CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- lenve vbloglenve VBlog WebSecurityConfig.java configure access control5.3 Medium
- yzmcmsYzmCMS message.tpl cross site scripting5.3 Medium
- mrcen springboot-ucan-adminmrcen springboot-ucan-admin Personal Settings Interface index cross site scripting5.1 Medium
- aaluoxiang oa systemhailey888 oa_system Backend MailController.java save cross site scripting5.1 Medium
- aaluoxiang oa systemhailey888 oa_system Backend AddrController. java outAddress cross site scripting5.1 Medium
tarantoolOSS-FuzzStack-buffer-overflow in snap_usedefNo scoretarantoolOSS-FuzzHeap-buffer-overflow in lj_buf_ruleb128No score- aaluoxiang oa systemhailey888 oa_system Backend DaymanageController.java addandchangeday cross site scripting5.1 Medium
joniOSS-FuzzSecurity exception in org.joni.Parser.parseCharClassNo score- gnome libxml2In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the...5.6 Medium
- circl vulnerability-lookupVulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py.6.4 Medium
- nakivo backup & replication directorAn XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1...8.6 High
- lemonldap-ng lemonldap::ngIn the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers...7.2 High
- microsoft asp.net core, asp.net core 8.0, asp.net core 9.0 +5 more +7 moreASP.NET Core and Visual Studio Denial of Service Vulnerability7.5 High
- lucee serverLucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let an attacker run code that would be expecte…8.8 High
- aaluoxiang oa systemhailey888 oa_system Backend InformManageController.java testMess cross site scripting5.1 Medium
- aaluoxiang oa systemhailey888 oa_system Frontend LoginsController.java loginCheck cross site scripting5.3 Medium
- renrenio renren-securityrenrenio renren-security JSON cross site scripting5.1 Medium
- linzhaoguan pb-cmsLinZhaoguan pb-cms Friendship Link admin#links cross site scripting4.8 Medium
- jalios jplatformJalios JPlatform 10 SP6 < 10.0.6 Record Chooser SQL Injection8.6 High
- linzhaoguan pb-cmsLinZhaoguan pb-cms Classification Management Page cross site scripting4.8 Medium
- 1000 projects human resource management system1000 Projects Human Resource Management System employee.php sql injection6.9 Medium
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System search_sales.php sql injection6.9 Medium
- apeleghq ts-asn1-derts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation6.9 Medium
- libvips, debian linux +1 morelibvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF output8.5 High
- joey-zhou xiaozhi-esp32-server-javajoey-zhou xiaozhi-esp32-server-java update sql injection5.3 Medium
- mmaitre314 picklescanpicklescan - Remote Code Execution via timeit.timeit() Detection Bypass7.6 High
- zhangyanbo2007 youkefuzhangyanbo2007 youkefu File Upload WebIMController.java path traversal5.3 Medium
- apollographql apollo-rsapollo-compiler Named Fragment Processing Vulnerability7.5 High
- apollographql apollo gateway, federation +1 moreApollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass7.5 High
- apollographql apollo gateway, federation +1 moreApollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion7.5 High
- apollographql routerApollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing7.5 High
- pcman ftp serverPCMan FTP Server FEAT Command buffer overflow6.9 Medium
- apollographql routerApollo Router Operation Limits Vulnerable to Bypass via Integer Overflow7.5 High
- apollographql routerApollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion7.5 High
- apollographql routerApollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass7.5 High
- flowiseFlowise - SQL Injection in importChatflows API via chatflow.id Parameter8.5 High
- mmaitre314 picklescanPicklescan - Arbitrary Code Execution via Unsafe Numpy Function Detection Bypass7.6 High
- mmaitre314 picklescanPicklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate6.8 Medium
js-object-utilitiesnpmjs-object-utilities Vulnerable to Prototype Pollution7.0 High- pcman ftp serverPCMan FTP Server EPSV Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server EPRT Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server ENC Command buffer overflow6.9 Medium
- tianocore edk2Out-of-bounds Read in HashPeImageByType()4.6 Medium
- pcman ftp serverPCMan FTP Server CONF Command buffer overflow6.9 Medium
jj-clicrates.io,jj-libcrates.io +1 moreJujutsu does not have SHA-1 collision detection6.8 Medium- pcman ftp serverPCMan FTP Server CDUP Command buffer overflow6.9 Medium
- philips advanced visualization workspace, intellispace portal +1 moreUse of default hardcoded credentials7.2 High
- philips intellispace portalUnauthenticated Remote Code Execution via .NET Deserialization7.3 High
- pcman ftp serverPCMan FTP Server CCC Command buffer overflow6.9 Medium
- Show moreLoading…