CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- patelmilap widget for social page feedsWidget for Social Page Feeds < 6.4.2 - Admin+ Stored XSS4.8 Medium
- red hat discovery 2, enterprise linux 10, enterprise linux 6 +26 more +28 moreKrb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions5.9 Medium
- xorbits inferenceXorbits Inference model.py load deserialization5.1 Medium
- cyberchimps responsive addons for elementor, responsive addons for elementor – free elementor addons, kits and elementor templates +1 moreResponsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rael_title_tag'6.4 Medium
- jquery-validationjquery-validation vulnerable to Cross-site Scripting5.3 Medium
- dell trusted device client, trusted device agent +1 moreDell Trusted Device, versions prior to 7.0.3.0, contain an Incorrect Default Permissions ...6.7 Medium
- dell trusted device client, trusted device agent +1 moreDell Trusted Device, versions prior to 7.0.3.0, contain an Improper Link Resolution Before File...6.7 Medium
- demtec graphyticsDemtec Graphytics visualization cross site scripting5.1 Medium
- demtec graphyticsDemtec Graphytics HTTP GET Parameter visualization cross site scripting5.3 Medium
- totalsoft ts poll – survey, versus poll, image poll, video pollTS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.4.6 - Authenticated (Administrator+) SQL Injection via 's' Parameter4.9 Medium
assimpOSS-FuzzHeap-buffer-overflow in Assimp::SceneCombiner::CopySceneNo score- winzipIn WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete...6.1 Medium
- bandisoft bandizipIn Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This...6.1 Medium
- peazipIn PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability...6.1 Medium
- vision helpdesk helpdeskVision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka...6.5 Medium
- arctera ediscovery platformArctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used,...6.0 Medium
- crushftpCrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the ...5.0 Medium
- crushftpCrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port...5.0 Medium
- tanghc code-gencode-gen <=2.0.6 is vulnerable to Incorrect Access Control. The project does not have permission...4.3 Medium
- nagios log serverCross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to...8.3 High
- perfree perfreeblogIn PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability...8.8 High
- perfree perfreeblogStored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field...4.8 Medium
- jeewmsA zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows...5.5 Medium
- exrick xmallAn issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the...9.8 Critical
- hitstiresoftware hitout car saleA SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive...5.9 Medium
- edimax br-6478ac v3 firmwareEdimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a...6.5 Medium
- edimax br-6478ac v3 firmwareEdimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a...6.5 Medium
- edimax br-6478ac v3 firmwareEdimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a...6.5 Medium
- edimax br-6478ac v3 firmwareEdimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a...6.5 Medium
- totolink a810r firmwareThe TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command...9.8 Critical
- totolink a800r firmwareTOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in...6.5 Medium
- geeeeeeeek dingfanzuA SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code...9.8 Critical
- oldmoon cashbookcashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=.6.5 Medium
- tenda ac10 firmwareTenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serverName2.4.6 Medium
- tenda ac10 firmwareTenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via mac2.9.8 Critical
- tenda ac10 firmwareTenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serviceName2.4.6 Medium
- joturlIn JotUrl 2.0, is possible to bypass security requirements during the password change process.6.5 Medium
- joturlIn JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to...6.5 Medium
- edimax re11s firmwareRE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the...5.6 Medium
- totolink n600r firmwareTOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the pin...4.6 Medium
- totolink n600r firmwareTotolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the...9.8 Critical
- extron sme 211 firmware, smp 111 firmware, smp 351 firmware +1 more +3 moreA command injection vulnerability in the Nmap diagnostic tool in the admin web console of Extron...7.2 High
- insyde kernelAn issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2...6.4 Medium
- steve-community steveAn issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass...5.9 Medium
- No product listedAn issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part...7.3 High
- No product listedA replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix ...9.1 Critical
- enricozab cmsSQL injection vulnerability found in Enricozab CMS v.1.0 allows a remote attacker to execute...6.5 Medium
- meshtastic firmwareMeshtastic incorrectly hands malformed packets leads to controlled buffer overflow9.4 Critical
- agpt autogpt platform, significant-gravitas autogpt +1 moreAutoGPT allows cross-user sharing of node execution results through WebSockets API3.5 Low
- significant-gravitas autogpt, agpt autogpt platform +1 moreAutoGPT allows leakage of cross-domain cookies and protected headers in requests redirect8.6 High
- Show moreLoading…