# CVEs published 2025-04-02

109 CVEs were published on April 2, 2025: 10 critical, 30 high. Days are UTC.

- [CVE-2025-3123](https://cve.now/CVE-2025-3123.md): WonderCMS Theme Installation/Plugin Installation installUpdateModuleAction unrestricted upload (CVSS 5.1, WonderCMS)
- [CVE-2025-3154](https://cve.now/CVE-2025-3154.md): Out-of-bounds array write due to invalid VerticesPerRow in Xpdf 4.05 (CVSS 2.1, Xpdf)
- [CVE-2025-0257](https://cve.now/CVE-2025-0257.md): HCL DevOps Deploy / HCL Launch is susceptible to unauthorized access to other services (CVSS 6.3, HCL Software HCL DevOps Deploy / HCL Launch)
- [CVE-2025-3122](https://cve.now/CVE-2025-3122.md): WebAssembly wabt binary-reader-interp.cc BeginFunctionBody null pointer dereference (CVSS 2.3, WebAssembly wabt · wabt-bin)
- [CVE-2025-3121](https://cve.now/CVE-2025-3121.md): PyTorch torch.jit.jit\_module\_from\_flatbuffer memory corruption (CVSS 4.8, PyTorch · torch)
- [CVE-2025-31484](https://cve.now/CVE-2025-31484.md): conda-forge infrastructure uses a bad token for Azure's cf-staging access (CVSS 9.3, conda-forge infrastructure)
- [CVE-2025-3120](https://cve.now/CVE-2025-3120.md): SourceCodester Apartment Visitors Management System add-apartment.php sql injection (CVSS 5.3, SourceCodester Apartment Visitors Management System)
- [CVE-2025-3119](https://cve.now/CVE-2025-3119.md): SourceCodester Online Tutor Portal manage\_course.php sql injection (CVSS 5.3, SourceCodester Online Tutor Portal)
- [CVE-2025-30218](https://cve.now/CVE-2025-30218.md): Next.js may leak x-middleware-subrequest-id to external hosts (CVSS 1.7, vercel next.js · next)
- [CVE-2025-3130](https://cve.now/CVE-2025-3130.md): Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029 (CVSS 5.4, Drupal Obfuscate · drupal/obfuscate)
- [CVE-2025-3129](https://cve.now/CVE-2025-3129.md): Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028 (CVSS 4.8, Drupal Access code · drupal/access\_code)
- [CVE-2025-31477](https://cve.now/CVE-2025-31477.md): Improper Scope Validation in the open Endpoint of tauri-plugin-shell (CVSS 9.3, tauri-apps plugins-workspace · tauri-plugin-shell +1)
- [CVE-2025-31479](https://cve.now/CVE-2025-31479.md): canonical/get-workflow-version-action can leak a partial GITHUB\_TOKEN in exception output (CVSS 8.2, canonical get-workflow-version-action)
- [CVE-2025-27608](https://cve.now/CVE-2025-27608.md): Self Cross-Site Scripting in Arduino IDE (CVSS 1.0, arduino-ide)
- [CVE-2025-2704](https://cve.now/CVE-2025-2704.md): OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting (CVSS 7.5, OpenVPN)
- [CVE-2025-3118](https://cve.now/CVE-2025-3118.md): SourceCodester Online Tutor Portal view\_course.php sql injection (CVSS 5.3, SourceCodester Online Tutor Portal)
- [CVE-2025-31286](https://cve.now/CVE-2025-31286.md): An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code. (CVSS 4.6, Trend Micro Trend Vision One)
- [CVE-2025-31285](https://cve.now/CVE-2025-31285.md): A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator (CVSS 4.6, Trend Micro Trend Vision One)
- [CVE-2025-31284](https://cve.now/CVE-2025-31284.md): A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to (CVSS 4.6, Trend Micro Trend Vision One)
- [CVE-2025-31283](https://cve.now/CVE-2025-31283.md): A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator (CVSS 4.6, Trend Micro Trend Vision One)
- [CVE-2025-31282](https://cve.now/CVE-2025-31282.md): A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrat (CVSS 4.6, Trend Micro Trend Vision One)
- [CVE-2024-36336](https://cve.now/CVE-2024-36336.md): Integer overflow within the AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to a loss of confidentia (CVSS 7.9, AMD Ryzen™ AI Software)
- [CVE-2024-36328](https://cve.now/CVE-2024-36328.md): Integer overflow within AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to loss of integrity or avai (CVSS 7.3, AMD Ryzen™ AI Software)
- [CVE-2025-20203](https://cve.now/CVE-2025-20203.md): A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure co (CVSS 4.8, Cisco Prime Infrastructure · Cisco Evolved Programmable Net…)
- [CVE-2025-20120](https://cve.now/CVE-2025-20120.md): A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure co (CVSS 6.1, Cisco Prime Infrastructure · Cisco Evolved Programmable Net…)
- [CVE-2024-36337](https://cve.now/CVE-2024-36337.md): Integer overflow within AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to loss of confidentiality, (CVSS 7.9, AMD Ryzen™ AI Software)
- [CVE-2025-20139](https://cve.now/CVE-2025-20139.md): A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause (CVSS 7.5, Cisco Enterprise Chat and Email)
- [CVE-2025-20212](https://cve.now/CVE-2025-20212.md): A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series devices could allow an authenticated, remote (CVSS 7.7, Cisco Meraki MX Firmware)
- [CVE-2025-0014](https://cve.now/CVE-2025-0014.md): Incorrect default permissions on the AMD Ryzen(TM) AI installation folder could allow an attacker to achieve privilege escalation, potential (CVSS 7.3, AMD Ryzen™ AI Software)
- [CVE-2024-56476](https://cve.now/CVE-2024-56476.md): IBM TXSeries for Multiplatforms information disclosure (CVSS 5.3, IBM TXSeries for Multiplatforms)
- [CVE-2024-56475](https://cve.now/CVE-2024-56475.md): IBM TXSeries for Multiplatforms cross-site scripting (CVSS 5.4, IBM TXSeries for Multiplatforms)
- [CVE-2024-56474](https://cve.now/CVE-2024-56474.md): IBM TXSeries for Multiplatforms cross-site request forgery (CVSS 4.3, IBM TXSeries for Multiplatforms)
- [CVE-2025-0154](https://cve.now/CVE-2025-0154.md): IBM TXSeries for Multiplatforms information disclosure (CVSS 5.3, IBM TXSeries for Multiplatforms)
- [CVE-2024-56341](https://cve.now/CVE-2024-56341.md): IBM Content Navigator cross-site scripting (CVSS 5.4, IBM Content Navigator)
- [CVE-2025-31728](https://cve.now/CVE-2025-31728.md): Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasin (CVSS 5.5, Jenkins Project Jenkins AsakusaSatellite Plugin · org.codef…)
- [CVE-2025-31727](https://cve.now/CVE-2025-31727.md): Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins contro (CVSS 5.5, Jenkins Project Jenkins AsakusaSatellite Plugin · org.codef…)
- [CVE-2025-31726](https://cve.now/CVE-2025-31726.md): Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller whe (CVSS 5.5, Jenkins Project Jenkins Stack Hammer Plugin · org.jenkins-c…)
- [CVE-2025-31725](https://cve.now/CVE-2025-31725.md): Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewe (CVSS 5.5, Jenkins Project Jenkins monitor-remote-job Plugin · org.uki…)
- [CVE-2025-31724](https://cve.now/CVE-2025-31724.md): Jenkins Cadence vManager Plugin 4.0.0-282.v5096a\_c2db\_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files (CVSS 4.3, Jenkins Project Jenkins Cadence vManager Plugin · org.jenki…)
- [CVE-2025-31723](https://cve.now/CVE-2025-31723.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the (CVSS 4.3, Jenkins Project Jenkins Simple Queue Plugin · io.jenkins.pl…)
- [CVE-2025-31722](https://cve.now/CVE-2025-31722.md): In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attacker (CVSS 8.8, Jenkins Project Jenkins Templating Engine Plugin · org.jenk…)
- [CVE-2025-31721](https://cve.now/CVE-2025-31721.md): A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but withou (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-31720](https://cve.now/CVE-2025-31720.md): A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but withou (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2024-25051](https://cve.now/CVE-2024-25051.md): IBM Jazz Reporting Service insufficient session expiration (CVSS 6.6, IBM Jazz Reporting Service)
- [CVE-2025-21994](https://cve.now/CVE-2025-21994.md): ksmbd: fix incorrect validation for num\_aces field of smb\_acl (CVSS 7.6, Linux)
- [CVE-2024-45064](https://cve.now/CVE-2024-45064.md): A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. (CVSS 8.5, STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8)
- [CVE-2024-50385](https://cve.now/CVE-2024-50385.md): A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. (CVSS 6.5, STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8)
- [CVE-2024-50384](https://cve.now/CVE-2024-50384.md): A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. (CVSS 6.5, STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8)
- [CVE-2024-50595](https://cve.now/CVE-2024-50595.md): An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. (CVSS 4.3, STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8)
- [CVE-2024-50594](https://cve.now/CVE-2024-50594.md): An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. (CVSS 4.3, STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8)
- [CVE-2024-50597](https://cve.now/CVE-2024-50597.md): An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. (CVSS 4.3, STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8)
- [CVE-2024-50596](https://cve.now/CVE-2024-50596.md): An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. (CVSS 4.3, STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8)
- [CVE-2025-21993](https://cve.now/CVE-2025-21993.md): iscsi\_ibft: Fix UBSAN shift-out-of-bounds warning in ibft\_attr\_show\_nic() (CVSS 7.1, Linux)
- [CVE-2025-21992](https://cve.now/CVE-2025-21992.md): HID: ignore non-functional sensor in HP 5MP Camera (no CVSS, Linux)
- [CVE-2025-21991](https://cve.now/CVE-2025-21991.md): x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CVSS 7.8, Linux)
- [CVE-2025-21990](https://cve.now/CVE-2025-21990.md): drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags (CVSS 5.5, Linux)
- [CVE-2025-21989](https://cve.now/CVE-2025-21989.md): drm/amd/display: fix missing .is\_two\_pixels\_per\_container (CVSS 5.5, Linux)
- [CVE-2025-21988](https://cve.now/CVE-2025-21988.md): fs/netfs/read\_collect: add to next-\>prev\_donated (CVSS 9.8, Linux)
- [CVE-2025-1805](https://cve.now/CVE-2025-1805.md): Crypt::Salt for Perl uses insecure rand() function when generating salts for cryptographic purposes (CVSS 5.3, HACHI Crypt::Salt)
- [CVE-2025-21987](https://cve.now/CVE-2025-21987.md): drm/amdgpu: init return value in amdgpu\_ttm\_clear\_buffer (no CVSS, Linux)
- [CVE-2025-2842](https://cve.now/CVE-2025-2842.md): Tempo-operator: tempo operator token exposition lead to read sensitive data (CVSS 4.3, tempo-operator · Red Hat OpenShift distributed tracing +1)
- [CVE-2025-2786](https://cve.now/CVE-2025-2786.md): Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator (CVSS 4.3, tempo-operator · Red Hat OpenShift distributed tracing +1)
- [CVE-2025-3097](https://cve.now/CVE-2025-3097.md): wp Time Machine \<= 3.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, paulgpetty wp Time Machine)
- [CVE-2025-3063](https://cve.now/CVE-2025-3063.md): Shopper Approved Reviews 2.0 - 2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, shopperapprovedapp Shopper Approved Reviews)
- [CVE-2025-2483](https://cve.now/CVE-2025-2483.md): Gift Certificate Creator \<= 1.1.0 - Reflected Cross-Site Scripting via receip\_address Parameter (CVSS 6.1, bobcares\_plugins Gift Certificate Creator)
- [CVE-2024-13637](https://cve.now/CVE-2024-13637.md): Demo Awesome \<= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activation (CVSS 6.5, romik84 Demo Awesome)
- [CVE-2024-12410](https://cve.now/CVE-2024-12410.md): Front End Users \<= 3.2.32 - Authenticated (Admin+) SQL injection (CVSS 4.9, rustaurius Front End Users)
- [CVE-2025-2513](https://cve.now/CVE-2025-2513.md): Smart Icons For WordPress \<= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, smartpixels Smart Icons For WordPress)
- [CVE-2025-3098](https://cve.now/CVE-2025-3098.md): Video Url \<= 1.0.0.3 - Reflected Cross-Site Scripting (CVSS 6.1, ulshamim Video Url)
- [CVE-2025-3099](https://cve.now/CVE-2025-3099.md): Advanced Search by My Solr Server \<= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, dbejean Advanced Search by My Solr Server)
- [CVE-2025-2005](https://cve.now/CVE-2025-2005.md): Front-End-Only-Users \<= 3.2.32 - Unauthenticated Arbitrary File Upload (CVSS 9.8, rustaurius Front End Users)
- [CVE-2023-40714](https://cve.now/CVE-2023-40714.md): A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to es (CVSS 9.7, Fortinet FortiSIEM)
- [CVE-2024-39780](https://cve.now/CVE-2024-39780.md): Use of unsafe yaml load in dynparam (CVSS 7.8, Open Source Robotics Foundation Robot Operating System)
- [CVE-2025-0676](https://cve.now/CVE-2025-0676.md): Commend Injection Leading to Privilege Escalation (CVSS 8.6, Moxa EDF-G1002-BP Series · Moxa EDR-810 Series +6)
- [CVE-2025-0415](https://cve.now/CVE-2025-0415.md): Command Injection in NTP Setting (CVSS 9.2, Moxa EDF-G1002-BP Series · Moxa EDR-810 Series +6)
- [CVE-2024-45700](https://cve.now/CVE-2024-45700.md): DoS vulnerability due to uncontrolled resource exhaustion (CVSS 6.0, Zabbix)
- [CVE-2024-45699](https://cve.now/CVE-2024-45699.md): Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps (CVSS 7.5, Zabbix)
- [CVE-2024-42325](https://cve.now/CVE-2024-42325.md): Excessive information returned by user.get (CVSS 2.1, Zabbix)
- [CVE-2024-36469](https://cve.now/CVE-2024-36469.md): User enumeration via timing attack in Zabbix web interface (CVSS 2.3, Zabbix)
- [CVE-2024-36465](https://cve.now/CVE-2024-36465.md): SQL injection in Zabbix API (CVSS 8.6, Zabbix)
- [CVE-2025-27244](https://cve.now/CVE-2025-27244.md): AssetView and AssetView CLOUD contain an issue with acquiring sensitive information from sent data to the developer. (CVSS 5.9, Hammock AssetView)
- [CVE-2025-25060](https://cve.now/CVE-2025-25060.md): Missing authentication for critical function vulnerability exists in AssetView and AssetView CLOUD. (CVSS 8.2, Hammock AssetView)
- [CVE-2025-2779](https://cve.now/CVE-2025-2779.md): Insert Headers and Footers Code – HT Script \<= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (CVSS 6.5, htplugins Insert Headers and Footers Code – HT Script)
- [CVE-2025-3074](https://cve.now/CVE-2025-3074.md): Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a cra (CVSS 5.4, Google Chrome)
- [CVE-2025-3073](https://cve.now/CVE-2025-3073.md): Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in (CVSS 5.4, Google Chrome)
- [CVE-2025-3072](https://cve.now/CVE-2025-3072.md): Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage (CVSS 5.4, Google Chrome)
- [CVE-2025-3071](https://cve.now/CVE-2025-3071.md): Inappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage (CVSS 5.4, Google Chrome)
- [CVE-2025-3070](https://cve.now/CVE-2025-3070.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privil (CVSS 6.5, Google Chrome)
- [CVE-2025-3069](https://cve.now/CVE-2025-3069.md): Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation (CVSS 8.8, Google Chrome)
- [CVE-2025-3068](https://cve.now/CVE-2025-3068.md): Inappropriate implementation in Intents in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker to perform privilege es (CVSS 8.8, Google Chrome)
- [CVE-2025-3067](https://cve.now/CVE-2025-3067.md): Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a use (CVSS 8.8, Google Chrome)
- [CVE-2025-3066](https://cve.now/CVE-2025-3066.md): Use after free in Site Isolation in Google Chrome prior to 135.0.7049.84 allowed a remote attacker to potentially exploit heap corruption vi (CVSS 8.8, Google Chrome)
- [CVE-2025-27692](https://cve.now/CVE-2025-27692.md): Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Unrestricted Upload of File with Dangerous Type vulnerability. (CVSS 4.7, Dell Wyse Management Suite Repository)
- [CVE-2025-27693](https://cve.now/CVE-2025-27693.md): Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site (CVSS 4.9, Dell Wyse Management Suite)
- [CVE-2025-27694](https://cve.now/CVE-2025-27694.md): Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool vulnerability. (CVSS 5.3, Dell Wyse Management Suite)
- [CVE-2025-29982](https://cve.now/CVE-2025-29982.md): Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insecure Inherited Permissions vulnerability. (CVSS 6.8, Dell Wyse Management Suite)
- [CVE-2025-29981](https://cve.now/CVE-2025-29981.md): Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Queries vulnerability. (CVSS 7.5, Dell Wyse Management Suite)
- [CVE-2024-37917](https://cve.now/CVE-2024-37917.md): Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (software abort) via a (CVSS 7.5)
- [CVE-2024-38392](https://cve.now/CVE-2024-38392.md): Pexip Infinity Connect before 1.13.0 lacks sufficient authenticity checks during the loading of resources, and thus remote attackers can cau (CVSS 9.1)
- [CVE-2025-22923](https://cve.now/CVE-2025-22923.md): An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST req (CVSS 8.8)
- [CVE-2025-22924](https://cve.now/CVE-2025-22924.md): OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu\_id parameter at /modules/students/Student.php. (CVSS 8.8)
- [CVE-2025-22925](https://cve.now/CVE-2025-22925.md): OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.ph (CVSS 7.5)
- [CVE-2025-27556](https://cve.now/CVE-2025-27556.md): An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. (CVSS 5.8, djangoproject Django · django)
- [CVE-2025-29062](https://cve.now/CVE-2025-29062.md): An issue in BL-AC2100 \<=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in the set\_LimitClient\_ (CVSS 9.8)
- [CVE-2025-29063](https://cve.now/CVE-2025-29063.md): An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set\_hi (CVSS 9.8)
- [CVE-2025-29085](https://cve.now/CVE-2025-29085.md): SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/e (CVSS 9.8, com.vip.saturn:saturn-console)
- [CVE-2025-29719](https://cve.now/CVE-2025-29719.md): SourceCodester (rems) Employee Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add\_employee.php via the First Name and (CVSS 6.1)
- [CVE-2025-30080](https://cve.now/CVE-2025-30080.md): Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary d (CVSS 7.5)
- [CVE-2025-30090](https://cve.now/CVE-2025-30090.md): mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript (CVSS 7.2, SquirrelMail)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.