CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setL2tpServerCfg access control6.9 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setUrlFilterRules access control6.9 Medium
- 10web form maker, unknown form maker by 10web +1 moreForm Maker by 10Web < 1.15.32 - Admin+ Stored XSS4.8 Medium
- rocklobster contact form 7Contact Form 7 <= 6.0.5 - Order Replay Vulnerability5.3 Medium
- linux, linux kernel +1 moreatm: Fix NULL pointer dereference5.5 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setScheduleCfg access control6.9 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setUPnPCfg access control6.9 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setDdnsCfg access control6.9 Medium
- delta electronics commgrCOMMGR - Insufficient Randomization Authentication Bypass9.8 Critical
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setSmartQosCfg access control6.9 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setWiFiEasyGuestCfg access control6.9 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R Password cstecgi.cgi setWiFiEasyGuestCfg access control6.9 Medium
- tecno carlcare, com.transsion.carlcare +1 moreInterface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to ...7.5 High
- supsysticcom contact form by supsysticContact Form by Supsystic <= 1.7.29 - Cross-Site Request Forgery to Stored Cross-Site Scripting via saveAsCopy AJAX Action6.1 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- dell alienware command center, alienware command center (awcc) +1 moreDell Alienware Command Center 6.x, versions prior to 6.7.37.0 contain an Improper Access Control...6.7 Medium
@cat-wc/utilitiesnpmWithdrawn Advisory: Malware in @cat-wc/utilitiesNo score- veritas data insightArctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use...4.7 Medium
- ankitects ankiAn issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in...6.1 Medium
- erlang erlang/otp, otp, cisco cloud native broadband network gateway +22 more +24 moreErlang/OTP SSH Vulnerable to Pre-Authentication RCE10.0 Critical
- torrahclef company website cmsSourceCodester Company Website CMS 1.0 is vulnerable to Cross Site Scripting (XSS) via /dashboard...6.1 Medium
- torrahclef company website cmsSourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio"...9.8 Critical
- torrahclef company website cmsSourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create...9.8 Critical
- phpgurukul pre-school enrollment systemPHPGurukul Pre-School Enrollment System is vulnerable to Directory Traversal in manage-teachers.php.7.5 High
- No product listedA Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28....5.4 Medium
- wxwidgetsIn wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are...3.7 Low
- nopcommercenopCommerce before 4.80.0 does not offer locking for order placement. Thus there is a race...3.5 Low
- wallosapp wallosWallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows...9.8 Critical
- wallosapp wallosWallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows...9.8 Critical
- benbusby whoogle searchWhoogle allows attackers to execute arbitrary code via supplying a crafted search query7.3 High
- No product listedAn issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to...6.5 Medium
- No product listedA remote code execution (RCE) vulnerability in the upload_file function of LRQA Nettitude PoshC2...8.8 High
- oretnom23 online id generator systemSourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site...4.8 Medium
- oretnom23 online id generator systemSourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection...9.8 Critical
- oretnom23 online id generator systemSourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection...9.8 Critical
- oretnom23 online id generator systemSourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload...9.8 Critical
- oretnom23 online id generator systemSourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload...5.1 Medium
- oretnom23 online id generator systemSourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site...5.4 Medium
- oretnom23 online id generator systemSourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection...5.9 Medium
- espocrmEspoCRM allows unrestricted Embedding in Iframe dashlet5.3 Medium
- nixos hydraHydra no restricted eval after nix-eval-jobs migration2.6 Low
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- conda-forge conda-forge-webservicesconda-forge-webservices has an Unauthorized Artifact Modification Race Condition7.5 High
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- goodlayers tourmasterWordPress Tourmaster plugin < 5.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- dzynit seo toolsWordPress SEO Tools plugin <= 4.0.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- zookatron mybookprogress by stormhill mediaWordPress MyBookProgress by Stormhill Media plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- notfound easy contactWordPress Easy Contact plugin <= 0.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound wpjobboardWordPress WPJobBoard plugin < 5.11.1 - CSRF to Remote Code Execution (RCE) vulnerability9.6 Critical
- Show moreLoading…