# CVEs published 2025-05-31

37 CVEs were published on May 31, 2025: 2 critical, 3 high. Days are UTC.

- [CVE-2025-5390](https://cve.now/CVE-2025-5390.md): JeeWMS File filedeal.do filedeal access control (CVSS 5.3, JeeWMS)
- [CVE-2025-5389](https://cve.now/CVE-2025-5389.md): JeeWMS File generateController.do dogenerateOne2Many access control (CVSS 5.3, JeeWMS)
- [CVE-2025-5388](https://cve.now/CVE-2025-5388.md): JeeWMS generateController.do dogenerate sql injection (CVSS 5.3, JeeWMS)
- [CVE-2025-5387](https://cve.now/CVE-2025-5387.md): JeeWMS File generateController.do dogenerate access control (CVSS 5.3, JeeWMS)
- [CVE-2025-5386](https://cve.now/CVE-2025-5386.md): JeeWMS cgformTransController.do transEditor sql injection (CVSS 5.3, JeeWMS)
- [CVE-2025-5385](https://cve.now/CVE-2025-5385.md): JeeWMS cgformTemplateController.do doAdd path traversal (CVSS 5.3, JeeWMS)
- [CVE-2025-5384](https://cve.now/CVE-2025-5384.md): JeeWMS cgAutoListController.do CgAutoListController sql injection (CVSS 5.3, JeeWMS)
- [CVE-2025-5383](https://cve.now/CVE-2025-5383.md): Yifang CMS Article Management Module cross site scripting (CVSS 4.8, Yifang CMS)
- [CVE-2025-5381](https://cve.now/CVE-2025-5381.md): Yifang CMS Admin Panel downloadFile path traversal (CVSS 5.1, Yifang CMS)
- [CVE-2025-5380](https://cve.now/CVE-2025-5380.md): ashinigit 天青一白 XueShengZhuSu 学生住宿管理系统 Image File Upload upload path traversal (CVSS 5.3, ashinigit 天青一白 XueShengZhuSu 学生住宿管理系统)
- [CVE-2025-5379](https://cve.now/CVE-2025-5379.md): NuCom NC-WR744G Console Application hard-coded credentials (CVSS 5.3, NuCom NC-WR744G)
- [CVE-2025-5378](https://cve.now/CVE-2025-5378.md): Astun Technology iShare Maps mycouncil2.aspx cross site scripting (CVSS 5.3, Astun Technology iShare Maps)
- [CVE-2025-5377](https://cve.now/CVE-2025-5377.md): Astun Technology iShare Maps historic1.asp cross site scripting (CVSS 5.3, Astun Technology iShare Maps)
- [CVE-2025-5376](https://cve.now/CVE-2025-5376.md): SourceCodester Health Center Patient Record Management System patient.php sql injection (CVSS 6.9, SourceCodester Health Center Patient Record Management Syst…)
- [CVE-2025-4691](https://cve.now/CVE-2025-4691.md): Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking \<= 1.3.21 - Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 5.3, syntactics eaSYNC Booking – Hotels, Restaurants & Car Renta…)
- [CVE-2025-4857](https://cve.now/CVE-2025-4857.md): Newsletters \<= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion (CVSS 7.2, contrid Newsletters)
- [CVE-2025-5375](https://cve.now/CVE-2025-5375.md): PHPGurukul HPGurukul Online Birth Certificate System registered-users.php sql injection (CVSS 5.3, PHPGurukul HPGurukul Online Birth Certificate System)
- [CVE-2025-5374](https://cve.now/CVE-2025-5374.md): PHPGurukul Online Birth Certificate System all-applications.php sql injection (CVSS 5.3, PHPGurukul Online Birth Certificate System)
- [CVE-2025-5373](https://cve.now/CVE-2025-5373.md): PHPGurukul Online Birth Certificate System users-applications.php sql injection (CVSS 5.3, PHPGurukul Online Birth Certificate System)
- [CVE-2025-5371](https://cve.now/CVE-2025-5371.md): SourceCodester Health Center Patient Record Management System admin.php sql injection (CVSS 6.9, SourceCodester Health Center Patient Record Management Syst…)
- [CVE-2025-3813](https://cve.now/CVE-2025-3813.md): Royal Elementor Addons and Templates \<= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2025-5290](https://cve.now/CVE-2025-5290.md): Borderless – Elementor Addons and Templates \<= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, visualmodo Borderless – Addons and Templates for Elementor)
- [CVE-2025-4595](https://cve.now/CVE-2025-4595.md): FastSpring \<= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jtewes FastSpring)
- [CVE-2025-4631](https://cve.now/CVE-2025-4631.md): Profitori 2.0.6.0 - 2.1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via stocktend\_object Endpoint (CVSS 9.8, unitybusinesstechnology The E-Commerce ERP: Purchasing, Inv…)
- [CVE-2025-5285](https://cve.now/CVE-2025-5285.md): Product Subtitle for WooCommerce \<= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag Parameter (CVSS 6.4, spiderwares Product Subtitle for WooCommerce)
- [CVE-2025-5292](https://cve.now/CVE-2025-5292.md): Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder \<= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2025-4607](https://cve.now/CVE-2025-4607.md): PSW Front-end Login & Registration \<= 1.12 - Insufficiently Random Values to Unauthenticated Account Takeover/Privilege Escalation via customer\_registration Function (CVSS 9.8, empoweringprowebsite PSW Front-end Login & Registration)
- [CVE-2025-4672](https://cve.now/CVE-2025-4672.md): Offsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission\_callback Function (CVSS 8.8, Offsprout Page Builder)
- [CVE-2025-4590](https://cve.now/CVE-2025-4590.md): Daisycon prijsvergelijkers \<= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Daisycon prijsvergelijkers)
- [CVE-2025-4103](https://cve.now/CVE-2025-4103.md): WP-GeoMeta 0.3.4 - 0.3.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via wp\_ajax\_wpgm\_start\_geojson\_import Function (CVSS 8.8, luminfire WP-GeoMeta)
- [CVE-2025-5370](https://cve.now/CVE-2025-5370.md): PHPGurukul News Portal forgot-password.php sql injection (CVSS 6.9, PHPGurukul News Portal)
- [CVE-2025-5369](https://cve.now/CVE-2025-5369.md): SourceCodester PHP Display Username After Login login.php sql injection (CVSS 6.9, SourceCodester PHP Display Username After Login)
- [CVE-2025-5368](https://cve.now/CVE-2025-5368.md): PHPGurukul Daily Expense Tracker System expense-yearwise-reports-detailed.php sql injection (CVSS 5.3, PHPGurukul Daily Expense Tracker System)
- [CVE-2025-5016](https://cve.now/CVE-2025-5016.md): Relevanssi \<= 4.24.5 (Free) and \<= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights (CVSS 4.7, Relevanssi Premium · comesio Relevanssi – A Better Search)
- [CVE-2025-5367](https://cve.now/CVE-2025-5367.md): PHPGurukul Online Shopping Portal Project category.php sql injection (CVSS 6.9, PHPGurukul Online Shopping Portal Project)
- [CVE-2025-5365](https://cve.now/CVE-2025-5365.md): Campcodes Online Hospital Management System patient-search.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2018-25111](https://cve.now/CVE-2018-25111.md): django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py. (CVSS 5.1, django-helpdesk Project django-helpdesk · django-helpdesk)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.