view-foreigner-ticket.php sql injection (CVSS 6.9, PHPGurukul Zoo Management System)
- [CVE-2025-2892](https://cve.now/CVE-2025-2892.md): All in One SEO Pack \<= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL (CVSS 6.4, smub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…)
- [CVE-2025-4910](https://cve.now/CVE-2025-4910.md): PHPGurukul Zoo Management System edit-animal-details.php sql injection (CVSS 6.9, PHPGurukul Zoo Management System)
- [CVE-2025-4909](https://cve.now/CVE-2025-4909.md): SourceCodester Client Database Management System exposure of information through directory listing (CVSS 6.9, SourceCodester Client Database Management System)
- [CVE-2025-4908](https://cve.now/CVE-2025-4908.md): PHPGurukul Daily Expense Tracker System expense-datewise-reports-detailed.php sql injection (CVSS 6.9, PHPGurukul Daily Expense Tracker System)
- [CVE-2025-4907](https://cve.now/CVE-2025-4907.md): PHPGurukul Daily Expense Tracker System forgot-password.php sql injection (CVSS 6.9, PHPGurukul Daily Expense Tracker System)
- [CVE-2025-4906](https://cve.now/CVE-2025-4906.md): PHPGurukul Notice Board System login.php sql injection (CVSS 6.9, PHPGurukul Notice Board System)
- [CVE-2025-4905](https://cve.now/CVE-2025-4905.md): iop-apl-uw basestation3 QC.py load\_qc\_pickl deserialization (CVSS 4.8, iop-apl-uw basestation3)
- [CVE-2025-23165](https://cve.now/CVE-2025-23165.md): In Node.js, the \`ReadFileUtf8\` internal binding leaks memory due to a corrupted pointer in \`uv\_fs\_s.file\`: a UTF-16 path buffer is allocated (CVSS 3.7, nodejs node)
- [CVE-2025-23123](https://cve.now/CVE-2025-23123.md): A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vul (CVSS 10.0, Ubiquiti UniFi Protect Cameras)
- [CVE-2025-23166](https://cve.now/CVE-2025-23166.md): The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background t (CVSS 7.5, nodejs node)
- [CVE-2025-23164](https://cve.now/CVE-2025-23164.md): A misconfigured access token mechanism in the Unifi Protect Application (Version 5.3.41 and earlier) could permit the recipient of a "Share (CVSS 4.4, Ubiquiti UniFi Protect Application)
- [CVE-2025-23167](https://cve.now/CVE-2025-23167.md): A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \`\\r\\n\\rX\` instead of the required \`\\r\\n\\r\\n\`. (CVSS 6.5, nodejs node)
- [CVE-2025-4904](https://cve.now/CVE-2025-4904.md): D-Link DI-7003GV2 webgl.data sub\_41F0FC information disclosure (CVSS 6.9, D-Link DI-7003GV2)
- [CVE-2025-4903](https://cve.now/CVE-2025-4903.md): D-Link DI-7003GV2 webgl.asp sub\_41F4F0 unverified password change (CVSS 6.9, D-Link DI-7003GV2)
- [CVE-2025-4902](https://cve.now/CVE-2025-4902.md): D-Link DI-7003GV2 versionupdate.data sub\_48F4F0 information disclosure (CVSS 6.9, D-Link DI-7003GV2)
- [CVE-2024-51106](https://cve.now/CVE-2024-51106.md): A cross-site scripting (XSS) vulnerability in the component mcgs/admin/aboutus.php of PHPGURUKUL Medical Card Generation System using PHP an (CVSS 4.6)
- [CVE-2024-55063](https://cve.now/CVE-2024-55063.md): Multiple Code Injection vulnerabilities in EasyVirt DC NetScope \<= 8.7.0 allows remote authenticated attackers to execute arbitrary code via (CVSS 8.8)
- [CVE-2025-28371](https://cve.now/CVE-2025-28371.md): EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function. (CVSS 6.5)
- [CVE-2025-30072](https://cve.now/CVE-2025-30072.md): Tiiwee X1 Alarm System TWX1HAKV2 allows Authentication Bypass by Capture-replay, leading to physical Access to the protected facilities with (CVSS 7.6)
- [CVE-2025-43714](https://cve.now/CVE-2025-43714.md): The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a c (CVSS 6.5)
- [CVE-2025-44108](https://cve.now/CVE-2025-44108.md): A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions co (CVSS 4.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.