Skip to content
OpenAdvisories

Archive

30 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /30 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

53 results · Clear filters · Feed

  • Medium 6.1
    CVE-2025-48485

    FreeScout Vulnerable to Stored XSS

    FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data when an authenticated user update…

    freescout-help-desk freescout
  • Medium 5.3
    CVE-2025-48889

    Gradio Allows Unauthorized File Copy via Path Manipulation

    Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Prior to version 5.31.0, an arbitrary file copy vulnerability in Gradio's flagging feature allo…

    gradio-app gradio gradio PyPI
  • Medium 6.1
    CVE-2025-4429

    WordPress Gearside Developer Dashboard <= 1.0.72 - Reflected XSS

    The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

    Web / CMS
  • Medium 6.6
    CVE-2025-48490

    Laravel Rest Api has a Search Validation Bypass

    Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across mul…

    Lomkit laravel-rest-api lomkit/laravel-rest-api Packagist
  • Medium 5.3
    CVE-2025-4659

    Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.4 - Unauthenticated Full Path Disclosure

    The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to retr…

    CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms Web / CMS
  • Medium 6.4
    CVE-2025-5259

    Minimal Share Buttons <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter

    The Minimal Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authentica…

    gonzomir Minimal Share Buttons Web / CMS
  • Medium 4.6
    CVE-2025-48484

    FreeScout Vulnerable to Stored XSS

    FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data in the conversation POST data bod…

    freescout-help-desk freescout
  • Medium 6.3
    CVE-2025-48483

    FreeScout Stored XSS leads to CSRF

    FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data during mail signature sanitizatio…

    freescout-help-desk freescout
  • Medium 5.3
    CVE-2025-48482

    FreeScout Has Business Logic Errors

    FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, there is a mass assignment vulnerability. The Customer object is updated using the fill() method, which processes fields such as channel and channel_id. However, the fill(…

    freescout-help-desk freescout
  • Medium 6.1
    CVE-2025-48481

    FreeScout Has Business Logic Errors

    FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invite_hash, can exploit this vulnerability to self-activate their account, despite it being blocked or deleted…

    freescout-help-desk freescout
  • Medium 5.3
    CVE-2025-48381

    CVAT has information disclosure via browsable API

    Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0, an authenticated CVAT user may be able to retrieve the IDs and names of all tasks, projects, labels…

    cvat-ai cvat
  • Medium 5.1
    CVE-2024-12224

    idna accepts Punycode labels that do not produce any non-ASCII when decoded

    Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to anoth…

    servo rust-url linkerd2-controller linkerd2-web Debian Ubuntu Alpine Wolfi crates.io
  • Medium 5.9
    CVE-2025-44612

    Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control infor…