Web Application Detections Published in May 2025

Hitesh Kadu
Hitesh Kadu, Senior Web Application Security Signatures Engineer
- 6 min read

Table of Contents

In May, Qualys Web Application Scanning released QIDs targeting vulnerabilities in several widely used software products and frameworks, including:

Vue, React Router, WordPress, Tornado, OpenSSL, SAP, Apache, SeaCMS, XWiki, Ivanti, Python, Traefik, YesWiki, Kibana, GitLab, Zimbra, JetBrains, Ollama, Jenkins, Adobe, Fortinet, Microsoft, DeepJavaLibrary, Atlassian, ZenML, Versa, Grafana, Moodle, vBulletin, Invision Community, WSO2, and Gradio.

The QIDs released to detect the vulnerabilities in these frameworks are listed below.

Details about the following QIDs can be found in our knowledge base. Please review reports of the scanned applications for these detections and, if any are identified, follow the steps provided in the knowledge base to ensure applications are protected against the reported vulnerabilities. Immediate resolution of these vulnerabilities as soon as they are detected should be a priority for all organizations. If not addressed, these vulnerabilities can pose security risks, such as breaches, unauthorized access, and various malicious activities.

List of QIDs Released

QIDTitle
151055Vue Cross-site Scripting Vulnerability (CVE-2024-6783)
151056React Router URL Spoofing Vulnerability (CVE-2025-31137)
151057React Router Cache Poisoning Vulnerability (CVE-2025-43864)
151058React Router Pre-rendered Data Spoofing Vulnerability (CVE-2025-43865)
152993WordPress Download Manager Plugin: Arbitrary File Deletion Vulnerability (CVE-2025-3404)
520049Tornado Denial of Service Vulnerability (CVE-2025-47287)
520050Open Secure Sockets Layer (OpenSSL) Improper Certificate Validation Vulnerability (CVE-2025-4575)
530031SAP NetWeaver Visual Composer Development Server Missing Authorization Vulnerability (CVE-2025-31324)
530032WordPress NewsBlogger Theme: Arbitrary File Upload Vulnerability (CVE-2025-1304)
530033Apache Solr Misconfigured Authentication
530034WordPress SureTriggers Plugin: Privilege Escalation Vulnerability (CVE-2025-27007)
530035WordPress Job Listings Plugin: Privilege Escalation Vulnerability (CVE-2025-3918)
530036SeaCMS SQL Injection Vulnerability (CVE-2025-44072)
530037SeaCMS SQL Injection Vulnerability (CVE-2025-44074)
530038WordPress External Image Replace Plugin: Arbitrary File Upload Vulnerability (CVE-2025-4279)
530039WordPress Depicter Plugin: SQL Injection Vulnerability (CVE-2025-2011)
530040WordPress Page View Count Plugin: Missing Authorization Vulnerability (CVE-2025-2816)
530041WordPress Projectopia Plugin: Missing Authorization Vulnerability (CVE-2025-3952)
530042SeaCMS Remote Code Execution (RCE) Vulnerability (CVE-2025-44071)
530043WordPress Frontend Login and Registration Blocks Plugin: Privilege Escalation Vulnerability (CVE-2025-3605)
530044WordPress Drag and Drop Multiple File Upload for WooCommerce Plugin: Arbitrary File Upload Vulnerability (CVE-2025-4403)
530045WordPress WPBookit Plugin: Privilege Escalation Vulnerabilities (CVE-2025-3810,CVE-2025-3811)
530046Apache ActiveMQ Denial of Service (DoS) Vulnerability (CVE-2025-27533)
530047FoxCMS File Deletion Vulnerability (CVE-2025-45238)
530048XWiki Cross-Site Scripting (XSS) and Privilege Escalation Vulnerability (CVE-2025-32974)
530049Ivanti Cloud Services Application (CSA) Default Credentials Privilege Escalation Vulnerability (CVE-2025-22460)
530051Python h11 HTTP Request Smuggling Vulnerability (CVE-2025-43859)
530052Traefik Path Traversal Vulnerability (CVE-2025-32431)
530053YesWiki Unauthenticated Archive Creation and Download Vulnerability (CVE-2025-46348)
530054Kibana Prototype Pollution Vulnerability (CVE-2025-25014)
530055GitLab CE/EE Information Disclosure and Session Hijacking Vulnerability (CVE-2025-1908)
530056Zimbra Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2025-32354)
530057JetBrains TeamCity Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2025-46618)
530058JetBrains TeamCity Path Traversal Vulnerability (CVE-2025-46433)
530061Ivanti Endpoint Manager Mobile (EPMM) Remote Code Execution (RCE) Vulnerability (CVE-2025-4427,CVE-2025-4428)
530062Apache Superset Improper Authorization Vulnerability (CVE-2025-27696)
530063WordPress TicketBAI Facturas para WooCommerce Plugin: Arbitrary File Deletion Vulnerability (CVE-2025-4564)
530064Ollama Denial of Service Vulnerability (CVE-2025-1975)
530065JetBrains TeamCity Base64 Credentials Exposure Vulnerability (CVE-2025-46432)
530066Jenkins WSO2 Oauth Plugin Authentication Bypass Vulnerability (CVE-2025-47889)
530067Adobe ColdFusion Arbitrary Code Execution Vulnerabilities (CVE-2025-43559,CVE-2025-43560,CVE-2025-43562)
530068Adobe ColdFusion Arbitrary Code Execution Vulnerabilities (CVE-2025-43561,CVE-2025-43565)
530069Adobe ColdFusion Arbitrary File Read Vulnerabilities (CVE-2025-43563,CVE-2025-43564)
530070Adobe ColdFusion Path Traversal Vulnerability (CVE-2025-43566)
530071Fortinet FortiOS Authentication Bypass Vulnerability (CVE-2025-22252)
530073Jenkins OpenID Connect Provider Plugin Token Impersonation Vulnerability (CVE-2025-47884)
530074Jenkins Health Advisor by CloudBees Plugin Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2025-47885)
530075Adobe Connect Multiple Cross-site Scripting Vulnerabilities (APSB25-36)
530076WordPress BEAF Plugin: Arbitrary File Upload Vulnerability (CVE-2025-47549)
530077WordPress TI WooCommerce Wishlist Plugin: Arbitrary File Upload Vulnerability (CVE-2025-47577)
530078Microsoft Partner Center Detected
530079Microsoft Copilot Studio Detected
530080DeepJavaLibrary Path Traversal Vulnerability (CVE-2025-0851)
530081DeepJavaLibrary Path Traversal Vulnerability (CVE-2024-37902)
530082DJL Serving Unauthorized Access to Application Configuration
530083WordPress OTP-less One Tap Sign In Plugin: Privilege Escalation Vulnerability (CVE-2025-3746)
530084WordPress Frontend Dashboard Plugin: Privilege Escalation Vulnerability (CVE-2025-4104)
530085Atlassian Jira Privilege Escalation Vulnerability (CVE-2025-22157)
530086DJL Serving Log Exposure
530087JetBrains TeamCity Stored Cross-Site Scripting Vulnerability (CVE-2025-47853)
530088JetBrains TeamCity Stored Cross-Site Scripting Vulnerability (CVE-2025-47852)
530089JetBrains TeamCity Stored Cross-Site Scripting Vulnerability (CVE-2025-47851)
530090ZenML Denial of Service Vulnerability (CVE-2024-9340)
530091Zimbra Cross-Site Scripting (XSS) Vulnerability (CVE-2024-27443)
530092Microsoft Azure Portal Detected
530093JetBrains TeamCity Open Redirect Vulnerability (CVE-2025-47854)
530094JetBrains YouTrack Attachment Visibility Bypass Vulnerability (CVE-2025-47850)
530095JetBrains YouTrack Unauthenticated Issue Deletion Vulnerability (CVE-2025-48391)
530097Versa Concerto Authentication Bypass Vulnerability (CVE-2025-34027)
530098WordPress The Events Calendar Plugin: Sensitive Information Disclosure Vulnerability (CVE-2024-5333)
530099WordPress The Events Calendar Plugin: Cross-Site Scripting Vulnerability (CVE-2024-12118)
530101FortiClientEMS Path Traversal Vulnerability (CVE-2025-22859)
530102Grafana Improper Access Control Vulnerability (CVE-2025-3580)
530103Moodle Self Enrollment Bypass Vulnerability (CVE-2025-3634)
530104WordPress StoreKeeper for WooCommerce Plugin: Arbitrary File Upload Vulnerability (CVE-2025-47687)
530105Moodle Anonymous Submission De-anonymization Vulnerability (CVE-2025-3628)
530106Moodle Authentication Bypass Vulnerability (CVE-2025-3625)
530107Atlassian Confluence Data Center and Server DoS (Denial of Service) Vulnerability (CVE-2025-31650)
530108WordPress Store Manager Connector Plugin: Arbitrary File Deletion Vulnerability (CVE-2025-4603)
530109vBulletin Remote Code Execution (RCE) Vulnerability (CVE-2025-48827)
530110WordPress Elementor Plugin: Cross-Site Scripting Vulnerability (CVE-2024-10453)
530111WordPress Elementor Plugin: Cross-Site Scripting Vulnerability (CVE-2024-13445)
530112WordPress Elementor Plugin: Cross-Site Scripting Vulnerability (CVE-2024-54444)
530113Moodle Remote Code Execution Vulnerability (CVE-2025-3642)
530114Invision Community Remote Code Execution (RCE) Vulnerability (CVE-2025-47916)
530115WordPress Property Plugin: Privilege Escalation Vulnerability (CVE-2025-5117)
530116WordPress Store Manager Connector Plugin: Arbitrary File Upload Vulnerability (CVE-2025-4336)
530117WordPress ELEX WordPress HelpDesk and Customer Ticketing System Plugin: Arbitrary File Upload Vulnerability (CVE-2025-47658)
530118Moodle User Data Exposure Before MFA Vulnerability (CVE-2025-3627)
530119Moodle CSRF Token Exposure Vulnerability (CVE-2025-3637)
530120WordPress Essential Real Estate Plugin: Local File Inclusion Vulnerability (CVE-2025-30849)
530121Moodle Reflected Cross-Site Scripting Vulnerability (CVE-2025-3643)
530122WordPress Likes and Dislikes Plugin: SQL Injection Vulnerability (CVE-2025-5287)
530123Moodle Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2025-3636)
530124WordPress NewsBlogger Theme: Cross-Site Request Forgery Vulnerability (CVE-2025-1305)
530125Moodle Brickfield Tool Cross-site Request Forgery (CSRF) Vulnerability (CVE-2025-3638)
530126Moodle Messaging Web Service Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2025-3645)
530127WSO2 API Manager XML External Entity (XXE) Vulnerability (CVE-2025-2905)
530128WSO2 API Manager Default Credentials
530129WordPress Review Plugin: Local File Inclusion Vulnerability (CVE-2025-2158)
530130Gradio CORS Origin Validation Bypass Vulnerability (CVE-2025-5320)
530131WordPress WP Tabs Plugin: PHP Object Injection Vulnerability (CVE-2025-48134)
530132Moodle Cohorts Report Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2025-3647)

 
What’s Next

Leverage the QID list to guide your remediation efforts and strengthen your risk posture.

Looking for more context or remediation tips? Head to Qualys KnowledgeBase for detailed analysis, actionable guidance, and expert-backed support.

Share your Comments

Comments

Your email address will not be published. Required fields are marked *