CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- sap se commerce cloud (public cloud)Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)6.8 Medium
- sap se netweaver application server abap (applications based on sap gui for html)Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)4.7 Medium
- sap se netweaver application server abapMixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP8.5 High
- giflibThe giflib open-source component has a buffer overflow vulnerability7.3 High
- fuzzoid 3dprint lite3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'coating_text'4.9 Medium
- nik00726 team circle image slider with lightboxTeam Circle Image Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL Injection4.9 Medium
- fuzzoid 3dprint lite3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'printer_text'4.9 Medium
- fuzzoid 3dprint lite3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'material_text'4.9 Medium
- fuzzoid 3dprint lite3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'infill_text'4.9 Medium
- opplus springboot-adminopplus springboot-admin SysGeneratorController.java code deserialization5.3 Medium
- axis os, os 2024 +1 moreDuring an annual penetration test conducted on behalf of Axis Communications, Truesec discovered...4.3 Medium
- axis os, os 2022, os 2024 +2 more51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API...4.3 Medium
- aiasmymagicpower AIAS InferController.java server-side request forgery5.3 Medium
- aiasmymagicpower AIAS AsrController.java server-side request forgery5.3 Medium
- aiasmymagicpower AIAS LocalStorageController.java unrestricted upload5.3 Medium
- samsung mobile devices, samsung wear os +1 moreImproper handling of exceptional conditions in pairing specific bluetooth devices in Galaxy Watch...8.8 High
- samsung mobile devices, samsung wear os +1 moreImproper authorization in wireless download protocol in Galaxy Watch prior to SMR Apr-2025...5.4 Medium
- samsung galaxy storeImproper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to...5.1 Medium
- samsung notes, samsung mobile samsungnotes +1 moreUse of implicit intent for sensitive communication in SamsungNotes prior to version 4.4.26.45...4.0 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bounds read in enrollment with cdsp frame secfr trustlet prior to SMR Apr-2025 Release 1...5.5 Medium
- samsung android, samsung mobile devices +1 moreImproper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr...5.5 Medium
- samsung wear os, samsung mobile devices +1 moreImproper access control in Galaxy Watch prior to SMR Apr-2025 Release 1 allows local attackers to...4.0 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bounds read in parsing audio data in libsavsac.so prior to SMR Apr-2025 Release 1 allows...6.2 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bounds write in secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged...6.4 Medium
- samsung android, samsung mobile devices +1 moreImproper Verification of Intent by Broadcast Receiver in DeviceIdService prior to SMR Apr-2025...4.4 Medium
- samsung android, samsung mobile devices +1 moreImproper access control in InputManager to SMR Apr-2025 Release 1 allows local attackers to...6.2 Medium
- samsung mobile devicesImproper handling of insufficient permission in Samsung Device Health Manager Service prior to...4.0 Medium
- samsung android, samsung mobile devices +1 moreImproper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers...5.5 Medium
- samsung android, samsung mobile devices +1 moreImproper access control in HDCP trustlet prior to SMR Apr-2025 Release 1 allows local attackers...8.8 High
- samsung mobile devicesImproper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr...5.5 Medium
- samsung android, samsung mobile devices +1 moreImproper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers...5.5 Medium
- nothings stb, stb image.h +1 moreNothings stb stb_include_string stack-based overflow5.3 Medium
- wpminds simple wp eventsSimple WP Events <= 1.8.17 - Unauthenticated Arbitrary File Deletion9.1 Critical
- melhorenvio melhor envioMelhor Envio <= 2.15.11 - Unauthenticated Sensitive Information Exposure via Hardcoded Hash5.3 Medium
- nothings stb, stb image.h +1 moreNothings stb stb_dupreplace integer overflow5.3 Medium
- nothings stb, stb image.h +1 moreNothings stb stbhw_build_tileset_from_image out-of-bounds5.3 Medium
- nothings stb, stb image.h +1 moreNothings stb Header Array stbhw_build_tileset_from_image out-of-bounds5.3 Medium
- fcj venture builder appclientefielFCJ Venture Builder appclientefiel HTTP GET Request ObterPedido resource injection5.3 Medium
- vivotek nvr nd8422p, nvr nd9525p, nvr nd9541p +2 moreVivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source5.1 Medium
- seeyon fe collaborative office platform, zhiyuan interconnect fe collaborative office platform +1 moreSeeyon Zhiyuan Interconnect FE Collaborative Office Platform check.js%70 sql injection5.3 Medium
- esafenet cdgESAFENET CDG getLimitIPList.jsp sql injection6.9 Medium
- hgiga powerstationHGiga PowerStation - Chroot Escape6.7 Medium
- hgiga isherlock 4.5, isherlock 5.5 +1 moreHGiga iSherlock - OS Command Injection9.8 Critical
- hgiga isherlock 4.5, isherlock 5.5 +1 moreHGiga iSherlock - OS Command Injection9.8 Critical
- esafenet cdgESAFENET CDG UnChkMailApplication.jsp sql injection6.9 Medium
- esafenet cdgESAFENET CDG updateNotice.jsp sql injection6.9 Medium
- hgiga isherlock 4.5, isherlock 5.5 +1 moreHGiga iSherlock - OS Command Injection9.8 Critical
- iqonicdesign streamitStreamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- iqonicdesign streamitStreamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Download6.5 Medium
- iqonicdesign streamitStreamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover8.8 High
- Show moreLoading…