CVEs published April 4, 2025
231 CVEs were published on April 4, 2025: 10 critical, 48 high.
- Published
- 231
- Critical
- 10
- High
- 48
- Medium
- 172
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- PHPGurukul e-Diary Management System
- 8
- xujiangfei admintwo
- 7
- code-projects Patient Record Management System
- 6
- PHPGurukul Online Fire Reporting System
- 3
- qinguoyi TinyWebServer
- 3
- ageerle ruoyi-ai
- 2
- Bitdefender GravityZone Console
- 2
- devsoftbaltic SurveyJS
- 2
- ERA404 StaffList
- 2
- Imagination Technologies Graphics DDK
- 2
Critical 10
- CVE-2024-11235Reference counting in php_request_shutdown causes Use-After-FreePHP Group PHP
- CVE-2025-32118WordPress CMP – Coming Soon & Maintenance plugin <= 4.1.14 - Remote Code Execution (RCE) vulnerabilityNiteoThemes CMP – Coming Soon & Maintenance
- CVE-2025-31480aiven-extras allows PostgreSQL Privilege Escalation through format functionaiven-extras
- CVE-2025-27520BentoML Allows Remote Code Execution (RCE) via Insecure DeserializationBentoML
- CVE-2024-51800WordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerabilityFavethemes Homey
- CVE-2025-2798Woffice <= 5.4.21 - Authentication Bypass via Registration RoleXTENDIFY Woffice CRM
- CVE-2025-31403WordPress Booking Calendar and Notification plugin <= 4.0.3 - SQL Injection vulnerabilityshiptrack Booking Calendar and Notification
- CVE-2025-2244Insecure PHP deserialization issue in GravityZone Console (VA-12634)Bitdefender GravityZone Console
- CVE-2024-13645TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object InstantiationtagDiv Composer
- CVE-2025-28146Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url i
High 48
- CVE-2025-3259Tenda RX3 SetOnlineDevName formSetDeviceName stack-based overflowTenda RX3
- CVE-2025-32204WordPress Split Test For Elementor Plugin <= 1.8.3 - SQL Injection vulnerabilityrocketelements Split Test For Elementor
- CVE-2025-32203WordPress Falling things Plugin <= 1.08 - SQL Injection vulnerabilitymanu225 Falling things
- CVE-2025-32159WordPress Radius Blocks plugin <= 2.2.1 - Local File Inclusion vulnerabilityRadiusTheme Radius Blocks
- CVE-2025-32157WordPress Sparkle Elementor Kit plugin <= 2.0.9 - Local File Inclusion vulnerabilityJakub Glos Sparkle Elementor Kit
- CVE-2025-32156WordPress Just Post Preview Widget plugin <= 1.1.1 - Local File Inclusion vulnerabilityAlex Prokopenko / JustCoded Just Post Preview Widget
- CVE-2025-32155WordPress Beds24 Online Booking plugin <= 2.0.28 - Local File Inclusion vulnerabilitymarkkinchin Beds24 Online Booking
- CVE-2025-32154WordPress Catch Dark Mode plugin <= 2.0.1 - Local File Inclusion vulnerabilityCatch Themes Catch Dark Mode
- CVE-2025-32153WordPress VG WooCarousel plugin <= 1.3 - Local File Inclusion vulnerabilityvinagecko VG WooCarousel
- CVE-2025-32152WordPress Slider a SlidersPack Plugin <= 2.3 - Local File Inclusion vulnerabilityEssential Plugin Slider a SlidersPack
- CVE-2025-32151WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerabilityThemekraft BuddyForms
- CVE-2025-32150WordPress Real Estate Manager plugin <= 7.3 - Local File Inclusion vulnerabilityRameez Iqbal Real Estate Manager
- CVE-2025-32149WordPress teachPress plugin <= 9.0.11 - SQL Injection vulnerabilitywinkm89 teachPress
- CVE-2025-32148WordPress Daisycon prijsvergelijkers plugin <= 4.8.4 - SQL Injection vulnerabilityDaisycon prijsvergelijkers
- CVE-2025-32147WordPress Easy WP Optimizer Plugin <= 1.1.0 - Broken Access Control vulnerabilitycoothemes Easy WP Optimizer
- CVE-2025-32146WordPress JS Job Manager plugin <= 2.0.2 - Local File Inclusion vulnerabilityJoomSky JS Job Manager
- CVE-2025-32142WordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerabilityStylemix Motors
- CVE-2025-32141WordPress MasterStudy LMS plugin <= 3.5.28 - Local File Inclusion vulnerabilityStylemix MasterStudy LMS
- CVE-2025-32127WordPress onOffice for WP-Websites plugin <= 5.7 - SQL Injection vulnerabilityonOffice for WP-Websites
- CVE-2025-32126WordPress Pay with Contact Form 7 Plugin <= 1.0.4 - SQL Injection vulnerabilitycmsMinds Pay with Contact Form
- CVE-2025-32125WordPress Silvasoft boekhouden plugin <= 3.0.6 - SQL Injection vulnerabilitySilvasoft boekhouden
- CVE-2025-32124WordPress Behance Portfolio Manager plugin <= 1.7.5 - SQL Injection vulnerabilityeleopard Behance Portfolio Manager
- CVE-2025-32122WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerabilityStylemix uListing
- CVE-2025-32121WordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.3 - SQL Injection vulnerabilitySuitePlugins Video & Photo Gallery for Ultimate Member
- CVE-2025-32120WordPress Easy Query – WP Query Builder plugin <= 2.0.4 - SQL Injection Vulnerabilityedanzer Easy Query – WP Query Builder
- CVE-2025-32113WordPress Libro de Reclamaciones y Quejas plugin <= 1.0 - CSRF to Stored XSS vulnerabilityRenzo Tejada Libro de Reclamaciones y Quejas
- CVE-2025-32112WordPress Sidebar Manager Light plugin <= 1.18 - CSRF to Stored XSS vulnerabilityOTWthemes Sidebar Manager Light
- CVE-2025-25178GPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memoryImagination Technologies Graphics DDK
- CVE-2025-0468GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)Imagination Technologies Graphics DDK
- CVE-2025-31384WordPress Videos plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityAviplugins Videos
- CVE-2025-31389WordPress Sequel plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerabilityIntrovoke Inc. dba Sequel.io Sequel
- CVE-2025-31405WordPress Fami WooCommerce Compare plugin <= 1.0.5 - Local File Inclusion vulnerabilityzankover Fami WooCommerce Compare
- CVE-2025-31416WordPress Awesome Event Booking plugin <= 2.8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityAwesomeTOGI Awesome Event Booking
- CVE-2025-31418WordPress Gravel theme <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerabilitynoonnoo Gravel
- CVE-2025-31420WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerabilityTomdever wpForo Forum
- CVE-2025-22282WordPress ez Form Calculator Premouium plugin <= 2.14.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilitykeksdieb ez Form Calculator Premium
- CVE-2025-1865Local Privilege Escalation in Virtual CloneDrive Kernel DriverElaborate Bytes AG Virtual CloneDrive
- CVE-2025-3105Vehica Core <= 1.0.97 - Authenticated (Subscriber+) Privilege EscalationTangibleWP Vehica Core
- CVE-2025-2780Woffice Core <= 5.4.21 - Authenticated (Subscriber+) Arbitrary File UploadWofficeIO Woffice Core
- CVE-2024-13708Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scriptingpluggabl Booster for WooCommerce
- CVE-2025-2270Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.8.9.1 - Unauthenticated Limited Local File Inclusionadamskaat Countdown, Coming Soon, Maintenance – Countdown &…
- CVE-2025-2317Product Filter by WBW <= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend Parameterwoobewoo Product Filter for WooCommerce by WBW
- CVE-2025-3192Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to aspatie/browsershot
- CVE-2025-3194Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE() function.bigint-buffer
- CVE-2024-13744Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Uploadpluggabl Booster for WooCommerce
- CVE-2025-2075Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationuncannyowl Uncanny Automator – Easy Automation, Integration…
- CVE-2025-29815Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2025-32111The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for acme.sh project acme.sh
Medium, low and unrated 173
- CVE-2025-2889Link Library <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parametersjackdewey Link Library
- CVE-2025-3268qinguoyi TinyWebServer http_conn.cpp improper authenticationqinguoyi TinyWebServer
- CVE-2025-3267qinguoyi TinyWebServer http_conn.cpp sql injectionqinguoyi TinyWebServer
- CVE-2025-3266qinguoyi TinyWebServer http_conn.cpp stack-based overflowqinguoyi TinyWebServer
- CVE-2025-3265PHPGurukul e-Diary Management System add-category.php sql injectionPHPGurukul e-Diary Management System
- CVE-2025-3258PHPGurukul Old Age Home Management System search.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-3257xujiangfei admintwo updateSet cross-site request forgeryxujiangfei admintwo
- CVE-2025-3256xujiangfei admintwo updateSet access controlxujiangfei admintwo
- CVE-2025-3255xujiangfei admintwo home access controlxujiangfei admintwo
- CVE-2025-3254xujiangfei admintwo add server-side request forgeryxujiangfei admintwo
- CVE-2025-32178WordPress 6Storage Rentals plugin <= 2.20.2 - Broken Access Control vulnerability6Storage Rentals
- CVE-2025-32250WordPress Rollbar plugin <= 2.7.1 - Cross Site Request Forgery (CSRF) vulnerabilityRollbar
- CVE-2025-32239WordPress Social Share Buttons & Analytics Plugin plugin <= 4.5 - Broken Access Control vulnerabilityJoao Romao Social Share Buttons & Analytics Plugin – GetSoc…
- CVE-2025-32224WordPress Privyr CRM plugin <= 1.0.2 - Broken Access Control vulnerabilityShivam Mani Tripathi Privyr CRM Integration
- CVE-2025-32280WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) VulnerabilityweDevs WP Project Manager
- CVE-2025-32278WordPress Table Block by RioVizual plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerabilitywprio Table Block by RioVizual
- CVE-2025-32277WordPress RepairBuddy plugin <= 3.8213 - Broken Access Control vulnerabilityAteeq Rafeeq RepairBuddy
- CVE-2025-32276WordPress Administrator Z plugin <= 2026.03.02 - Cross Site Request Forgery (CSRF) vulnerabilityQuý Lê 91 Administrator Z
- CVE-2025-32274WordPress w3all phpBB integration Plugin <= 2.9.8 - Cross Site Request Forgery (CSRF) vulnerabilityaxew3 WP w3all phpBB
- CVE-2025-32273WordPress Freetobook Responsive Widget Plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerabilityFreetobook Responsive Widget
- CVE-2025-32272WordPress Wishlist plugin <= 1.0.46 - Cross Site Request Forgery (CSRF) vulnerabilityPickPlugins Wishlist
- CVE-2025-32271WordPress Woocommerce Role Pricing Plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerabilityablancodev Woocommerce Role Pricing
- CVE-2025-32270WordPress Broadstreet plugin <= 1.52.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityBroadstreet Ads
- CVE-2025-32269WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityCRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor…
- CVE-2025-32268WordPress QR Code Tag for WC plugin <= 1.9.42 - Cross Site Request Forgery (CSRF) vulnerabilitywww.15.to QR Code Tag for WC
- CVE-2025-32267WordPress WP to Hootsuite plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerabilitywpzinc Post to Social Media – WordPress to Hootsuite
- CVE-2025-32266WordPress 404 Image Redirection (Replace Broken Images) plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabilitywp-buy 404 Image Redirection
- CVE-2025-32265WordPress JobWP plugin <= 2.3.9 - Cross Site Request Forgery (CSRF) vulnerabilityHossni Mubarak JobWP
- CVE-2025-32264WordPress UltraAddons – Elementor Addons plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerabilitySaiful Islam UltraAddons Elementor Lite
- CVE-2025-32263WordPress Sequential Order Numbers for WooCommerce plugin <= 3.6.2 - Cross Site Request Forgery (CSRF) vulnerabilityBeRocket Sequential Order Numbers for WooCommerce
- CVE-2025-32262WordPress RDP Wiki Embed plugin <= 1.2.20 - Cross Site Request Forgery (CSRF) VulnerabilityRobert D Payne RDP Wiki Embed
- CVE-2025-32261WordPress Advanced All in One Admin Search by WP Spotlight plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) VulnerabilityKuppuraj Advanced All in One Admin Search by WP Spotlight
- CVE-2025-32258WordPress Simple Website Logo plugin <= 1.1 - Broken Access Control vulnerabilityInfoGiants Simple Website Logo
- CVE-2025-32257WordPress 1 Click WordPress Migration plugin <= 2.5.7 - Sensitive Data Exposure vulnerability1clickmigration 1 Click WordPress Migration
- CVE-2025-32256WordPress SurveyJS plugin <= 1.12.20 - Broken Access Control vulnerabilitydevsoftbaltic SurveyJS
- CVE-2025-32255WordPress StaffList plugin <= 3.2.7 - Sensitive Data Exposure vulnerabilityERA404 StaffList
- CVE-2025-32254WordPress WPBookit plugin <= 1.0.7 - Broken Access Control vulnerabilityIqonic Design WPBookit
- CVE-2025-32253WordPress Course Booking System Plugin <= 6.1 - Broken Access Control vulnerabilityComMotion Course Booking System
- CVE-2025-32252WordPress WP Genealogy plugin <= 0.1.9 - Broken Access Control vulnerabilityBlack and White WP Genealogy – Your Family History Website
- CVE-2025-32251WordPress Jetpack Feedback Exporter plugin <= 1.23 - Sensitive Data Exposure VulnerabilityJ. Tyler Wiest Jetpack Feedback Exporter
- CVE-2025-32249WordPress DirectoryPress Plugin <= 3.6.22 - Cross Site Request Forgery (CSRF) vulnerabilityDesigninvento DirectoryPress
- CVE-2025-32248WordPress SwiftXR (3D/AR/VR) Viewer plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerabilitySwiftXR (3D/AR/VR) Viewer
- CVE-2025-32247WordPress AI Content Creator plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) vulnerabilityABCdatos AI Content Creator
- CVE-2025-32246WordPress 1-Click Backup & Restore Database plugin <= 1.0.3 - Broken Access Control VulnerabilityTim Nguyen 1-Click Backup & Restore Database
- CVE-2025-32241WordPress Official CleverReach WooCommerce Integration plugin <= 3.4.6 - CSRF to Settings Change vulnerabilityCleverReach® Official CleverReach Plugin for WooCommerce
- CVE-2025-32238WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Sensitive Data Exposure vulnerabilityOnline Booking & Scheduling Calendar for WordPress by vcita
- CVE-2025-32237WordPress MasterStudy LMS plugin <= 3.5.28 - Broken Access Control vulnerabilityStylemix MasterStudy LMS
- CVE-2025-32235WordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin <= 5.9.4 - Broken Access Control vulnerabilityMP3 Audio Player for Music, Radio & Podcast by Sonaar
- CVE-2025-32234WordPress AdMail plugin <= 1.7.0 - Broken Access Control vulnerabilityaleswebs AdMail – Multilingual Back in-Stock Notifier for W…
- CVE-2025-32233WordPress Revive.so plugin <= 2.0.3 - Broken Access Control vulnerabilityWP Chill Revive.so
- CVE-2025-32232WordPress StaffList plugin <= 3.2.7 - Broken Access Control vulnerabilityERA404 StaffList
- CVE-2025-32231WordPress Bookingor plugin <= 2.0.1 - Broken Access Control vulnerabilityBookingor
- CVE-2025-32229WordPress Variable Inspector plugin <= 2.6.3 - Broken Access Control vulnerabilityBowo Variable Inspector
- CVE-2025-32226WordPress Display product variations dropdown on shop page plugin <= 1.1.3 - Broken Access Control vulnerabilityAnzar Ahmed Display product variations dropdown on shop page
- CVE-2025-32225WordPress WP Event Manager plugin <= 3.2.0 - Broken Access Control vulnerabilityWP Event Manager
- CVE-2025-32220WordPress Salon booking system plugin <= 10.31.9 - Broken Access Control vulnerabilityDimitri Grassi Salon booking system
- CVE-2025-32219WordPress eaSYNC plugin <= 1.3.19 - Broken Access Control vulnerabilitySyntactics eaSYNC
- CVE-2025-32218WordPress TableOn plugin <= 1.0.5.1 - Broken Access Control vulnerabilityRealMag777 TableOn
- CVE-2025-32217WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.1 - Broken Access Control vulnerabilityWP Messiah Ai Image Alt Text Generator for WP
- CVE-2025-32207WordPress Ni WooCommerce Cost Of Goods plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerabilityAnzar Ahmed Ni WooCommerce Cost Of Goods
- CVE-2025-32201WordPress Xpro Theme Builder Plugin <= 1.2.8.4 - Broken Access Control vulnerabilityXpro Theme Builder
- CVE-2025-32197WordPress Piotnet Addons For Elementor plugin <= 2.4.36 - Cross Site Scripting (XSS) vulnerabilitypiotnetdotcom Piotnet Addons For Elementor
- CVE-2025-32196WordPress News Kit Elementor Addons plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityblazethemes News Kit Elementor Addons
- CVE-2025-32195WordPress Ecwid Shopping Cart plugin <= 7.0 - Cross Site Scripting (XSS) vulnerabilityEcwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping…
- CVE-2025-32194WordPress LA-Studio Element Kit for Elementor plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityLA-Studio Element Kit for Elementor
- CVE-2025-32193WordPress Simple WP Events plugin <= 1.8.17 - Cross Site Scripting (XSS) vulnerabilityWPMinds Simple WP Events
- CVE-2025-32192WordPress Ultra Addons Lite for Elementor plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerabilityUltraPress Ultra Addons Lite for Elementor
- CVE-2025-32191WordPress News Element Elementor Blog Magazine plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerabilitywebangon News Element Elementor Blog Magazine
- CVE-2025-32190WordPress Musician's Pack For Elementor plugin <= 1.8.7 - Cross Site Scripting (XSS) vulnerabilitysmartwpress Musician's Pack For Elementor
- CVE-2025-32189WordPress BWD Elementor Addons plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerabilityBest WP Developer BWD Elementor Addons
- CVE-2025-32188WordPress Advanced Woo Labels plugin <= 2.15 - Cross Site Scripting (XSS) vulnerabilityILLID Advanced Woo Labels
- CVE-2025-32187WordPress Administrator Z plugin <= 2026.03.02 - Cross Site Scripting (XSS) vulnerabilityQuý Lê 91 Administrator Z
- CVE-2025-32186WordPress Turbo Addons for Elementor plugin <= 1.7.7 - Cross Site Scripting (XSS) vulnerabilityTurbo Addons Elementor
- CVE-2025-32185WordPress Colibri Page Builder plugin <= 1.0.329 - Cross Site Scripting (XSS) vulnerabilityExtend Themes Colibri Page Builder
- CVE-2025-32184WordPress Ultimate Store Kit Elementor Addons plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilitybdthemes Ultimate Store Kit Elementor Addons
- CVE-2025-32183WordPress Video Playlist For YouTube plugin <= 6.7.1 - Cross Site Scripting (XSS) vulnerabilityGalaxy Weblinks Video Playlist For YouTube
- CVE-2025-32182WordPress Spider Elements – Addons for Elementor plugin <= 1.6.5 - Cross Site Scripting (XSS) vulnerabilitySpider Themes Spider Elements
- CVE-2025-32181WordPress Search, Filters & Merchandising for WooCommerce plugin <= 3.0.58 - Stored Cross Site Scripting (XSS) vulnerabilityFast Simon Search, Filters & Merchandising for WooCommerce
- CVE-2025-32179WordPress Maps for WP Plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityicopydoc Maps for WP
- CVE-2025-32177WordPress Embed Chessboard plugin <= 3.08.00 - Cross Site Scripting (XSS) vulnerabilitypgn4web Embed Chessboard
- CVE-2025-32176WordPress Gallery Blocks with Lightbox plugin <= 3.2.5 - Stored Cross Site Scripting (XSS) vulnerabilityGalleryCreator SimpLy Gallery
- CVE-2025-32175WordPress VK Filter Search plugin <= 2.20.2 - Cross Site Scripting (XSS) vulnerabilityVektor VK Filter Search
- CVE-2025-32174WordPress Tockify Events Calendar plugin <= 2.2.13 - Cross Site Scripting (XSS) vulnerabilityTockify Events Calendar
- CVE-2025-32173WordPress B Blocks plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerabilitybPlugins B Blocks
- CVE-2025-32172WordPress YaMaps for WordPress plugin <= 0.6.40 - Cross Site Scripting (XSS) vulnerabilityYuri Baranov YaMaps for WordPress
- CVE-2025-32171WordPress Table Block by Tableberg plugin <= 0.6.10 - Cross Site Scripting (XSS) vulnerabilityImtiaz Rayhan Table Block by Tableberg
- CVE-2025-32170WordPress Motors plugin <= 1.4.71 - Cross Site Scripting (XSS) vulnerabilityStylemix Motors
- CVE-2025-32169WordPress Showeblogin Social plugin <= 7.0 - Cross Site Scripting (XSS) vulnerabilitySuresh Prasad Showeblogin Social
- CVE-2025-32168WordPress Gutenify plugin <= 1.5.7 - Cross Site Scripting (XSS) vulnerabilityCodeYatri Gutenify
- CVE-2025-32167WordPress SurveyJS plugin <= 1.12.20 - Cross Site Scripting (XSS) vulnerabilitydevsoftbaltic SurveyJS
- CVE-2025-32166WordPress Emma for WordPress plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityJohn Housholder Emma for WordPress
- CVE-2025-32165WordPress Doppler Forms plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerabilityfromdoppler Doppler Forms
- CVE-2025-32163WordPress Xpro Elementor Addons plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerabilityXpro Elementor Addons
- CVE-2025-32162WordPress Chamber Dashboard Business Directory plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerabilityMorgan Kay Chamber Dashboard Business Directory
- CVE-2025-32161WordPress Arkhe Blocks plugin <= 2.27.1 - Cross Site Scripting (XSS) VulnerabilityRyo Arkhe Blocks
- CVE-2025-32138WordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerabilitysupsystic Easy Google Maps
- CVE-2025-32137WordPress s2Member plugin <= 250419 - Local File Inclusion vulnerabilityCristián Lávaque s2Member
- CVE-2025-32136WordPress ActiveCampaign Plugin <= 8.1.16 - Cross Site Scripting (XSS) vulnerabilityActiveCampaign
- CVE-2025-32135WordPress Split Test For Elementor plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerabilityrocketelements Split Test For Elementor
- CVE-2025-32134WordPress URL Shortify Plugin <= 1.10.5.1 - Cross Site Scripting (XSS) vulnerabilityKaizenCoders URL Shortify
- CVE-2025-32133WordPress Secure Copy Content Protection and Content Locking plugin <= 4.5.5 - Cross Site Scripting (XSS) vulnerabilityAys Pro Secure Copy Content Protection and Content Locking
- CVE-2025-32132WordPress FunnelCockpit Plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityFunnelCockpit
- CVE-2025-32131WordPress Social Intents plugin <= 1.6.19 - Cross Site Scripting (XSS) Vulnerabilitysocialintents Social Intents
- CVE-2025-32130WordPress Posts Footer Manager plugin <= 2.2.0 - Cross Site Scripting (XSS) VulnerabilityData443 Risk Mitigation Posts Footer Manager
- CVE-2025-32129WordPress Welcome Bar plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilityData443 Risk Mitigation Welcome Bar
- CVE-2025-3253xujiangfei admintwo insertTree cross site scriptingxujiangfei admintwo
- CVE-2025-3252xujiangfei admintwo add cross site scriptingxujiangfei admintwo
- CVE-2025-3251xujiangfei admintwo updateSet cross site scriptingxujiangfei admintwo
- CVE-2025-3250elunez eladmin Maintenance Management Module testConnect deserializationelunez eladmin
- CVE-2025-31130gitoxide does not detect SHA-1 collision attacksGitoxideLabs gitoxide · gix-features +26
- CVE-2025-3249TOTOLINK A6000R mtkwifi.lua apcli_cancel_wps command injectionTOTOLINK A6000R
- CVE-2025-22285WordPress Pallet Packaging for WooCommerce Plugin <= 1.1.15 - Broken Access Control vulnerabilityenituretechnology Pallet Packaging for WooCommerce
- CVE-2025-22281WordPress Simplish theme <= 2.6.4 - Stored Cross Site Scripting (XSS) vulnerabilityjoshix Simplish
- CVE-2025-31381WordPress Booking Calendar and Notification plugin <= 4.0.3 - Broken Authentication vulnerabilityshiptrack Booking Calendar and Notification
- CVE-2025-31407WordPress Tiger theme <= 2.0 - Cross Site Scripting (XSS) vulnerabilityhutsixdigital Tiger
- CVE-2025-31421WordPress Srbtranslatin plugin <= 3.2.0 - Sensitive Data Exposure vulnerabilityOblak Studio Srbtranslatin
- CVE-2025-3189Stored Cross-Site Scripting (XSS) in DoWISPDoWISP
- CVE-2025-3245itsourcecode Library Management System Forgot.java search sql injectionitsourcecode Library Management System
- CVE-2025-3244SourceCodester Web-based Pharmacy Product Management System Create User Page add-admin.php unrestricted uploadSourceCodester Web-based Pharmacy Product Management System
- CVE-2025-3243code-projects Patient Record Management System dental_form.php sql injectioncode-projects Patient Record Management System
- CVE-2025-3242PHPGurukul e-Diary Management System search-result.php sql injectionPHPGurukul e-Diary Management System
- CVE-2025-3241zhangyanbo2007 youkefu XML Document CallCenterRouterController.java xml external entity referencezhangyanbo2007 youkefu
- CVE-2025-3240PHPGurukul Online Fire Reporting System search.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-3239PHPGurukul Online Fire Reporting System edit-guard-detail.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-3238PHPGurukul Online Fire Reporting System search-request.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-3237Tenda FH1202 wrlwpsset access controlTenda FH1202
- CVE-2025-2245Server Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646)Bitdefender GravityZone Update Server
- CVE-2025-2243SSRF in GravityZone Console via DNS Truncation (VA-12634)Bitdefender GravityZone Console
- CVE-2025-3236Tenda FH1202 Web Management Interface VirSerDMZ access controlTenda FH1202
- CVE-2025-3235PHPGurukul Old Age Home Management System profile.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-3231PHPGurukul Zoo Management System aboutus.php sql injectionPHPGurukul Zoo Management System
- CVE-2025-3229PHPGurukul Restaurant Table Booking System edit-subadmin.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2025-3220PHPGurukul e-Diary Management System dashboard.php sql injectionPHPGurukul e-Diary Management System
- CVE-2025-3219CodeCanyon Perfex CRM Project Discussions Module 2 cross site scriptingCodeCanyon Perfex CRM
- CVE-2025-3217PHPGurukul e-Diary Management System registration.php sql injectionPHPGurukul e-Diary Management System
- CVE-2025-2797Woffice Core <= 5.4.21 - Cross-Site Request Forgery to User Registration ApprovalWofficeIO Woffice Core
- CVE-2025-3087Stored XSS Vulnerability in M-Files WebM-Files Web
- CVE-2025-3086User in anonymous role could create and delete viewsM-Files Server
- CVE-2025-3216PHPGurukul e-Diary Management System password-recovery.php sql injectionPHPGurukul e-Diary Management System
- CVE-2025-3215PHPGurukul Restaurant Table Booking System add-subadmin.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2025-2159Stored XSS in M-Files Admin user interfaceM-Files Admin
- CVE-2025-3214JFinal CMS readTemplate engine.getTemplate path traversalJFinal CMS
- CVE-2025-2279Maps - Google Maps <= 1.0.6 - Contributor+ Stored XSSMaps
- CVE-2025-3213PHPGurukul e-Diary Management System view-note.php sql injectionPHPGurukul e-Diary Management System
- CVE-2025-3211code-projects Patient Record Management System birthing_print.php sql injectioncode-projects Patient Record Management System
- CVE-2024-42208HCL Connections is vulnerable to an information disclosure vulnerabilityHCL Software HCL Connections
- CVE-2025-2836RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scriptingmetagauss RegistrationMagic – Custom Registration Forms, Us…
- CVE-2024-13898Simple Banner <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scriptingrpetersen29 Simple Banner – Easily add multiple Banners/Bar…
- CVE-2025-3210code-projects Patient Record Management System birthing_pending.php sql injectioncode-projects Patient Record Management System
- CVE-2025-3209code-projects Patient Record Management System add_patient.php sql injectioncode-projects Patient Record Management System
- CVE-2025-3191All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result react-draft-wysiwyg
- CVE-2025-3197Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js.expand-object
- CVE-2025-3208code-projects Patient Record Management System xray_print.php sql injectioncode-projects Patient Record Management System
- CVE-2025-3207code-projects Patient Record Management System birthing_form.php sql injectioncode-projects Patient Record Management System
- CVE-2025-3206code-projects Hospital Management System doctor-specilization.php sql injectioncode-projects Hospital Management System
- CVE-2025-3205CodeAstro Student Grading System studentsubject.php sql injectionCodeAstro Student Grading System
- CVE-2025-3204CodeAstro Car Rental System returncar.php sql injectionCodeAstro Car Rental System
- CVE-2025-3203Tenda W18E setModules formSetAccountList stack-based overflowTenda W18E
- CVE-2025-3202ageerle ruoyi-ai SysNoticeController.java improper authorizationageerle ruoyi-ai
- CVE-2025-26401Weak encoding for password vulnerability exists in HMI ViewJet C-more series.JTEKT ELECTRONICS HMI ViewJet C-more series
- CVE-2025-25061Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remotJTEKT ELECTRONICS HMI ViewJet C-more series · JTEKT ELECTRO…
- CVE-2025-24317Allocation of resources without limits or throttling issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remotJTEKT ELECTRONICS HMI ViewJet C-more series · JTEKT ELECTRO…
- CVE-2025-24310Improper restriction of rendered UI layers or frames issue exists in HMI ViewJet C-more series, which may allow a remote unauthenticated attJTEKT ELECTRONICS HMI ViewJet C-more series
- CVE-2025-3199ageerle ruoyi-ai API Interface SysModelController.java improper authorizationageerle ruoyi-ai
- CVE-2025-3198GNU Binutils objdump bucomm.c display_info memory leakGNU Binutils
- CVE-2025-3196Open Asset Import Library Assimp Malformed File MD2Loader.cpp InternReadFile stack-based overflowOpen Asset Import Library Assimp · pyassimp
- CVE-2025-3195itsourcecode Online Blood Bank Management System bbms.php sql injectionitsourcecode Online Blood Bank Management System
- CVE-2025-3188PHPGurukul e-Diary Management System add-notes.php sql injectionPHPGurukul e-Diary Management System
- CVE-2025-3187PHPGurukul e-Diary Management System login.php sql injectionPHPGurukul e-Diary Management System
- CVE-2025-29796Microsoft Edge for iOS Spoofing VulnerabilityMicrosoft Edge for iOS
- CVE-2025-25001Microsoft Edge for iOS Spoofing VulnerabilityMicrosoft Edge for iOS
- CVE-2025-29476Buffer Overflow vulnerability in compress_chunk_fuzzer with oss-fuzz on commit 16450518afddcb3139de627157208e49bfef6987 in c-blosc2 v.2.17.0
- CVE-2025-29477An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.