CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- zealopensource user registration using contact form 7WordPress User Registration Using Contact Form 7 plugin <= 2.4 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- ashish ajani wp show statsWordPress WP Show Stats plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- grade us, inc. review streamWordPress Review Stream plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- romancode mapsvgWordPress MapSVG Lite plugin <= 8.6.6 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- romancode mapsvgWordPress MapSVG Lite plugin <= 8.6.4 - Broken Access Control Vulnerability5.0 Medium
- blubrry powerpress podcastingWordPress PowerPress Podcasting plugin <= 11.12.5 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- aristo rinjuang wp inquiriesWordPress WP Inquiries plugin <= 0.2.1 - SQL Injection Vulnerability7.6 High
- blubrry powerpress podcastingWordPress PowerPress Podcasting plugin <= 11.12.6 - Server Side Request Forgery (SSRF) Vulnerability4.9 Medium
- webinarpressWordPress WebinarPress plugin <= 1.33.28 - Open Redirection Vulnerability4.7 Medium
- wp shuffle subscription formsWordPress WP Subscription Forms plugin <= 1.2.4 - Local File Inclusion Vulnerability7.5 High
- rustaurius ultimate wp mailWordPress Ultimate WP Mail plugin <= 1.3.10 - Open Redirection vulnerability4.7 Medium
- azuread microsoft-identity-webMicrosoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs4.7 Medium
- dnnsoftware dnn.platform, dotnetnuke +1 morePossible Denial of Service (DoS) in DNN.PLATFORM registration5.9 Medium
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN allows a registered user to enumerate and access files they should not have access to6.5 Medium
- dnnsoftware dotnetnuke, dnn.platform +1 moreUnexpected external content may be displayed in DNN ImageHandler4.3 Medium
- apache artemis, apache software foundation activemq artemis +1 moreApache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log6.8 Medium
- ibm security guardiumIBM Security Guardium information disclosure4.9 Medium
- ibm security verify governanceIBM Security Verify Governance cross-site scripting5.4 Medium
- shopwareShopware's default newsletter opt-in settings allow for mass sign-up abuse6.9 Medium
- progress software corporation sitefinityInsufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under...7.7 High
wallabag/wallabagPackagistwallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities4.3 Medium- mlc-ai xgrammarDenial of Service by abusing xgrammar unbounded cache in memory6.5 Medium
tendermint-light-client-verifiercrates.iotendermint-rs's Light Client Verifier allows malicious validators to spoof votes from other validators8.2 High- koajs koaXSS at ctx.redirect() function in Koajs5.0 Medium
- bentomlInsecure Deserialization leads to RCE in BentoML's runner server9.8 Critical
- dnnsoftware dotnetnuke, dnn.platform +1 moreServer-Side Request Forgery (SSRF) in DotNetNuke.Core6.5 Medium
- apache poi, netapp active iq unified manager +1 moreApache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names5.3 Medium
- apache pulsar, apache software foundation pulsar io kafka connect adaptor, pulsar io kafka connector +2 moreApache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka Connectors6.3 Medium
- propanetank roommate-bill-trackingpropanetank Roommate-Bill-Tracking login.php sql injection6.9 Medium
- schneider electric trio q licensed data radioCWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could...5.4 Medium
- schneider electric trio q licensed data radioCWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could...4.1 Medium
- schneider electric trio q licensed data radioCWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially...4.1 Medium
- schneider electric connexium network managerCWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality...8.4 High
- schneider electric connexium network managerCWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that...8.2 High
- inaba denki sangyo co., ltd. ac-wps-11ac, ac-pd-wps-11ac, ac-pd-wps-11ac-p +3 more +5 moreMissing authentication for critical function vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac...7.5 High
- inaba denki sangyo co., ltd. ac-wps-11ac, ac-pd-wps-11ac, ac-pd-wps-11ac-p +3 more +5 moreInformation disclosure of authentication information in the specific service vulnerability exists...7.5 High
- inaba denki sangyo co., ltd. ac-wps-11ac, ac-pd-wps-11ac, ac-pd-wps-11ac-p +3 more +5 moreOS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac...9.8 Critical
- inaba denki sangyo co., ltd. ac-wps-11ac, ac-pd-wps-11ac, ac-pd-wps-11ac-p +3 more +5 moreCleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series...5.9 Medium
- inaba denki sangyo co., ltd. ac-wps-11ac, ac-pd-wps-11ac, ac-pd-wps-11ac-p +3 more +5 moreImproper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac...6.5 Medium
- inaba denki sangyo co., ltd. ac-wps-11ac, ac-pd-wps-11ac, ac-pd-wps-11ac-p +3 more +5 moreCross-site request forgery vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user...4.3 Medium
- inaba denki sangyo co., ltd. ac-wps-11ac, ac-pd-wps-11ac, ac-pd-wps-11ac-p +3 more +5 moreOS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC...8.8 High
- inaba denki sangyo co., ltd. ac-wps-11ac, ac-pd-wps-11ac, ac-pd-wps-11ac-p +3 more +5 moreIncorrect privilege assignment vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP...4.3 Medium
- samsung android, samsung mobile devices +1 moreImproper access control in Mdecservice prior to SMR Apr-2025 Release 1 allows local attackers to...5.5 Medium
- tp-link tapo h200 v1 iot smart hubInformation Disclosure Vulnerability in TP-Link Tapo IoT Smart Hub4.4 Medium
- unknown wordpress/plugin upgrade time out plugin, felixker wordpress\/plugin upgrade time out plugin +1 morePlugin Upgrade Time Out <= 1.0 - Stored XSS via CSRF6.3 Medium
- ngothang wp multitaskingWP MultiTasking <= 0.1.12 - Permalink Suffix Update via CSRF4.3 Medium
- ngothang wp multitaskingWP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF4.3 Medium
- wedevs wp project manager, project manager – ai powered project management, task management, kanban board & time tracker +1 moreWP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- dell client platform bios, 14 plus 2-in-1 db04250 firmware, 14 plus db14250 firmware +259 more +261 moreDell Client Platform BIOS contains a Stack-based Buffer Overflow Vulnerability. A high privileged...6.9 Medium
libbssolv-perlDebianlibbssolv-perl - security updateNo score- Show moreLoading…