# CVEs published 2025-05-24

26 CVEs were published on May 24, 2025: 3 critical, 3 high. Days are UTC.

- [CVE-2025-5136](https://cve.now/CVE-2025-5136.md): Tmall Demo Payment Identifier pay random values (CVSS 6.3, Tmall Demo)
- [CVE-2025-5135](https://cve.now/CVE-2025-5135.md): Tmall Demo Product Details Page admin cross site scripting (CVSS 4.8, Tmall Demo)
- [CVE-2025-5134](https://cve.now/CVE-2025-5134.md): Tmall Demo Buy Item Page cross site scripting (CVSS 5.1, Tmall Demo)
- [CVE-2025-5133](https://cve.now/CVE-2025-5133.md): Tmall Demo Search Box cross site scripting (CVSS 5.3, Tmall Demo)
- [CVE-2025-5132](https://cve.now/CVE-2025-5132.md): Tmall Demo logout cross-site request forgery (CVSS 5.3, Tmall Demo)
- [CVE-2025-5131](https://cve.now/CVE-2025-5131.md): Tmall Demo uploadCategoryImage unrestricted upload (CVSS 5.1, Tmall Demo)
- [CVE-2025-5130](https://cve.now/CVE-2025-5130.md): Tmall Demo uploadProductImage unrestricted upload (CVSS 5.1, Tmall Demo)
- [CVE-2025-5129](https://cve.now/CVE-2025-5129.md): Sangfor 零信任访问控制系统 aTrust MSASN1.dll uncontrolled search path (CVSS 7.3, Sangfor 零信任访问控制系统 aTrust)
- [CVE-2025-5128](https://cve.now/CVE-2025-5128.md): ScriptAndTools Real-Estate-website-in-PHP Admin Login Panel admin sql injection (CVSS 6.9, ScriptAndTools Real-Estate-website-in-PHP)
- [CVE-2025-5127](https://cve.now/CVE-2025-5127.md): Teledyne FLIR AX8 prod.php cross site scripting (CVSS 5.1, Teledyne FLIR AX8)
- [CVE-2025-5126](https://cve.now/CVE-2025-5126.md): Teledyne FLIR AX8 settingsregional.php setDataTime command injection (CVSS 8.7, Teledyne FLIR AX8)
- [CVE-2025-5124](https://cve.now/CVE-2025-5124.md): Sony SNC-M1 Administrative Interface default credentials (CVSS 9.2, Sony SNC-M1 · Sony SNC-M3 +5)
- [CVE-2025-4223](https://cve.now/CVE-2025-4223.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 2.0.0 - Reflected Cross-Site Scripting via login\_url Parameter (CVSS 4.7, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2025-5058](https://cve.now/CVE-2025-5058.md): eMagicOne Store Manager for WooCommerce \<= 1.2.5 - Unauthenticated Arbitrary File Upload via set\_image() (CVSS 9.8, eMagicOne Store Manager for WooCommerce)
- [CVE-2025-4336](https://cve.now/CVE-2025-4336.md): eMagicOne Store Manager for WooCommerce \<= 1.2.5 - Unauthenticated Arbitrary File Upload via set\_file() (CVSS 8.1, eMagicOne Store Manager for WooCommerce)
- [CVE-2025-4603](https://cve.now/CVE-2025-4603.md): eMagicOne Store Manager for WooCommerce \<= 1.2.5 - Unauthenticated Arbitrary File Deletion (CVSS 9.1, eMagicOne Store Manager for WooCommerce)
- [CVE-2025-4602](https://cve.now/CVE-2025-4602.md): eMagicOne Store Manager for WooCommerce \<= 1.2.5 - Unauthenticated Arbitrary File Read (CVSS 5.9, eMagicOne Store Manager for WooCommerce)
- [CVE-2025-5055](https://cve.now/CVE-2025-5055.md): Smart Forms \<= 2.6.98 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, edgarrojas Smart Forms – when you need more than just a con…)
- [CVE-2025-3869](https://cve.now/CVE-2025-3869.md): 4stats \<= 2.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, 4stats)
- [CVE-2024-13427](https://cve.now/CVE-2024-13427.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link (CVSS 6.4, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2025-48751](https://cve.now/CVE-2025-48751.md): The process\_lock crate 0.1.0 for Rust allows data races in unlock. (CVSS 2.9, tickbh ProcessLock · process\_lock)
- [CVE-2025-48752](https://cve.now/CVE-2025-48752.md): In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread\_mutex is unlocked. (CVSS 2.9, Forestryks process-sync-rs · process-sync)
- [CVE-2025-48753](https://cve.now/CVE-2025-48753.md): In the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock. (CVSS 2.9, obsidiandynamics anode)
- [CVE-2025-48754](https://cve.now/CVE-2025-48754.md): In the memory\_pages crate 0.1.0 for Rust, division by zero can occur. (CVSS 2.9, FractalFir memory\_pages · memory\_pages)
- [CVE-2025-48755](https://cve.now/CVE-2025-48755.md): In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type). (CVSS 2.9, blyssprivacy sdk)
- [CVE-2025-48756](https://cve.now/CVE-2025-48756.md): In group\_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.g (CVSS 2.9, maboroshinokiseki scsir · scsir)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.