# CVEs published 2025-04-03

177 CVEs were published on April 3, 2025: 18 critical, 52 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2025-25000](https://cve.now/CVE-2025-25000.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2025-3186](https://cve.now/CVE-2025-3186.md): projectworlds Online Doctor Appointment Booking System invoice.php sql injection (CVSS 6.9, projectworlds Online Doctor Appointment Booking System)
- [CVE-2025-3185](https://cve.now/CVE-2025-3185.md): projectworlds Online Doctor Appointment Booking System patientupdateprofile.php sql injection (CVSS 6.9, projectworlds Online Doctor Appointment Booking System)
- [CVE-2025-3184](https://cve.now/CVE-2025-3184.md): projectworlds Online Doctor Appointment Booking System profile.php sql injection (CVSS 6.9, projectworlds Online Doctor Appointment Booking System)
- [CVE-2025-0278](https://cve.now/CVE-2025-0278.md): An internal path disclosure vulnerability affects HCL Traveler (CVSS 4.3, HCL Software HCL Traveler)
- [CVE-2025-30370](https://cve.now/CVE-2025-30370.md): jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal" (CVSS 7.4, jupyterlab-git)
- [CVE-2025-3183](https://cve.now/CVE-2025-3183.md): projectworlds Online Doctor Appointment Booking System patientupdateprofile.php sql injection (CVSS 6.9, projectworlds Online Doctor Appointment Booking System)
- [CVE-2025-0279](https://cve.now/CVE-2025-0279.md): HCL Traveler is affected by generation of error messages containing sensitive information (CVSS 4.3, HCL Software HCL Traveler)
- [CVE-2025-3182](https://cve.now/CVE-2025-3182.md): projectworlds Online Doctor Appointment Booking System getschedule.php sql injection (CVSS 6.9, projectworlds Online Doctor Appointment Booking System)
- [CVE-2025-3181](https://cve.now/CVE-2025-3181.md): projectworlds Online Doctor Appointment Booking System appointment.php sql injection (CVSS 6.9, projectworlds Online Doctor Appointment Booking System)
- [CVE-2025-3180](https://cve.now/CVE-2025-3180.md): projectworlds Online Doctor Appointment Booking System deleteschedule.php sql injection (CVSS 6.9, projectworlds Online Doctor Appointment Booking System)
- [CVE-2025-3179](https://cve.now/CVE-2025-3179.md): projectworlds Online Doctor Appointment Booking System deletepatient.php sql injection (CVSS 6.9, projectworlds Online Doctor Appointment Booking System)
- [CVE-2025-3178](https://cve.now/CVE-2025-3178.md): projectworlds Online Doctor Appointment Booking System deleteappointment.php sql injection (CVSS 6.9, projectworlds Online Doctor Appointment Booking System)
- [CVE-2025-3177](https://cve.now/CVE-2025-3177.md): FastCMS JWT hard-coded key (CVSS 2.3, FastCMS)
- [CVE-2025-31489](https://cve.now/CVE-2025-31489.md): MinIO performs incomplete signature validation for unsigned-trailer uploads (CVSS 8.7, minio · github.com/minio/minio)
- [CVE-2025-31485](https://cve.now/CVE-2025-31485.md): GraphQL grant on a property might be cached with different objects (CVSS 7.5, api-platform core · api-platform/graphql +1)
- [CVE-2025-3176](https://cve.now/CVE-2025-3176.md): Project Worlds Online Lawyer Management System single\_lawyer.php sql injection (CVSS 6.9, Project Worlds Online Lawyer Management System)
- [CVE-2025-31481](https://cve.now/CVE-2025-31481.md): GraphQL query operations security can be bypassed (CVSS 7.5, api-platform core · api-platform/graphql +1)
- [CVE-2025-31119](https://cve.now/CVE-2025-31119.md): CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework (CVSS 7.7, generator-jhipster-entity-audit)
- [CVE-2025-3175](https://cve.now/CVE-2025-3175.md): Project Worlds Online Lawyer Management System save\_user\_edit\_profile.php sql injection (CVSS 6.9, Project Worlds Online Lawyer Management System)
- [CVE-2025-3174](https://cve.now/CVE-2025-3174.md): Project Worlds Online Lawyer Management System searchLawyer.php sql injection (CVSS 6.9, Project Worlds Online Lawyer Management System)
- [CVE-2025-31487](https://cve.now/CVE-2025-31487.md): The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server (CVSS 7.7, xwiki-contrib jira · org.xwiki.contrib.jira:jira-macro-defa…)
- [CVE-2025-3173](https://cve.now/CVE-2025-3173.md): Project Worlds Online Lawyer Management System save\_booking.php sql injection (CVSS 6.9, Project Worlds Online Lawyer Management System)
- [CVE-2025-31486](https://cve.now/CVE-2025-31486.md): Vite allows server.fs.deny to be bypassed with .svg or relative paths (CVSS 5.3, vitejs vite · vite)
- [CVE-2025-31483](https://cve.now/CVE-2025-31483.md): Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration (CVSS 4.8, miniflux · miniflux.app +1)
- [CVE-2025-3172](https://cve.now/CVE-2025-3172.md): Project Worlds Online Lawyer Management System lawyer\_booking.php sql injection (CVSS 6.9, Project Worlds Online Lawyer Management System)
- [CVE-2025-3171](https://cve.now/CVE-2025-3171.md): Project Worlds Online Lawyer Management System approve\_lawyer.php sql injection (CVSS 6.9, Project Worlds Online Lawyer Management System)
- [CVE-2025-31126](https://cve.now/CVE-2025-31126.md): Element X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call (CVSS 5.3, element-hq element-x-ios)
- [CVE-2025-31127](https://cve.now/CVE-2025-31127.md): Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call (CVSS 5.3, element-hq element-x-android)
- [CVE-2025-3170](https://cve.now/CVE-2025-3170.md): Project Worlds Online Lawyer Management System admin\_user.php sql injection (CVSS 6.9, Project Worlds Online Lawyer Management System)
- [CVE-2025-3169](https://cve.now/CVE-2025-3169.md): Projeqtor saveAttachment.php unrestricted upload (CVSS 2.3, Projeqtor)
- [CVE-2025-3168](https://cve.now/CVE-2025-3168.md): PHPGurukul Time Table Generator System edit-class.php sql injection (CVSS 6.9, PHPGurukul Time Table Generator System)
- [CVE-2025-31115](https://cve.now/CVE-2025-31115.md): XZ has a heap-use-after-free bug in threaded .xz decoder (CVSS 8.7, tukaani-project xz · xz-clib)
- [CVE-2025-32054](https://cve.now/CVE-2025-32054.md): In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file (CVSS 3.3, JetBrains IntelliJ IDEA)
- [CVE-2023-47639](https://cve.now/CVE-2023-47639.md): API Platform Core can leak exceptions message that may contain sensitive information (CVSS 5.3, api-platform core · api-platform/core)
- [CVE-2025-3167](https://cve.now/CVE-2025-3167.md): Tenda AC23 API Interface VerAPIMant denial of service (CVSS 7.1, Tenda AC23)
- [CVE-2025-3166](https://cve.now/CVE-2025-3166.md): code-projects Product Management System Search Product Menu search\_item stack-based overflow (CVSS 4.8, code-projects Product Management System)
- [CVE-2025-3165](https://cve.now/CVE-2025-3165.md): thu-pacman chitu backend.py torch.load deserialization (CVSS 4.8, thu-pacman chitu)
- [CVE-2025-3164](https://cve.now/CVE-2025-3164.md): Tencent Music Entertainment SuperSonic H2 Database Connection testConnect code injection (CVSS 5.1, Tencent Music Entertainment SuperSonic)
- [CVE-2025-3163](https://cve.now/CVE-2025-3163.md): InternLM LMDeploy conf.py open code injection (CVSS 4.8, InternLM LMDeploy · lmdeploy)
- [CVE-2025-22457](https://cve.now/CVE-2025-22457.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA (CVSS 9.0, KEV, Ivanti Connect Secure · Ivanti Policy Secure +1)
- [CVE-2025-29987](https://cve.now/CVE-2025-29987.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Ac (CVSS 8.8, Dell DD OS · Dell PowerProtect DP Series Appliance)
- [CVE-2024-4877](https://cve.now/CVE-2024-4877.md): OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI c (CVSS 8.8, OpenVPN)
- [CVE-2025-3162](https://cve.now/CVE-2025-3162.md): InternLM LMDeploy PT File utils.py load\_weight\_ckpt deserialization (CVSS 4.8, InternLM LMDeploy · lmdeploy)
- [CVE-2025-0272](https://cve.now/CVE-2025-0272.md): HCL DevOps Deploy / HCL Launch is susceptible to an HTML injection vulnerability (CVSS 5.4, HCL Software HCL DevOps Deploy / HCL Launch)
- [CVE-2025-3161](https://cve.now/CVE-2025-3161.md): Tenda AC10 ShutdownSetAdd stack-based overflow (CVSS 8.7, Tenda AC10)
- [CVE-2025-3160](https://cve.now/CVE-2025-3160.md): Open Asset Import Library Assimp File SceneCombiner.cpp AddNodeHashes out-of-bounds (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-3159](https://cve.now/CVE-2025-3159.md): Open Asset Import Library Assimp ASE File ASEParser.cpp ParseLV4MeshBonesVertices heap-based overflow (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-32053](https://cve.now/CVE-2025-32053.md): Libsoup: heap buffer overflows in sniff\_feed\_or\_html() and skip\_insignificant\_space() (CVSS 6.5, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-32052](https://cve.now/CVE-2025-32052.md): Libsoup: heap buffer overflow in sniff\_unknown() (CVSS 6.5, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-32051](https://cve.now/CVE-2025-32051.md): Libsoup: segmentation fault when parsing malformed data uri (CVSS 5.9, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-32050](https://cve.now/CVE-2025-32050.md): Libsoup: integer overflow in append\_param\_quoted (CVSS 5.9, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-32049](https://cve.now/CVE-2025-32049.md): Libsoup: denial of service attack to websocket server (CVSS 7.5, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-3155](https://cve.now/CVE-2025-3155.md): Yelp: arbitrary file read (CVSS 7.4, yelp · Red Hat Enterprise Linux)
- [CVE-2025-3158](https://cve.now/CVE-2025-3158.md): Open Asset Import Library Assimp LWO File LWOAnimation.cpp UpdateAnimRangeSetup heap-based overflow (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-3157](https://cve.now/CVE-2025-3157.md): Intelbras WRN 150 Wireless Menu cross site scripting (CVSS 4.8, Intelbras WRN)
- [CVE-2025-31911](https://cve.now/CVE-2025-31911.md): WordPress Social Share And Social Locker plugin \<= 1.4.2 - SQL Injection vulnerability (CVSS 9.3, reputeinfosystems Social Share And Social Locker)
- [CVE-2025-31909](https://cve.now/CVE-2025-31909.md): WordPress Apptivo Business Site CRM plugin \<= 5.3 - Arbitrary Content Deletion vulnerability (CVSS 7.5, Apptivo Business Site CRM)
- [CVE-2025-31907](https://cve.now/CVE-2025-31907.md): WordPress Team Builder plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Labib Ahmed Team Builder)
- [CVE-2025-31905](https://cve.now/CVE-2025-31905.md): WordPress Team Rosters Plugin \<= 4.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mark O'Donnell Team Rosters)
- [CVE-2025-31903](https://cve.now/CVE-2025-31903.md): WordPress XV Random Quotes plugin \<= 2.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Xavi Ivars XV Random Quotes)
- [CVE-2025-31902](https://cve.now/CVE-2025-31902.md): WordPress Social Share And Social Locker Plugin \<= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, reputeinfosystems Social Share And Social Locker)
- [CVE-2025-31901](https://cve.now/CVE-2025-31901.md): WordPress Digihood HTML Sitemap Plugin \<= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Digihood HTML Sitemap)
- [CVE-2025-31900](https://cve.now/CVE-2025-31900.md): WordPress Lexicata plugin \<= 1.0.16 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Lexicata)
- [CVE-2025-31899](https://cve.now/CVE-2025-31899.md): WordPress Awesome Logos plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpshopee Awesome Logos)
- [CVE-2025-31898](https://cve.now/CVE-2025-31898.md): WordPress MediaView plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dustinscarberry MediaView)
- [CVE-2025-31896](https://cve.now/CVE-2025-31896.md): WordPress GetBookingsWP Plugin \<= 1.1.27 - Broken Access Control vulnerability (CVSS 6.5, istmoplugins GetBookingsWP)
- [CVE-2025-31893](https://cve.now/CVE-2025-31893.md): WordPress Botnet Attack Blocker plugin \<= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, cheesefather Botnet Attack Blocker)
- [CVE-2025-31876](https://cve.now/CVE-2025-31876.md): WordPress Payday plugin \<= 3.3.18 - Broken Access Control vulnerability (CVSS 5.8, gunnarpayday Payday)
- [CVE-2025-31858](https://cve.now/CVE-2025-31858.md): WordPress Local Magic plugin \<= 2.9.0 - Broken Access Control vulnerability (CVSS 6.5, matthewrubin Local Magic)
- [CVE-2025-31841](https://cve.now/CVE-2025-31841.md): WordPress FPW Category Thumbnails Plugin \<= 1.9.5 - Broken Access Control vulnerability (CVSS 6.3, Frank P. Walentynowicz FPW Category Thumbnails)
- [CVE-2025-31827](https://cve.now/CVE-2025-31827.md): WordPress Fonto plugin \<= 1.2.2 - Arbitrary File Download vulnerability (CVSS 4.9, vlad.olaru Fonto)
- [CVE-2025-31825](https://cve.now/CVE-2025-31825.md): WordPress Category Icon plugin \<= 1.0.1 - Arbitrary File Download vulnerability (CVSS 4.9, pixelgrade Category Icon)
- [CVE-2025-31800](https://cve.now/CVE-2025-31800.md): WordPress Publitio plugin \<= 2.2.0 - Arbitrary File Read vulnerability (CVSS 6.5, Publitio)
- [CVE-2025-31795](https://cve.now/CVE-2025-31795.md): WordPress Shopify to WooCommerce Migration plugin \<= 1.3.0 - Settings Change vulnerability (CVSS 6.5, Plugin Devs Shopify to WooCommerce Migration)
- [CVE-2025-31794](https://cve.now/CVE-2025-31794.md): WordPress WR Price List Manager For Woocommerce plugin \<= 1.0.8 - Arbitrary Content Deletion vulnerability (CVSS 5.4, Web Ready Now WR Price List Manager For Woocommerce)
- [CVE-2025-31789](https://cve.now/CVE-2025-31789.md): WordPress TextMe SMS plugin \<= 1.9.1 - Broken Access Control vulnerability (CVSS 6.5, Matat Technologies TextMe SMS)
- [CVE-2025-31768](https://cve.now/CVE-2025-31768.md): WordPress Widget Manager Light plugin \<= 1.18 - Broken Access Control vulnerability (CVSS 6.5, OTWthemes Widget Manager Light)
- [CVE-2025-31758](https://cve.now/CVE-2025-31758.md): WordPress Free Woocommerce Product Table View plugin \<= 1.78 - Arbitrary Content Deletion vulnerability (CVSS 6.5, BinaryCarpenter Free Woocommerce Product Table View)
- [CVE-2025-31746](https://cve.now/CVE-2025-31746.md): WordPress Clients plugin \<= 1.1.4 - Broken Access Control vulnerability (CVSS 6.4, Think201 Clients)
- [CVE-2025-31739](https://cve.now/CVE-2025-31739.md): WordPress Minimalistic Event Manager plugin \<= 1.1.1 - Broken Access Control vulnerability (CVSS 6.4, Manuel Schmalstieg Minimalistic Event Manager)
- [CVE-2025-31736](https://cve.now/CVE-2025-31736.md): WordPress Rich Text Editor Plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 6.5, richtexteditor Rich Text Editor)
- [CVE-2025-31729](https://cve.now/CVE-2025-31729.md): WordPress WooTumblog plugin \<= 2.1.4 - Content Injection vulnerability (CVSS 6.5, jeffikus WooTumblog)
- [CVE-2025-31626](https://cve.now/CVE-2025-31626.md): WordPress Support Helpdesk Ticket System Lite plugin \<= 4.5.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Alisaleem252 Support Helpdesk Ticket System Lite)
- [CVE-2025-31622](https://cve.now/CVE-2025-31622.md): WordPress Advanced Typekit plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Utkarsh Kukreti Advanced Typekit)
- [CVE-2025-31582](https://cve.now/CVE-2025-31582.md): WordPress Contact Form vCard Generator plugin \<= 2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ashish Ajani Contact Form vCard Generator)
- [CVE-2025-31581](https://cve.now/CVE-2025-31581.md): WordPress WP Video Playlist plugin \<= 1.1.2 - Settings Change vulnerability (CVSS 6.5, Sandeep Kumar WP Video Playlist)
- [CVE-2025-31573](https://cve.now/CVE-2025-31573.md): WordPress PeproDev CF7 Database plugin \<= 2.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pepro Dev. Group PeproDev CF7 Database)
- [CVE-2025-31558](https://cve.now/CVE-2025-31558.md): WordPress TailPress plugin \<= 0.4.4 - Sensitive Data Exposure vulnerability (CVSS 5.8, Greg TailPress)
- [CVE-2025-31554](https://cve.now/CVE-2025-31554.md): WordPress Docxpresso plugin \<= 2.6 - Arbitrary File Download vulnerability (CVSS 5.9, Docxpresso)
- [CVE-2025-31541](https://cve.now/CVE-2025-31541.md): WordPress TuriTop Booking System plugin \<= 1.0.10 - Broken Access Control vulnerability (CVSS 6.5, TuriTop Booking System)
- [CVE-2025-31536](https://cve.now/CVE-2025-31536.md): WordPress CF7 Spreadsheets plugin \<= 2.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, moshensky CF7 Spreadsheets)
- [CVE-2025-31468](https://cve.now/CVE-2025-31468.md): WordPress WP\_Identicon plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, scottsm WP\_Identicon)
- [CVE-2025-31467](https://cve.now/CVE-2025-31467.md): WordPress Flickr Photostream plugin \<= 3.1.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, miro.mannino Flickr Photostream)
- [CVE-2025-31442](https://cve.now/CVE-2025-31442.md): WordPress Search engine keywords highlighter plugin \<= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, e1tekoap42 Search engine keywords highlighter)
- [CVE-2025-31436](https://cve.now/CVE-2025-31436.md): WordPress Blubrry PowerPress Podcasting plugin MultiSite add-on plugin \<= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Angelo Mandato Blubrry PowerPress Podcasting plugin MultiSi…)
- [CVE-2025-31098](https://cve.now/CVE-2025-31098.md): WordPress DeBounce Email Validator plugin \<= 5.7 - Local File Inclusion Vulnerability (CVSS 7.5, DeBounce Email Validator)
- [CVE-2025-31091](https://cve.now/CVE-2025-31091.md): WordPress CM Header and Footer plugin \<= 1.2.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, CreativeMindsSolutions CM Header and Footer)
- [CVE-2025-30916](https://cve.now/CVE-2025-30916.md): WordPress Residential Address Detection plugin \<= 2.5.4 - Broken Access Control vulnerability (CVSS 6.5, enituretechnology Residential Address Detection)
- [CVE-2025-30915](https://cve.now/CVE-2025-30915.md): WordPress Small Package Quotes – Worldwide Express Edition plugin \<= 5.2.19 - Broken Access Control vulnerability (CVSS 6.5, enituretechnology Small Package Quotes – Worldwide Express…)
- [CVE-2025-30908](https://cve.now/CVE-2025-30908.md): WordPress Web Directory Free plugin \<= 1.7.6 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shamalli Web Directory Free)
- [CVE-2025-30889](https://cve.now/CVE-2025-30889.md): WordPress Testimonial Slider plugin \<= 2.0.13 - PHP Object Injection vulnerability (CVSS 8.8, PickPlugins Testimonial Slider)
- [CVE-2025-30858](https://cve.now/CVE-2025-30858.md): WordPress Snow Storm plugin \<= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tribulant Software Snow Storm)
- [CVE-2025-30616](https://cve.now/CVE-2025-30616.md): WordPress Latest Custom Post Type Updates plugin \<= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, David Wood Latest Custom Post Type Updates)
- [CVE-2025-30611](https://cve.now/CVE-2025-30611.md): WordPress Wptobe-signinup plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Wptobe-signinup)
- [CVE-2025-30596](https://cve.now/CVE-2025-30596.md): WordPress include-file plugin \<= 1 - Arbitrary File Download Vulnerability (CVSS 6.5, tstafford include-file)
- [CVE-2025-2946](https://cve.now/CVE-2025-2946.md): Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4 (CVSS 9.1, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2025-2945](https://cve.now/CVE-2025-2945.md): pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment (CVSS 9.9, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2024-9416](https://cve.now/CVE-2024-9416.md): Modula Image Gallery \<= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library (CVSS 6.4, wpchill Modula Image Gallery – Photo Grid & Video Gallery)
- [CVE-2025-2299](https://cve.now/CVE-2025-2299.md): LuckyWP Table of Contents \<= 2.1.10 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, theluckywp LuckyWP Table of Contents)
- [CVE-2024-53868](https://cve.now/CVE-2024-53868.md): Apache Traffic Server: Malformed chunked message body allows request smuggling (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2025-3152](https://cve.now/CVE-2025-3152.md): caipeichao ThinkOX Search search.html cross site scripting (CVSS 5.1, caipeichao ThinkOX)
- [CVE-2025-3151](https://cve.now/CVE-2025-3151.md): SourceCodester Gym Management System signup.php sql injection (CVSS 6.9, SourceCodester Gym Management System)
- [CVE-2025-3150](https://cve.now/CVE-2025-3150.md): itning Student Homework Management System cross-site request forgery (CVSS 5.3, itning Student Homework Management System)
- [CVE-2025-3149](https://cve.now/CVE-2025-3149.md): itning Student Homework Management System Edit Job Page fileupload cross site scripting (CVSS 4.8, itning Student Homework Management System)
- [CVE-2025-1663](https://cve.now/CVE-2025-1663.md): Unlimited Elements For Elementor \<= 1.5.142 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, unitecms Unlimited Elements For Elementor)
- [CVE-2025-2874](https://cve.now/CVE-2025-2874.md): User Submitted Posts \<= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, specialk User Submitted Posts – Enable Users to Submit Post…)
- [CVE-2024-13673](https://cve.now/CVE-2024-13673.md): Big Boom Directory \<= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bigboomdesign Big Boom Directory)
- [CVE-2025-22007](https://cve.now/CVE-2025-22007.md): Bluetooth: Fix error code in chan\_alloc\_skb\_cb() (CVSS 5.5, Linux)
- [CVE-2025-22006](https://cve.now/CVE-2025-22006.md): net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (CVSS 5.5, Linux)
- [CVE-2025-22005](https://cve.now/CVE-2025-22005.md): ipv6: Fix memleak of nhc\_pcpu\_rth\_output in fib\_check\_nh\_v6\_gw(). (CVSS 5.5, Linux)
- [CVE-2025-22004](https://cve.now/CVE-2025-22004.md): net: atm: fix use after free in lec\_send() (CVSS 8.6, Linux)
- [CVE-2025-22003](https://cve.now/CVE-2025-22003.md): can: ucan: fix out of bound read in strscpy() source (CVSS 5.5, Linux)
- [CVE-2025-22002](https://cve.now/CVE-2025-22002.md): netfs: Call \`invalidate\_cache\` only if implemented (CVSS 5.5, Linux)
- [CVE-2025-22001](https://cve.now/CVE-2025-22001.md): accel/qaic: Fix integer overflow in qaic\_validate\_req() (CVSS 7.8, Linux)
- [CVE-2025-22000](https://cve.now/CVE-2025-22000.md): mm/huge\_memory: drop beyond-EOF folios with the right number of refs (CVSS 5.5, Linux)
- [CVE-2025-21999](https://cve.now/CVE-2025-21999.md): proc: fix UAF in proc\_get\_inode() (CVSS 7.8, Linux)
- [CVE-2025-21998](https://cve.now/CVE-2025-21998.md): firmware: qcom: uefisecapp: fix efivars registration race (CVSS 4.7, Linux)
- [CVE-2025-21997](https://cve.now/CVE-2025-21997.md): xsk: fix an integer overflow in xp\_create\_and\_assign\_umem() (CVSS 5.5, Linux)
- [CVE-2025-21996](https://cve.now/CVE-2025-21996.md): drm/radeon: fix uninitialized size issue in radeon\_vce\_cs\_parse() (CVSS 5.5, Linux)
- [CVE-2025-21995](https://cve.now/CVE-2025-21995.md): drm/sched: Fix fence reference count leak (CVSS 5.5, Linux)
- [CVE-2025-3148](https://cve.now/CVE-2025-3148.md): codeprojects Product Management System Login buffer overflow (CVSS 4.8, codeprojects Product Management System)
- [CVE-2025-3147](https://cve.now/CVE-2025-3147.md): PHPGurukul Boat Booking System add-subadmin.php sql injection (CVSS 6.9, PHPGurukul Boat Booking System)
- [CVE-2025-3146](https://cve.now/CVE-2025-3146.md): PHPGurukul Bus Pass Management System view-pass-detail.php sql injection (CVSS 6.9, PHPGurukul Bus Pass Management System)
- [CVE-2025-3145](https://cve.now/CVE-2025-3145.md): MindSpore mindspore.numpy.fft.rfft2 memory corruption (CVSS 4.8, MindSpore)
- [CVE-2025-30485](https://cve.now/CVE-2025-30485.md): UNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. (CVSS 6.2, Century Systems Co. FutureNet NXR-1420 · Century System… +30)
- [CVE-2025-3144](https://cve.now/CVE-2025-3144.md): MindSpore mindspore.numpy.fft.hfftn memory corruption (CVSS 4.8, MindSpore)
- [CVE-2025-3143](https://cve.now/CVE-2025-3143.md): SourceCodester Apartment Visitor Management System visitor-entry.php sql injection (CVSS 5.3, SourceCodester Apartment Visitor Management System)
- [CVE-2025-2055](https://cve.now/CVE-2025-2055.md): MapPress Maps for WordPress \< 2.94.9 - Contributor+ Stored XSS (CVSS 6.8, MapPress Maps for WordPress)
- [CVE-2025-3142](https://cve.now/CVE-2025-3142.md): SourceCodester Apartment Visitor Management System add-apartment.php sql injection (CVSS 5.3, SourceCodester Apartment Visitor Management System)
- [CVE-2025-31334](https://cve.now/CVE-2025-31334.md): Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file (CVSS 6.8, RARLAB WinRAR)
- [CVE-2025-3141](https://cve.now/CVE-2025-3141.md): SourceCodester Online Medicine Ordering System manage\_category.php sql injection (CVSS 5.3, SourceCodester Online Medicine Ordering System)
- [CVE-2025-3140](https://cve.now/CVE-2025-3140.md): SourceCodester Online Medicine Ordering System view\_category.php sql injection (CVSS 5.3, SourceCodester Online Medicine Ordering System)
- [CVE-2025-3139](https://cve.now/CVE-2025-3139.md): code-projects Bus Reservation System Login Form login buffer overflow (CVSS 4.8, code-projects Bus Reservation System)
- [CVE-2025-3138](https://cve.now/CVE-2025-3138.md): PHPGurukul Online Security Guards Hiring System edit-guard-detail.php sql injection (CVSS 6.9, PHPGurukul Online Security Guards Hiring System)
- [CVE-2025-3137](https://cve.now/CVE-2025-3137.md): PHPGurukul Online Security Guards Hiring System changeimage.php sql injection (CVSS 6.9, PHPGurukul Online Security Guards Hiring System)
- [CVE-2025-3136](https://cve.now/CVE-2025-3136.md): PyTorch CUDACachingAllocator.cpp torch.cuda.memory.caching\_allocator\_delete memory corruption (CVSS 4.8, PyTorch · torch)
- [CVE-2025-2784](https://cve.now/CVE-2025-2784.md): Libsoup: heap buffer over-read in \`skip\_insignificant\_space\` when sniffing content (CVSS 7.0, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-3135](https://cve.now/CVE-2025-3135.md): fcba\_zzm ics-park Smart Park Management System update sql injection (CVSS 5.3, fcba\_zzm ics-park Smart Park Management System)
- [CVE-2025-3134](https://cve.now/CVE-2025-3134.md): code-projects Payroll Management System add\_overtime.php sql injection (CVSS 5.3, code-projects Payroll Management System)
- [CVE-2025-3153](https://cve.now/CVE-2025-3153.md): Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attribute (CVSS 5.1, Concrete CMS · concrete5/concrete5)
- [CVE-2024-22611](https://cve.now/CVE-2024-22611.md): OpenEMR 7.0.2 is vulnerable to SQL Injection via \\openemr\\library\\classes\\Pharmacy.class.php, \\controllers\\C\_Pharmacy.class.php and \\openemr (CVSS 9.8)
- [CVE-2024-45198](https://cve.now/CVE-2024-45198.md): insightsoftware Spark JDBC 2.6.21 has a remote code execution vulnerability. (CVSS 8.8)
- [CVE-2024-45199](https://cve.now/CVE-2024-45199.md): insightsoftware Hive JDBC through 2.6.13 has a remote code execution vulnerability. (CVSS 8.8)
- [CVE-2024-47212](https://cve.now/CVE-2024-47212.md): An issue was discovered in Iglu Server 0.13.0 and below. (CVSS 7.5)
- [CVE-2024-47213](https://cve.now/CVE-2024-47213.md): An issue was discovered affecting Enrich 5.1.0 and below. (CVSS 7.5)
- [CVE-2024-47214](https://cve.now/CVE-2024-47214.md): An issue was discovered in Iglu Server 0.13.0 and below. (CVSS 7.5)
- [CVE-2024-47215](https://cve.now/CVE-2024-47215.md): An issue was discovered in Snowbridge setups sending data to Google Tag Manager Server Side. (CVSS 7.5)
- [CVE-2024-47217](https://cve.now/CVE-2024-47217.md): An issue was discovered in Iglu Server 0.13.0 and below. (CVSS 6.5)
- [CVE-2024-56528](https://cve.now/CVE-2024-56528.md): This vulnerability affects Snowplow Collector 3.x before 3.3.0 (unless it’s set up behind a reverse proxy that establishes payload limits). (CVSS 7.5)
- [CVE-2025-22926](https://cve.now/CVE-2025-22926.md): An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules. (CVSS 9.8)
- [CVE-2025-22927](https://cve.now/CVE-2025-22927.md): An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules. (CVSS 9.1)
- [CVE-2025-22928](https://cve.now/CVE-2025-22928.md): OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp\_id parameter at /modules/messages/Inbox.php. (CVSS 9.8)
- [CVE-2025-22929](https://cve.now/CVE-2025-22929.md): OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter\_id parameter at /students/StudentFilters.p (CVSS 9.8)
- [CVE-2025-22930](https://cve.now/CVE-2025-22930.md): OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php. (CVSS 9.8)
- [CVE-2025-22931](https://cve.now/CVE-2025-22931.md): An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attacker (CVSS 7.5)
- [CVE-2025-26817](https://cve.now/CVE-2025-26817.md): Netwrix Password Secure 9.2.0.32454 allows OS command injection. (CVSS 9.8)
- [CVE-2025-26818](https://cve.now/CVE-2025-26818.md): Netwrix Password Secure through 9.2 allows command injection. (CVSS 9.8)
- [CVE-2025-29064](https://cve.now/CVE-2025-29064.md): An issue in TOTOLINK x18 v.9.1.0cu.2024\_B20220329 allows a remote attacker to execute arbitrary code via the sub\_410E54 function of the cste (CVSS 9.8)
- [CVE-2025-29369](https://cve.now/CVE-2025-29369.md): Code-Projects Matrimonial Site V1.0 is vulnerable to SQL Injection in /view\_profile.php?id=1. (CVSS 9.8)
- [CVE-2025-29462](https://cve.now/CVE-2025-29462.md): A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13. (CVSS 9.8)
- [CVE-2025-29504](https://cve.now/CVE-2025-29504.md): Insecure Permission vulnerability in student-manage 1 allows a local attacker to escalate privileges via the Unsafe permission verification. (CVSS 7.8)
- [CVE-2025-29570](https://cve.now/CVE-2025-29570.md): An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftp\_ima (CVSS 7.8)
- [CVE-2025-29647](https://cve.now/CVE-2025-29647.md): SeaCMS v13.3 has a SQL injection vulnerability in the component admin\_tempvideo.php. (CVSS 9.8)
- [CVE-2025-29991](https://cve.now/CVE-2025-29991.md): Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. (CVSS 2.2, Yubico YubiKey)
- [CVE-2025-30406](https://cve.now/CVE-2025-30406.md): Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal' (CVSS 9.0, KEV, Gladinet CentreStack)
- [CVE-2025-31161](https://cve.now/CVE-2025-31161.md): CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy… (CVSS 9.8, KEV, CrushFTP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.