CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- 201206030 novel-plus20120630 Novel-Plus CrawlController.java addCrawlSource missing authentication6.9 Medium
- 201206030 novel-plus20120630 Novel-Plus LogController.java list improper authorization5.3 Medium
- 201206030 novel-plus20120630 Novel-Plus LogController.java deleteIndex improper authorization5.3 Medium
els-os-releaseTuxCareUpdate of els-os-releaseNo score- 201206030 novel-plus20120630 Novel-Plus SessionController.java list missing authentication6.9 Medium
- wiesemann & theis com-server 20ma, com-server oem, com-server poe 3x isolated +2 more +4 moreCom-Server Exposed via Weak TLS9.1 Critical
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System manage-art-medium.php sql injection6.9 Medium
- sick ag flx3-cpuc200, tdc-x401gl +1 moreReuse of salt3.7 Low
- seventhqueen kleoWordPress Kleo theme < 5.4.4 - Broken Access Control vulnerability5.3 Medium
- sick ag flx0-gpnt100, flx3-cpuc200 +1 moreUnauthenticated change of IP adress7.5 High
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System aboutus.php sql injection6.9 Medium
- playeduos playedu, playeduxyz playedu 开源培训系统 +1 moreplayeduxyz PlayEdu 开源培训系统 User Avatar create server-side request forgery5.1 Medium
- seiko epson corporation epson printer drivers for windows osMultiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access...8.4 High
redmineDebianRedmine Custom Query cross site scripting5.1 Medium- tenda i24, w12, i24 firmware +1 more +3 moreTenda W12/i24 httpd modules cgidhcpsCfgSet stack-based overflow8.7 High
- spring bootSpring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed7.3 High
- youyiio beyongcmsyouyiio BeyongCms Document Management Page Upload.html unrestricted upload5.1 Medium
- phpgurukul covid19 testing management systemPHPGurukul COVID19 Testing Management System patient-report.php sql injection6.9 Medium
- phpgurukul covid19 testing management systemPHPGurukul COVID19 Testing Management System password-recovery.php sql injection6.9 Medium
- unknown wordpress tag, category, and taxonomy manager, taxopress +1 moreAI Autotagger < 3.30.0 - Admin+ Stored XSS3.5 Low
- plechevandrey wp-recallWP-Recall < 16.26.12 - Admin+ Stored XSS3.5 Low
- bowo admin and site enhancements (ase), wpase admin and site enhancements +1 moreAdmin and Site Enhancements (ASE) < 7.6.10 - Password Protection Bypass5.3 Medium
- refindplusrepo refindplusRefindPlusRepo RefindPlus RP_ApfsIo.c InternalApfsTranslateBlock null pointer dereference6.8 Medium
- refindplusrepo refindplusRefindPlusRepo RefindPlus BootLog.c GetDebugLogFile null pointer dereference6.8 Medium
- scipopt scipscipopt scip File Descriptor genRandomLOPInstance.c main file descriptor consumption4.8 Medium
- seeyon oa web application system, zhiyuan oa web application system +1 moreSeeyon Zhiyuan OA Web Application System ssoproxy.jsp cross site scripting5.1 Medium
- seeyon oa web application system, zhiyuan oa web application system +1 moreSeeyon Zhiyuan OA Web Application System URL Parameter date.jsp cross site scripting5.1 Medium
- codeastro membership management systemCodeAstro Membership Management System renew.php sql injection6.9 Medium
- 104 corporation ehrms104 Corporation eHRMS - Reflected Cross-Site Scripting6.1 Medium
- dazhouda lecmsdazhouda lecms Personal Information Page index.php cross-site request forgery5.3 Medium
- totolink n150rt, n150rt firmware +1 moreTOTOLINK N150RT MAC Filtering Page home.htm cross site scripting4.8 Medium
- totolink n150rt, n150rt firmware +1 moreTOTOLINK N150RT LAN Settings Page fromStaticDHCP cross site scripting4.8 Medium
- totolink n150rt, n150rt firmware +1 moreTOTOLINK N150RT IP Port Filtering home.htm cross site scripting4.8 Medium
- totolink n150rt, n150rt firmware +1 moreTOTOLINK N150RT formWsc buffer overflow8.7 High
- totolink n150rt, n150rt firmware +1 moreTOTOLINK N150RT formWlwds buffer overflow8.7 High
- ipw metazoIPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because...10.0 Critical
- snowflake odbcIn Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL...3.3 Low
- phpgurukul hostel management systemA vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change...9.1 Critical
- phpgurukul user registration \& login and user management systemA critical vulnerability was found in PHPGurukul User Registration & Login and User Management...9.8 Critical
- phpgurukul online banquet booking systemAn issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary...9.8 Critical
- codeastro bus ticket booking systemCross-Site Scripting (XSS) vulnerability exists in the User Registration and User Profile...5.0 Medium
- newforma project center server, project center +1 moreNewforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET...4.9 Medium
- citrix workspaceOneVision Workspace before WS23.1 SR1 (build w31.040) allows arbitrary Java EL execution.4.9 Medium
- devexpressDevExpress before 23.1.3 allows AsyncDownloader SSRF.5.0 Medium
- devexpressDevExpress before 23.1.3 allows arbitrary TypeConverter conversion.3.5 Low
- devexpressDevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on...3.5 Low
- devexpressDevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.3.5 Low
- seppmailSEPPmail through 12.1.17 allows command injection within the Admin Portal. An authenticated...6.0 Medium
- thecartpress boot-store, boot store +1 moreThe TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php...7.2 High
- userminUsermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code...9.9 Critical
- Show moreLoading…