CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- project team tmall demo, tmall demo +1 moreTmall Demo uploadProductImage unrestricted upload5.1 Medium
- sangfor atrust, 零信任访问控制系统 atrust +1 moreSangfor 零信任访问控制系统 aTrust MSASN1.dll uncontrolled search path7.3 High
- scriptandtools real-estate-website-in-php, real estate management system +1 moreScriptAndTools Real-Estate-website-in-PHP Admin Login Panel admin sql injection6.9 Medium
- teledyne flir ax8, flir ax8 firmware +1 moreTeledyne FLIR AX8 prod.php cross site scripting5.1 Medium
- teledyne flir ax8, flir ax8 firmware +1 moreTeledyne FLIR AX8 settingsregional.php setDataTime command injection8.7 High
- sony snc-cs3n, snc-ds10, snc-m1 +4 more +6 moreSony SNC-M1 Administrative Interface default credentials9.2 Critical
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter4.7 Medium
- emagicone store manager for woocommerceeMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image()9.8 Critical
- emagicone store manager for woocommerceeMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Deletion9.1 Critical
- emagicone store manager for woocommerceeMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()8.1 High
- emagicone store manager for woocommerceeMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Read5.9 Medium
- edgarrojas smart forms – when you need more than just a contact formSmart Forms <= 2.6.98 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- 4stats4stats <= 2.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link6.4 Medium
- crates scsirSCSIR has a Potential Unsound Issue in WriteSameCommand2.9 Low
- blyssprivacy spiral-rs, sdk +1 moreIn the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type).2.9 Low
- fractalfir memory pagesmemory_pages division by zero2.9 Low
- obsidiandynamics anodeIn the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock.2.9 Low
- forestryks process-sync, process-sync-rs +1 moreProcess Sync has a Potential Unsound Issue in SharedMutex2.9 Low
- tickbh process lock, processlock +1 moreprocess_lock has a Potential Unsound issue in unlock2.9 Low
- emlog, emlog pro +1 moreEmlog Pro api_controller.php sql injection6.9 Medium
- tenable network monitor, nessus network monitor +1 moreImproper Access Control leads to Local Privilege Escalation7.8 High
- tenable network monitor, nessus network monitor +1 moreImproper Access Control leads to Local Priviledge Escalation7.0 High
amd64-microcodeTuxCareUpdate of amd64-microcodeNo score- schule111 schule, schule school management system +1 moreSchule Missing Rate Limiting on OTP Email Requests – Susceptible to Abuse & DoS6.6 Medium
- dnnsoftware dnn.platform, dotnetnuke +1 moreDnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit mode6.0 Medium
- dnnsoftware dnn.platform, dotnetnuke +1 moreDnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inline6.1 Medium
- dnnsoftware dnn.platform, dotnetnuke +1 moreDnn.Platform's Site Import could use an external source with a crafted request3.5 Low
- open-emr openemrOpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics7.6 High
- open-emr openemrOpenEMR doesn't log password administration properly5.4 Medium
amd64-microcodeTuxCareUpdate of amd64-microcodeNo score- open-emr openemrOpenEMR Stored XSS via Patient Name Field in Procedure Orders7.6 High
- siemens sipass integratedA vulnerability has been identified in SiPass integrated (All versions < V2.95.3.18). Affected...8.7 High
- siemens building x - security manager edge controller (acc-ap), sipass integrated ac5102 \(acc-g2\) firmware, sipass integrated acc-ap firmware +2 moreA vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions), SiPass...5.9 Medium
- marked project markedRegular Expression Denial of Service (ReDoS) in markedjs/marked6.9 Medium
- easycorp zentao, easysoft zentaopms +1 moreeasysoft zentaopms Editor index.php edit deserialization5.3 Medium
- freefloat ftp serverFreeFloat FTP Server MGET Command buffer overflow6.9 Medium
- freefloat ftp serverFreeFloat FTP Server TYPE Command buffer overflow6.9 Medium
- grafanaAn access control vulnerability was discovered in Grafana OSS where an Organization administrator...5.5 Medium
- freefloat ftp serverFreeFloat FTP Server VERBOSE Command buffer overflow6.9 Medium
- freefloat ftp serverFreeFloat FTP Server STATUS Command buffer overflow6.9 Medium
- themeton dashWordPress Dash <= 1.3 - PHP Object Injection Vulnerability9.8 Critical
- techspawn whatscart - whatsapp abandoned cart recovery, order notifications, chat box, otp for woocommerceWordPress WhatsCart plugin <= 1.1.0 - SQL Injection vulnerability9.3 Critical
- quantumcloud kbx pro ultimateWordPress KBx Pro Ultimate plugin < 8.0.5 - Arbitrary File Deletion Vulnerability7.7 High
- gavias vizeon - business consultingWordPress Vizeon theme < 1.2.1 - Local File Inclusion vulnerability8.1 High
- apustheme capieWordPress Capie theme <= 1.0.40 - Local File Inclusion Vulnerability8.1 High
- smartcms bus ticket booking with seat reservation for woocommerceWordPress Bus Ticket Booking with Seat Reservation for WooCommerce plugin <= 1.7 - SQL Injection vulnerability9.3 Critical
- themeton hotstar – multi-purpose business themeWordPress HotStar – Multi-Purpose Business Theme <= 1.4 - PHP Object Injection Vulnerability9.8 Critical
- themeton the businessWordPress The Business <= 1.6.1 - PHP Object Injection Vulnerability9.8 Critical
- ancorathemes umbertoWordPress Umberto theme <= 1.2.8 - PHP Object Injection Vulnerability9.8 Critical
- Show moreLoading…