CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- moodleMoodle: unauthenticated rest api user data exposure7.5 High
- moodleMoodle: idor when accessing the cohorts report4.3 Medium
- moodleMoodle: idor in messaging web service allows access to some user details4.3 Medium
- moodleMoodle: ajax section delete does not respect course_can_delete_section()4.3 Medium
- moodleMoodle: reflected xss risk in policy tool5.4 Medium
- moodleMoodle: authenticated remote code execution risk in the moodle lms equella repository8.8 High
- moodleMoodle: authenticated remote code execution risk in the moodle lms dropbox repository8.8 High
- moodleMoodle: idor in web service allows users enrolled in a course to access some details of other users4.3 Medium
- moodleMoodle: csrf risk in brickfield tool's analysis request action8.8 High
- moodleMoodle: csrf token exposure via url in moodle mod_data module3.1 Low
- moodleMoodle: idor in moodle rss block allows unauthorized access to rss feeds4.3 Medium
- moodleMoodle: csrf risk in moodle user tours manager allows tour duplication3.5 Low
- moodleMoodle: moodle assignment submission search leaks anonymous student identities4.3 Medium
- moodleMoodle: partial data exposure in moodle before completing multi-factor authentication4.3 Medium
- moodleMoodle: user dos and name disclosure via idor in moodle mfa email factor revoke action7.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab3.5 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was...4.9 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs4.3 Medium
- jetbrains riderIn JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite...5.4 Medium
- moodleMoodle: moodle allows course self-enrolment before completing mfa4.3 Medium
- viasat eg1000, eg1020, rg1100 +2 more +4 moreUnauthenticated Remote Code Execution7.7 High
- viasat eg1000, eg1020, em4100 +6 more +8 moreSNORE Interface Unauthenticated Remote Code Execution7.7 High
fast-ablecrates.iofast-able is vulnerable to DoS attack through insecure method8.7 High- aonetheme service finder bookingsService Finder Bookings <= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'9.8 Critical
- westguard ws form lite – drag & drop contact form builderWS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.10.35 - Missing Authorization to Unauthenticated Sensitive Information Exposure5.3 Medium
- eyecix jobsearch wp job boardJobSearch WP Job Board <= 2.9.2 - Authentication Bypass via Social Logins8.1 High
- ibm maximo asset managementIBM Maximo Asset Management cross-site scripting5.5 Medium
- teconcetheme mayosis coreMayosis Core <= 5.4.1 - Unauthenticated Arbitrary File Read7.5 High
govulncheck-vulndbopenSUSESecurity update for govulncheck-vulndbNo score- olarmarius 1 decembrie 19181 Decembrie 1918 <= 1.dec.2012 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- seatheme bm content builderBM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- alphaefficiencyteam custom login and registrationWordPress Custom Login and Registration plugin <= 1.0.0 - Broken Access Control vulnerability5.4 Medium
- mythemeshop wp quizWordPress WP Quiz plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpswings upsell funnel builder for woocommerce – create upsells, cross-sells, order bumps, frequently bought, and popups.Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation5.3 Medium
- codeandreload custom admin-bar favoritesCustom Admin-Bar Favorites <= 0.1 - Reflected Cross-Site Scripting6.1 Medium
- odin design vikingerVikinger <= 1.9.30 - Authenticated (Subscriber+) Privilege Escalation via 'vikinger_user_meta_update_ajax'8.8 High
- rafe007 ajax comment form cstAjax Comment Form CST <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- rohanpawale add google +1 (plus one) social share buttonAdd Google +1 (Plus one) social share Button <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- icegram express, unknown icegram express +1 moreEmail Subscribers < 5.7.50 - Admin+ Stored XSS in Template6.1 Medium
- buildwps prevent direct access – protect wordpress filesPrevent Direct Access – Protect WordPress Files <= 2.8.8 - Unauthenticated Sensitive Information Exposure5.3 Medium
- buildwps prevent direct access – protect wordpress filesPrevent Direct Access 2.8.6 - 2.8.8.2 - Incorrect Authorization to Authenticated (Contributor+) Multiple Media Actions5.4 Medium
- bitpressadmin bit form – custom contact form, multi step, conversational form & payment form builderContact Form by Bit Form <= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload4.9 Medium
- mitsubishi electric corporation cc-link ie tsn analog-digital converter module nz2gn2b-60ad4, cc-link ie tsn analog-digital converter module nz2gn2s-60ad4, cc-link ie tsn digital-analog converter module nz2gn2b-60da4 +46 more +48 moreImproper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric...7.5 High
- joedolson able player, accessible html5 media playerAble Player, accessible HTML5 media player <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload Parameter6.4 Medium
- hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 moreShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter6.5 Medium
- quantum stornextQuantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and...7.2 High
- quantum stornextQuantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE)...9.9 Critical
- autonomy openplcOpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access...7.5 High
- k3sCNCF K3s Kubernetes kubelet configuration exposes credentials6.8 Medium
- backdropcms flagAn XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a...6.4 Medium
- Show moreLoading…