# CVEs published 2025-05-26

69 CVEs were published on May 26, 2025: 4 critical, 10 high. Days are UTC.

- [CVE-2025-5214](https://cve.now/CVE-2025-5214.md): Kashipara Responsive Online Learing Platform course\_detail\_user\_new.php sql injection (CVSS 6.9, Kashipara Responsive Online Learing Platform)
- [CVE-2025-5213](https://cve.now/CVE-2025-5213.md): projectworlds Responsive E-Learning System delete\_file.php sql injection (CVSS 6.9, projectworlds Responsive E-Learning System)
- [CVE-2025-4783](https://cve.now/CVE-2025-4783.md): Exclusive Addons for Elementor \<= 2.7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2025-5212](https://cve.now/CVE-2025-5212.md): PHPGurukul Employee Record Management System editempexp.php sql injection (CVSS 6.9, PHPGurukul Employee Record Management System)
- [CVE-2025-5211](https://cve.now/CVE-2025-5211.md): PHPGurukul Employee Record Management System myprofile.php sql injection (CVSS 6.9, PHPGurukul Employee Record Management System)
- [CVE-2025-5210](https://cve.now/CVE-2025-5210.md): PHPGurukul Employee Record Management System loginerms.php sql injection (CVSS 6.9, PHPGurukul Employee Record Management System)
- [CVE-2025-5208](https://cve.now/CVE-2025-5208.md): SourceCodester Online Hospital Management System check\_availability.php sql injection (CVSS 6.9, SourceCodester Online Hospital Management System)
- [CVE-2025-5207](https://cve.now/CVE-2025-5207.md): SourceCodester Client Database Management System superadmin\_update\_profile.php sql injection (CVSS 5.1, SourceCodester Client Database Management System)
- [CVE-2025-5206](https://cve.now/CVE-2025-5206.md): Pixelimity Installation index.php sql injection (CVSS 5.1, Pixelimity)
- [CVE-2025-5205](https://cve.now/CVE-2025-5205.md): 1000 Projects Daily College Class Work Report Book dcwr\_entry.php sql injection (CVSS 6.9, 1000 Projects Daily College Class Work Report Book)
- [CVE-2025-5204](https://cve.now/CVE-2025-5204.md): Open Asset Import Library Assimp MDLMaterialLoader.cpp ParseSkinLump\_3DGS\_MDL7 out-of-bounds (CVSS 4.8, Open Asset Import Library Assimp)
- [CVE-2025-5203](https://cve.now/CVE-2025-5203.md): Open Asset Import Library Assimp ParsingUtils.h SkipSpaces out-of-bounds (CVSS 4.8, Open Asset Import Library Assimp)
- [CVE-2025-5202](https://cve.now/CVE-2025-5202.md): Open Asset Import Library Assimp HL1MDLLoader.cpp validate\_header out-of-bounds (CVSS 4.8, Open Asset Import Library Assimp)
- [CVE-2025-5201](https://cve.now/CVE-2025-5201.md): Open Asset Import Library Assimp LWOLoader.cpp CountVertsAndFacesLWO2 out-of-bounds (CVSS 4.8, Open Asset Import Library Assimp)
- [CVE-2025-5200](https://cve.now/CVE-2025-5200.md): Open Asset Import Library Assimp MDLLoader.cpp InternReadFile\_Quake1 out-of-bounds (CVSS 4.8, Open Asset Import Library Assimp)
- [CVE-2025-23392](https://cve.now/CVE-2025-23392.md): Reflected XSS in SystemsController.java in spacewalk-java (CVSS 5.2, Container suse/manager/5.0/x86\_64/server:5.0.4.7.19.1 · SUS…)
- [CVE-2025-23394](https://cve.now/CVE-2025-23394.md): daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root (CVSS 9.8, openSUSE Tumbleweed)
- [CVE-2025-23395](https://cve.now/CVE-2025-23395.md): Local root exploit via \`logfile\_reopen()\` in screen 5.0.0 with setuid-root bit set (CVSS 7.8, screen)
- [CVE-2025-46802](https://cve.now/CVE-2025-46802.md): Temporary chown() of users' TTY to mode 0666 allows PTY hijacking in screen (CVSS 6.0, SUSE Linux Enterprise Micro · SUSE Linux Enterprise Modu… +4)
- [CVE-2025-46803](https://cve.now/CVE-2025-46803.md): Screen creates by default world-writable PTYs (CVSS 5.0, screen)
- [CVE-2025-37992](https://cve.now/CVE-2025-37992.md): net\_sched: Flush gso\_skb list too during -\>change() (no CVSS, Linux)
- [CVE-2025-39498](https://cve.now/CVE-2025-39498.md): WordPress Spotlight - Social Media Feeds (Premium) plugin \<= 1.7.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, Spotlight - Social Media Feeds)
- [CVE-2025-46804](https://cve.now/CVE-2025-46804.md): Screen 5.0.0 and older versions allow file existence tests when installed setuid-root (CVSS 3.3, screen)
- [CVE-2025-5196](https://cve.now/CVE-2025-5196.md): Wing FTP Server Lua Admin Console unnecessary privileges (CVSS 7.5, Wing FTP Server)
- [CVE-2025-46805](https://cve.now/CVE-2025-46805.md): Screen has a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root (CVSS 5.5, screen)
- [CVE-2025-5186](https://cve.now/CVE-2025-5186.md): thinkgem JeeSite URI Scheme form ResourceLoader.getResource server-side request forgery (CVSS 5.3, thinkgem JeeSite)
- [CVE-2025-40663](https://cve.now/CVE-2025-40663.md): Stored Cross-Site Scripting (XSS) in i2A-Cronos by i2A (CVSS 5.1, i2A Cronos)
- [CVE-2025-40653](https://cve.now/CVE-2025-40653.md): User enumeration in M3M Printer Server Web (CVSS 6.9, M3M Printer Server Web)
- [CVE-2025-40652](https://cve.now/CVE-2025-40652.md): Cross-Site Scripting (XSS) in CoverManager (CVSS 5.3, CoverManager)
- [CVE-2025-40650](https://cve.now/CVE-2025-40650.md): Insecure Direct Object Reference (IDOR) in Clickedu (CVSS 8.7, Clickedu)
- [CVE-2025-40667](https://cve.now/CVE-2025-40667.md): Missing authorization vulnerability in TCMAN GIM v11 (CVSS 8.7, TCMAN GIM)
- [CVE-2025-40666](https://cve.now/CVE-2025-40666.md): Time-based blind SQL injection vulnerability in TCMAN GIM v11 (CVSS 8.7, TCMAN GIM)
- [CVE-2025-40665](https://cve.now/CVE-2025-40665.md): Time-based blind SQL injection vulnerability in TCMAN GIM v11 (CVSS 8.7, TCMAN GIM)
- [CVE-2025-40664](https://cve.now/CVE-2025-40664.md): Missing authentication vulnerability in TCMAN GIM v11 (CVSS 9.3, TCMAN GIM)
- [CVE-2025-5185](https://cve.now/CVE-2025-5185.md): Summer Pearl Group Vacation Rental Management Platform cross-site request forgery (CVSS 5.3, Summer Pearl Group Vacation Rental Management Platform)
- [CVE-2025-5184](https://cve.now/CVE-2025-5184.md): Summer Pearl Group Vacation Rental Management Platform HTTP Response Header information disclosure (CVSS 5.3, Summer Pearl Group Vacation Rental Management Platform)
- [CVE-2025-5183](https://cve.now/CVE-2025-5183.md): Summer Pearl Group Vacation Rental Management Platform Header redirect (CVSS 5.1, Summer Pearl Group Vacation Rental Management Platform)
- [CVE-2025-5182](https://cve.now/CVE-2025-5182.md): Summer Pearl Group Vacation Rental Management Platform Listing authorization (CVSS 5.3, Summer Pearl Group Vacation Rental Management Platform)
- [CVE-2025-5181](https://cve.now/CVE-2025-5181.md): Summer Pearl Group Vacation Rental Management Platform updateListing cross site scripting (CVSS 5.1, Summer Pearl Group Vacation Rental Management Platform)
- [CVE-2025-4053](https://cve.now/CVE-2025-4053.md): Unauthorized creation of master key in Mifare Classic Be-Tech cards (CVSS 6.8, Be-Tech Mifare Classic cards)
- [CVE-2025-35003](https://cve.now/CVE-2025-35003.md): Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities. (CVSS 9.8, Apache Software Foundation Apache NuttX RTOS)
- [CVE-2025-5180](https://cve.now/CVE-2025-5180.md): Wondershare Filmora Installer NFWCHK.exe uncontrolled search path (CVSS 7.3, Wondershare Filmora)
- [CVE-2025-5179](https://cve.now/CVE-2025-5179.md): Realce Tecnologia Queue Ticket Kiosk Cadastro de Administrador Page index.php cross site scripting (CVSS 4.8, Realce Tecnologia Queue Ticket Kiosk)
- [CVE-2025-40671](https://cve.now/CVE-2025-40671.md): SQL injection vulnerability in AES Multimedia's Gestnet (CVSS 9.3, AES Multimedia Gestnet)
- [CVE-2025-40672](https://cve.now/CVE-2025-40672.md): Privilege Escalation in Panloader.exe (CVSS 8.5, Grupo Espiral MS Panloader.exe)
- [CVE-2025-5178](https://cve.now/CVE-2025-5178.md): Realce Tecnologia Queue Ticket Kiosk Image File ajax.php unrestricted upload (CVSS 5.3, Realce Tecnologia Queue Ticket Kiosk)
- [CVE-2025-4057](https://cve.now/CVE-2025-4057.md): Activemq-artemis-operator: amq broker operator starting credentials reuse (CVSS 5.5, activemq-artemis-operator · Red Hat AMQ Broker 7.13.0.OP… +3)
- [CVE-2025-5177](https://cve.now/CVE-2025-5177.md): Realce Tecnologia Queue Ticket Kiosk Admin Login Page index.php cross site scripting (CVSS 5.3, Realce Tecnologia Queue Ticket Kiosk)
- [CVE-2025-41655](https://cve.now/CVE-2025-41655.md): PEPPERL+FUCHS: Attacker can cause a DoS via URL (CVSS 7.5, Pepperl+Fuchs Profinet Gateway FB8122A.1.EL · Pepperl+Fuchs…)
- [CVE-2025-41654](https://cve.now/CVE-2025-41654.md): PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by information disclosure via the SNMP protocol (CVSS 8.2, Pepperl+Fuchs Profinet Gateway FB8122A.1.EL · Pepperl+Fuchs…)
- [CVE-2025-1985](https://cve.now/CVE-2025-1985.md): PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerability (CVSS 6.1, Pepperl+Fuchs Profinet Gateway FB8122A.1.EL · Pepperl+Fuchs…)
- [CVE-2025-5176](https://cve.now/CVE-2025-5176.md): Realce Tecnologia Queue Ticket Kiosk Admin Login Page index.php sql injection (CVSS 6.9, Realce Tecnologia Queue Ticket Kiosk)
- [CVE-2025-5175](https://cve.now/CVE-2025-5175.md): erdogant pypickle pypickle.py save improper authorization (CVSS 4.8, erdogant pypickle · pypickle)
- [CVE-2025-5174](https://cve.now/CVE-2025-5174.md): erdogant pypickle pypickle.py load deserialization (CVSS 4.8, erdogant pypickle · pypickle)
- [CVE-2025-5173](https://cve.now/CVE-2025-5173.md): HumanSignal label-studio-ml-backend PT File neural\_nets.py load deserialization (CVSS 4.8, HumanSignal label-studio-ml-backend · label-studio-ml)
- [CVE-2025-41441](https://cve.now/CVE-2025-41441.md): Mailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attacker (CVSS 3.7, SYNCK GRAPHICA Mailform Pro CGI)
- [CVE-2025-5172](https://cve.now/CVE-2025-5172.md): Econtrata valida sql injection (CVSS 6.9, Econtrata)
- [CVE-2025-5171](https://cve.now/CVE-2025-5171.md): llisoft MTA Maita Training System OpenController.java this.fileService.download unrestricted upload (CVSS 5.3, llisoft MTA Maita Training System)
- [CVE-2025-5170](https://cve.now/CVE-2025-5170.md): llisoft MTA Maita Training System AdminShitiController.java AdminShitiListRequestVo sql injection (CVSS 5.3, llisoft MTA Maita Training System)
- [CVE-2025-5169](https://cve.now/CVE-2025-5169.md): Open Asset Import Library Assimp MDLLoader.cpp InternReadFile\_3DGS\_MDL345 out-of-bounds (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-5168](https://cve.now/CVE-2025-5168.md): Open Asset Import Library Assimp MDLLoader.cpp ImportUVCoordinate\_3DGS\_MDL345 out-of-bounds (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-5167](https://cve.now/CVE-2025-5167.md): Open Asset Import Library Assimp LWOLoader.h GetS0 out-of-bounds (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-5166](https://cve.now/CVE-2025-5166.md): Open Asset Import Library Assimp MDC File Parser MDCLoader.cpp InternReadFile out-of-bounds (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-5165](https://cve.now/CVE-2025-5165.md): Open Asset Import Library Assimp MDCLoader.cpp ValidateSurfaceHeader out-of-bounds (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-5164](https://cve.now/CVE-2025-5164.md): PerfreeBlog JWT JwtUtil hard-coded key (CVSS 6.3, PerfreeBlog)
- [CVE-2025-5163](https://cve.now/CVE-2025-5163.md): yangshare 技术杨工 warehouseManager 仓库管理系统 access control (CVSS 6.9, yangshare 技术杨工 warehouseManager 仓库管理系统)
- [CVE-2025-5162](https://cve.now/CVE-2025-5162.md): H3C SecCenter SMP-E1114P02 importFile unrestricted upload (CVSS 5.3, H3C SecCenter SMP-E1114P02)
- [CVE-2025-5161](https://cve.now/CVE-2025-5161.md): H3C SecCenter SMP-E1114P02 download operationDailyOut path traversal (CVSS 5.3, H3C SecCenter SMP-E1114P02)
- [CVE-2025-5160](https://cve.now/CVE-2025-5160.md): H3C SecCenter SMP-E1114P02 download path traversal (CVSS 5.3, H3C SecCenter SMP-E1114P02)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.