Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2025

216 records · 19 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 3 of 3

  • CVE-2025-5287
    31Monitor

    Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 2%

    erumfaham · likes and dislikes pluginMay 28, 2025

  • CVE-2025-5298
    27Monitor

    Campcodes Online Hospital Management System betweendates-detailsreports.php sql injection

    MediumCVSS 6.9Proof of conceptEPSS 1%

    campcodes · online hospital management systemMay 28, 2025

  • CVE-2025-48927
    60This week

    The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploit

    MediumCVSS 5.3KEVWeaponizedEPSS 12%

    smarsh · telemessageMay 28, 2025

  • CVE-2025-48928
    46Plan

    The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in

    MediumCVSS 4.0KEVWeaponizedEPSS 0%

    smarsh · telemessageMay 28, 2025

  • CVE-2025-1461
    22Monitor

    Vuetify XSS through 'eventMoreText' prop of VCalendar

    MediumCVSS 5.6Proof of conceptEPSS 0%

    May 28, 2025

  • CVE-2025-48734
    36Monitor

    Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

    HighCVSS 8.8Proof of conceptEPSS 2%

    apache · commons beanutilsMay 28, 2025

  • CVE-2025-48047
    42Plan

    MICI Network Co. Ltd. NetFax Server Command Injection

    CriticalCVSS 9.4No exploitEPSS 16%

    mici network co. ltd. · netfax serverMay 29, 2025

  • CVE-2025-46078
    21Monitor

    HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server

    MediumCVSS 5.3Proof of conceptEPSS 0%

    huocms · huocmsMay 29, 2025

  • CVE-2025-46080
    21Monitor

    HuoCMS V3.5.1 has a File Upload Vulnerability.

    MediumCVSS 5.3Proof of conceptEPSS 0%

    huocms · huocmsMay 29, 2025

  • CVE-2025-29632
    21Monitor

    Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handl

    MediumCVSS 5.4Proof of conceptEPSS 0%

    free5gc · free5gcMay 29, 2025

  • CVE-2025-46701
    30Monitor

    Apache Tomcat: Security constraint bypass for CGI scripts

    HighCVSS 7.3Proof of conceptEPSS 3%

    apache · tomcatMay 29, 2025

  • CVE-2025-48757
    37Monitor

    An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    lovable · lovableMay 29, 2025

  • CVE-2024-7097
    17Monitor

    Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup

    MediumCVSS 4.3Proof of conceptEPSS 0%

    wso2 · api managerMay 30, 2025

  • CVE-2025-5054
    18Monitor

    Race Condition in Canonical Apport

    MediumCVSS 4.7Proof of conceptEPSS 0%

    canonical · apportMay 30, 2025

  • CVE-2025-2502
    34Monitor

    An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.

    HighCVSS 8.5Proof of conceptEPSS 0%

    lenovo · pcmanagerMay 30, 2025

  • CVE-2025-4631
    39Monitor

    Profitori 2.0.6.0 - 2.1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via stocktend_object Endpoint

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    unitybusinesstechnology · the e-commerce erp: purchasing, inventory, fulfillment, manufacturing, bom, accounting, sales analysisMay 31, 2025