CVEs published May 21, 2025
114 CVEs were published on May 21, 2025: 11 critical, 28 high. 2 are now in CISA KEV.
- Published
- 114
- Critical
- 11
- High
- 28
- Medium
- 67
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 35
Most affected products
- eCharge Hardy Barth cPH2 / cPP2 charging stations
- 7
- Proget
- 7
- FreeFloat FTP Server
- 5
- Campcodes Online Shopping Portal
- 4
- Cisco Webex Meetings
- 4
- Drupal One Time Password · drupal/one_time_password
- 3
- TYPO3 ns backup extension · nitsan/ns-backup
- 3
- Versa Concerto
- 3
- Ackites KillWxapkg · github.com/Ackites/KillWxapkg
- 2
- Cisco Identity Services Engine Software
- 2
Critical 11
- CVE-2025-34026Versa Concerto Actuator Authentication Bypass Information LeakVersa Concerto
- CVE-2025-34027Versa Concerto Authentication Bypass File Write Remote Code ExecutionVersa Concerto
- CVE-2025-36535AutomationDirect MB-Gateway Missing Authentication for Critical FunctionAutomationDirect MB-Gateway
- CVE-2025-41426Vertiv Liebert RDU101 and UNITY Stack-based Buffer OverflowVertiv Liebert RDU101 · Vertiv Liebert IS-UNITY
- CVE-2025-46412Vertiv Liebert RDU101 and UNITY Authentication Bypass Using an Alternate Path or ChannelVertiv Liebert RDU101 · Vertiv Liebert IS-UNITY
- CVE-2025-41232CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methodsSpring Security · org.springframework.security:spring-se… +1
- CVE-2025-4524Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File InclusionWPStylish Madara – Responsive and modern WordPress theme fo…
- CVE-2025-4094Digits < 8.4.6.1 - Auth Bypass via OTP BruteforcingDIGITS: WordPress Mobile Number Signup and Login
- CVE-2025-27558IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks.
- CVE-2025-44083An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication
- CVE-2025-48200The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.TYPO3 sr feuser register extension · sjbr/sr-feuser-register
High 28
- CVE-2025-34025Versa Concerto Insecure Docker Mount Container EscapeVersa Concerto
- CVE-2025-47947ModSecurity Has Possible DoS Vulnerabilityowasp-modsecurity ModSecurity
- CVE-2025-2261TIBCO BPM Enterprise XSS VulnerabilityTIBCO Software TIBCO BPM Enterprise
- CVE-2025-3751TIBCO ActiveMatrix BusinessWorks SQL Injection VulnerabilityTIBCO Software TIBCO ActiveMatrix BusinessWorks
- CVE-2025-48060AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)jqlang jq
- CVE-2025-46822Unauthenticated Arbitrary File Read via Absolute PathOsamaTaher Java-springboot-codebase
- CVE-2025-4416Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059Drupal Events Log Track · drupal/events_log_track
- CVE-2025-20113Cisco Unified Intelligence Center Privilege Escalation VulnerabilityCisco Unified Contact Center Express · Cisco Unified Intell…
- CVE-2025-20152ISE restartCisco Identity Services Engine Software
- CVE-2025-4008Arbitrary Command Injection in Smartbedded MeteoBridgeSmartbedded MeteoBridge
- CVE-2025-1416Password disclosure in Proget MDMProget
- CVE-2025-40775DNS message with invalid TSIG causes an assertion failureISC BIND
- CVE-2025-48416Backdoor Functionality via SSH in eCharge Hardy Barth cPH2 / cPP2 charging stationseCharge Hardy Barth cPH2 / cPP2 charging stations
- CVE-2025-48413Hard-coded OS root credentials in eCharge Hardy Barth cPH2 / cPP2 charging stationseCharge Hardy Barth cPH2 / cPP2 charging stations
- CVE-2025-4803Glossary by WPPedia <= 1.3.0 - Authenticated (Administrator+) PHP Object Injectionsteinrein Glossary by WPPedia – Best Glossary plugin for Wo…
- CVE-2025-1712Arbitrary file write with vcrtraceCheckmk
- CVE-2019-16536Stack overflow leading to DoS can be triggered by a malicious authenticated client.Clickhouse DB
- CVE-2021-25255Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.Yandex Browser Lite
- CVE-2021-25254Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.Yandex Browser Lite
- CVE-2024-56429itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users to read or write to titech iLabClient
- CVE-2025-27997An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell script or executable into
- CVE-2025-27998An issue in Valvesoftware Steam Client Steam Client 1738026274 allows attackers to escalate privileges via a crafted executable or DLL.
- CVE-2025-44040An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function.
- CVE-2025-45752A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functi
- CVE-2025-45753A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploitin
- CVE-2025-48201The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.TYPO3 ns backup extension · nitsan/ns-backup
- CVE-2025-48205The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference.TYPO3 sr feuser register extension · sjbr/sr-feuser-register
- CVE-2025-48207The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.TYPO3 reint downloadmanager extension · renolit/reint-downl…
Medium, low and unrated 75
- CVE-2025-5059Campcodes Online Shopping Portal edit-subcategory.php unrestricted uploadCampcodes Online Shopping Portal
- CVE-2025-48070Plane has insecure permissions in UserSerializermakeplane plane
- CVE-2025-5057Campcodes Online Shopping Portal insert-product.php sql injectionCampcodes Online Shopping Portal
- CVE-2025-5056Campcodes Online Shopping Portal edit-products.php sql injectionCampcodes Online Shopping Portal
- CVE-2025-47942Learners on edX Platform can download python_lib.zipopenedx edx-platform
- CVE-2025-5053FreeFloat FTP Server MDIR Command buffer overflowFreeFloat FTP Server
- CVE-2025-5052FreeFloat FTP Server LS Command buffer overflowFreeFloat FTP Server
- CVE-2025-5051FreeFloat FTP Server BINARY Command buffer overflowFreeFloat FTP Server
- CVE-2025-5050FreeFloat FTP Server BELL Command buffer overflowFreeFloat FTP Server
- CVE-2025-5049FreeFloat FTP Server APPEND Command buffer overflowFreeFloat FTP Server
- CVE-2025-48069ejson2env has insufficient input sanitizationShopify ejson2env · github.com/Shopify/ejson2env +2
- CVE-2025-48064GitHub Desktop vulnerable to maliciously crafted file renames leading to information disclosuredesktop
- CVE-2025-48063XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming rightxwiki-platform · org.xwiki.platform:xwiki-platform-security…
- CVE-2025-5033XiaoBingby TeaCMS addUser cross-site request forgeryXiaoBingby TeaCMS
- CVE-2025-47291containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.containerd · github.com/containerd/containerd/v2
- CVE-2025-2102Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.ThiHYPR Passwordless
- CVE-2025-5020Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addressesMozilla Firefox for iOS
- CVE-2025-0372Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in HYPR Passwordless on Windows alHYPR Passwordless
- CVE-2025-5032Campcodes Online Shopping Portal edit-category.php sql injectionCampcodes Online Shopping Portal
- CVE-2025-5031Ackites KillWxapkg wxapkg File Decompression resource consumptionAckites KillWxapkg · github.com/Ackites/KillWxapkg
- CVE-2025-20250A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.Cisco Webex Meetings
- CVE-2025-20247A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.Cisco Webex Meetings
- CVE-2025-20246A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.Cisco Webex Meetings
- CVE-2025-20258A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitrary commands into emCisco Duo
- CVE-2025-20255A vulnerability in client join services of Cisco Webex Meetings could allow an unauthenticated, remote attacker to manipulate cached HTTP reCisco Webex Meetings
- CVE-2025-20242A vulnerability in the Cloud Connect component of Cisco Unified Contact Center Enterprise (CCE) could allow an unauthenticated, remote attacCisco Unified Contact Center Enterprise
- CVE-2025-5030Ackites KillWxapkg wxapkg File Parser unpack.go processFile os command injectionAckites KillWxapkg · github.com/Ackites/KillWxapkg
- CVE-2025-48012One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063Drupal One Time Password · drupal/one_time_password
- CVE-2025-48011One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062Drupal One Time Password · drupal/one_time_password
- CVE-2025-48010One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061Drupal One Time Password · drupal/one_time_password
- CVE-2025-48009Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060Drupal Single Content Sync · drupal/single_content_sync
- CVE-2025-4415Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058Drupal Piwik PRO · drupal/piwik_pro
- CVE-2025-20267Cisco Identity Services Stored Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2025-20257Cisco Secure Network Analytics API Authorization VulnerabilityCisco Secure Network Analytics
- CVE-2025-20256Cisco Secure Network Analytics Manager Server-Side Template Injection VulnerabilityCisco Secure Network Analytics
- CVE-2025-20114Cisco Unified Intelligence Center Insecure Direct Object Reference VulnerabilityCisco Unified Contact Center Express · Cisco Unified Intell…
- CVE-2025-20112Cisco Unified Communications Products Privilege Escalation VulnerabilityCisco Emergency Responder · Cisco Finesse +7
- CVE-2024-23337jq has signed integer overflow in jv.c:jvp_array_writejqlang jq
- CVE-2025-5029Kingdee Cloud Galaxy Private Cloud BBC System File deleteFileAction.jhtml path traversalKingdee Cloud Galaxy Private Cloud BBC System
- CVE-2025-1421Formula injection in a CSV file in Proget MDMProget
- CVE-2025-1420XSS in Proget MDMProget
- CVE-2025-1419XSS in Proget MDMProget
- CVE-2025-1418Information disclosure in Proget MDMProget
- CVE-2025-1417Information disclosure in Proget MDMProget
- CVE-2025-48417Hard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stationseCharge Hardy Barth cPH2 / cPP2 charging stations
- CVE-2025-48415Backdoor Functionality via USB Drive in eCharge Hardy Barth cPH2 / cPP2 charging stationseCharge Hardy Barth cPH2 / cPP2 charging stations
- CVE-2025-48414Hard-coded web interface credentials in eCharge Hardy Barth cPH2 / cPP2 charging stationseCharge Hardy Barth cPH2 / cPP2 charging stations
- CVE-2025-27804OS Command Injection Vulnerability in eCharge Hardy Barth cPH2 / cPP2 charging stationseCharge Hardy Barth cPH2 / cPP2 charging stations
- CVE-2025-27803Missing Authentication in eCharge Hardy Barth cPH2 / cPP2 charging stationseCharge Hardy Barth cPH2 / cPP2 charging stations
- CVE-2025-1415Information disclosure in Proget MDMProget
- CVE-2025-4221Animated Buttons <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingbaswaniyash Animated Buttons
- CVE-2025-4219DPEPress <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingdarkyudex DPEPress
- CVE-2024-12561Affiliate Sales in Google Analytics and other tools <= 2.0.0 - Open Redirectwecantrack Affiliate Sales in Google Analytics and other to…
- CVE-2025-4217WP YouTube Video Optimizer <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingmeasuremarketing WP YouTube Video Optimizer
- CVE-2025-3750Network Posts Extended <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height Parameterjohnzenausa Network Posts Extended
- CVE-2025-4105Splitit <= 4.2.8 - Missing Authorization to Multiple Administrative ActionsSplitit
- CVE-2025-4611Slim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs Shortcoderilwis Slim SEO – A Fast & Automated SEO Plugin For WordPre…
- CVE-2025-3781Raisely Donation Form <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form Shortcodecreativefreedomau Raisely Donation Form
- CVE-2021-25262Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.Yandex Browser
- CVE-2025-4949XXE vulnerability in Eclipse JGitEclipse JGit · org.eclipse.jgit:org.eclipse.jgit
- CVE-2025-4969Libsoup: off-by-one out-of-bounds read in find_boundary() in soup-multipart.clibsoup · Red Hat Enterprise Linux
- CVE-2025-5013HkCms Search index.html cross site scriptingHkCms
- CVE-2025-5011moonlightL hexo-boot Dynamic List Page index.html cross site scriptingmoonlightL hexo-boot
- CVE-2024-42922AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.
- CVE-2024-56428The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for th
- CVE-2024-57529Cross Site Scripting vulnerability in Jeppesen JetPlanner Pro v.1.6.2.20 allows a remote attacker to execute arbitrary code.
- CVE-2025-25539Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information via help menu.
- CVE-2025-44892FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter in the web_rmon_alarm_post_rmon_alarm funct
- CVE-2025-44895FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4BasedAceAdd function.
- CVE-2025-45754A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32.
- CVE-2025-45755A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import featu
- CVE-2025-48202The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.TYPO3 femanager extension · in2code/femanager
- CVE-2025-48203The cs_seo extension through 9.2.0 for TYPO3 allows XSS.TYPO3 cs seo extension · clickstorm/cs-seo
- CVE-2025-48204The ns_backup extension through 13.0.0 for TYPO3 allows command injection.TYPO3 ns backup extension · nitsan/ns-backup
- CVE-2025-48206The ns_backup extension through 13.0.0 for TYPO3 allows XSS.TYPO3 ns backup extension · nitsan/ns-backup