CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- softcom iksorisXSS in iKSORIS5.1 Medium
- softcom iksorisXSS in iKSORIS5.1 Medium
- softcom iksorisXSS in iKSORIS5.1 Medium
- softcom iksorisXSS in iKSORIS5.1 Medium
- softcom iksorisXSS in iKSORIS5.3 Medium
- code-projects studentmanagerhuanfenz/code-projects StudentManager Announcement Management Section uploadArticle.do unrestricted upload5.1 Medium
- code-projects studentmanagerhuanfenz/code-projects StudentManager Teacher String improper authorization5.3 Medium
- wphocus my auctions allegroWordPress My auctions allegro plugin <= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- wuzhicmsWuzhiCMS Setting index.php set code injection5.1 Medium
- yonyou yonbipYonyou YonBIP userfile FileInputStream path traversal5.3 Medium
- ghostxbh uzy-ssm-mallghostxbh uzy-ssm-mall cross-site request forgery5.3 Medium
- ghostxbh uzy-ssm-mallghostxbh uzy-ssm-mall product cross site scripting5.1 Medium
- ghostxbh uzy-ssm-mallghostxbh uzy-ssm-mall 20 ForeProductListController sql injection5.3 Medium
- ghostxbh uzy-ssm-mallghostxbh uzy-ssm-mall uploadUserHeadImage unrestricted upload5.3 Medium
- apache rollerApache Roller: Insufficient Session Expiration on Password Change2.1 Low
- scriptandtools ecommerce-website-in-phpScriptAndTools eCommerce-website-in-PHP cross-site request forgery5.3 Medium
- scriptandtools ecommerce-website-in-phpScriptAndTools eCommerce-website-in-PHP login.php excessive authentication6.3 Medium
govulncheck-vulndbopenSUSESecurity update for govulncheck-vulndbNo score- scriptandtools ecommerce-website-in-phpScriptAndTools eCommerce-website-in-PHP login.php excessive authentication6.3 Medium
- mattermost, mattermost server +1 moreSyatem admin profile modification by delegated granular administration role4.7 Medium
- mattermost, mattermost mobile +1 moreUnauthorized Notification Exposure in Mobile App Under Specific Conditions2.0 Low
- phpshephpshe api.php cross site scripting5.3 Medium
- phpshephpshe admin.php pe_delete sql injection5.3 Medium
- unknown user registration & membership, wpeverest user registration \& membership +1 moreUser Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation8.1 High
- blubrry powerpress, powerpress podcasting plugin by blubrry +1 morePowerPress Podcasting < 11.9.18 - Author+ XSS via Podcast URL5.9 Medium
- wowjoy 浙江湖州华卓信息科技有限公司 internet doctor workstation systemwowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System detail improper authorization5.3 Medium
- assimpOpen Asset Import Library Assimp File MD3Loader.cpp ValidateSurfaceHeaderOffsets heap-based overflow4.8 Medium
- assimpOpen Asset Import Library Assimp File types.h Set heap-based overflow4.8 Medium
- agent-zerofrdel Agent-Zero get_work_dir_files path traversal5.3 Medium
- intumit smartrobotINTUMIT SmartRobot - Server-Side Request Forgery7.5 High
- h3c magic be18000, magic nx15, magic nx30 pro +7 more +9 moreH3C Magic BE18000 HTTP POST Request getLanguage FCGI_CheckStringIfContainsSemicolon command injection8.6 High
- h3c magic be18000, magic nx15, magic nx30 pro +2 more +4 moreH3C Magic BE18000 HTTP POST Request setLanguage FCGI_CheckStringIfContainsSemicolon command injection8.6 High
- h3c magic be18000, magic nx15, magic nx30 pro +2 more +4 moreH3C Magic BE18000 HTTP POST Request getCapabilityWeb FCGI_CheckStringIfContainsSemicolon command injection8.6 High
pocoOSS-FuzzUNKNOWN READ in void std::__1::vector<unsigned char, std::__1::allocator<unsigned char>>::__consNo score- h3c magic nx15, magic nx30 pro, magic nx400 +1 more +3 moreH3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request setsyncpppoecfg FCGI_WizardProtoProcess command injection8.6 High
- devdojo voyagerDevDojo Voyager Argument Injection vulnerability9.1 Critical
- langgenius difyDify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component...4.8 Medium
- h3c magic nx15, magic nx400, magic r3010 +2 moreH3C Magic NX15/Magic NX400/Magic R3010 HTTP POST Request getsyncpppoecfg FCGI_WizardProtoProcess command injection8.6 High
- h3c magic nx15, magic nx30 pro, magic nx400 +1 more +3 moreH3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getSpecs FCGI_WizardProtoProcess command injection8.6 High
- h3c magic nx15, magic nx30 pro, magic nx400 +1 more +3 moreH3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI_WizardProtoProcess command injection8.6 High
- github.com/mholt/archiver/v3mholt/archiver Vulnerable to Path Traversal via Crafted ZIP File8.1 High
- h3c magic be18000, magic nx15, magic nx30 pro +2 more +4 moreH3C Magic BE18000 HTTP POST Request getBasicInfo FCGI_CheckStringIfContainsSemicolon command injection8.6 High
- d-link di-8100, dlink di-8100 firmware +1 moreD-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflow8.7 High
- code-projects employee management systemTutorials-Website Employee Management System update-user.php improper authorization6.9 Medium
- ibm aspera faspexIBM Aspera Faspex 5 cross-site scripting5.4 Medium
- code-projects employee management systemTutorials-Website Employee Management System delete-user.php improper authorization6.9 Medium
- shuanx burpapifindershuanx BurpAPIFinder BurpApiFinder.db denial of service5.3 Medium
- powercreator cmsPowerCreator CMS OpenPublicCourse.aspx sql injection5.3 Medium
- youdiancmsYouDianCMS index.html.Attackers cross site scripting5.3 Medium
- youdiancmsYouDianCMS index.html.Attackers cross site scripting5.3 Medium
- Show moreLoading…