CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- librawIn LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer...2.9 Low
- librawIn LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads...2.9 Low
- librawIn LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag...2.9 Low
- convertigoTwsCachedXPathAPI in Convertigo through 8.3.4 does not restrict the use of commons-jxpath APIs.2.2 Low
- quasar qmarkdownQMarkdown Cross-Site Scripting (XSS) vulnerability4.9 Medium
- kitty project kittyopen_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local...4.1 Medium
- infodraw media relay service, pmrs-102 firmware +1 moreIn Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading...5.8 Medium
- gnu mailmanGNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create...5.3 Medium
- gnu mailmanGNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to execute...5.4 Medium
- gnu mailmanGNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read...5.8 Medium
- knowbe4 security awareness trainingThe KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect...5.3 Medium
- knowbe4 security awareness trainingThe KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The...6.1 Medium
- tenda i24, w12, i24 firmware +1 more +3 moreTenda W12/i24 httpd cgiSysUplinkCheckSet stack-based overflow8.7 High
- phpgurukul men salon management systemPHPGurukul Men Salon Management System search-appointment.php sql injection6.9 Medium
- webpy web.pywebpy web.py db.py PostgresDB._process_insert_query sql injection5.3 Medium
- oretnom23 online eyewear shopSourceCodester Online Eyewear Shop Master.php sql injection5.3 Medium
- westboy cicadascmswestboy CicadasCMS Scheduled Task save os command injection5.1 Medium
- zhenfeng13 my-bbszhenfeng13 My-BBS cross-site request forgery5.3 Medium
- zhenfeng13 my-bbszhenfeng13 My-BBS Endpoint UploadController.java upload unrestricted upload5.3 Medium
- dazhouda lecmsdazhouda lecms Edit Profile admin cross site scripting4.8 Medium
- sarrionandia tournatracksarrionandia tournatrack Jinja2 Template check_id.py injection4.8 Medium
- thautwarm vscode-dianathautwarm vscode-diana Jinja2 Template Gen.py injection4.8 Medium
- tenda i24, w12, i24 firmware +1 more +3 moreTenda W12/i24 httpd cgiSysScheduleRebootSet stack-based overflow8.7 High
- tenda i24, w12, i24 firmware +1 more +3 moreTenda W12/i24 httpd cgiPingSet stack-based overflow8.7 High
- songquanpeng one-apisongquanpeng one-api System Setting cross site scripting4.8 Medium
- wcmsWCMS AnonymousController.php sql injection6.9 Medium
- wcmsWCMS AnonymousController.php sql injection6.9 Medium
- wcmsWCMS Advertisement Image AdvadminController.php sub unrestricted upload5.1 Medium
- bobbingwide sb chart blockSB Chart block <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter6.4 Medium
- codename065 download managerDownload Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion8.8 High
- codeflist wordpress plugin smart product reviewWordpress Plugin Smart Product Review <= 1.0.4 - Unauthenticated Arbitrary File Upload9.8 Critical
- seacmsSeaCMS admin_topic.php sql injection5.1 Medium
- connections-pro wp-syntaxWP-Syntax <= 1.2 - Author+ Potential ReDoS7.5 High
- qriouslad debug log manager – conveniently monitor and inspect errorsDebug Log Manager <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting7.2 High
- hiddenpearls insert headers and footersWP Headers And Footers <= 3.1.1 - Cross-Site Request Forgery to Arbitrary Options Update7.5 High
- lambertgroup clever - html5 radio player with history - shoutcast and icecast - elementor widget addonCLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon <= 2.4 - Unauthenticated Arbitrary File Read7.5 High
- themesflat addons for elementorThemesflat Addons For Elementor <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bdthemes element pack – widgets, templates & addons for elementorElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting6.4 Medium
- liquidthemes ai hub - startup & technology wordpress themeAIHub <= 1.3.7 - Unauthenticated Arbitrary File Upload in generate_image9.8 Critical
- mhmrajib jobwp – job board, job listing, career page and recruitment pluginJobWP – Job Board, Job Listing, Career Page and Recruitment Plugin <= 2.3.9 - Unauthenticated SQL Injection7.5 High
- wpeverest user registration pro – custom registration form, login form, and user profile wordpress pluginUser Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User Deletion4.3 Medium
- edge-themes urbango membershipUrbanGo Membership <= 1.0.4 - Unauthenticated Privilege Escalation9.8 Critical
pcapplusplusOSS-FuzzHeap-buffer-overflow in pcpp::TelnetLayer::toStringNo scoreopenthreadOSS-FuzzStack-buffer-overflow in ot::Cli::Utils::OutputLineNo score- ssl.comSSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes...6.4 Medium
- pritunl pritunl-clientIn Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate...8.2 High
- mjson project mjsonmystrtod in mjson 1.2.7 requires more than a billion iterations during processing of certain...2.9 Low
- cjson project cjsoncJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b":...2.9 Low
- 7-zip7-Zip through 24.09 does not report an error for certain invalid xz files, involving stream flags...2.5 Low
- 7-zip7-Zip through 24.09 does not report an error for certain invalid xz files, involving block flags...2.5 Low
- Show moreLoading…