CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- soft8soft llc verge3dWordPress Verge3D plugin <= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wpjobportal wp job portalWordPress WP Job Portal plugin <= 2.3.2 - Arbitrary File Download Vulnerability7.5 High
- leadinfoWordPress Leadinfo plugin <= 1.1 - Settings Change Vulnerability6.5 Medium
- catkin redi restaurant reservationWordPress ReDi Restaurant Reservation plugin <= 24.1209 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- majestic support supportWordPress Majestic Support plugin <= 1.1.0 - SQL Injection Vulnerability9.3 Critical
- dastan800 visual headerWordPress Visual Header plugin <= 1.3 - Broken Access Control Vulnerability6.5 Medium
- ancorathemes kids planetWordPress Kids Planet theme <= 2.2.14 - PHP Object Injection Vulnerability9.8 Critical
- pagaleve pix 4x sem juros - pagaleveWordPress Pix 4x sem juros - Pagaleve plugin <= 1.6.9 - PHP Object Injection Vulnerability9.8 Critical
- goodlayers tourmasterWordPress Tourmaster plugin <= 5.3.8 - Local File Inclusion vulnerability8.1 High
- intellian technologies iridium certus 700Injection vulnerability in Iridium Certus 7006.1 Medium
- intellian technologies iridium certus 700Injection vulnerability in Iridium Certus 7006.3 Medium
- intellian technologies iridium certus 700Injection vulnerability in Iridium Certus 7006.9 Medium
- tesi gandia integra totalSQL injection vulnerability in Gandia Integra Total8.7 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabUser Interface (UI) Misrepresentation of Critical Information in GitLab3.5 Low
- shopxozongzhige ShopXO ZIP File Payment.php Upload unrestricted upload5.3 Medium
- fujian kelixun, kirisun fujian kelixun +1 moreFujian Kelixun xml_cdr_details.php sql injection5.3 Medium
- solidwp solid mail – smtp email and logging made by solidwpSolid Mail – SMTP email and logging made by SolidWP <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting via Email7.2 High
- fujian kelixunFujian Kelixun Filename fax_view.php os command injection6.9 Medium
- tozed zlt w51TOZED ZLT W51 Service Port 7777 heap inspection6.9 Medium
- manageengine adaudit plus, zohocorp manageengine adaudit plus +1 moreSQL Injection8.3 High
- manageengine adaudit plus, zohocorp manageengine adaudit plus +1 moreSQL Injection8.3 High
- jan syski megabipLow token entropy in MegaBIP9.1 Critical
- jan syski megabipStored XSS in MegaBIP4.8 Medium
- jan syski megabipSQL Injection in MegaBIP8.6 High
- studio fabryka dobrycmsReflected XSS in DobryCMS5.1 Medium
- abb aspect-enterprise, matrix series, nexus series +2 moreStored Absolute Path Traversal8.4 High
- digital arts inc. i-filterThe optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper pattern...6.9 Medium
- tablepress, tobiasbg tablepress – tables in wordpress made easy +1 moreTablePress <= 3.1.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters6.4 Medium
- tournamatchTournamatch <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- dynamixsoftware printershare, mobile dynamix printershare mobile print +1 moreKL-001-2025-005: Mobile Dynamix PrinterShare Mobile Print Double-Free Memory Write8.0 High
- dynamixsoftware printershare, mobile dynamix printershare mobile print +1 moreKL-001-2025-003: Mobile Dynamix PrinterShare Mobile Print Gmail Oauth Token Disclosure9.1 Critical
- dynamixsoftware printershare, mobile dynamix printershare mobile print +1 moreKL-001-2025-004: Mobile Dynamix PrinterShare Mobile Print Out-of-bounds Write9.8 Critical
quickjsOSS-FuzzUse-of-uninitialized-value in JS_FreeRuntimeNo scorecheckstyleOSS-FuzzSecurity exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.exprNo score- ecovacs mobile and android applicationDisclosure of Alibaba (OSS) Keys In Ecovacs Home Android and iOS Mobile Applications4.7 Medium
- strangebee thehiveA Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3...6.8 Medium
- strangebee thehiveA Cross-Site Request Forgery (CSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3...5.9 Medium
- strangebee thehiveA Server-Side Request Forgery (SSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3...4.6 Medium
- strangebee thehiveAn e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11,...6.9 Medium
- bos ip cameraA SQL Injection issue in the request body processing in BOS IPCs with firmware 21.45.8.2.2_220219...4.3 Medium
- artifex ghostscriptgs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript through 10.05.0 lacks...4.0 Medium
- opendcimopenDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are...5.4 Medium
- cyberdavaAn issue was discovered in CyberDAVA before 1.1.20. A privilege escalation vulnerability allows a...6.4 Medium
- dlink dir-605l firmware, dir-816l firmware +1 moreHardcoded credentials in the Telnet service in D-Link DIR-605L v2.13B01 and DIR-816L v2.06B01...6.5 Medium
- prasathmani tiny file managerA stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of...6.1 Medium
- phpgurukul hospital management systemAn issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary...9.8 Critical
- anujk305 medical card generation systemMultiple stored cross-site scripting (XSS) vulnerabilities in the component /admin/card-bwdates...5.4 Medium
- anujk305 medical card generation systemMultiple stored cross-site scripting (XSS) vulnerabilities in the component /mcgs/admin/contactus...4.8 Medium
- phpgurukul student management systemPHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple...6.5 Medium
- Show moreLoading…