Skip to content
OpenAdvisories

Archive

May 2025

Vulnerabilities first published in this month (UTC), newest first.

← April 2025 2025 / May June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

128 results · Clear filters · Feed

  • High 7.3
    CVE-2025-46731 Public exploit

    Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

    Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CH…

    craftcms cms craftcms/cms Packagist
  • High 7.3
    CVE-2025-4255 Public exploit

    PCMan FTP Server RMD Command buffer overflow

    A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RMD Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been…

    PCMan FTP Server
  • High 8.1
    CVE-2025-28062 Public exploit

    A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allo…

  • Critical 9.8
    CVE-2025-2812 Public exploit

    SQLi in Mydata Informatics' Ticket Sales Automation

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mydata Informatics Ticket Sales Automation allows Blind SQL Injection. This issue affects Ticket Sales Automation: before 03.04.2025 (DD.MM.YYYY).

    Mydata Informatics Ticket Sales Automation
  • High 8.8
    CVE-2024-11142 Public exploit

    CSRF in Gosoft Software's Proticaret E-Commerce

    Cross-Site Request Forgery (CSRF) vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05.

    Gosoft Software Proticaret E-Commerce
  • Medium 5.0
    CVE-2025-47226 Public exploit

    Grokability Snipe-IT has incorrect authorization for accessing asset information

    Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

    Snipeitapp Snipe-IT snipe/snipe-it Packagist
  • Critical 9.8
    CVE-2025-27007 Public exploit Scanner template EPSS 54%

    WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through <= 1.0.82.

    Brainstorm Force OttoKit
  • High 8.8
    CVE-2025-1304 Public exploit

    NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload

    The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated att…

    spicethemes NewsBlogger Web / CMS