Skip to content
OpenAdvisories

Archive

21 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /21 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

59 results · Clear filters · Feed

  • Medium 5.4
    CVE-2025-4105

    Splitit <= 4.2.8 - Missing Authorization to Multiple Administrative Actions

    The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the 'splitIt-flexfields-payment-gateway.php' file in all versions up to, and including, 4.2.8. This makes it possible …

    splitit Splitit Web / CMS
  • Medium 6.4
    CVE-2025-4611 Public exploit

    Slim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs Shortcode

    The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slim_seo_breadcrumbs shortcode in all versions up to, and including, 4.5.3 due to insufficient input sanitization and outpu…

    rilwis Slim SEO – A Fast & Automated SEO Plugin For WordPress Web / CMS
  • Medium 6.4
    CVE-2025-3781

    Raisely Donation Form <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form Shortcode

    The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied …

    creativefreedomau Raisely Donation Form Web / CMS
  • Medium 6.9
    CVE-2021-25262

    Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.

    Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.

    Yandex Browser
  • Medium 6.8
    CVE-2025-4949

    XXE vulnerability in Eclipse JGit

    In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are v…

    Eclipse JGit Eclipse JGit thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2025-4969

    Libsoup: off-by-one out-of-bounds read in find_boundary() in soup-multipart.c

    A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming …

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • Medium 4.3
    CVE-2025-5013

    HkCms Search index.html cross site scripting

    A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.html of the component Search. The manipulation of the argument keyword leads to cross site scripting.…

  • Medium 6.1
    CVE-2024-57529

    Cross Site Scripting vulnerability in Jeppesen JetPlanner Pro v.1.6.2.20 allows a remote attacker to execute arbitrary …

  • Medium 6.5
    CVE-2024-42922

    AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.

  • Medium 5.5
    CVE-2024-56428 Public exploit

    The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the …

  • Medium 6.8
    CVE-2025-48204

    The Backup Plus extension for TYPO3 (ns_backup) allows command injections

    The ns_backup extension through 13.0.0 for TYPO3 allows command injection.

    TYPO3 ns backup extension nitsan/ns-backup Packagist
  • Medium 6.4
    CVE-2025-48203

    [clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability

    The cs_seo extension through 9.2.0 for TYPO3 allows XSS.

    TYPO3 cs seo extension clickstorm/cs-seo Packagist
  • Medium 5.3
    CVE-2025-48202

    The femanager TYPO3 extension allows Insecure Direct Object Reference

    The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.

    TYPO3 femanager extension in2code/femanager Packagist
  • Medium 6.1
    CVE-2025-48206

    The Backup Plus extension for TYPO3 (ns_backup) allows XSS

    The ns_backup extension through 13.0.0 for TYPO3 allows XSS.

    TYPO3 ns backup extension nitsan/ns-backup Packagist
  • Medium 6.1
    CVE-2025-45755

    A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the …

  • Medium 5.4
    CVE-2025-45754

    A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to in…

  • Medium 6.5
    CVE-2025-44892

    FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter in the web_rmon_alarm_…

  • Medium 6.5
    CVE-2025-44895

    FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4…

  • Medium 6.5
    CVE-2025-25539

    Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information vi…