CVEs published April 22, 2025
113 CVEs were published on April 22, 2025: 19 critical, 34 high. 1 is now in CISA KEV.
- Published
- 113
- Critical
- 19
- High
- 34
- Medium
- 59
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 23
Most affected products
- NVIDIA NeMo Framework
- 3
- oceanwp Ocean Extra
- 3
- codepeople Appointment Booking Calendar
- 2
- IBM Hardware Management Console - Power Systems
- 2
- jmix-framework jmix · io.jmix.localfs:jmix-localfs
- 2
- Tecnick TCExam
- 2
- Unblu Spark
- 2
- Zyxel USG FLEX H series uOS firmware
- 2
- alttextai Download Alt Text AI
- 1
- Apache Software Foundation Apache Kvrocks
- 1
Critical 19
- CVE-2025-37087A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary…Hewlett Packard Enterprise (HPE) HPE Performance Cluster Ma…
- CVE-2025-32965Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2XRPLF xrpl.js · xrpl
- CVE-2025-34028Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path TraversalCommvault Command Center Innovation Release
- CVE-2025-1950IBM Hardware Management Console - Power Systems command executionIBM Hardware Management Console - Power Systems
- CVE-2023-43958An arbitrary file upload vulnerability in the component /jquery-file-upload/server/php/index.php of Hospital Management System v4.0 allows…
- CVE-2023-44752An issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to…
- CVE-2023-44755Sacco Management system v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /sacco/ajax.php.
- CVE-2024-40446An issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted script
- CVE-2024-58250The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges.Samba ppp
- CVE-2025-28024TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the cstecgi.cgi
- CVE-2025-28034TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903…
- CVE-2025-28035TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function…
- CVE-2025-28036TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg…
- CVE-2025-28037TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to contain a pre-auth remote command execution…
- CVE-2025-28038TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setWebWlanIdx…
- CVE-2025-28039TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setUpgradeFW…
- CVE-2025-43946TCPWave DDI 11.34P1C2 allows Remote Code Execution via Unrestricted File Upload (combined with Path Traversal).
- CVE-2025-43949MuM (aka Mensch und Maschine) MapEdit (aka mapedit-web) 24.2.3 is vulnerable to SQL Injection that allows an attacker to execute malicious…
- CVE-2025-43951LabVantage before LV 8.8.0.13 HF6 allows local file inclusion.
High 34
- CVE-2025-23251NVIDIA NeMo Framework contains a vulnerability where a user could cause an improper control of generation of code by remote code execution.NVIDIA NeMo Framework
- CVE-2025-23250NVIDIA NeMo Framework contains a vulnerability where an attacker could cause an improper limitation of a pathname to a restricted…NVIDIA NeMo Framework
- CVE-2025-23249NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution.NVIDIA NeMo Framework
- CVE-2025-3767SQL Injection in Centreon BAM boolean KPI listingCentreon BAM
- CVE-2025-1951IBM Hardware Management Console - Power Systems command executionIBM Hardware Management Console - Power Systems
- CVE-2025-23176Tecnick – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Tecnick TCExam
- CVE-2025-2092Remote site authentication secrets written to web logCheckmk
- CVE-2025-46252WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.2 - SQL Injection vulnerabilityKofi Mokome Message Filter for Contact Form
- CVE-2025-46251WordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.3.3 - CSRF to Stored XSS vulnerabilitye4jvikwp VikRestaurants
- CVE-2025-46242WordPress Watu Quiz plugin <= 3.4.3 - SQL Injection VulnerabilityBob Watu Quiz
- CVE-2025-46241WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerabilitycodepeople Appointment Booking Calendar
- CVE-2025-3519Replace uploaded files knowing the file upload IDUnblu Spark
- CVE-2025-26413Apache Kvrocks: The server was crashed by the negative offsetApache Software Foundation Apache Kvrocks
- CVE-2025-2594User Registration & Membership < 4.1.3 - Authentication BypassUser Registration & Membership
- CVE-2024-13569Front End Users <= 3.2.32 - Reflected XSSFront End Users
- CVE-2025-3616Greenshift 11.4 - 11.4.5 - Authenticated (Subscriber+) Arbitrary File Uploadwpsoul Greenshift – animation and page builder blocks
- CVE-2024-46899Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center Analyzer viewpoint OVFHitachi Ops Center Common Services · Hitachi Ops Center Ana…
- CVE-2025-1731An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from…Zyxel USG FLEX H series uOS firmware
- CVE-2025-3854H3C GR-3000AX HTTP POST Request aspForm Edit_List_SSID buffer overflowH3C GR-3000AX
- CVE-2024-33452An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD…
- CVE-2024-40445A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append…
- CVE-2024-46546NEXTU FLETA AX1500 WIFI6 Router v1.0.3 was discovered to contain a stack overflow via the url parameter at /boafrm/formFilter.
- CVE-2025-28026TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129…
- CVE-2025-28027TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129…
- CVE-2025-28029TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129…
Show all 34 entriesShow fewer entries
- CVE-2025-28030TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a stack overflow via the startTime and endTime parameters in…
- CVE-2025-28032TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903…
- CVE-2025-28033TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903…
- CVE-2025-29339An issue in UPF in Open5GS UPF versions up to v2.7.2 results an assertion failure vulnerability in PFCP session parameter validation.
- CVE-2025-29547In Rollback Rx Professional 12.8.0.0, the driver file shieldm.sys allows local users to cause a denial of service because of a null…
- CVE-2025-29621Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My…
- CVE-2025-43947Codemers KLIMS 1.6.DEV lacks a proper access control mechanism, allowing a normal KLIMS user to perform all the actions that an admin can…
- CVE-2025-43948Codemers KLIMS 1.6.DEV allows Python code injection.
- CVE-2025-43950DPMAdirektPro 4.1.5 is vulnerable to DLL Hijacking.
Medium, low and unrated 60
- CVE-2025-37088A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS).Hewlett Packard Enterprise (HPE) HPE Cray Data Virtualizati…
- CVE-2025-27087A vulnerability in the kernel of the Cray Operating System (COS) could allow an attacker to perform a local Denial of Service (DoS) attack.Hewlett Packard Enterprise (HPE) HPE Cray Operating System
- CVE-2025-23253NVIDIA NvContainer service for Windows contains a vulnerability in its usage of OpenSSL, where an attacker could exploit a hard-coded…NVIDIA App
- CVE-2025-31328Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)SAP_SE SAP S/4 HANA
- CVE-2025-31327OData meta-data property entity tampering in SAP Field LogisticsSAP_SE SAP Field Logistics
- CVE-2025-32961CUBA JPA Web API Vulnerable to Cross-Site Scripting (XSS) in the /download Endpointcuba-platform jpawebapi · com.haulmont.addon.jpawebapi:jpaw…
- CVE-2025-32960CUBA Generic REST API Vulnerable to Cross-Site Scripting (XSS) in the /files Endpointcuba-platform restapi · com.haulmont.addon.restapi:restapi-…
- CVE-2025-32959CUBA Vulnerable to Denial of Service (DoS) in the File Storagecuba-platform cuba · com.haulmont.cuba:cuba-core
- CVE-2025-32951io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST APIjmix-framework jmix · io.jmix.rest:jmix-rest
- CVE-2025-32952io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storagejmix-framework jmix · io.jmix.localfs:jmix-localfs
- CVE-2025-32964ManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensionsmiraheze ManageWiki
- CVE-2025-32963Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STSminio operator · github.com/minio/operator
- CVE-2025-32950io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storagejmix-framework jmix · io.jmix.localfs:jmix-localfs
- CVE-2025-32788OctoPrint Authenticated Reverse Proxy Page Authentication BypassOctoPrint
- CVE-2025-27907IBM WebSphere Application Server server-side request forgeryIBM WebSphere Application Server
- CVE-2025-23175Tecnick - Multiple XSS (CWE-79)Tecnick TCExam
- CVE-2024-11299Memberpress <= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information ExposureMemberpress
- CVE-2025-3458Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'oceanwp Ocean Extra
- CVE-2025-3472Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Executionoceanwp Ocean Extra
- CVE-2025-3457Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeoceanwp Ocean Extra
- CVE-2025-46254WordPress Visual Composer Website Builder plugin <= 45.10.0 - Cross Site Scripting (XSS) vulnerabilityVisual Composer Website Builder
- CVE-2025-46253WordPress GutenKit plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityAtaur R GutenKit
- CVE-2025-46250WordPress VForm plugin <= 3.1.14 - Cross Site Scripting (XSS) VulnerabilityVikas Ratudi VPSUForm
- CVE-2025-46249WordPress Simple calendar for Elementor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) VulnerabilityMichael Simple calendar for Elementor
- CVE-2025-46247WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerabilitycodepeople Appointment Booking Calendar
Show all 60 entriesShow fewer entries
- CVE-2025-46246WordPress CM Answers plugin <= 3.3.3 - Cross Site Request Forgery (CSRF) VulnerabilityCreativeMindsSolutions CM Answers
- CVE-2025-46245WordPress CM Ad Changer plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) VulnerabilityCreativeMindsSolutions CM Ad Changer
- CVE-2025-46244WordPress Advanced Linked Variations for Woocommerce plugin <= 1.0.3 - Broken Access Control VulnerabilityDotstore Advanced Linked Variations for Woocommerce
- CVE-2025-46243WordPress Recover abandoned cart for WooCommerce plugin <= 2.2 - Cross Site Request Forgery (CSRF) Vulnerabilitysonalsinha21 Recover abandoned cart for WooCommerce
- CVE-2025-46240WordPress Simple Download Counter plugin <= 2.2 - Cross Site Scripting (XSS) VulnerabilityJeff Starr Simple Download Counter
- CVE-2025-46239WordPress Theme Switcha plugin <= 3.4 - Cross Site Scripting (XSS) VulnerabilityJeff Starr Theme Switcha
- CVE-2025-46238WordPress List Last Changes plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerabilityrbaer List Last Changes
- CVE-2025-46237WordPress Link Library plugin <= 7.8 - Cross Site Scripting (XSS) VulnerabilityYannick Lefebvre Link Library
- CVE-2025-46236WordPress HTML Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) VulnerabilityLink Software HTML Forms
- CVE-2025-46235WordPress SKT Blocks – Gutenberg based Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerabilitysonalsinha21 SKT Blocks
- CVE-2025-46233WordPress Sirv plugin <= 7.5.3 - Cross Site Scripting (XSS) VulnerabilitySirv CDN and Image Hosting Sirv
- CVE-2025-46232WordPress Download Alt Text AI plugin <= 1.9.93 - Broken Access Control Vulnerabilityalttextai Download Alt Text AI
- CVE-2025-46231WordPress affiliate-toolkit plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) VulnerabilitySERVIT Software Solutions affiliate-toolkit
- CVE-2025-46229WordPress Textmetrics plugin <= 3.6.2 - Cross Site Scripting (XSS) VulnerabilityIsrapil Textmetrics
- CVE-2025-46228WordPress Event post plugin <= 5.9.11 - Cross Site Scripting (XSS) VulnerabilityBastien Ho Event post
- CVE-2025-46227WordPress Custom Related Posts plugin <= 1.7.4 - Cross Site Scripting (XSS) VulnerabilityBrecht Custom Related Posts
- CVE-2025-46226WordPress MPL-Publisher plugin <= 2.18.0 - Cross Site Scripting (XSS) Vulnerabilityferranfg MPL-Publisher
- CVE-2025-46225WordPress Post in page for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityMichael Post in page for Elementor
- CVE-2025-3518File upload functionality possible even when disabledUnblu Spark
- CVE-2025-3814Tax Switch for WooCommerce <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via class-name Parameterwijnbergdevelopments Tax Switch for WooCommerce
- CVE-2025-2839WP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingvjinfotech WP Import Export Lite
- CVE-2025-2300Information exposure vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVAHitachi Ops Center Common Services
- CVE-2025-3577UNSUPPORTED WHEN ASSIGNED A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version…Zyxel AMG1302-T10B firmware
- CVE-2025-1732An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and…Zyxel USG FLEX H series uOS firmware
- CVE-2025-3856xxyopen Novel-Plus searchByPage sql injectionxxyopen Novel-Plus
- CVE-2025-3855CodeCanyon RISE Ultimate Project Manager Profile Picture save_profile_image resource injectionCodeCanyon RISE Ultimate Project Manager
- CVE-2025-3850YXJ2018 SpringBoot-Vue-OnlineExam API improper authenticationYXJ2018 SpringBoot-Vue-OnlineExam
- CVE-2023-43378A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted…
- CVE-2023-44753A stored cross-site scripting (XSS) vulnerability fin Student Management System v1.0 allows attackers to execute arbitrary web scripts or…
- CVE-2024-53568A stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows…
- CVE-2024-53569A stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg Personal Management System v1.4.65 allows…
- CVE-2025-26159Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature.nasirkhan/laravel-starter
- CVE-2025-28031TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a hardcoded password for the telnet service in product.ini.
- CVE-2025-29743D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in /goform/delRouting.
- CVE-2025-43952A cross-site scripting (reflected XSS) vulnerability was found in Mettler Toledo FreeWeight.Net Web Reports Viewer 8.4.0 (440).