CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- project worlds online lawyer management systemProject Worlds Online Lawyer Management System save_booking.php sql injection6.9 Medium
- vitejs viteVite allows server.fs.deny to be bypassed with .svg or relative paths5.3 Medium
- miniflux v2Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration4.8 Medium
- project worlds online lawyer management systemProject Worlds Online Lawyer Management System lawyer_booking.php sql injection6.9 Medium
- project worlds online lawyer management systemProject Worlds Online Lawyer Management System approve_lawyer.php sql injection6.9 Medium
- element-hq element-x-iosElement X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call5.3 Medium
- element-hq element-x-androidElement X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call5.3 Medium
- project worlds online lawyer management systemProject Worlds Online Lawyer Management System admin_user.php sql injection6.9 Medium
- projeqtorProjeqtor saveAttachment.php unrestricted upload2.3 Low
- phpgurukul time table generator systemPHPGurukul Time Table Generator System edit-class.php sql injection6.9 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file3.3 Low
- tenda ac23, ac23 firmware +1 moreTenda AC23 API Interface VerAPIMant denial of service7.1 High
- code-projects product management systemcode-projects Product Management System Search Product Menu search_item stack-based overflow4.8 Medium
- thu-pacman chituthu-pacman chitu backend.py torch.load deserialization4.8 Medium
- tencent music entertainment supersonicTencent Music Entertainment SuperSonic H2 Database Connection testConnect code injection5.1 Medium
- internlm lmdeployInternLM LMDeploy conf.py open code injection4.8 Medium
- ivanti connect secure, policy secure, connect secure, policy secure, and zta gateways +2 more +4 moreA stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy...9.0 Critical
- dell data domain operating system, powerprotect data domain, dd os 7.10 +4 more +6 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0...8.8 High
- openvpnOpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to...8.8 High
- internlm lmdeployInternLM LMDeploy PT File utils.py load_weight_ckpt deserialization4.8 Medium
- tukaani-project xz, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreXZ has a heap-use-after-free bug in threaded .xz decoder8.7 High
- hcl software devops deploy / hcl launch, hcltechsw hcl devops deploy, hcl launch +2 moreHCL DevOps Deploy / HCL Launch is susceptible to an HTML injection vulnerability5.4 Medium
- tenda ac10, ac10 firmware +1 moreTenda AC10 ShutdownSetAdd stack-based overflow8.7 High
- assimpOpen Asset Import Library Assimp File SceneCombiner.cpp AddNodeHashes out-of-bounds4.8 Medium
apparmorSUSE,libapparmorSUSE +1 moreSecurity update for apparmorNo scoreapparmoropenSUSE,libapparmoropenSUSE +1 moreSecurity update for apparmorNo score- assimpOpen Asset Import Library Assimp ASE File ASEParser.cpp ParseLV4MeshBonesVertices heap-based overflow4.8 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreLibsoup: heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreLibsoup: heap buffer overflow in sniff_unknown()6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: segmentation fault when parsing malformed data uri5.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreLibsoup: integer overflow in append_param_quoted5.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 extended lifecycle support +11 more +13 moreLibsoup: denial of service attack to websocket server7.5 High
- gnome yelp, debian linux, red hat enterprise linux 6 +33 more +35 moreYelp: arbitrary file read7.4 High
- assimpOpen Asset Import Library Assimp LWO File LWOAnimation.cpp UpdateAnimRangeSetup heap-based overflow4.8 Medium
- intelbras wrn 150Intelbras WRN 150 Wireless Menu cross site scripting4.8 Medium
- reputeinfosystems social share and social lockerWordPress Social Share And Social Locker plugin <= 1.4.2 - SQL Injection vulnerability9.3 Critical
- apptivo business site crm, notfound apptivo business site crm +1 moreWordPress Apptivo Business Site CRM plugin <= 5.3 - Arbitrary Content Deletion vulnerability7.5 High
- labib ahmed team builderWordPress Team Builder plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- mark o'donnell team rostersWordPress Team Rosters Plugin <= 4.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound xv random quotesWordPress XV Random Quotes plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- reputeinfosystems social share and social lockerWordPress Social Share And Social Locker Plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- digihood html sitemapWordPress Digihood HTML Sitemap Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- lexicataWordPress Lexicata plugin <= 1.0.16 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wpshopee awesome logosWordPress Awesome Logos plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- dustinscarberry mediaviewWordPress MediaView plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- istmoplugins getbookingswpWordPress GetBookingsWP Plugin <= 1.1.27 - Broken Access Control vulnerability6.5 Medium
- cheesefather botnet attack blockerWordPress Botnet Attack Blocker plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- gunnarpayday paydayWordPress Payday plugin <= 3.3.18 - Broken Access Control vulnerability5.8 Medium
- matthewrubin local magicWordPress Local Magic plugin <= 2.9.0 - Broken Access Control vulnerability6.5 Medium
- frank p. walentynowicz fpw category thumbnailsWordPress FPW Category Thumbnails Plugin <= 1.9.5 - Broken Access Control vulnerability6.3 Medium
- Show moreLoading…