Skip to content
OpenAdvisories

Archive

28 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /28 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 5.6
    CVE-2025-1461 Public exploit

    Vuetify XSS through 'eventMoreText' prop of VCalendar

    Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component in Vuetify allows unsanitized HTML to be inserted into the page. This can lead to a  Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss  atta…

  • High 8.8
    CVE-2025-48734 Public exploit

    Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

    Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

    Apache Software Foundation Apache Commons BeanUtils 1.x Apache Commons BeanUtils 2.x druid Debian Ubuntu Azure Linux Wolfi Maven
  • High 7.3
    CVE-2025-5298 Public exploit

    Campcodes Online Hospital Management System betweendates-detailsreports.php sql injection

    A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. Affected is an unknown function of the file /admin/betweendates-detailsreports.php. The manipulation of the argument fromdate/todate leads to sql …

    Campcodes Online Hospital Management System
  • High 7.5
    CVE-2025-5287 Public exploit Scanner template

    Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

    The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi…

    erumfaham Likes and Dislikes Plugin Web / CMS
  • Medium 4.8
    CVE-2025-5025 Public exploit

    No QUIC certificate pinning with wolfSSL

    libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, faili…

    curl curl curl curl Debian Azure Linux Alpine