CVEs published May 24, 2025
26 CVEs were published on May 24, 2025: 3 critical, 3 high.
- Published
- 26
- Critical
- 3
- High
- 3
- Medium
- 14
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- Tmall Demo
- 7
- eMagicOne Store Manager for WooCommerce
- 4
- softaculous Page Builder: Pagelayer – Drag and Drop website…
- 2
- Teledyne FLIR AX8
- 2
- 4stats
- 1
- blyssprivacy sdk
- 1
- edgarrojas Smart Forms – when you need more than just a con…
- 1
- Forestryks process-sync-rs · process-sync
- 1
- FractalFir memory_pages · memory_pages
- 1
- maboroshinokiseki scsir · scsir
- 1
Critical 3
- CVE-2025-5124Sony SNC-M1 Administrative Interface default credentialsSony SNC-M1 · Sony SNC-M3 +5
- CVE-2025-5058eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image()eMagicOne Store Manager for WooCommerce
- CVE-2025-4603eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File DeletioneMagicOne Store Manager for WooCommerce
High 3
- CVE-2025-5129Sangfor 零信任访问控制系统 aTrust MSASN1.dll uncontrolled search pathSangfor 零信任访问控制系统 aTrust
- CVE-2025-5126Teledyne FLIR AX8 settingsregional.php setDataTime command injectionTeledyne FLIR AX8
- CVE-2025-4336eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()eMagicOne Store Manager for WooCommerce
Medium, low and unrated 20
- CVE-2025-5136Tmall Demo Payment Identifier pay random valuesTmall Demo
- CVE-2025-5135Tmall Demo Product Details Page admin cross site scriptingTmall Demo
- CVE-2025-5134Tmall Demo Buy Item Page cross site scriptingTmall Demo
- CVE-2025-5133Tmall Demo Search Box cross site scriptingTmall Demo
- CVE-2025-5132Tmall Demo logout cross-site request forgeryTmall Demo
- CVE-2025-5131Tmall Demo uploadCategoryImage unrestricted uploadTmall Demo
- CVE-2025-5130Tmall Demo uploadProductImage unrestricted uploadTmall Demo
- CVE-2025-5128ScriptAndTools Real-Estate-website-in-PHP Admin Login Panel admin sql injectionScriptAndTools Real-Estate-website-in-PHP
- CVE-2025-5127Teledyne FLIR AX8 prod.php cross site scriptingTeledyne FLIR AX8
- CVE-2025-4223Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parametersoftaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2025-4602eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File ReadeMagicOne Store Manager for WooCommerce
- CVE-2025-5055Smart Forms <= 2.6.98 - Authenticated (Admin+) Stored Cross-Site Scriptingedgarrojas Smart Forms – when you need more than just a con…
- CVE-2025-38694stats <= 2.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting4stats
- CVE-2024-13427Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Linksoftaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2025-48751The process_lock crate 0.1.0 for Rust allows data races in unlock.tickbh ProcessLock · process_lock
- CVE-2025-48752In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked.Forestryks process-sync-rs · process-sync
- CVE-2025-48753In the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock.obsidiandynamics anode
- CVE-2025-48754In the memory_pages crate 0.1.0 for Rust, division by zero can occur.FractalFir memory_pages · memory_pages
- CVE-2025-48755In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type).blyssprivacy sdk
- CVE-2025-48756In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.gmaboroshinokiseki scsir · scsir