Skip to content
OpenAdvisories

Archive

12 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /12 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

59 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-46745

    Improper Privilege Management

    An authenticated user without user-management permissions could view other users account information.

    Schweitzer Engineering Laboratories SEL Blueframe OS
  • Medium 4.3
    CVE-2025-46742

    Improper Access Control

    Users who were required to change their password could still access system information before changing their password

    Schweitzer Engineering Laboratories SEL Blueframe OS
  • Medium 5.7
    CVE-2025-46741

    Improper Privilege Management

    A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.

    Schweitzer Engineering Laboratories SEL Blueframe OS
  • Medium 6.6
    CVE-2025-46738

    Deserialization of Untrusted Data

    An authenticated attacker can maliciously modify layout data files in the SEL-5033 installation directory to execute arbitrary code.

    Schweitzer Engineering Laboratories SEL-5033 acSELerator RTAC Software
  • Medium 6.5
    CVE-2025-47578

    WordPress BNS Twitter Follow Button plugin <= 0.3.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edward Caissie BNS Twitter Follow Button bns-twitter-follow-button allows DOM-Based XSS.This issue affects BNS Twitter Follow Button: from n/a through <= 0.3…

    Edward Caissie BNS Twitter Follow Button
  • Medium 5.1
    CVE-2025-40627

    Reflected Cross-Site Scripting (XSS) in AbanteCart

    Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, suc…

    AbanteCart AbanteCart
  • Medium 5.1
    CVE-2025-40626

    Reflected Cross-Site Scripting (XSS) in AbanteCart

    Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, suc…

    AbanteCart AbanteCart
  • Medium 6.3
    CVE-2025-47271

    OZI-Project/ozi-publish Code Injection vulnerability

    The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13.2 through 1.13.5, potentially untrusted data flows into PR creation logic. A malicious actor could c…

    OZI-Project publish OZI-Project/publish GitHub Actions
  • Medium 6.1
    CVE-2025-22247

    Insecure file handling vulnerability

    VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM.

    open-vm-tools open-vm-tools open-vm-tools Debian Ubuntu Azure Linux
  • Medium 6.1
    CVE-2025-41393 Scanner template

    Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which imple…

    Ricoh Company Konica Minolta Japan Multiple laser printers and MFPs which implement Web Image Monitor Multiple MFPs which implement Web Image Monitor
  • Medium 6.5
    CVE-2025-4560

    Netvision ISOinsight - Missing Authentication

    The ISOinsight from Netvision has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access certain system functions. These functions include viewing the administrator list, viewing and editing IP settings, and uploading file…

    Netvision ISOinsight
  • Medium 6.8
    CVE-2025-3649

    LightPress Lightbox < 2.3.4 - Contributor+ Stored XSS

    The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks.

    Web / CMS
  • Medium 5.9
    CVE-2025-3597

    Firelight Lightbox < 2.3.15 - Contributor+ Stored XSS

    The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users,…

    Web / CMS
  • Medium 5.4
    CVE-2023-34732 Public exploit

    An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c …

  • Medium 6.5
    CVE-2024-55466 Public exploit

    An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard…

  • Medium 6.1
    CVE-2025-46611

    Cross Site Scripting vulnerability in ARTEC EMA Mail v6.92 allows an attacker to execute arbitrary code via a crafted s…

  • Medium 6.5
    CVE-2025-44176 EPSS 11%

    Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function.

  • Medium 5.4
    CVE-2025-44175

    Tenda AC10 v4 V16.03.10.13 is vulnerable to Buffer Overflow in the GetParentControlInfo function.

  • Medium 6.1
    CVE-2025-26841

    Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code…