CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- code-projects blood bank management system, adonesevangelista online blood bank management system +1 morecode-projects Blood Bank Management System delete.php sql injection6.9 Medium
- code-projects blood bank management system, adonesevangelista online blood bank management system +1 morecode-projects Blood Bank Management System campsdetails.php sql injection6.9 Medium
- aioseo broken link checker by aioseo – easily fix/monitor internal and external linksBroken Link Checker by AIOSEO <= 1.2.3 - Authenticated (Contributor+) SQL Injection6.5 Medium
- code-projects blood bank management system, adonesevangelista online blood bank management system +1 morecode-projects Blood Bank Management System viewrequest.php sql injection6.9 Medium
- code-projects blood bank management systemcode-projects Blood Bank Management System reset.php sql injection6.9 Medium
- code-projects blood bank management systemcode-projects Blood Bank Management System don.php sql injection6.9 Medium
binutilsOSS-FuzzHeap-buffer-overflow in bfd_getb16No score- kentico xperienceKentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions...7.2 High
- kentico xperienceKentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for...6.4 Medium
- chainmaker chainmaker-goIn chainmaker-go (aka ChainMaker) before 2.4.0, when making frequent updates to a node's...4.0 Medium
- chainmaker chainmaker-goIn chainmaker-go (aka ChainMaker) before 2.3.6, multiple updates to a single node's configuration...4.0 Medium
- fisco-bcosFISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example...4.0 Medium
- 1902756969 ikun library1902756969/code-projects IKUN_Library Borrow MvcConfig.java addInterceptors access control5.3 Medium
- code-projects patient record management systemcode-projects Patient Record Management System dental_not.php sql injection5.3 Medium
- code-projects patient record management systemcode-projects Patient Record Management System birthing_record.php sql injection5.3 Medium
- elliott net::xeroNet::Xero 0.044 and earlier for Perl uses insecure rand() function for cryptographic functions6.5 Medium
- localshop webservice::xero, webservice\ +1 moreWebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functions5.5 Medium
- taniguchi amon2::auth::site::line, nipotan line integration for amon2 +1 moreAmon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functions5.5 Medium
- norbu net::dropbox::api, norbu09 net\ +1 moreNet::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functions5.5 Medium
- lev web::api, web\ +1 moreWeb::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functions5.5 Medium
@weave-mui/dividernpmWithdrawn Advisory: Malware in @weave-mui/dividerNo score- whatsapp, facebook whatsapp desktop for windows +1 moreA spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments...6.7 Medium
- phpgurukul men salon management systemPHPGurukul Men Salon Management System appointment.php sql injection6.9 Medium
- oretnom23 online eyewear shopSourceCodester Online Eyewear Shop Registration Master.php access control5.3 Medium
- oretnom23 online eyewear shopSourceCodester Online Eyewear Shop Master.php cross site scripting5.1 Medium
- oretnom23 online eyewear shopSourceCodester Online Eyewear Shop Users.php sql injection5.3 Medium
- glenwpcoder drag and drop multiple file upload for woocommerceDrag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File Move9.8 Critical
- multivendorx, wcmp multivendorx – woocommerce multivendor marketplace solutions +1 moreMultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion5.3 Medium
- althemist lafka pluginLafka Plugin <= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update4.3 Medium
- digitalzoomstudio zoomsounds, zoomit zoomsounds - wordpress wave audio player with playlist +1 moreZoomSounds <= 6.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- digitalzoomstudio zoomsounds, zoomit zoomsounds - wordpress wave audio player with playlist +1 moreZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation8.1 High
- aweos email notifications for updatesEmail Notifications for Updates <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- adamwillhoeft ai content pipelines: content engine + analyticsAI Content Pipelines <= 1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- edmon.parker read more & accordionRead More & Accordion <= 3.4.7 - Cross-Site Request Forgery to Local File Inclusion7.5 High
- logoninc kb support – customer support ticket & helpdesk plugin, knowledge base pluginKB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin <= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory7.5 High
- ibm maximo application suiteIBM Maximo Application Suite file upload5.5 Medium
karchiveOSS-FuzzGlobal-buffer-overflow in parseExtraFieldNo scorekimageformatsOSS-FuzzGlobal-buffer-overflow in QByteArray::QByteArrayNo scorejetty9Debianjetty9 - regression updateNo score- connmanIn ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR...4.8 Medium
- freedesktop popplerPoppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the...4.0 Medium
- freedesktop popplerA floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an...4.0 Medium
- zammadIn Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see...4.2 Medium
- zammadIn Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When...4.8 Medium
- zammadIn Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in...4.0 Medium
- zammadIn Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to...4.3 Medium
- zend zendtoA type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote...4.8 Medium
- zend zendtoAn OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6...10.0 Critical
- jackdewey link libraryLink Library <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters6.4 Medium
- qinguoyi tinywebserverqinguoyi TinyWebServer http_conn.cpp improper authentication6.9 Medium
- Show moreLoading…