CVEs published May 31, 2025
37 CVEs were published on May 31, 2025: 2 critical, 3 high.
- Published
- 37
- Critical
- 2
- High
- 3
- Medium
- 32
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- JeeWMS
- 7
- Astun Technology iShare Maps
- 2
- PHPGurukul Online Birth Certificate System
- 2
- SourceCodester Health Center Patient Record Management Syst…
- 2
- Yifang CMS
- 2
- ashinigit 天青一白 XueShengZhuSu 学生住宿管理系统
- 1
- bdthemes Element Pack – Widgets, Templates & Addons for Ele…
- 1
- Campcodes Online Hospital Management System
- 1
- contrid Newsletters
- 1
- Daisycon prijsvergelijkers
- 1
Critical 2
- CVE-2025-4631Profitori 2.0.6.0 - 2.1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via stocktend_object Endpointunitybusinesstechnology The E-Commerce ERP: Purchasing, Inv…
- CVE-2025-4607PSW Front-end Login & Registration <= 1.12 - Insufficiently Random Values to Unauthenticated Account Takeover/Privilege Escalation via customer_registration Functionempoweringprowebsite PSW Front-end Login & Registration
High 3
- CVE-2025-4857Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusioncontrid Newsletters
- CVE-2025-4672Offsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback FunctionOffsprout Page Builder
- CVE-2025-4103WP-GeoMeta 0.3.4 - 0.3.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via wp_ajax_wpgm_start_geojson_import Functionluminfire WP-GeoMeta
Medium, low and unrated 32
- CVE-2025-5390JeeWMS File filedeal.do filedeal access controlJeeWMS
- CVE-2025-5389JeeWMS File generateController.do dogenerateOne2Many access controlJeeWMS
- CVE-2025-5388JeeWMS generateController.do dogenerate sql injectionJeeWMS
- CVE-2025-5387JeeWMS File generateController.do dogenerate access controlJeeWMS
- CVE-2025-5386JeeWMS cgformTransController.do transEditor sql injectionJeeWMS
- CVE-2025-5385JeeWMS cgformTemplateController.do doAdd path traversalJeeWMS
- CVE-2025-5384JeeWMS cgAutoListController.do CgAutoListController sql injectionJeeWMS
- CVE-2025-5383Yifang CMS Article Management Module cross site scriptingYifang CMS
- CVE-2025-5381Yifang CMS Admin Panel downloadFile path traversalYifang CMS
- CVE-2025-5380ashinigit 天青一白 XueShengZhuSu 学生住宿管理系统 Image File Upload upload path traversalashinigit 天青一白 XueShengZhuSu 学生住宿管理系统
- CVE-2025-5379NuCom NC-WR744G Console Application hard-coded credentialsNuCom NC-WR744G
- CVE-2025-5378Astun Technology iShare Maps mycouncil2.aspx cross site scriptingAstun Technology iShare Maps
- CVE-2025-5377Astun Technology iShare Maps historic1.asp cross site scriptingAstun Technology iShare Maps
- CVE-2025-5376SourceCodester Health Center Patient Record Management System patient.php sql injectionSourceCodester Health Center Patient Record Management Syst…
- CVE-2025-4691Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to Sensitive Information Exposuresyntactics eaSYNC Booking – Hotels, Restaurants & Car Renta…
- CVE-2025-5375PHPGurukul HPGurukul Online Birth Certificate System registered-users.php sql injectionPHPGurukul HPGurukul Online Birth Certificate System
- CVE-2025-5374PHPGurukul Online Birth Certificate System all-applications.php sql injectionPHPGurukul Online Birth Certificate System
- CVE-2025-5373PHPGurukul Online Birth Certificate System users-applications.php sql injectionPHPGurukul Online Birth Certificate System
- CVE-2025-5371SourceCodester Health Center Patient Record Management System admin.php sql injectionSourceCodester Health Center Patient Record Management Syst…
- CVE-2025-3813Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scriptingwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2025-5290Borderless – Elementor Addons and Templates <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingvisualmodo Borderless – Addons and Templates for Elementor
- CVE-2025-4595FastSpring <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingjtewes FastSpring
- CVE-2025-5285Product Subtitle for WooCommerce <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag Parameterspiderwares Product Subtitle for WooCommerce
- CVE-2025-5292Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2025-4590Daisycon prijsvergelijkers <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingDaisycon prijsvergelijkers
- CVE-2025-5370PHPGurukul News Portal forgot-password.php sql injectionPHPGurukul News Portal
- CVE-2025-5369SourceCodester PHP Display Username After Login login.php sql injectionSourceCodester PHP Display Username After Login
- CVE-2025-5368PHPGurukul Daily Expense Tracker System expense-yearwise-reports-detailed.php sql injectionPHPGurukul Daily Expense Tracker System
- CVE-2025-5016Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt HighlightsRelevanssi Premium · comesio Relevanssi – A Better Search
- CVE-2025-5367PHPGurukul Online Shopping Portal Project category.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2025-5365Campcodes Online Hospital Management System patient-search.php sql injectionCampcodes Online Hospital Management System
- CVE-2018-25111django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.django-helpdesk Project django-helpdesk · django-helpdesk