CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- vvvebAn issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin...9.8 Critical
- znunyAn issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using...9.8 Critical
- wpeverest everest formsCross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to...6.1 Medium
open-vm-toolsAlmaLinux,open-vm-tools-debuginfoRed Hat,open-vm-tools-debugsourceRed Hat +8 more +10 moreInsecure file handling vulnerability6.1 Medium- radware cloud wafRadware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass...9.1 Critical
- radware cloud wafRadware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass...9.1 Critical
- thingsboardAn arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard...6.5 Medium
- flytxt neon-dxAn issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1...5.4 Medium
- continew adminContiNew Admin password unverified password change5.3 Medium
- continew adminContiNew Admin file cross site scripting5.1 Medium
- phpgurukul apartment visitors management systemPHPGurukul Apartment Visitors Management System pass-details.php sql injection6.9 Medium
- campcodes online food ordering systemCampcodes Online Food Ordering System register-router.php sql injection6.9 Medium
- campcodes online food ordering systemCampcodes Online Food Ordering System router.php sql injection6.9 Medium
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System Add User Page cross site scripting4.8 Medium
- 1panel-dev maxkb1Panel-dev MaxKB Knowledge Base Module csv injection5.1 Medium
- code-projects content management system, ctcms project ctcms +1 moreCTCMS Content Management System File Tpl.php del path traversal5.3 Medium
- d-link di-8100, dlink di-8100 firmware +1 moreD-Link DI-8100 jhttpd ddos.asp stack-based overflow7.5 High
- lylme spageLyLme Spage ajax_link.php sql injection6.9 Medium
- freeebird hotel, hotel 酒店管理系统 api +1 moreFreeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy2.3 Low
- lmxcmsLmxCMS POST Request ZtAction.class.php manageZt sql injection5.3 Medium
- lodop c-lodopMTSoftware C-Lodop CLodopPrintService unquoted search path7.3 High
- hainan todeskHainan ToDesk DLL File Parser profapi.dll uncontrolled search path7.3 High
- keking kkfileviewkkFileView fileUpload unrestricted upload5.3 Medium
- ruoyi ruoyi-vueyangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookie2.3 Low
- gosuncn technology group audio-visual integrated management platform, gosuncntech group audio-visual integrated management +1 moreGosuncn Technology Group Audio-Visual Integrated Management Platform listByPage information disclosure6.9 Medium
- gosuncn technology group audio-visual integrated management platform, gosuncntech group audio-visual integrated management +1 moreGosuncn Technology Group Audio-Visual Integrated Management Platform Configuration File config.properties information disclosure6.9 Medium
- sungrow logger1000SunGrow Logger1000 weak password6.3 Medium
- jeecg bootJeecgBoot Document Library Upload zip unzipFile resource consumption5.1 Medium
- shanghai bairui information technology sunloginclientShanghai Bairui Information Technology SunloginClient sunlogin_guard.exe uncontrolled search path7.3 High
- seeyon oa web application system, zhiyuan oa web application system +1 moreSeeyon Zhiyuan OA Web Application System Beetl Template EhrSalaryPayrollServiceImpl.class postData code injection5.3 Medium
- feng ha ha ssm-erp, production ssm +1 morefeng_ha_ha/megagao ssm-erp/production_ssm File FileController.java handleFileDownload path traversal5.3 Medium
- seeyon oa web application system, zhiyuan oa web application system +1 moreSeeyon Zhiyuan OA Web Application System ZIP File M3CoreController.class download path traversal5.3 Medium
- digitro ngc explorerDígitro NGC Explorer session expiration5.3 Medium
- digitro ngc explorerDígitro NGC Explorer Password Transmission client-side enforcement of server-side security6.3 Medium
- digitro ngc explorerDígitro NGC Explorer Configuration missing password field masking5.3 Medium
checkstyleOSS-FuzzSecurity exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statementNo score- lumi h5p-nodejs-library@lumieducation/h5p-server Fails to Sanitize Plain Text Strings6.4 Medium
- discordDiscord WINSTA.dll uncontrolled search path7.3 High
- pribai privategptZylon PrivateGPT settings.yaml cross-domain policy5.3 Medium
- mayicmsZhengzhou Jiuhua Electronic Technology mayicms javascript.php sql injection5.3 Medium
- catalyst user key authentication pluginCatalyst User Key Authentication Plugin Logout logout.php redirect5.3 Medium
- inetum iodasInetum IODAS app.jsp cross site scripting5.3 Medium
- vector4wang spring-boot-quickvector4wang spring-boot-quick quick-img2txt Img2TxtController.java ResponseEntity path traversal5.3 Medium
- changjietong ufida crmChangjietong UFIDA CRM optntyday.php sql injection5.3 Medium
- phpgurukul e-diary management systemPHPGurukul e-Diary Management System manage-notes.php sql injection6.9 Medium
- phpgurukul e-diary management systemPHPGurukul e-Diary Management System my-profile.php sql injection6.9 Medium
- campcodes online food ordering systemCampcodes Online Food Ordering System add-item.php sql injection6.9 Medium
- campcodes online food ordering systemCampcodes Online Food Ordering System menu-router.php sql injection6.9 Medium
- phpgurukul apartment visitors management systemPHPGurukul Apartment Visitors Management System category.php sql injection6.9 Medium
- donbermoy online college library systemSourceCodester Online College Library System index.php sql injection6.9 Medium
- Show moreLoading…