CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- sherpa orchestrator, sherparpa sherpa orchestrator +1 moreIn Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with...5.4 Medium
- sherpa orchestrator, sherparpa sherpa orchestrator +1 moreIn Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an...3.5 Low
- sherpa orchestrator, sherparpa sherpa orchestrator +1 moreIn Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for...4.4 Medium
- sherpa orchestrator, sherparpa sherpa orchestrator +1 moreIn Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new...6.4 Medium
- netscout ngeniusoneNETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper...7.5 High
- netscout ngeniusoneNETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR...9.8 Critical
- netscout ngeniusoneNETSCOUT nGeniusONE before 6.4.0 b2350 allows Stored Cross-Site Scripting (XSS) via a certain...6.1 Medium
- netscout ngeniusoneNETSCOUT nGeniusONE before 6.4.0 b2350 allows Technical Information Disclosure via a Stack Trace.7.5 High
- netscout ngeniusoneNETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module.7.5 High
- netscout ngeniusoneNETSCOUT nGeniusONE before 6.4.0 b2350 allows local users to leverage Insecure Permissions for...7.1 High
- No product listedNETSCOUT nGeniusONE before 6.4.0 b2350 has a Weak Sudo Configuration.9.8 Critical
- netscout ngeniusoneNETSCOUT nGeniusONE before 6.4.0 b2350 allows Arbitrary File Creation by authenticated users.6.5 Medium
- No product listedAn issue in the Printer Manager Systm of Entrust Corp Printer Manager D3.18.4-3 and below allows...6.5 Medium
- mytel telecom online account systemAn issue in Mytel Telecom Online Account System v1.0 allows attackers to bypass the OTP...7.0 High
- No product listedMultiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.4 and CO2Scope <= 1.3.4 allows...6.5 Medium
- codeastro bus ticket booking systemCodeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket...9.8 Critical
- andamiro pump it upAndamiro Pump It Up 20th Anniversary (aka Double X or XX/2019) 1.00.0-2.08.3 allows a physically...2.4 Low
- albedo telecom net.time - ptp/ntp clock (serial no. nbc0081p)ALBEDO Telecom Net.Time - PTP/NTP Clock Insufficient Session Expiration8.5 High
- vestel ac charger evc04Vestel AC Charger Exposure of Sensitive System Information to an Unauthorized Control Sphere8.7 High
- planet technology wgs-4215-8t2s, wgs-804hpt-v2 +1 morePlanet Technology Network Products Missing Authentication for Critical Function9.3 Critical
- planet technology uni-nms-litePlanet Technology Network Products Use of Hard-coded Credentials9.3 Critical
- planet technology uni-nms-litePlanet Technology Network Products Use of Hard-coded Credentials9.3 Critical
- planet technology wgs-4215-8t2s, wgs-804hpt-v2 +1 morePlanet Technology Network Products OS Command Injection9.3 Critical
- planet technology uni-nms-litePlanet Technology Network Products OS Command Injection9.3 Critical
- wpquark eform - wordpress form buildereForm <= 4.18.0 - Unauthenticated Stored Cross-Site Scripting7.2 High
- mgyura breeze displayBreeze Display <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal_size Parameter6.4 Medium
- miraheze managewikiManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection4.4 Medium
- hcl software leap, hcltech hcl leap +1 moreHCL Leap is affected by Cross-site scripting (XSS)4.6 Medium
- hcl software leap, hcltech hcl leap +1 moreHCL Leap is affected by an unrestricted upload of file with dangerous type vulnerability4.6 Medium
- hcl software leap, hcltech hcl leap +1 moreHCL Leap is affected by missing "no cache" headers3.2 Low
- hcl software leap, hcltech hcl leap +1 moreHCL Leap is affected by missing "no cache" headers3.2 Low
- johnson controls istar configuration utility (icu)Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool9.3 Critical
- sap netweaver, sap se netweaver (visual composer development server) +1 moreMissing Authorization check in SAP NetWeaver (Visual Composer development server)10.0 Critical
- @tanstack react-routerReact Router allows pre-render data spoofing on React-Router framework mode8.2 High
- @tanstack react-routerReact Router allows a DoS via cache poisoning by forcing SPA mode7.5 High
- hcl software leap, hcltech hcl leap +1 moreHCL Leap is affected by a Cross-site scripting (XSS) vulnerability7.1 High
- hcl software leap, hcltech hcl leap +1 moreHCL Leap is affected by a disclosure of private personal information vulnerability5.3 Medium
- hcl software leap, hcltech hcl leap +1 moreHCL Leap is affected by a cross-site scripting (XSS) vulnerability6.3 Medium
- hcl software leap, hcltech hcl leap +1 moreHCL Leap is affected by a cross-site scripting (XSS) vulnerability3.7 Low
- hcl software leap, hcltech hcl leap +1 moreHCL Leap is affected by a cross-site scripting (XSS) vulnerability6.5 Medium
- hcl software leap, hcltech hcl leap +1 moreHCL Leap is affected by improper access control4.1 Medium
- nghialuu zalo official live chatWordPress Zalo Official Live Chat plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability5.4 Medium
- djjmz social counterWordPress Social Counter plugin <= 2.0.5 - PHP Object Injection Vulnerability7.2 High
- devignstudiosltd covid-19 (coronavirus) update your customersWordPress COVID-19 (Coronavirus) Update Your Customers plugin <= 1.5.1 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- ldrumm unsafe mimetypesWordPress Unsafe Mimetypes plugin <= 0.1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- michael cannon flickr shortcode importerWordPress Flickr Shortcode Importer plugin <= 2.2.3 - PHP Object Injection Vulnerability7.2 High
- ankur vishwakarma wp avcl automation helper (formerly wpflyleads)WordPress WP AVCL Automation Helper (formerly WPFlyLeads) plugin <= 3.4 - Server Side Request Forgery (SSRF) Vulnerability4.9 Medium
- wpfable fable extraWordPress Fable Extra plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- m.code media library downloaderWordPress Media Library Downloader plugin <= 1.3.1 - Broken Access Control Vulnerability4.3 Medium
- derek springer beerxml shortcodeWordPress BeerXML Shortcode plugin <= 0.7.1 - Server Side Request Forgery (SSRF) Vulnerability6.4 Medium
- Show moreLoading…