CVEs published May 23, 2025
183 CVEs were published on May 23, 2025: 47 critical, 80 high.
- Published
- 183
- Critical
- 47
- High
- 80
- Medium
- 53
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- FreeFloat FTP Server
- 4
- StrangeBee TheHive
- 4
- Goodlayers Hostel
- 3
- Goodlayers Hotel
- 3
- Intellian Technologies Iridium Certus
- 3
- Jan Syski MegaBIP
- 3
- Mobile Dynamix PrinterShare Mobile Print
- 3
- openemr
- 3
- ApusTheme Butcher
- 2
- Fujian Kelixun
- 2
Critical 47
- CVE-2025-31049WordPress Dash <= 1.3 - PHP Object Injection Vulnerabilitythemeton Dash
- CVE-2025-31056WordPress WhatsCart plugin <= 1.1.0 - SQL Injection vulnerabilityTechspawn WhatsCart - Whatsapp Abandoned Cart Recovery, Ord…
- CVE-2025-31069WordPress HotStar – Multi-Purpose Business Theme <= 1.4 - PHP Object Injection Vulnerabilitythemeton HotStar – Multi-Purpose Business Theme
- CVE-2025-31397WordPress Bus Ticket Booking with Seat Reservation for WooCommerce plugin <= 1.7 - SQL Injection vulnerabilitysmartcms Bus Ticket Booking with Seat Reservation for WooCo…
- CVE-2025-31423WordPress Umberto theme <= 1.2.8 - PHP Object Injection VulnerabilityAncoraThemes Umberto
- CVE-2025-31430WordPress The Business <= 1.6.1 - PHP Object Injection Vulnerabilitythemeton The Business
- CVE-2025-31631WordPress Fish House theme <= 1.2.7 - PHP Object Injection VulnerabilityAncoraThemes Fish House
- CVE-2025-31914WordPress Pixel Form BuilderPlugin & Autoresponder plugin <= 1.0.2 - SQL Injection Vulnerabilitykamleshyadav Pixel WordPress Form BuilderPlugin & Autorespo…
- CVE-2025-31916WordPress JP Students Result Management System Premium plugin 1.1.7 - Arbitrary File Upload vulnerabilityjoy2012bd JP Students Result Management System Premium
- CVE-2025-31918WordPress Simple Business Directory Pro plugin < 15.6.9 - Privilege Escalation vulnerabilityquantumcloud Simple Business Directory Pro
- CVE-2025-31927WordPress Acerola <= 1.6.5 - PHP Object Injection Vulnerabilitythemeton Acerola
- CVE-2025-32292WordPress Jarvis – Night Club, Concert, Festival WordPress theme <= 1.8.11 - PHP Object Injection VulnerabilityAncoraThemes Jarvis – Night Club, Concert, Festival WordPre…
- CVE-2025-39480WordPress Car Dealer theme < 1.6.8 - PHP Object Injection vulnerabilityThemeMakers Car Dealer
- CVE-2025-39485WordPress GrandTour theme <= 5.6 - PHP Object Injection vulnerabilityThemeGoods Grand Tour
- CVE-2025-39489WordPress CouponXL theme <= 4.5.0 - Privilege Escalation Vulnerabilitypebas CouponXL
- CVE-2025-39495WordPress Avantage Theme <= 2.4.9 - PHP Object Injection vulnerabilityBoldThemes Avantage
- CVE-2025-39499WordPress Medicare Theme <= 2.1.0 - PHP Object Injection vulnerabilityBoldThemes Medicare
- CVE-2025-39500WordPress Goodlayers Hostel Plugin <= 3.1.2 - PHP Object Injection vulnerabilityGoodlayers Hostel
- CVE-2025-39501WordPress Goodlayers Hostel plugin <= 3.1.4 - SQL Injection vulnerabilityGoodlayers Hostel
- CVE-2025-39503WordPress Goodlayers Hotel plugin <= 3.1.4 - PHP Object Injection vulnerabilityGoodlayers Hotel
- CVE-2025-39504WordPress Goodlayers Hotel plugin <= 3.1.4 - SQL Injection vulnerabilityGoodlayers Hotel
- CVE-2025-46455WordPress WP HRM LITE plugin <= 1.1 - SQL Injection VulnerabilityIndigoThemes WP HRM LITE
- CVE-2025-46460WordPress Easy Guide plugin <= 1.0.0 - SQL Injection VulnerabilityDetheme Easy Guide
- CVE-2025-46468WordPress Fable Extra plugin <= 1.0.6 - Local File Inclusion VulnerabilityWPFable Fable Extra
- CVE-2025-46490WordPress Crossword Compiler Puzzles plugin <= 5.2 - Arbitrary File Upload Vulnerabilitywordwebsoftware Crossword Compiler Puzzles
- CVE-2025-46539WordPress Fable Extra plugin <= 1.0.6 - SQL Injection VulnerabilityWPFable Fable Extra
- CVE-2025-47530WordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection VulnerabilityWPFunnels
- CVE-2025-47532WordPress CoinPayments.net Payment Gateway for WooCommerce plugin <= 1.0.17 - PHP Object Injection VulnerabilityCoinPayments.net Payment Gateway for WooCommerce
- CVE-2025-47539WordPress Eventin plugin <= 4.0.26 - Privilege Escalation VulnerabilityArraytics Eventin
- CVE-2025-47568WordPress ZoomSounds plugin <= 6.91 - PHP Object Injection vulnerabilityZoomIt ZoomSounds
- CVE-2025-47599WordPress Facturante plugin <= 1.11 - SQL Injection VulnerabilityFacturante
- CVE-2025-47637WordPress STAGGS plugin <= 2.11.0 - Arbitrary File Upload VulnerabilitySTAGGS
- CVE-2025-47640WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection VulnerabilityPrintcart Web to Print Product Designer for WooCommerce
- CVE-2025-47641WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.3.9 - Arbitrary File Upload VulnerabilityPrintcart Web to Print Product Designer for WooCommerce
- CVE-2025-47642WordPress Ajar in5 Embed plugin <= 3.1.5 - Arbitrary File Upload VulnerabilityAjar Productions Ajar in5 Embed
- CVE-2025-47646WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication VulnerabilityGilblas Ngunte Possi PSW Front-end Login & Registration
- CVE-2025-47658WordPress ELEX HelpDesk & Customer Ticketing System plugin <= 3.2.9 - Arbitrary File Upload vulnerabilityELEXtensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2025-47663WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Arbitrary File Upload vulnerabilitymojoomla Hospital Management System
- CVE-2025-47687WordPress StoreKeeper for WooCommerce plugin <= 14.4.4 - Arbitrary File Upload VulnerabilityStoreKeeper B.V. StoreKeeper for WooCommerce
- CVE-2025-48283WordPress Majestic Support plugin <= 1.1.0 - SQL Injection VulnerabilityMajestic Support
- CVE-2025-48287WordPress Pix 4x sem juros - Pagaleve plugin <= 1.6.9 - PHP Object Injection VulnerabilityPix 4x sem juros - Pagaleve
- CVE-2025-48289WordPress Kids Planet theme <= 2.2.14 - PHP Object Injection VulnerabilityAncoraThemes Kids Planet
- CVE-2025-3895Low token entropy in MegaBIPJan Syski MegaBIP
- CVE-2025-5098KL-001-2025-003: Mobile Dynamix PrinterShare Mobile Print Gmail Oauth Token DisclosureMobile Dynamix PrinterShare Mobile Print
- CVE-2025-5099KL-001-2025-004: Mobile Dynamix PrinterShare Mobile Print Out-of-bounds WriteMobile Dynamix PrinterShare Mobile Print
- CVE-2024-51101PHPGURUKUL Restaurant Table Booking System using PHP and MySQL v1.0 was discovered to contain a SQL injection vulnerability via the searchda
- CVE-2024-51360An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php fi
High 80
- CVE-2025-24917Improper Access Control leads to Local Privilege EscalationTenable Network Monitor
- CVE-2025-24916Improper Access Control leads to Local Priviledge EscalationTenable Network Monitor
- CVE-2025-43860OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographicsopenemr
- CVE-2025-32794OpenEMR Stored XSS via Patient Name Field in Procedure Ordersopenemr
- CVE-2022-31812A vulnerability has been identified in SiPass integrated (All versions < V2.95.3.18).Siemens SiPass integrated
- CVE-2025-31053WordPress KBx Pro Ultimate plugin < 8.0.5 - Arbitrary File Deletion Vulnerabilityquantumcloud KBx Pro Ultimate
- CVE-2025-31060WordPress Capie theme <= 1.0.40 - Local File Inclusion VulnerabilityApusTheme Capie
- CVE-2025-31064WordPress Vizeon theme < 1.2.1 - Local File Inclusion vulnerabilitygavias Vizeon - Business Consulting
- CVE-2025-31632WordPress La Boom <= 2.7 - Local File Inclusion VulnerabilitySpyroPress La Boom
- CVE-2025-31633WordPress Kiamo - Responsive Business Service WordPress Theme <= 1.3.3 - Local File Inclusion Vulnerabilitygavias Kiamo - Responsive Business Service WordPress Theme
- CVE-2025-31636WordPress WP Post Modules for Elementor plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySaurabhSharma WP Post Modules for Elementor
- CVE-2025-31912WordPress Enzio - Responsive Business WordPress Theme theme < 1.2.6 - Local File Inclusion vulnerabilitygavias Enzio - Responsive Business WordPress Theme
- CVE-2025-31913WordPress Ogami theme <= 1.53 - Local File Inclusion VulnerabilityApusTheme Ogami
- CVE-2025-31924WordPress Crafts & Arts theme <= 2.5 - PHP Object Injection Vulnerabilitydesignthemes Crafts & Arts
- CVE-2025-32284WordPress Pet World theme <= 2.8 - PHP Object Injection Vulnerabilitydesignthemes Pet World
- CVE-2025-32285WordPress Butcher theme < 2.54 - Cross Site Scripting (XSS) vulnerabilityApusTheme Butcher
- CVE-2025-32286WordPress Butcher theme <= 2.40 - Local File Inclusion VulnerabilityApusTheme Butcher
- CVE-2025-32289WordPress Yozi theme <= 2.0.63 - Local File Inclusion VulnerabilityApusTheme Yozi
- CVE-2025-32293WordPress Finance Consultant theme <= 2.8 - PHP Object Injection Vulnerabilitydesignthemes Finance Consultant
- CVE-2025-32294WordPress Oxpitan theme <= 1.3.5 - Local File Inclusion Vulnerabilitygavias Oxpitan
- CVE-2025-32302WordPress Winnex theme <= 1.3.2 - Local File Inclusion Vulnerabilitygavias Winnex
- CVE-2025-32309WordPress Healsoul theme <= 2.2.3 - Local File Inclusion VulnerabilityThemeMove Healsoul
- CVE-2025-39490WordPress Backpack Traveler theme <= 2.10.2 - Local File Inclusion VulnerabilityMikado-Themes Backpack Traveler
- CVE-2025-39494WordPress Wilmër theme < 3.4.2 - Local File Inclusion VulnerabilityMikado-Themes Wilmër
- CVE-2025-39502WordPress Goodlayers Hostel Plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityGoodlayers Hostel
- CVE-2025-39505WordPress Goodlayers Hotel plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityGoodlayers Hotel
- CVE-2025-39506WordPress Nasa Core Plugin <= 6.3.2 - Local File Inclusion vulnerabilityNasaTheme Nasa Core
- CVE-2025-39536WordPress JobHunt Job Alerts <= 3.6 - Arbitrary Content Deletion VulnerabilityChimpstudio JobHunt Job Alerts
- CVE-2025-46437WordPress Tayori Form plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilitytayoricom Tayori Form
- CVE-2025-46440WordPress kStats Reloaded plugin <= 0.7.4 - Reflected Cross Site Scripting (XSS) vulnerabilityMark kStats Reloaded
- CVE-2025-46444WordPress Ads Pro plugin <= 4.89 - Local File Inclusion vulnerabilityscripteo Ads Pro
- CVE-2025-46446WordPress Libro de Reclamaciones plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerabilityivanrojas Libro de Reclamaciones
- CVE-2025-46448WordPress Document Management System plugin <= 1.24 - Cross Site Scripting (XSS) Vulnerabilityreifsnyderb Document Management System
- CVE-2025-46454WordPress Meta Keywords & Description plugin <= 0.8 - Local File Inclusion Vulnerabilitysvil4ok Meta Keywords & Description
- CVE-2025-46456WordPress Theme Blvd Sliders plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityJason Theme Blvd Sliders
- CVE-2025-46458WordPress occupancyplan plugin <= 1.0.3.0 - CSRF to SQL Injection vulnerabilityx000x occupancyplan
- CVE-2025-46463WordPress Mailing Group Listserv plugin <= 3.0.4 - SQL Injection VulnerabilityYamna Khawaja Mailing Group Listserv
- CVE-2025-46474WordPress SEUR Oficial plugin <= 2.2.23 - Local File Inclusion VulnerabilitySEUR Oficial
- CVE-2025-46487WordPress EC Authorize.net plugin <= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilitysftranna EC Authorize.net
- CVE-2025-46488WordPress Visual Builder plugin <= 1.2.2 - Broken Access Control vulnerabilitydastan800 Visual Builder
- CVE-2025-46515WordPress Category Widget plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityM A Vinoth Kumar Category Widget
- CVE-2025-46526WordPress My Custom Widgets plugin <= 2.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityjanekniefeldt My Custom Widgets
- CVE-2025-46537WordPress Section Widget plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityctltwp Section Widget
- CVE-2025-47438WordPress WP Job Portal plugin <= 2.3.1 - Local File Inclusion vulnerabilitywpjobportal WP Job Portal
- CVE-2025-47453WordPress WP Smart Import plugin <= 1.1.3 - Local File Inclusion VulnerabilityXylus Themes WP Smart Import
- CVE-2025-47458WordPress B2i Investor Tools plugin <= 1.0.7.9 - Reflected Cross Site Scripting (XSS) vulnerabilityB2itech B2i Investor Tools
- CVE-2025-47461WordPress Subaccounts for WooCommerce plugin <= 1.6.6 - Account Takeover vulnerabilitymediaticus Subaccounts for WooCommerce
- CVE-2025-47478WordPress ProfileGrid plugin <= 5.9.5.0 - SQL Injection VulnerabilityMetagauss ProfileGrid
- CVE-2025-47492WordPress Drag and Drop File Upload for Elementor Forms plugin <= 1.4.3 - Arbitrary File Deletion Vulnerabilityadd-ons.org Drag and Drop File Upload for Elementor Forms
- CVE-2025-47512WordPress Tainacan plugin <= 0.21.14 - Arbitrary File Deletion vulnerabilityTainacan
- CVE-2025-47535WordPress Opal Woo Custom Product Variation plugin <= 1.2.0 - Arbitrary File Deletion Vulnerabilitywpopal Opal Woo Custom Product Variation
- CVE-2025-47541WordPress Mail Mint plugin <= 1.17.7 - Sensitive Data Exposure VulnerabilityWPFunnels Mail Mint
- CVE-2025-47558WordPress MapSVG plugin < 8.6.13 - Broken Access Control vulnerabilityRomanCode MapSVG
- CVE-2025-47575WordPress School Management plugin <= 92.0.0 - SQL Injection vulnerabilitymojoomla School Management
- CVE-2025-47603WordPress belingoGeo plugin <= 1.12.0 - Arbitrary File Download VulnerabilitybelingoGeo
- CVE-2025-47611WordPress User Meta plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityKhaled User Meta
- CVE-2025-47613WordPress School Management System for Wordpress plugin <= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitymojoomla School Management
- CVE-2025-47618WordPress BMI Adult & Kid Calculator plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityMortgage Calculator BMI Adult & Kid Calculator
- CVE-2025-47631WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Privilege Escalation vulnerabilitymojoomla Hospital Management System
- CVE-2025-47660WordPress WC Affiliate plugin <= 2.16 - PHP Object Injection vulnerabilityCodexpert WC Affiliate
- CVE-2025-47670WordPress Social Login and Register plugin <= 7.6.10 - Local File Inclusion VulnerabilityminiOrange WordPress Social Login and Register
- CVE-2025-47671WordPress Binary MLM Plan plugin <= 3.0 - SQL Injection vulnerabilityLETSCMS MLM Software Binary MLM Plan
- CVE-2025-47672WordPress miniOrange Discord Integration plugin <= 2.2.2 - Local File Inclusion VulnerabilityminiOrange Discord Integration
- CVE-2025-47673WordPress Arconix Shortcodes plugin <= 2.1.16 - Reflected Cross Site Scripting (XSS) vulnerabilitytychesoftwares Arconix Shortcodes
- CVE-2025-47678WordPress FunnelCockpit plugin <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerabilityFunnelCockpit
- CVE-2025-47680WordPress xili-tidy-tags plugin <= 1.12.06 - Reflected Cross Site Scripting (XSS) vulnerabilityMichel - xiligroup dev xili-tidy-tags
- CVE-2025-47690WordPress Lead Form Data Collection to CRM plugin <= 3.1 - Arbitrary Option Update to Privilege Escalation vulnerabilitySmackcoders Inc., Lead Form Data Collection to CRM
- CVE-2025-48241WordPress Verge3D plugin <= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerabilitySoft8Soft Verge3D
- CVE-2025-48245WordPress Quick Contact Form plugin <= 8.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilitySaad Iqbal Quick Contact Form
- CVE-2025-48273WordPress WP Job Portal plugin <= 2.3.2 - Arbitrary File Download Vulnerabilitywpjobportal WP Job Portal
- CVE-2025-48286WordPress ReDi Restaurant Reservation plugin <= 24.1209 - Reflected Cross Site Scripting (XSS) vulnerabilitycatkin ReDi Restaurant Reservation
- CVE-2025-48292WordPress Tourmaster plugin <= 5.3.8 - Local File Inclusion vulnerabilityGoodLayers Tourmaster
- CVE-2025-41377SQL injection vulnerability in Gandia Integra TotalTESI Gandia Integra Total
- CVE-2025-1123Solid Mail – SMTP email and logging made by SolidWP <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting via EmailSolid Mail – SMTP email and logging made by SolidWP
- CVE-2025-41407SQL InjectionManageEngine ADAudit Plus
- CVE-2025-36527SQL InjectionManageEngine ADAudit Plus
- CVE-2025-3893SQL Injection in MegaBIPJan Syski MegaBIP
- CVE-2024-13945Stored Absolute Path TraversalABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2025-5100KL-001-2025-005: Mobile Dynamix PrinterShare Mobile Print Double-Free Memory WriteMobile Dynamix PrinterShare Mobile Print
- CVE-2023-34873On MOBOTIX P3 cameras before MX-V4.7.2.18 and Mx6 cameras before MX-V5.2.0.61, the tcpdump feature does not properly validate input, which aMOBOTIX P3 · MOBOTIX Mx6
Medium, low and unrated 56
- CVE-2025-5119Emlog Pro api_controller.php sql injectionEmlog Pro
- CVE-2025-48375Schule Missing Rate Limiting on OTP Email Requests – Susceptible to Abuse & DoSschule111 Schule
- CVE-2025-48377Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit modednnsoftware Dnn.Platform · DotNetNuke.Web +1
- CVE-2025-48378Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inlinednnsoftware Dnn.Platform · DotNetNuke.Core
- CVE-2025-48376Dnn.Platform's Site Import could use an external source with a crafted requestdnnsoftware Dnn.Platform · DotNetNuke.SiteExportImport
- CVE-2025-32967OpenEMR doesn't log password administration properlyopenemr
- CVE-2022-31807A vulnerability has been identified in Building X - Security Manager Edge Controller (ACC-AP) (All versions).Siemens Building X - Security Manager Edge Controller
- CVE-2018-25110Regular Expression Denial of Service (ReDoS) in markedjs/markedmarked
- CVE-2025-5114easysoft zentaopms Editor index.php edit deserializationeasysoft zentaopms
- CVE-2025-5112FreeFloat FTP Server MGET Command buffer overflowFreeFloat FTP Server
- CVE-2025-5111FreeFloat FTP Server TYPE Command buffer overflowFreeFloat FTP Server
- CVE-2025-3580An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server adminiGrafana
- CVE-2025-5110FreeFloat FTP Server VERBOSE Command buffer overflowFreeFloat FTP Server
- CVE-2025-5109FreeFloat FTP Server STATUS Command buffer overflowFreeFloat FTP Server
- CVE-2025-46486WordPress Nomupay Payment Processing Gateway plugin <= 7.1.7 - Arbitrary File Download Vulnerabilitytotalprocessing Nomupay Payment Processing Gateway
- CVE-2025-46493WordPress Crossword Compiler Puzzles plugin <= 14.5 - Cross Site Scripting (XSS) vulnerabilitywordwebsoftware Crossword Compiler Puzzles
- CVE-2025-46518WordPress IGIT Related Posts With Thumb Image After Posts plugin <= 4.5.3 - Cross Site Scripting (XSS) Vulnerabilityphpaddicted IGIT Related Posts With Thumb Image After Posts
- CVE-2025-46527WordPress Web3Press – Decentralize Publishing with Writing NFT plugin <= 3.2.0 - Arbitrary File Read vulnerabilityLikeCoin Web3Press
- CVE-2025-47513WordPress Infocob CRM Forms plugin <= 2.4.0 - Arbitrary File Download vulnerabilityJames Laforge Infocob CRM Forms
- CVE-2025-47529WordPress Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin <= 1.1.1 - Settings Change VulnerabilityUX Design Experts Experto CTA Widget – Call To Action, Stic…
- CVE-2025-47619WordPress 6Storage Rentals plugin <= 2.20.2 - Broken Access Control vulnerability6Storage Rentals
- CVE-2025-48271WordPress Leadinfo plugin <= 1.1 - Settings Change VulnerabilityLeadinfo
- CVE-2025-48275WordPress Visual Header plugin <= 1.3 - Broken Access Control Vulnerabilitydastan800 Visual Header
- CVE-2025-41380Injection vulnerability in Iridium Certus 700Intellian Technologies Iridium Certus
- CVE-2025-41379Injection vulnerability in Iridium Certus 700Intellian Technologies Iridium Certus
- CVE-2025-41378Injection vulnerability in Iridium Certus 700Intellian Technologies Iridium Certus
- CVE-2024-7803Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2024-9163User Interface (UI) Misrepresentation of Critical Information in GitLabGitLab
- CVE-2025-5108zongzhige ShopXO ZIP File Payment.php Upload unrestricted uploadzongzhige ShopXO
- CVE-2025-5107Fujian Kelixun xml_cdr_details.php sql injectionFujian Kelixun
- CVE-2025-5106Fujian Kelixun Filename fax_view.php os command injectionFujian Kelixun
- CVE-2025-5105TOZED ZLT W51 Service Port 7777 heap inspectionTOZED ZLT W51
- CVE-2025-3894Stored XSS in MegaBIPJan Syski MegaBIP
- CVE-2025-4379Reflected XSS in DobryCMSStudio Fabryka DobryCMS
- CVE-2025-47149The optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper pattern file validation.Digital Arts i-FILTER
- CVE-2025-5096TablePress <= 3.1.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameterstobiasbg TablePress – Tables in WordPress made easy
- CVE-2025-4594Tournamatch <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingTournamatch
- CVE-2025-2394Disclosure of Alibaba (OSS) Keys In Ecovacs Home Android and iOS Mobile ApplicationsEcovacs Mobile and Android Application
- CVE-2023-53154parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSON_ParseWithLength is callecJSON project cJSON
- CVE-2024-48702PHPGurukul Old Age Home Management System v1.0 is vulnerable to HTML Injection via the searchdata parameter.
- CVE-2024-48704Phpgurukul Medical Card Generation System v1.0 is vulnerable to HTML Injection in admin/contactus.php via the parameter pagedes.
- CVE-2024-51099A reflected cross-site scripting (XSS) vulnerability in the component mcgs/download-medical-cards.php of PHPGURUKUL Medical Card Generation
- CVE-2024-51102PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentreco
- CVE-2024-51103PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentreco
- CVE-2024-51107Multiple stored cross-site scripting (XSS) vulnerabilities in the component /mcgs/admin/contactus.php of PHPGURUKUL Medical Card Generation
- CVE-2024-51108Multiple stored cross-site scripting (XSS) vulnerabilities in the component /admin/card-bwdates-report.php of PHPGURUKUL Medical Card Genera
- CVE-2025-44998A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execut
- CVE-2025-46176Hardcoded credentials in the Telnet service in D-Link DIR-605L v2.13B01 and DIR-816L v2.06B01 allow attackers to remotely execute arbitrary
- CVE-2025-48695An issue was discovered in CyberDAVA before 1.1.20.CyberDAVA
- CVE-2025-48701openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used.openDCIM
- CVE-2025-48708gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case.Artifex Ghostscript
- CVE-2025-48735A SQL Injection issue in the request body processing in BOS IPCs with firmware 21.45.8.2.2_220219 before 21.45.8.2.3_230220 allows remote atBOS IP camera
- CVE-2025-48738An e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1StrangeBee TheHive
- CVE-2025-48739A Server-Side Request Forgery (SSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and StrangeBee TheHive
- CVE-2025-48740A Cross-Site Request Forgery (CSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5StrangeBee TheHive
- CVE-2025-48741A Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, and 5.4.0 before 5.4.10 allows remote,StrangeBee TheHive