CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- awesometogi awesome event bookingWordPress Awesome Event Booking plugin <= 2.8.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- noonnoo gravelWordPress Gravel theme <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- tomdever wpforo forumWordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability7.6 High
- oblak studio srbtranslatinWordPress Srbtranslatin plugin <= 3.2.0 - Sensitive Data Exposure vulnerability5.8 Medium
- dowispStored Cross-Site Scripting (XSS) in DoWISP4.8 Medium
- angeljudesuarez library management systemitsourcecode Library Management System Forgot.java search sql injection5.3 Medium
opensslcrates.iorust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`6.3 Medium- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System Create User Page add-admin.php unrestricted upload5.3 Medium
- code-projects patient record management systemcode-projects Patient Record Management System dental_form.php sql injection5.3 Medium
- phpgurukul e-diary management systemPHPGurukul e-Diary Management System search-result.php sql injection5.3 Medium
- zhangyanbo2007 youkefuzhangyanbo2007 youkefu XML Document CallCenterRouterController.java xml external entity reference5.3 Medium
- keksdieb ez form calculator premiumWordPress ez Form Calculator Premouium plugin <= 2.14.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- phpgurukul online fire reporting systemPHPGurukul Online Fire Reporting System search.php sql injection6.9 Medium
- phpgurukul online fire reporting systemPHPGurukul Online Fire Reporting System edit-guard-detail.php sql injection6.9 Medium
- phpgurukul online fire reporting systemPHPGurukul Online Fire Reporting System search-request.php sql injection6.9 Medium
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 wrlwpsset access control6.9 Medium
- bitdefender gravityzone update serverServer Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646)6.9 Medium
- bitdefender gravityzone, gravityzone console +1 moreSSRF in GravityZone Console via DNS Truncation (VA-12634)6.9 Medium
- elaborate bytes ag virtual clonedriveLocal Privilege Escalation in Virtual CloneDrive Kernel Driver8.5 High
- bitdefender gravityzone, gravityzone console +1 moreInsecure PHP deserialization issue in GravityZone Console (VA-12634)9.5 Critical
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 Web Management Interface VirSerDMZ access control6.9 Medium
- phpgurukul old age home management systemPHPGurukul Old Age Home Management System profile.php sql injection5.3 Medium
- phpgurukul zoo management systemPHPGurukul Zoo Management System aboutus.php sql injection6.9 Medium
- phpgurukul restaurant table booking systemPHPGurukul Restaurant Table Booking System edit-subadmin.php sql injection5.1 Medium
- phpgurukul e-diary management systemPHPGurukul e-Diary Management System dashboard.php sql injection6.9 Medium
- codecanyon perfex crmCodeCanyon Perfex CRM Project Discussions Module 2 cross site scripting5.1 Medium
- tangiblewp vehica coreVehica Core <= 1.0.97 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- phpgurukul e-diary management systemPHPGurukul e-Diary Management System registration.php sql injection6.9 Medium
- wofficeio woffice core, xtendify woffice +1 moreWoffice Core <= 5.4.21 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- wofficeio woffice core, xtendify woffice +1 moreWoffice Core <= 5.4.21 - Cross-Site Request Forgery to User Registration Approval5.4 Medium
- m-files webStored XSS Vulnerability in M-Files Web5.1 Medium
- m-files serverUser in anonymous role could create and delete views6.3 Medium
- phpgurukul e-diary management systemPHPGurukul e-Diary Management System password-recovery.php sql injection6.9 Medium
- phpgurukul restaurant table booking systemPHPGurukul Restaurant Table Booking System add-subadmin.php sql injection5.3 Medium
- m-files corporation adminStored XSS in M-Files Admin user interface5.1 Medium
- jfinal cmsJFinal CMS readTemplate engine.getTemplate path traversal5.3 Medium
- robosoft mapsMaps - Google Maps <= 1.0.6 - Contributor+ Stored XSS5.9 Medium
- phpgurukul e-diary management systemPHPGurukul e-Diary Management System view-note.php sql injection6.9 Medium
- code-projects patient record management systemcode-projects Patient Record Management System birthing_print.php sql injection5.3 Medium
- hcl software connectionsHCL Connections is vulnerable to an information disclosure vulnerability3.5 Low
- adamskaat countdown, coming soon, maintenance – countdown & clockCountdown, Coming Soon, Maintenance – Countdown & Clock <= 2.8.9.1 - Unauthenticated Limited Local File Inclusion8.1 High
- booster for woocommerce, pluggabl booster for woocommerce +1 moreBooster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting7.2 High
- metagauss registrationmagic – custom registration forms, user registration, payment, and user loginRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- rpetersen29 simple banner – easily add multiple banners/bars/notifications/announcements to the top or bottom of your websiteSimple Banner <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- tagdiv composerTagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation9.8 Critical
- unknown product filter for woocommerce by wbwProduct Filter by WBW <= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend Parameter7.5 High
- code-projects patient record management systemcode-projects Patient Record Management System birthing_pending.php sql injection5.3 Medium
- code-projects patient record management systemcode-projects Patient Record Management System add_patient.php sql injection5.3 Medium
spatie/browsershotPackagistBrowsershot Server-Side Request Forgery (SSRF) via setURL() Function8.8 Highreact-draft-wysiwygnpmReact Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button5.1 Medium- Show moreLoading…