CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- newbee-ltd newbee-mallnewbee-mall UploadController.java upload unrestricted upload5.3 Medium
- zhangyanbo2007 youkefuzhangyanbo2007 youkefu MediaController.java upload unrestricted upload5.3 Medium
- seacmsSeaCMS admin_pay.php cross site scripting5.1 Medium
- seacmsSeaCMS admin_paylog.php cross site scripting5.1 Medium
quickjsOSS-FuzzHeap-use-after-free in __JS_FreeValueRTNo scorelibredwgOSS-FuzzIndex-out-of-bounds in dwg_decode_eedNo score- pcman ftp serverPCMan FTP Server RMD Command buffer overflow6.9 Medium
- iputilsping in iputils through 20240905 allows a denial of service (application error or incorrect data...6.5 Medium
- senior-walter web-based pharmacy product management systemSourceCodester Web Based Pharmacy Product Management System 1.0 is vulnerable to Cross Site...6.1 Medium
- huangjian888 jeeweb-mybatis-springbootIncorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis...6.5 Medium
- megagao production ssmIncorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows...7.5 High
- baidu brccBRCC Incorrect Access Control vulnerability9.8 Critical
- user-xiangpeng yaoqishanIncorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain...9.8 Critical
- lcw2004 oneIncorrect access control in the component /api/user/manager of One v1.0 allows attackers to...7.5 High
- zhaojun1998 shiro-actionIncorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to...7.5 High
- exrick xmallIncorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted...9.8 Critical
- java-aodeng hope-bootIncorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to...9.8 Critical
- passjavaIncorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows...7.5 High
- ke kobIncorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers...7.5 High
- zykzhangyukang xinguanIncorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows...7.5 High
- liaoxuefeng itranswarpAn issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication...9.8 Critical
- lopalopa online service management portalkashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in osms/Requester...8.8 High
- lopalopa online service management portalkashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in /osms/Requester...8.8 High
- lopalopa online service management portalA Directory Listing Vulnerability was found in the /osms/Requester/ directory of the Kashipara...5.3 Medium
- rhymixRhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the...7.7 High
- qianfox foxcmsfoxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand...6.5 Medium
- qianfox foxcmsAn issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a...5.3 Medium
- qianfox foxcmsfoxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the...9.1 Critical
- dbsyncer project dbsyncerIncorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to...7.5 High
- dbsyncer project dbsyncerA stored cross-site scripting (XSS) vulnerability in the Edit Profile feature of DBSyncer v2.0.6...5.4 Medium
- tenda ac9 firmwareTenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet...9.8 Critical
- seacmsSeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component...9.8 Critical
- seacmsSeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component...9.8 Critical
- seacmsSeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the...9.8 Critical
- linkerd buoyant, linkerd +1 moreLinkerd resource exhaustion vulnerability6.5 Medium
- grafana, grafana enterprise +1 moreGrafana's datasource proxy API allows authorization checks to be bypassed5.0 Medium
- jupo mezzanineMezzanine CMS Cross-Site Scripting (XSS) vulnerability6.1 Medium
- multi uploaders multiple file upload, multiple file upload project file upload +1 moreOutsystems Multiple File Upload < 3.1.0 is vulnerable to Unrestricted File Upload. The...6.4 Medium
- frappe erpnextA Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3....8.1 High
- srimax output messengerA reflected cross-site scripting (XSS) vulnerability was discovered in Output Messenger before 2...6.1 Medium
- srimax output messengerOutput Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper...7.2 High
- enhancesoft osticketA SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1...6.5 Medium
- niceforyou gefen webfwcAn issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1...6.5 Medium
- netgear rax50 firmwareNETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection...9.8 Critical
- netgear rax50 firmwareNETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection...9.8 Critical
- netgear rax50 firmwareNETGEAR RAX5 (AX1600 WiFi Router) v1.0.2.26 was discovered to contain a command injection...9.8 Critical
- netgear rax50 firmwareNETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection...9.8 Critical
- netgear rax50 firmwareNETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection...9.8 Critical
- netgear rax50 firmwareNETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection...9.8 Critical
- netgear rax50 firmwareNETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection...9.8 Critical
- Show moreLoading…