CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- code-projects employee record systemcode-projects Employee Record System getData.php sql injection5.3 Medium
- xu-yijie grpo-flatXU-YIJIE grpo-flat grpo_vanilla.py main deserialization4.8 Medium
- campcodes sales and inventory systemCampcodes Sales and Inventory System purchase_add.php sql injection6.9 Medium
- beamctrl airianaBeamCtrl Airiana coef deserialization4.8 Medium
- urkekg posts per catPosts per Cat [Unmaintained] <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- projectworlds hospital database management systemprojectworlds Hospital Database Management System medicines_info.php sql injection6.9 Medium
- anujk305 daily expense trackerPHPGurukul Daily Expense Tracker register.php sql injection6.9 Medium
- campcodes sales and inventory systemCampcodes Sales and Inventory System product.php unrestricted upload5.3 Medium
- campcodes sales and inventory systemCampcodes Sales and Inventory System ci_update.php sql injection6.9 Medium
- ibm content navigatorIBM Content Navigator HTML injection5.4 Medium
- totolink a3002r, a3002ru, a3002r firmware +1 more +3 moreTOTOLINK A3002R/A3002RU HTTP POST Request formIpQoS buffer overflow8.7 High
- totolink a3002r, a3002ru, a3002r firmware +1 more +3 moreTOTOLINK A3002R/A3002RU HTTP POST Request formFilter buffer overflow8.7 High
wiresharkOSS-FuzzIndex-out-of-bounds in tcp_analyze_sequence_numberNo scoreopensslDebian,openssl-3openSUSE +1 moreOpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack,...5.3 Medium- totolink a3002r, a3002ru, a3002r firmware +1 more +3 moreTOTOLINK A3002R/A3002RU HTTP POST Request formPortFw buffer overflow8.7 High
- totolink a3002r, a3002ru, a3002r firmware +1 more +3 moreTOTOLINK A3002R/A3002RU HTTP POST Request formMapDel buffer overflow8.7 High
- gnu pspplibpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data...2.9 Low
- aomedia libavifIn libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications...4.5 Medium
- aomedia libavifIn libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer...4.5 Medium
- invisioncommunity invision power board, invisioncommunity +1 moreInvision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings...10.0 Critical
- wibu codemeter, siemens desigo cc family v5.0, desigo cc family v5.1 +11 more +13 moreWibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation ...8.2 High
- samsung internetSamsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does...5.9 Medium
- seaweedfsSeaweedFS Vulnerable to SQL Injection6.5 Medium
- totolink a3002r, a3002ru, a3002r firmware +1 more +3 moreTOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injection5.3 Medium
- zulipZulip Server has access control bypass for restrictions on creation of specific channel types5.3 Medium
- mayurik best online news portalSourceCodester Best Online News Portal search.php sql injection6.9 Medium
- meteorMeteor livedata_server.js Object.assign redos6.3 Medium
- mitsubishi electric corporation analytix, bizviz, genesis +7 more +9 moreInformation Tampering Vulnerability in Multiple Services of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, GENESIS, GENESIS32, and BizViz6.5 Medium
- angeljudesuarez placement management systemitsourcecode Placement Management System view_student.php sql injection6.9 Medium
- angeljudesuarez placement management systemitsourcecode Placement Management System view_drive.php sql injection6.9 Medium
- angeljudesuarez placement management systemitsourcecode Placement Management System student_profile.php sql injection6.9 Medium
- angeljudesuarez placement management systemitsourcecode Placement Management System all_student.php sql injection6.9 Medium
- angeljudesuarez placement management systemitsourcecode Placement Management System edit_profile.php sql injection6.9 Medium
- tornadoweb tornado, debian linux +1 moreTornado vulnerable to excessive logging caused by malformed multipart form data7.5 High
- auth0 auth0-phpBrute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK9.1 Critical
- angeljudesuarez placement management systemitsourcecode Placement Management System drive.php sql injection6.9 Medium
- munyweki student result management systemSourceCodester Student Result Management System drop_student.php path traversal5.3 Medium
- campcodes sales and inventory systemCampcodes Sales and Inventory System cash_transaction.php sql injection6.9 Medium
- campcodes sales and inventory systemCampcodes Sales and Inventory System customer_add.php sql injection6.9 Medium
- dumbwareio dumbdropDumbDrop vulnerable to DOM XSS via file upload2.1 Low
- ibm infosphere information server, infosphere information server on cloud +1 moreIBM Information Server information disclosure4.3 Medium
- spotipy-dev spotipySpotipy repo vulnerable to secrets exfiltration via `pull_request_target`9.1 Critical
- automattic sensei lmsSensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure4.3 Medium
- unknown event tickets with ticket scannerEvent Tickets with Ticket Scanner < 2.3.8 - Admin+ Stored XSS3.5 Low
- metagauss eventprimeEventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update6.4 Medium
- bdwm responsive gallery gridResponsive Gallery Grid < 2.3.15 - Admin+ Stored XSS3.5 Low
- bracketspace advanced cron managerAdvanced Cron Manager < 2.5.7 - Admin+ Stored XSS3.5 Low
- unknown carousel, slider, gallery by wp carousel, techearty carousel\, slider\, gallery by wp carousel +1 moreCarousel, Slider, Gallery by WP Carousel < 2.6.9 - Editor+ Stored XSS3.5 Low
- shapedplugin smart post showPost Grid, Post Carousel, & List Category Posts < 2.4.28 - Editor+ Stored XSS3.5 Low
- unknown genesis blocksGenesis Blocks <= 3.1.3 - Contributor+ Stored XSS6.8 Medium
- Show moreLoading…