# CVEs published 2025-04-28

88 CVEs were published on April 28, 2025: 7 critical, 12 high. Days are UTC.

- [CVE-2025-46328](https://cve.now/CVE-2025-46328.md): NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file (CVSS 3.3, snowflakedb snowflake-connector-nodejs · snowflake-sdk)
- [CVE-2025-46327](https://cve.now/CVE-2025-46327.md): Go Snowflake Driver has race condition when checking access to Easy Logging configuration file (CVSS 3.3, snowflakedb gosnowflake · github.com/snowflakedb/gosnowflake)
- [CVE-2025-46326](https://cve.now/CVE-2025-46326.md): Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration file (CVSS 3.3, snowflakedb snowflake-connector-net · Snowflake.Data)
- [CVE-2025-4039](https://cve.now/CVE-2025-4039.md): PHPGurukul Rail Pass Management System search-pass.php sql injection (CVSS 6.9, PHPGurukul Rail Pass Management System)
- [CVE-2025-4038](https://cve.now/CVE-2025-4038.md): code-projects Train Ticket Reservation System reservation stack-based overflow (CVSS 4.8, code-projects Train Ticket Reservation System)
- [CVE-2024-11922](https://cve.now/CVE-2024-11922.md): Input Validation vulnerability in Web Client emails that do not go through Secure Mail (CVSS 6.3, Fortra GoAnywhere MFT)
- [CVE-2025-0049](https://cve.now/CVE-2025-0049.md): Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0 (CVSS 3.5, Fortra GoAnywhere)
- [CVE-2024-10635](https://cve.now/CVE-2024-10635.md): Enterprise Protection S/MIME Opaque Signature Attachment Scanning Bypass (CVSS 6.1, Proofpoint Enterprise Protection)
- [CVE-2025-4037](https://cve.now/CVE-2025-4037.md): code-projects ATM Banking moneyWithdraw logic error (CVSS 4.8, code-projects ATM Banking)
- [CVE-2025-4036](https://cve.now/CVE-2025-4036.md): 201206030 Novel Chapter AuthorController.java updateBookChapter access control (CVSS 5.3, 201206030 Novel)
- [CVE-2025-4034](https://cve.now/CVE-2025-4034.md): projectworlds Online Examination System inser\_doc\_process.php sql injection (CVSS 6.9, projectworlds Online Examination System)
- [CVE-2025-3224](https://cve.now/CVE-2025-3224.md): Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion (CVSS 7.3, Docker Desktop)
- [CVE-2025-34491](https://cve.now/CVE-2025-34491.md): GFI MailEssentials \< 21.8 MultiNode Insecure Deserialization (CVSS 8.8, GFI MailEssentials)
- [CVE-2025-31651](https://cve.now/CVE-2025-31651.md): Apache Tomcat: Bypass of rules in Rewrite Valve (CVSS 9.8, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2025-31650](https://cve.now/CVE-2025-31650.md): Apache Tomcat: DoS via malformed HTTP/2 PRIORITY\_UPDATE frame (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2025-34490](https://cve.now/CVE-2025-34490.md): GFI MailEssentials \< 21.8 XXE Arbitrary File Read (CVSS 6.5, GFI MailEssentials)
- [CVE-2025-4033](https://cve.now/CVE-2025-4033.md): PHPGurukul Nipah Virus Testing Management System patient-search-report.php sql injection (CVSS 6.9, PHPGurukul Nipah Virus Testing Management System)
- [CVE-2025-34489](https://cve.now/CVE-2025-34489.md): GFI MailEssentials \< 21.8 Local Privilege Escalation (CVSS 7.8, GFI MailEssentials)
- [CVE-2025-4032](https://cve.now/CVE-2025-4032.md): inclusionAI AWorld shell\_tool.py subprocess.Popen os command injection (CVSS 2.3, inclusionAI AWorld · aworld)
- [CVE-2025-4031](https://cve.now/CVE-2025-4031.md): PHPGurukul Pre-School Enrollment System aboutus.php sql injection (CVSS 6.9, PHPGurukul Pre-School Enrollment System)
- [CVE-2024-12706](https://cve.now/CVE-2024-12706.md): SQL Injection vulnerability discovered in OpenText™ Digital Asset Management. (CVSS 2.1, OpenText™ Digital Asset Management.)
- [CVE-2025-4030](https://cve.now/CVE-2025-4030.md): PHPGurukul COVID19 Testing Management System search-report-result.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-4029](https://cve.now/CVE-2025-4029.md): code-projects Personal Diary Management System New Record addrecord stack-based overflow (CVSS 4.8, code-projects Personal Diary Management System)
- [CVE-2025-4028](https://cve.now/CVE-2025-4028.md): PHPGurukul COVID19 Testing Management System profile.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-43857](https://cve.now/CVE-2025-43857.md): net-imap rubygem vulnerable to possible DoS by memory exhaustion (CVSS 6.0, ruby net-imap · net-imap)
- [CVE-2025-4027](https://cve.now/CVE-2025-4027.md): PHPGurukul Old Age Home Management System rules.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2025-43854](https://cve.now/CVE-2025-43854.md): DIFY vulnerable to Clickjacking Attack (CVSS 2.3, langgenius dify)
- [CVE-2025-4026](https://cve.now/CVE-2025-4026.md): PHPGurukul Nipah Virus Testing Management System profile.php sql injection (CVSS 6.9, PHPGurukul Nipah Virus Testing Management System)
- [CVE-2025-4025](https://cve.now/CVE-2025-4025.md): itsourcecode Placement Management System registration.php sql injection (CVSS 6.9, itsourcecode Placement Management System)
- [CVE-2025-23377](https://cve.now/CVE-2025-23377.md): Dell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability. (CVSS 4.2, Dell PowerProtect Data Manager)
- [CVE-2025-23376](https://cve.now/CVE-2025-23376.md): Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used… (CVSS 2.3, Dell PowerProtect Data Manager Reporting)
- [CVE-2025-4024](https://cve.now/CVE-2025-4024.md): itsourcecode Placement Management System add\_drive.php sql injection (CVSS 6.9, itsourcecode Placement Management System)
- [CVE-2025-23375](https://cve.now/CVE-2025-23375.md): Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability. (CVSS 7.8, Dell PowerProtect Data Manager)
- [CVE-2025-4023](https://cve.now/CVE-2025-4023.md): itsourcecode Placement Management System add\_company.php sql injection (CVSS 6.9, itsourcecode Placement Management System)
- [CVE-2025-4022](https://cve.now/CVE-2025-4022.md): web-arena-x webarena evaluators.py HTMLContentEvaluator code injection (CVSS 5.3, web-arena-x webarena)
- [CVE-2025-4021](https://cve.now/CVE-2025-4021.md): code-projects Patient Record Management System edit\_spatient.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-4020](https://cve.now/CVE-2025-4020.md): PHPGurukul Old Age Home Management System contact.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2025-32472](https://cve.now/CVE-2025-32472.md): DoS attack by conducting a slowloris-type attack (CVSS 5.3, SICK AG SICK multiScan1XX · SICK AG SICK picoScan1XX)
- [CVE-2025-4019](https://cve.now/CVE-2025-4019.md): 20120630 Novel-Plus GeneratorController.java genCode missing authentication (CVSS 6.9, 20120630 Novel-Plus)
- [CVE-2025-4018](https://cve.now/CVE-2025-4018.md): 20120630 Novel-Plus CrawlController.java addCrawlSource missing authentication (CVSS 6.9, 20120630 Novel-Plus)
- [CVE-2025-4017](https://cve.now/CVE-2025-4017.md): 20120630 Novel-Plus LogController.java list improper authorization (CVSS 5.3, 20120630 Novel-Plus)
- [CVE-2025-4016](https://cve.now/CVE-2025-4016.md): 20120630 Novel-Plus LogController.java deleteIndex improper authorization (CVSS 5.3, 20120630 Novel-Plus)
- [CVE-2025-4015](https://cve.now/CVE-2025-4015.md): 20120630 Novel-Plus SessionController.java list missing authentication (CVSS 6.9, 20120630 Novel-Plus)
- [CVE-2025-3200](https://cve.now/CVE-2025-3200.md): Com-Server Exposed via Weak TLS (CVSS 9.1, Wiesemann & Theis Com-Server++ · Wiesemann & Theis Com-S… +3)
- [CVE-2025-4014](https://cve.now/CVE-2025-4014.md): PHPGurukul Art Gallery Management System manage-art-medium.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System)
- [CVE-2025-32471](https://cve.now/CVE-2025-32471.md): Reuse of salt (CVSS 3.7, SICK AG SICK FLX3-CPUC200 · SICK AG TDC-X401GL)
- [CVE-2025-39367](https://cve.now/CVE-2025-39367.md): WordPress Kleo theme \< 5.4.4 - Broken Access Control vulnerability (CVSS 5.3, SeventhQueen Kleo)
- [CVE-2025-32470](https://cve.now/CVE-2025-32470.md): Unauthenticated change of IP adress (CVSS 7.5, SICK AG SICK FLX0-GPNT100 · SICK AG SICK FLX3-CPUC200)
- [CVE-2025-4013](https://cve.now/CVE-2025-4013.md): PHPGurukul Art Gallery Management System aboutus.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System)
- [CVE-2025-4012](https://cve.now/CVE-2025-4012.md): playeduxyz PlayEdu 开源培训系统 User Avatar create server-side request forgery (CVSS 5.1, playeduxyz PlayEdu 开源培训系统)
- [CVE-2025-42598](https://cve.now/CVE-2025-42598.md): Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a… (CVSS 7.8, SEIKO EPSON printer drivers for Windows OS)
- [CVE-2025-4011](https://cve.now/CVE-2025-4011.md): Redmine Custom Query cross site scripting (CVSS 5.1, Redmine)
- [CVE-2025-4007](https://cve.now/CVE-2025-4007.md): Tenda W12/i24 httpd modules cgidhcpsCfgSet stack-based overflow (CVSS 8.7, Tenda W12 · Tenda i24)
- [CVE-2025-22235](https://cve.now/CVE-2025-22235.md): Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed (CVSS 7.3, Spring Boot · org.springframework.boot:spring-boot)
- [CVE-2025-4006](https://cve.now/CVE-2025-4006.md): youyiio BeyongCms Document Management Page Upload.html unrestricted upload (CVSS 5.1, youyiio BeyongCms)
- [CVE-2025-4005](https://cve.now/CVE-2025-4005.md): PHPGurukul COVID19 Testing Management System patient-report.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-4004](https://cve.now/CVE-2025-4004.md): PHPGurukul COVID19 Testing Management System password-recovery.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-0627](https://cve.now/CVE-2025-0627.md): AI Autotagger \< 3.30.0 - Admin+ Stored XSS (CVSS 3.5, WordPress Tag, Category, and Taxonomy Manager)
- [CVE-2024-9771](https://cve.now/CVE-2024-9771.md): WP-Recall \< 16.26.12 - Admin+ Stored XSS (CVSS 3.5, WP-Recall)
- [CVE-2024-13688](https://cve.now/CVE-2024-13688.md): Admin and Site Enhancements (ASE) \< 7.6.10 - Password Protection Bypass (CVSS 5.3, Admin and Site Enhancements)
- [CVE-2025-4003](https://cve.now/CVE-2025-4003.md): RefindPlusRepo RefindPlus RP\_ApfsIo.c InternalApfsTranslateBlock null pointer dereference (CVSS 6.8, RefindPlusRepo RefindPlus)
- [CVE-2025-4002](https://cve.now/CVE-2025-4002.md): RefindPlusRepo RefindPlus BootLog.c GetDebugLogFile null pointer dereference (CVSS 6.8, RefindPlusRepo RefindPlus)
- [CVE-2025-4001](https://cve.now/CVE-2025-4001.md): scipopt scip File Descriptor genRandomLOPInstance.c main file descriptor consumption (CVSS 4.8, scipopt scip)
- [CVE-2025-4000](https://cve.now/CVE-2025-4000.md): Seeyon Zhiyuan OA Web Application System ssoproxy.jsp cross site scripting (CVSS 5.1, Seeyon Zhiyuan OA Web Application System)
- [CVE-2025-3999](https://cve.now/CVE-2025-3999.md): Seeyon Zhiyuan OA Web Application System URL Parameter date.jsp cross site scripting (CVSS 5.1, Seeyon Zhiyuan OA Web Application System)
- [CVE-2025-3998](https://cve.now/CVE-2025-3998.md): CodeAstro Membership Management System renew.php sql injection (CVSS 6.9, CodeAstro Membership Management System)
- [CVE-2025-3706](https://cve.now/CVE-2025-3706.md): 104 Corporation eHRMS - Reflected Cross-Site Scripting (CVSS 6.1, 104 eHRMS)
- [CVE-2025-3997](https://cve.now/CVE-2025-3997.md): dazhouda lecms Personal Information Page index.php cross-site request forgery (CVSS 5.3, dazhouda lecms)
- [CVE-2025-3996](https://cve.now/CVE-2025-3996.md): TOTOLINK N150RT MAC Filtering Page home.htm cross site scripting (CVSS 4.8, TOTOLINK N150RT)
- [CVE-2025-3995](https://cve.now/CVE-2025-3995.md): TOTOLINK N150RT LAN Settings Page fromStaticDHCP cross site scripting (CVSS 4.8, TOTOLINK N150RT)
- [CVE-2025-3994](https://cve.now/CVE-2025-3994.md): TOTOLINK N150RT IP Port Filtering home.htm cross site scripting (CVSS 4.8, TOTOLINK N150RT)
- [CVE-2025-3993](https://cve.now/CVE-2025-3993.md): TOTOLINK N150RT formWsc buffer overflow (CVSS 8.7, TOTOLINK N150RT)
- [CVE-2025-3992](https://cve.now/CVE-2025-3992.md): TOTOLINK N150RT formWlwds buffer overflow (CVSS 8.7, TOTOLINK N150RT)
- [CVE-2015-2079](https://cve.now/CVE-2015-2079.md): Usermin 0.980 through 1.x before 1.660 allows uconfig\_save.cgi sig\_file\_free remote code execution because it uses the two argument (not… (CVSS 9.9, Usermin)
- [CVE-2015-4582](https://cve.now/CVE-2015-4582.md): The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp\_register\_error XSS. (CVSS 7.2, TheCartPress boot-store)
- [CVE-2022-41871](https://cve.now/CVE-2022-41871.md): SEPPmail through 12.1.17 allows command injection within the Admin Portal. (CVSS 6.0, SEPPmail)
- [CVE-2023-35814](https://cve.now/CVE-2023-35814.md): DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms. (CVSS 3.5, DevExpress)
- [CVE-2023-35815](https://cve.now/CVE-2023-35815.md): DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data. (CVSS 3.5, DevExpress)
- [CVE-2023-35816](https://cve.now/CVE-2023-35816.md): DevExpress before 23.1.3 allows arbitrary TypeConverter conversion. (CVSS 3.5, DevExpress)
- [CVE-2023-35817](https://cve.now/CVE-2023-35817.md): DevExpress before 23.1.3 allows AsyncDownloader SSRF. (CVSS 5.0, DevExpress)
- [CVE-2023-42404](https://cve.now/CVE-2023-42404.md): OneVision Workspace before WS23.1 SR1 (build w31.040) allows arbitrary Java EL execution. (CVSS 4.9, OneVision Workspace)
- [CVE-2024-32499](https://cve.now/CVE-2024-32499.md): Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed. (CVSS 4.9, Newforma Project Center Server)
- [CVE-2025-25776](https://cve.now/CVE-2025-25776.md): Cross-Site Scripting (XSS) vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System… (CVSS 5.0)
- [CVE-2025-45947](https://cve.now/CVE-2025-45947.md): An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/change-password.php… (CVSS 9.8)
- [CVE-2025-45949](https://cve.now/CVE-2025-45949.md): A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the… (CVSS 9.8)
- [CVE-2025-45953](https://cve.now/CVE-2025-45953.md): A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change… (CVSS 9.1)
- [CVE-2025-46614](https://cve.now/CVE-2025-46614.md): In Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL query at the INFO level, aka Insertion of… (CVSS 3.3, Snowflake ODBC)
- [CVE-2025-46661](https://cve.now/CVE-2025-46661.md): IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide… (CVSS 10.0, IPW Metazo)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2025-04-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.