Skip to content
OpenAdvisories

Archive

May 2025

Vulnerabilities first published in this month (UTC), newest first.

← April 2025 2025 / May June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

49 results · Clear filters · Feed

  • High 8.1
    CVE-2025-47533 Public exploit

    WordPress Graphina plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) to Local File Inclusion vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design Graphina graphina-elementor-charts-and-graphs allows PHP Local File Inclusion.This issue affects Graphina: from n/a through <= 3.0.4.

    Iqonic Design Graphina
  • High 7.5
    CVE-2025-29448 Public exploit

    Easy!Appointments Denial of Service (DoS)

    Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability.

    alextselegidis/easyappointments Packagist
  • High 7.1
    CVE-2025-46820 Public exploit

    phpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifact

    phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the c…

    phpgt Dom
  • High 7.5
    CVE-2025-2011 Public exploit Scanner template EPSS 47%

    Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter

    The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation…

    Averta Depicter — Popup & Slider Builder Web / CMS
  • High 7.3
    CVE-2025-46731 Public exploit

    Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

    Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CH…

    craftcms cms craftcms/cms Packagist
  • High 7.3
    CVE-2025-4255 Public exploit

    PCMan FTP Server RMD Command buffer overflow

    A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RMD Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been…

    PCMan FTP Server
  • High 8.1
    CVE-2025-28062 Public exploit

    A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allo…

  • High 8.8
    CVE-2024-11142 Public exploit

    CSRF in Gosoft Software's Proticaret E-Commerce

    Cross-Site Request Forgery (CSRF) vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05.

    Gosoft Software Proticaret E-Commerce
  • High 8.8
    CVE-2025-1304 Public exploit

    NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload

    The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated att…

    spicethemes NewsBlogger Web / CMS