Skip to content
OpenAdvisories

Archive

24 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /24 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-5133

    Tmall Demo Search Box cross site scripting

    A vulnerability classified as problematic has been found in Tmall Demo up to 20250505. Affected is an unknown function of the component Search Box. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has b…

    Tmall Demo
  • Medium 4.3
    CVE-2025-5132

    Tmall Demo logout cross-site request forgery

    A vulnerability was found in Tmall Demo up to 20250505. It has been rated as problematic. This issue affects some unknown processing of the file tmall/admin/account/logout. The manipulation leads to cross-site request forgery. The attack may be initiated remo…

    Tmall Demo
  • Medium 4.7
    CVE-2025-5131

    Tmall Demo uploadCategoryImage unrestricted upload

    A vulnerability was found in Tmall Demo up to 20250505. It has been declared as critical. This vulnerability affects the function uploadCategoryImage of the file tmall/admin/uploadCategoryImage. The manipulation of the argument File leads to unrestricted uplo…

    Tmall Demo
  • Medium 4.7
    CVE-2025-5130

    Tmall Demo uploadProductImage unrestricted upload

    A vulnerability was found in Tmall Demo up to 20250505. It has been classified as critical. This affects the function uploadProductImage of the file tmall/admin/uploadProductImage. The manipulation of the argument File leads to unrestricted upload. It is poss…

    Tmall Demo
  • Medium 4.7
    CVE-2025-4223

    Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter

    The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘login_url’ parameter in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escapi…

    Softaculous Page Builder: Pagelayer – Drag and Drop website builder Web / CMS
  • Medium 5.9
    CVE-2025-4602 Public exploit

    eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Read

    The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Reads in all versions up to, and including, 1.2.5 via the get_file() function. This makes it possible for unauthenticated attackers to read the contents of arbitr…

    eMagicOne eMagicOne Store Manager for WooCommerce Web / CMS
  • Medium 6.1
    CVE-2025-3869

    4stats <= 2.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The 4stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the stats/stats.php page. This makes it possible for unauthenticated attackers to …

    4stats 4stats Web / CMS
  • Medium 4.4
    CVE-2025-5055

    Smart Forms <= 2.6.98 - Authenticated (Admin+) Stored Cross-Site Scripting

    The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.98 due to insufficient input sanitization and output escaping. This ma…

    Edgar Rojas Smart Forms – when you need more than just a contact form Web / CMS
  • Medium 6.4
    CVE-2024-13427

    Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link

    The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping…

    Softaculous Page Builder: Pagelayer – Drag and Drop website builder Web / CMS