CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- yxj2018 springboot-vue-onlineexamYXJ2018 SpringBoot-Vue-OnlineExam API improper authentication6.3 Medium
- No product listedA cross-site scripting (reflected XSS) vulnerability was found in Mettler Toledo FreeWeight.Net...6.1 Medium
- No product listedLabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve...9.8 Critical
- No product listedDPMAdirektPro 4.1.5 is vulnerable to DLL Hijacking. It happens by placing a malicious DLL in a...7.8 High
- No product listedMuM (aka Mensch und Maschine) MapEdit (aka mapedit-web) 24.2.3 is vulnerable to SQL Injection...9.8 Critical
- No product listedCodemers KLIMS 1.6.DEV allows Python code injection. A user can provide Python code as an input...7.3 High
- codemers klimsCodemers KLIMS 1.6.DEV lacks a proper access control mechanism, allowing a normal KLIMS user to...7.3 High
- tcpwave ddiTCPWave DDI 11.34P1C2 allows Remote Code Execution via Unrestricted File Upload (combined with...9.8 Critical
epiphanyopenSUSE,epiphany-browserDebian +1 moreEpiphany: insecure external protocol invocation in epiphany8.0 High- dlink dir-816 firmwareD-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in /goform/delRouting.6.5 Medium
- No product listedFrancois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in...7.3 High
- horizondatasys rollback rx proIn Rollback Rx Professional 12.8.0.0, the driver file shieldm.sys allows local users to cause a...7.0 High
- open5gsAn issue in UPF in Open5GS UPF versions up to v2.7.2 results an assertion failure vulnerability...7.5 High
- totolink ex1200t firmwareTOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution...9.8 Critical
- totolink ex1200t firmwareTOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution...9.8 Critical
- totolink a810r firmware, a950rg firmware +1 moreTOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to contain a...9.8 Critical
- totolink a3000ru firmware, a3100r firmware, a800r firmware +3 more +5 moreTOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution...9.8 Critical
- totolink a3000ru firmware, a3100r firmware, a800r firmware +3 more +5 moreTOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution...9.8 Critical
- totolink a3000ru firmware, a3100r firmware, a800r firmware +3 more +5 moreTOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu...9.8 Critical
- totolink a3000ru firmware, a3100r firmware, a800r firmware +3 more +5 moreTOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu...7.3 High
- totolink a3000ru firmware, a3100r firmware, a800r firmware +3 more +5 moreTOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu...7.3 High
- totolink a810r firmwareTOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a hardcoded password for the...6.5 Medium
- totolink a810r firmwareTOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a stack overflow via the...8.8 High
- totolink a3000ru firmware, a3100r firmware, a830r firmware +1 more +3 moreTOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c...7.3 High
- totolink a3000ru firmware, a3100r firmware, a830r firmware +1 more +3 moreTOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c...7.3 High
- totolink a3000ru firmware, a3100r firmware, a830r firmware +1 more +3 moreTOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c...7.3 High
- totolink a810r firmwareTOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in...9.8 Critical
nasirkhan/laravel-starterPackagistLaravel Starter Cross Site Scripting (XSS)6.1 Medium- samba pppThe passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.9.3 Critical
- No product listedA stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg...5.4 Medium
- No product listedA stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal...5.4 Medium
- nextu fleta ax1500 firmwareNEXTU FLETA AX1500 WIFI6 Router v1.0.3 was discovered to contain a stack overflow via the url...7.3 High
- ctan mimetexAn issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a...9.8 Critical
- ctan mimetexDirectory Traversal vulnerability in forkosh Mime Tex before v.1.77 allows an attacker to execute...7.3 High
- openresty lua-nginx-moduleAn issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct...7.7 High
- mayurik sacco management systemSacco Management system v1.0 was discovered to contain a SQL injection vulnerability via the...9.8 Critical
- mayurik online student management systemA stored cross-site scripting (XSS) vulnerability fin Student Management System v1.0 allows...6.1 Medium
- oretnom23 student study center desk management systemAn issue in Student Study Center Desk Management System v1.0 allows attackers to bypass...9.8 Critical
- kishan0725 hospital management systemAn arbitrary file upload vulnerability in the component /jquery-file-upload/server/php/index.php...9.8 Critical
- digitaldruid hoteldruidA cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute...6.1 Medium
- yxj2018 springboot-vue-onlineexamYXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password change5.3 Medium
- ibm maximo asset managementIBM Maximo Asset Management server-side request forgery3.8 Low
- markparticle webservermarkparticle WebServer Login httprequest.cpp sql injection6.9 Medium
- minio operatorMinio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS6.9 Medium
- markparticle webservermarkparticle WebServer Registration httprequest.cpp sql injection6.9 Medium
- markparticle webservermarkparticle WebServer buffer.cpp HasWritten buffer overflow6.9 Medium
- panhainan ds-javapanhainan DS-Java cross-site request forgery5.3 Medium
- step-security harden-runnerHarden-Runner Evasion of 'disable-sudo' policy6.0 Medium
- miraheze managewikiManageWiki has SQL injection vulnerability in NamespaceMigrationJob8.0 High
- adeptlanguage adeptAdept exposed the GITHUB_TOKEN in workflow run artifact9.8 Critical
- Show moreLoading…