CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- code-projects patient record management systemcodeprojects Patient Record Management System edit_rpatient.php.php sql injection5.3 Medium
- ververica platformVerverica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct...5.0 Medium
- ververica platformVerverica Platform 2.14.0 contain an Reflected XSS vulnerability via a namespaces/default/formats...5.4 Medium
- quickjs project quickjsquickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading...5.6 Medium
- bellard quickjsquickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a...5.6 Medium
- nasa cryptolibIn NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to...3.5 Low
- nasa cryptolibNASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended...3.5 Low
- nasa cryptolibNASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use,...4.9 Medium
- nasa cryptolibNASA CryptoLib before 1.3.2 does not check the OTAR crypto function returned status, potentially...3.5 Low
- karaz karazalKaraz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI.7.2 High
- churchcrmChurchCRM Referer server-side request forgery6.3 Medium
- thememove edumall - professional lms education center wordpress themeEdumall <= 4.2.4 - Unauthenticated Local File Inclusion8.1 High
- anps theme pluginAnps Theme plugin <= 1.1.1 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- gl.inet gl-a1300 slate plus, gl-ar300m shadow, gl-ar300m16 shadow +20 more +22 moreGL.iNet GL-A1300 Slate Plus RPC plugins.so buffer overflow8.6 High
- gl.inet gl-a1300 slate plus, gl-ar300m shadow, gl-ar300m16 shadow +20 more +22 moreGL.iNet GL-A1300 Slate Plus Download Interface improper authorization5.1 Medium
- gl.inet gl-a1300 slate plus, gl-ar300m shadow, gl-ar300m16 shadow +20 more +22 moreGL.iNet GL-A1300 Slate Plus API redos6.9 Medium
- tychesoftwares order delivery date pro for woocommerce, unknown order delivery date +1 moreOrder Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update9.8 Critical
- aeropage sync for airtableAeropage Sync for Airtable <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion4.3 Medium
- aeropage sync for airtableAeropage Sync for Airtable <= 3.2.0 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- felipe152 integração entre eduzz e woocommerceIntegração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation8.8 High
- kiranpatil353 add custom page templateAdd custom page template <= 2.0.1 - Authenticated (Administrator+) PHP Code Injection to Remote Code Execution7.2 High
- bdthemes element pack, element pack – widgets, templates & addons for elementor +1 moreElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- artbees jupiter x coreJupiter X Core <= 4.8.11 - Unauthenticated PHP Object Injection via PHAR8.1 High
- wpxpro xpro elementor addons - pro, xpro addons for elementor +1 moreXpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code Execution8.8 High
- dorinabc create custom forms for wordpress with a smart form plugin for smart businesses – form builder for wordpressCreate custom forms for WordPress with a smart form plugin for smart businesses <= 1.2.4 - Unauthenticated Arbitrary Shortcode Execution7.3 High
pcre2OSS-FuzzNegative-size-param in recurse_update_offsetsNo scorelibphonenumberOSS-FuzzHeap-buffer-overflow in i18n::phonenumbers::UnicodeText::const_iterator::operator--No scoredistro-info-dataDebiandistro-info-data - database updateNo score- matthewwithanm markdownify, python-markdownify +1 moremarkdownify allows large headline prefixes such as <h9999999>, which causes memory consumption2.9 Low
- hackmd codimdCodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG...4.9 Medium
- hackmd codimdCodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript...4.9 Medium
- node-formidable formidableFormidable relies on hexoid to prevent guessing of filenames for untrusted executable content3.1 Low
- izarcIn IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an...6.1 Medium
- artifex ghostscriptIn Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8...4.5 Medium
- academiaerp student information system, serosoft academia student information system +1 moreAn arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information...6.4 Medium
- vancluever z2dz2d OOB composition could lead to invalid memory access and corruption7.3 High
- connectwise screenconnectScreenConnect Exposure to ASP.NET ViewState Code Injection8.1 High
- hcl software sx, hcltech hcl sx +1 moreHCL SX is affected by usage of a weak cryptographic algorithm6.5 Medium
- commvault, commvault web server +1 moreCommvault Web Server unspecified vulnerability8.7 High
- filez clientAn improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary...5.1 Medium
- filez clientA cross-site scripting vulnerability was reported in the FileZ client that could allow execution...5.1 Medium
- filez clientAn open redirect vulnerability was reported in the FileZ client that could allow information...5.1 Medium
@escape.tech/graphql-armor-cost-limitnpmGraphQL Armor Cost-Limit Plugin Bypass via Introspection Query Obfuscation5.3 Medium- steve-community steveSteve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks8.0 High
- fleetdm fleetFleet doesn’t validate a server’s certificate when connecting through SSH6.3 Medium
- suse rancherRancher users who can create Projects can gain access to arbitrary projects8.5 High
- haloHalo Vulnerable to Stored XSS and RCE via File Upload Bypass5.5 Medium
- langgenius difyDify Allows Unauthorized Access and Modification of APP Orchestration7.6 High
- craft cms cms, craftcms craft cms +1 moreCraft CMS Allows Remote Code Execution10.0 Critical
- moodleMoodle: hidden grades shown to users without permission on some grade reports5.3 Medium
- Show moreLoading…