Skip to content
OpenAdvisories

Archive

6 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /6 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

56 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-4337

    AHAthat Plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletion

    The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the aha_plugin_page() function. This makes it possible for unauthenticated a…

    mitchelllevy AHAthat Plugin Web / CMS
  • Medium 4.7
    CVE-2025-4310

    itsourcecode Content Management System add_topic.php unrestricted upload

    A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. This affects an unknown part of the file /admin/add_topic.php?category=BBS. The manipulation of the argument Cover Image leads to unrestricted upload. It is p…

    itsourcecode Content Management System
  • Medium 5.3
    CVE-2025-3609

    Reales WP STPT <= 2.1.2 - Unauthorized User Registration

    The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'reales_user_signup_form' AJAX action not verifying if user registration is enabled, prior to registering a…

    pixel_prime Reales WP STPT Web / CMS
  • Medium 6.3
    CVE-2025-4305

    kefaming mayi File.php upload unrestricted upload

    A vulnerability has been found in kefaming mayi up to 1.3.9 and classified as critical. This vulnerability affects the function Upload of the file app/tools/controller/File.php. The manipulation of the argument File leads to unrestricted upload. The attack ca…

    kefaming mayi
  • Medium 6.2
    CVE-2024-39442

    In sprd ssense service, there is a possible missing permission check. This could lead to local information disclosure w…

    Unisoc (Shanghai) Technologies SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300
  • Medium 6.7
    GHSA-pv22-fqcj-7xwh

    Inspektor Gadget Security Policies Can be Bypassed

    Security policies like [`allowed-gadgets`](https://inspektor-gadget.io/docs/latest/reference/restricting-gadgets), [`disallow-pulling`](https://inspektor-gadget.io/docs/latest/reference/disallow-pulling), [`verify-image`](https://inspektor-gadget.io/docs/late…

    github.com/inspektor-gadget/inspektor-gadget Go
  • Medium 5.1
    CVE-2023-33770

    Real Estate Management System v1.0 was discovered to contain a SQL injection vulnerability via the message parameter at…

  • Medium 5.5
    CVE-2025-45250 Public exploit

    MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/…

  • Medium 6.5
    CVE-2025-45488 EPSS 12%

    Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS fu…

  • Medium 6.5
    CVE-2025-45492

    Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function.

  • Medium 6.5
    CVE-2025-45490

    Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS fu…

  • Medium 6.5
    CVE-2025-45489

    Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS fu…

  • Medium 6.5
    CVE-2025-45487 EPSS 12%

    Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection f…

  • Medium 6.5
    CVE-2025-44900

    In Tenda RX3 V1.0br_V16.03.13.11 in the GetParentControlInfo function of the web url /goform/GetParentControlInfo, the …

  • Medium 6.5
    CVE-2025-26262

    An issue in the component /internals/functions of R-fx Networks Linux Malware Detect v1.6.5 allows attackers to escalat…

  • Medium 5.6
    CVE-2025-47256 Public exploit

    Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha for…

    libxmp libxmp libxmp libxmp Debian Ubuntu