Skip to content
OpenAdvisories

Archive

6 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /6 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-0855

    PGS Core <= 5.8.0 - Unauthenticated PHP Object Injection

    The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via deserialization of untrusted input in the 'import_header' function. This makes it possible for unauthenticated attackers to inject a PHP Ob…

    Potenza Global Solutions PGS Core Web / CMS
  • Critical 10.0
    CVE-2025-47419

    Non-Secure Access

    Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords. This issue…

    Crestron Automate VX
  • Critical 9.3
    CVE-2025-46572

    passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping

    passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLRes…

    auth0 passport-wsfed-saml2 passport-wsfed-saml2 npm
  • Critical 9.1
    CVE-2024-12225

    Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass

    A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide…

    Red Hat Red Hat build of Quarkus
  • Critical 9.4
    CVE-2025-46816 Public exploit

    goshs route not protected, allows command execution

    goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c…

    patrickhener goshs github.com/patrickhener/goshs Go
  • Critical 9.1
    CVE-2025-25014 Public exploit EPSS 22%

    Kibana arbitrary code execution via prototype pollution

    A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

    Elastic Kibana
  • Critical 9.3
    CVE-2025-4041

    Use of Hard-coded Credentials Optigo Networks ONS NC600

    In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions.

    Optigo Networks ONS NC600
  • Critical 9.3
    CVE-2025-40625

    Multiple vulnerabilities in TCMAN's GIM

    Unrestricted file upload in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to upload any file within the server, even a malicious file to obtain a Remote Code Execution (RCE).

    TCMAN GIM
  • Critical 9.3
    CVE-2025-40624

    Multiple vulnerabilities in TCMAN's GIM

    SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the …

    TCMAN GIM
  • Critical 9.3
    CVE-2025-40623

    Multiple vulnerabilities in TCMAN's GIM

    SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the …

    TCMAN GIM
  • Critical 9.3
    CVE-2025-40622

    Multiple vulnerabilities in TCMAN's GIM

    SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the …

    TCMAN GIM
  • Critical 9.3
    CVE-2025-40621

    Multiple vulnerabilities in TCMAN's GIM

    SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the …

    TCMAN GIM
  • Critical 9.3
    CVE-2025-40620

    Multiple vulnerabilities in TCMAN's GIM

    SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the …

    TCMAN GIM
  • Critical 9.8
    CVE-2025-45491

    Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS fu…

  • Critical 9.8
    CVE-2025-44899

    There is a stack overflow vulnerability in Tenda RX3 V1.0br_V16.03.13.11 In the fromSetWifiGusetBasic function of the w…

  • Critical 9.8
    CVE-2025-44073

    SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.