Skip to content
OpenAdvisories

Archive

15 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /15 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 5.4
    CVE-2025-4720 Public exploit

    SourceCodester Student Result Management System drop_student.php path traversal

    A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file academic/core/drop_student.php. The manipulation of the argument img leads to path traversa…

    SourceCodester Student Result Management System
  • Critical 9.1
    CVE-2025-47928 Public exploit

    Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`

    Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by a…

    spotipy-dev spotipy spotipy Ubuntu
  • High 7.3
    CVE-2023-7231 Public exploit

    illi Link Party! <= 1.0 - Unauthenticated Arbitrary Link Deletion

    The illi Link Party! WordPress plugin through 1.0 lacks proper access controls, allowing unauthenticated visitors to delete links.

    Web / CMS
  • High 7.8
    CVE-2025-47161 Public exploit

    Microsoft Defender for Endpoint Elevation of Privilege Vulnerability

    Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.

    Microsoft Microsoft Defender for Endpoint for Linux Linux
  • Medium 6.4
    CVE-2025-4126 Public exploit

    EG-Series <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes in the short…

    emmanuelg EG-Series Web / CMS