CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- significant-gravitas autogpt, agpt autogpt platform +1 moreAutoGPT allows SSRF due to DNS Rebinding in requests wrapper7.5 High
- team-alembic ash authenticationAsh Authentication email link auto-click account confirmation vulnerability5.3 Medium
- code-projects my-blog-layuiZHENFENG13/code-projects My-Blog-layui authorImg upload unrestricted upload5.3 Medium
- code-projects my-blog-layuiZHENFENG13/code-projects My-Blog-layui edit cross site scripting5.1 Medium
- code-projects my-blog-layuiZHENFENG13/code-projects My-Blog-layui edit cross site scripting5.1 Medium
- adianti frameworkAdianti Framework deserialization5.3 Medium
- oretnom23 music class enrollment systemSourceCodester Music Class Enrollment System manage_class.php sql injection5.3 Medium
- ibm aspera consoleIBM Aspera Console cross-site scripting5.4 Medium
- ibm aspera consoleIBM Aspera Console XPath injection4.3 Medium
- ibm aspera consoleIBM Aspera Console information disclosure5.9 Medium
- ibm aspera consoleIBM Aspera Console weak password requirements3.1 Low
- ibm aspera consoleIBM Aspera Console information disclosure5.3 Medium
- joelittlejohn jsonschema2pojojoelittlejohn jsonschema2pojo JSON File SchemaRule.java apply stack-based overflow4.8 Medium
- ibm aspera consoleIBM Aspera Console HTTP header injection5.4 Medium
- code-projects studentmanagerZeroWdd/code-projects studentmanager getTeacherList improper authorization5.3 Medium
- sveltejs kitSvelteKit allows XSS via tracked search_params5.4 Medium
- avantfax, ifax hylafax +1 moreUnsanitized input in language form field9.9 Critical
- westboy cicadascmswestboy CicadasCMS JSP Parser upload unrestricted upload5.3 Medium
- roderickvd pleezerpleezer allows resource exhaustion through uncollected hook script processes6.5 Medium
- argoproj argo-eventsUsers can gain privileged access to the host system and cluster with EventSource and Sensor CR10.0 Critical
- sqlite, siemens ruggedcom crossbow station access controller (sac), simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moreAn integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated...6.9 Medium
- progress whatsup goldWhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability5.6 Medium
- sicommnet basecXSS, HTML and Style injection on login page8.7 High
- sicommnet basecInsecure password storage in SicommNet BASEC8.4 High
- sicommnet basecSQL-injection in admin_login_handler allows unauthenticated user to log in as an administrator in SicommNet BASEC9.3 Critical
- gorilla csrfgorilla/csrf CSRF vulnerability due to broken Referer validation5.4 Medium
- fannuo enterprise content management system 凡诺企业网站管理系统Fannuo Enterprise Content Management System 凡诺企业网站管理系统 cms_chip.php sql injection5.3 Medium
- ibm robotic process automation, robotic process automation for cloud pak +1 moreIBM Robotic Process Automation session fixation6.3 Medium
- mattermost, mattermost server +1 moreUnauthorized Bot Login Using Credentials5.4 Medium
- mattermost, mattermost server +1 moreLeaked Metadata of Deleted Files via Bookmark Creation3.1 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 extended lifecycle support +11 more +13 moreLibsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process7.4 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: null pointer dereference in client when server omits the "nonce" parameter in an unauthorized response with digest authentication6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: null pointer deference on libsoup via /auth/soup-auth-digest.c through "soup_auth_digest_authenticate" on client when server omits the "realm" parameter in an unauthorized response with di…6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: null pointer dereference on libsoup through function "sniff_mp4" in soup-content-sniffer.c5.3 Medium
- code-projects db-hospital-drugJamesZBL/code-projects db-hospital-drug ContentController.java save cross site scripting5.1 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup8.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: denial of service on libsoup through http/2 server7.5 High
- code-projects db-hospital-drugJamesZBL/code-projects db-hospital-drug ShiroConfig.java improper authorization5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreLibsoup: denial of service in server when client requests a large amount of overlapping ranges with range header5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 extended lifecycle support +13 more +15 moreLibsoup: out of bounds reads in soup_headers_parse_request()7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 extended lifecycle support +13 more +15 moreLibsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in content-disposition header7.5 High
- webkul krayin crmWebkul Krayin CRM SVG File edit cross site scripting5.1 Medium
- veal98 小牛肉 echo 开源社区系统veal98 小牛肉 Echo 开源社区系统 Ticket LoginTicketInterceptor.java preHandle improper authorization5.3 Medium
- veal98 小牛肉 echo 开源社区系统veal98 小牛肉 Echo 开源社区系统 uploadMdPic unrestricted upload6.9 Medium
- softcom iksorisXSS in iKSORIS2.3 Low
- softcom iksorisXSS in iKSORIS5.1 Medium
- softcom iksorisXSS in iKSORIS5.1 Medium
- softcom iksorisXSS in iKSORIS5.1 Medium
- softcom iksorisXSS in iKSORIS5.3 Medium
- softcom iksorisXSS in iKSORIS5.1 Medium
- Show moreLoading…