CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- projectworlds life insurance management systemProjectworlds Life Insurance Management System deleteAgent.php sql injection6.9 Medium
- totolink a3002r, a3002ru, a702r +3 more +5 moreTOTOLINK A702R/A3002R/A3002RU HTTP POST Request formWlanRedirect buffer overflow8.7 High
- totolink a3002r, a3002ru, a702r +3 more +5 moreTOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSetLg buffer overflow8.7 High
- cocotais cocotais-botCocotais Bot has builtin .echo command injection7.2 High
- donetickDonetick Has Weak Default JWT Secret9.1 Critical
- totolink a3002r, a3002ru, a702r +3 more +5 moreTOTOLINK A702R/A3002R/A3002RU HTTP POST Request formNtp buffer overflow8.7 High
- totolink a3002r, a3002ru, a702r +3 more +5 moreTOTOLINK A702R/A3002R/A3002RU HTTP POST Request formDosCfg buffer overflow8.7 High
- totolink a3002r, a3002ru, a702r +3 more +5 moreTOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSiteSurveyProfile buffer overflow8.7 High
- ibm iIBM i privilege escalation8.5 High
- librenmsLibreNMS stored Cross-site Scripting vulnerability in poller group name2.1 Low
- pypa setuptools, debian linux +1 moresetuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write7.7 High
- totolink a3002r, a3002ru, a702r +3 more +5 moreTOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSysCmd buffer overflow8.7 High
auth0/loginPackagistlaravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions9.1 Criticalauth0/wordpressPackagistAuth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions9.1 Criticalauth0/symfonyPackagistAuth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions9.1 Critical- totolink a3002r, a3002ru, a702r +3 more +5 moreTOTOLINK A702R/A3002R/A3002RU HTTP POST Request formStats sub_40BE30 buffer overflow8.7 High
- totolink a3002r, a3002ru, a702r +3 more +5 moreTOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSaveConfig buffer overflow8.7 High
- multivendorx, wcmp multivendorx – woocommerce multivendor marketplace solutions +1 moreMultiVendorX – WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion4.3 Medium
surfcrates.iosurf is unmaintainedNo score- wpbookingcalendar wp booking calendar, wpdevelop booking calendar +1 moreBooking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode6.4 Medium
- kainex wise chatWise Chat <= 3.3.3 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory7.5 High
- artbees jupiter x coreJupiterx Core <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG6.4 Medium
- myeventon eventon, eventon (pro) - wordpress virtual event calendar plugin +1 moreEventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- totolink a3002r, a3002ru, a702r +3 more +5 moreTOTOLINK A702R/A3002R/A3002RU HTTP POST Request formWirelessTbl buffer overflow8.7 High
- totolink a3002r, a3002ru, a702r +3 more +5 moreTOTOLINK A702R/A3002R/A3002RU HTTP POST Request formDMZ buffer overflow8.7 High
- totolink a3002r, a3002ru, a702r +3 more +5 moreTOTOLINK A702R/A3002R/A3002RU HTTP POST Request formWsc buffer overflow8.7 High
- totolink a3002r, a3002ru, a702r +3 more +5 moreTOTOLINK A702R/A3002R/A3002RU HTTP POST Request formReflashClientTbl submit-url buffer overflow8.7 High
- cbutlerjr wp-members membership pluginWP-Members <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode6.4 Medium
- ruoyiy_project RuoYi Offline Logout batchForceLogout improper authorization2.3 Low
- aleapp csv mass importerCSV Mass Importer <= 1.2 - Admin+ Arbitrary File Upload7.2 High
- quantumcloud wpbot pro wordpress chatbotWPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion8.1 High
- coderevolution echo rss feed post generatorEcho RSS Feed Post Generator <= 5.4.8.1 - Unauthenticated Arbitrary File Upload9.8 Critical
- coderevolution crawlomatic multipage scraper post generatorCrawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload9.8 Critical
- sourcecodester doctor's appointment system, hshnudr doctors appointment system +1 moreSourceCodester Doctor's Appointment System GET Parameter delete-doctor.php sql injection6.9 Medium
- sourcecodester doctor's appointment system, hshnudr doctors appointment system +1 moreSourcecodester Doctor's Appointment System GET Parameter delete-appointment.php sql injection6.9 Medium
- alti5 alt monitoringAlT Monitoring <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- naicuoctavian audio comments pluginAudio Comments Plugin <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- sourcecodester doctor's appointment system, hshnudr doctors appointment system +1 moreSourceCodester Doctor's Appointment System GET Parameter appointment.php sql injection6.9 Medium
- campcodes sales and inventory systemCampcodes Sales and Inventory System supplier_update.php sql injection6.9 Medium
- campcodes sales and inventory systemCampcodes Sales and Inventory System supplier_add.php sql injection6.9 Medium
- imagination technologies graphics ddkGPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups)6.5 Medium
- imagination technologies graphics ddkGPU DDK - Improper locking when accessing the pvr_exp_fence object7.5 High
pcapplusplusOSS-FuzzUse-of-uninitialized-value in pcpp::SomeIpSdEntry::SomeIpSdEntryNo scoreassimpOSS-FuzzHeap-use-after-free in aiMesh::~aiMeshNo score- infiniflow ragflowRAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute...9.1 Critical
linux-cloud-tools-genericTuxCare,linux-cloud-tools-lowlatencyTuxCare,linux-crashdumpTuxCare +9 more +11 moreUpdate of linux-metaNo score- phpgurukul human metapneumovirus testing management systemPHPGurukul Human Metapneumovirus Testing Management System edit-phlebotomist.php sql injection6.9 Medium
- phpgurukul human metapneumovirus testing management system, human metapneumovirus +1 morePHPGurukul Human Metapneumovirus Testing Management System profile.php sql injection6.9 Medium
linux-cloud-tools-genericTuxCare,linux-cloud-tools-lowlatencyTuxCare,linux-crashdumpTuxCare +9 more +11 moreUpdate of linux-metaNo score- bdtask pharmacy management systemCodeAstro Pharmacy Management System Login index.php sql injection6.9 Medium
- Show moreLoading…