# CVEs published 2025-04-04

231 CVEs were published on April 4, 2025: 10 critical, 48 high. Days are UTC.

- [CVE-2025-2889](https://cve.now/CVE-2025-2889.md): Link Library \<= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters (CVSS 6.4, jackdewey Link Library)
- [CVE-2025-3268](https://cve.now/CVE-2025-3268.md): qinguoyi TinyWebServer http\_conn.cpp improper authentication (CVSS 6.9, qinguoyi TinyWebServer)
- [CVE-2025-3267](https://cve.now/CVE-2025-3267.md): qinguoyi TinyWebServer http\_conn.cpp sql injection (CVSS 5.3, qinguoyi TinyWebServer)
- [CVE-2025-3266](https://cve.now/CVE-2025-3266.md): qinguoyi TinyWebServer http\_conn.cpp stack-based overflow (CVSS 6.9, qinguoyi TinyWebServer)
- [CVE-2025-3265](https://cve.now/CVE-2025-3265.md): PHPGurukul e-Diary Management System add-category.php sql injection (CVSS 6.9, PHPGurukul e-Diary Management System)
- [CVE-2024-11235](https://cve.now/CVE-2024-11235.md): Reference counting in php\_request\_shutdown causes Use-After-Free (CVSS 9.2, PHP Group PHP)
- [CVE-2025-3259](https://cve.now/CVE-2025-3259.md): Tenda RX3 SetOnlineDevName formSetDeviceName stack-based overflow (CVSS 8.7, Tenda RX3)
- [CVE-2025-3258](https://cve.now/CVE-2025-3258.md): PHPGurukul Old Age Home Management System search.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2025-3257](https://cve.now/CVE-2025-3257.md): xujiangfei admintwo updateSet cross-site request forgery (CVSS 5.3, xujiangfei admintwo)
- [CVE-2025-3256](https://cve.now/CVE-2025-3256.md): xujiangfei admintwo updateSet access control (CVSS 5.3, xujiangfei admintwo)
- [CVE-2025-3255](https://cve.now/CVE-2025-3255.md): xujiangfei admintwo home access control (CVSS 5.3, xujiangfei admintwo)
- [CVE-2025-3254](https://cve.now/CVE-2025-3254.md): xujiangfei admintwo add server-side request forgery (CVSS 5.3, xujiangfei admintwo)
- [CVE-2025-32178](https://cve.now/CVE-2025-32178.md): WordPress 6Storage Rentals plugin \<= 2.20.2 - Broken Access Control vulnerability (CVSS 5.4, 6Storage Rentals)
- [CVE-2025-32250](https://cve.now/CVE-2025-32250.md): WordPress Rollbar plugin \<= 2.7.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Rollbar)
- [CVE-2025-32239](https://cve.now/CVE-2025-32239.md): WordPress Social Share Buttons & Analytics Plugin plugin \<= 4.5 - Broken Access Control vulnerability (CVSS 4.3, Joao Romao Social Share Buttons & Analytics Plugin – GetSoc…)
- [CVE-2025-32224](https://cve.now/CVE-2025-32224.md): WordPress Privyr CRM plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 5.4, Shivam Mani Tripathi Privyr CRM Integration)
- [CVE-2025-32280](https://cve.now/CVE-2025-32280.md): WordPress WP Project Manager plugin \< 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, weDevs WP Project Manager)
- [CVE-2025-32278](https://cve.now/CVE-2025-32278.md): WordPress Table Block by RioVizual plugin \<= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wprio Table Block by RioVizual)
- [CVE-2025-32277](https://cve.now/CVE-2025-32277.md): WordPress RepairBuddy plugin \<= 3.8213 - Broken Access Control vulnerability (CVSS 4.3, Ateeq Rafeeq RepairBuddy)
- [CVE-2025-32276](https://cve.now/CVE-2025-32276.md): WordPress Administrator Z plugin \<= 2026.03.02 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Quý Lê 91 Administrator Z)
- [CVE-2025-32274](https://cve.now/CVE-2025-32274.md): WordPress w3all phpBB integration Plugin \<= 2.9.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, axew3 WP w3all phpBB)
- [CVE-2025-32273](https://cve.now/CVE-2025-32273.md): WordPress Freetobook Responsive Widget Plugin \<= 1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Freetobook Responsive Widget)
- [CVE-2025-32272](https://cve.now/CVE-2025-32272.md): WordPress Wishlist plugin \<= 1.0.46 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, PickPlugins Wishlist)
- [CVE-2025-32271](https://cve.now/CVE-2025-32271.md): WordPress Woocommerce Role Pricing Plugin \<= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ablancodev Woocommerce Role Pricing)
- [CVE-2025-32270](https://cve.now/CVE-2025-32270.md): WordPress Broadstreet plugin \<= 1.52.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, Broadstreet Ads)
- [CVE-2025-32269](https://cve.now/CVE-2025-32269.md): WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms Plugin \<= 1.1.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor…)
- [CVE-2025-32268](https://cve.now/CVE-2025-32268.md): WordPress QR Code Tag for WC plugin \<= 1.9.42 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, www.15.to QR Code Tag for WC)
- [CVE-2025-32267](https://cve.now/CVE-2025-32267.md): WordPress WP to Hootsuite plugin \<= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wpzinc Post to Social Media – WordPress to Hootsuite)
- [CVE-2025-32266](https://cve.now/CVE-2025-32266.md): WordPress 404 Image Redirection (Replace Broken Images) plugin \<= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wp-buy 404 Image Redirection)
- [CVE-2025-32265](https://cve.now/CVE-2025-32265.md): WordPress JobWP plugin \<= 2.3.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Hossni Mubarak JobWP)
- [CVE-2025-32264](https://cve.now/CVE-2025-32264.md): WordPress UltraAddons – Elementor Addons plugin \<= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Saiful Islam UltraAddons Elementor Lite)
- [CVE-2025-32263](https://cve.now/CVE-2025-32263.md): WordPress Sequential Order Numbers for WooCommerce plugin \<= 3.6.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, BeRocket Sequential Order Numbers for WooCommerce)
- [CVE-2025-32262](https://cve.now/CVE-2025-32262.md): WordPress RDP Wiki Embed plugin \<= 1.2.20 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Robert D Payne RDP Wiki Embed)
- [CVE-2025-32261](https://cve.now/CVE-2025-32261.md): WordPress Advanced All in One Admin Search by WP Spotlight plugin \<= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Kuppuraj Advanced All in One Admin Search by WP Spotlight)
- [CVE-2025-32258](https://cve.now/CVE-2025-32258.md): WordPress Simple Website Logo plugin \<= 1.1 - Broken Access Control vulnerability (CVSS 5.3, InfoGiants Simple Website Logo)
- [CVE-2025-32257](https://cve.now/CVE-2025-32257.md): WordPress 1 Click WordPress Migration plugin \<= 2.5.7 - Sensitive Data Exposure vulnerability (CVSS 5.3, 1clickmigration 1 Click WordPress Migration)
- [CVE-2025-32256](https://cve.now/CVE-2025-32256.md): WordPress SurveyJS plugin \<= 1.12.20 - Broken Access Control vulnerability (CVSS 5.3, devsoftbaltic SurveyJS)
- [CVE-2025-32255](https://cve.now/CVE-2025-32255.md): WordPress StaffList plugin \<= 3.2.7 - Sensitive Data Exposure vulnerability (CVSS 5.3, ERA404 StaffList)
- [CVE-2025-32254](https://cve.now/CVE-2025-32254.md): WordPress WPBookit plugin \<= 1.0.7 - Broken Access Control vulnerability (CVSS 5.3, Iqonic Design WPBookit)
- [CVE-2025-32253](https://cve.now/CVE-2025-32253.md): WordPress Course Booking System Plugin \<= 6.1 - Broken Access Control vulnerability (CVSS 5.3, ComMotion Course Booking System)
- [CVE-2025-32252](https://cve.now/CVE-2025-32252.md): WordPress WP Genealogy plugin \<= 0.1.9 - Broken Access Control vulnerability (CVSS 5.3, Black and White WP Genealogy – Your Family History Website)
- [CVE-2025-32251](https://cve.now/CVE-2025-32251.md): WordPress Jetpack Feedback Exporter plugin \<= 1.23 - Sensitive Data Exposure Vulnerability (CVSS 5.3, J. Tyler Wiest Jetpack Feedback Exporter)
- [CVE-2025-32249](https://cve.now/CVE-2025-32249.md): WordPress DirectoryPress Plugin \<= 3.6.22 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Designinvento DirectoryPress)
- [CVE-2025-32248](https://cve.now/CVE-2025-32248.md): WordPress SwiftXR (3D/AR/VR) Viewer plugin \<= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, SwiftXR (3D/AR/VR) Viewer)
- [CVE-2025-32247](https://cve.now/CVE-2025-32247.md): WordPress AI Content Creator plugin \<= 1.2.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, ABCdatos AI Content Creator)
- [CVE-2025-32246](https://cve.now/CVE-2025-32246.md): WordPress 1-Click Backup & Restore Database plugin \<= 1.0.3 - Broken Access Control Vulnerability (CVSS 5.4, Tim Nguyen 1-Click Backup & Restore Database)
- [CVE-2025-32241](https://cve.now/CVE-2025-32241.md): WordPress Official CleverReach WooCommerce Integration plugin \<= 3.4.6 - CSRF to Settings Change vulnerability (CVSS 6.5, CleverReach® Official CleverReach Plugin for WooCommerce)
- [CVE-2025-32238](https://cve.now/CVE-2025-32238.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin \<= 4.5.5 - Sensitive Data Exposure vulnerability (CVSS 4.3, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2025-32237](https://cve.now/CVE-2025-32237.md): WordPress MasterStudy LMS plugin \<= 3.5.28 - Broken Access Control vulnerability (CVSS 4.3, Stylemix MasterStudy LMS)
- [CVE-2025-32235](https://cve.now/CVE-2025-32235.md): WordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin \<= 5.9.4 - Broken Access Control vulnerability (CVSS 4.3, MP3 Audio Player for Music, Radio & Podcast by Sonaar)
- [CVE-2025-32234](https://cve.now/CVE-2025-32234.md): WordPress AdMail plugin \<= 1.7.0 - Broken Access Control vulnerability (CVSS 4.3, aleswebs AdMail – Multilingual Back in-Stock Notifier for W…)
- [CVE-2025-32233](https://cve.now/CVE-2025-32233.md): WordPress Revive.so plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 4.3, WP Chill Revive.so)
- [CVE-2025-32232](https://cve.now/CVE-2025-32232.md): WordPress StaffList plugin \<= 3.2.7 - Broken Access Control vulnerability (CVSS 4.3, ERA404 StaffList)
- [CVE-2025-32231](https://cve.now/CVE-2025-32231.md): WordPress Bookingor plugin \<= 2.0.1 - Broken Access Control vulnerability (CVSS 4.3, Bookingor)
- [CVE-2025-32229](https://cve.now/CVE-2025-32229.md): WordPress Variable Inspector plugin \<= 2.6.3 - Broken Access Control vulnerability (CVSS 4.3, Bowo Variable Inspector)
- [CVE-2025-32226](https://cve.now/CVE-2025-32226.md): WordPress Display product variations dropdown on shop page plugin \<= 1.1.3 - Broken Access Control vulnerability (CVSS 4.3, Anzar Ahmed Display product variations dropdown on shop page)
- [CVE-2025-32225](https://cve.now/CVE-2025-32225.md): WordPress WP Event Manager plugin \<= 3.2.0 - Broken Access Control vulnerability (CVSS 5.3, WP Event Manager)
- [CVE-2025-32220](https://cve.now/CVE-2025-32220.md): WordPress Salon booking system plugin \<= 10.31.9 - Broken Access Control vulnerability (CVSS 5.4, Dimitri Grassi Salon booking system)
- [CVE-2025-32219](https://cve.now/CVE-2025-32219.md): WordPress eaSYNC plugin \<= 1.3.19 - Broken Access Control vulnerability (CVSS 5.4, Syntactics eaSYNC)
- [CVE-2025-32218](https://cve.now/CVE-2025-32218.md): WordPress TableOn plugin \<= 1.0.5.1 - Broken Access Control vulnerability (CVSS 5.4, RealMag777 TableOn)
- [CVE-2025-32217](https://cve.now/CVE-2025-32217.md): WordPress Ai Image Alt Text Generator for WP plugin \<= 1.1.1 - Broken Access Control vulnerability (CVSS 5.4, WP Messiah Ai Image Alt Text Generator for WP)
- [CVE-2025-32207](https://cve.now/CVE-2025-32207.md): WordPress Ni WooCommerce Cost Of Goods plugin \<= 3.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Anzar Ahmed Ni WooCommerce Cost Of Goods)
- [CVE-2025-32204](https://cve.now/CVE-2025-32204.md): WordPress Split Test For Elementor Plugin \<= 1.8.3 - SQL Injection vulnerability (CVSS 7.6, rocketelements Split Test For Elementor)
- [CVE-2025-32203](https://cve.now/CVE-2025-32203.md): WordPress Falling things Plugin \<= 1.08 - SQL Injection vulnerability (CVSS 7.6, manu225 Falling things)
- [CVE-2025-32201](https://cve.now/CVE-2025-32201.md): WordPress Xpro Theme Builder Plugin \<= 1.2.8.4 - Broken Access Control vulnerability (CVSS 4.3, Xpro Theme Builder)
- [CVE-2025-32197](https://cve.now/CVE-2025-32197.md): WordPress Piotnet Addons For Elementor plugin \<= 2.4.36 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, piotnetdotcom Piotnet Addons For Elementor)
- [CVE-2025-32196](https://cve.now/CVE-2025-32196.md): WordPress News Kit Elementor Addons plugin \<= 1.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, blazethemes News Kit Elementor Addons)
- [CVE-2025-32195](https://cve.now/CVE-2025-32195.md): WordPress Ecwid Shopping Cart plugin \<= 7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping…)
- [CVE-2025-32194](https://cve.now/CVE-2025-32194.md): WordPress LA-Studio Element Kit for Elementor plugin \<= 1.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LA-Studio Element Kit for Elementor)
- [CVE-2025-32193](https://cve.now/CVE-2025-32193.md): WordPress Simple WP Events plugin \<= 1.8.17 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPMinds Simple WP Events)
- [CVE-2025-32192](https://cve.now/CVE-2025-32192.md): WordPress Ultra Addons Lite for Elementor plugin \<= 1.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, UltraPress Ultra Addons Lite for Elementor)
- [CVE-2025-32191](https://cve.now/CVE-2025-32191.md): WordPress News Element Elementor Blog Magazine plugin \<= 1.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webangon News Element Elementor Blog Magazine)
- [CVE-2025-32190](https://cve.now/CVE-2025-32190.md): WordPress Musician's Pack For Elementor plugin \<= 1.8.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, smartwpress Musician's Pack For Elementor)
- [CVE-2025-32189](https://cve.now/CVE-2025-32189.md): WordPress BWD Elementor Addons plugin \<= 4.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Best WP Developer BWD Elementor Addons)
- [CVE-2025-32188](https://cve.now/CVE-2025-32188.md): WordPress Advanced Woo Labels plugin \<= 2.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ILLID Advanced Woo Labels)
- [CVE-2025-32187](https://cve.now/CVE-2025-32187.md): WordPress Administrator Z plugin \<= 2026.03.02 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Quý Lê 91 Administrator Z)
- [CVE-2025-32186](https://cve.now/CVE-2025-32186.md): WordPress Turbo Addons for Elementor plugin \<= 1.7.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Turbo Addons Elementor)
- [CVE-2025-32185](https://cve.now/CVE-2025-32185.md): WordPress Colibri Page Builder plugin \<= 1.0.329 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Extend Themes Colibri Page Builder)
- [CVE-2025-32184](https://cve.now/CVE-2025-32184.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 2.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bdthemes Ultimate Store Kit Elementor Addons)
- [CVE-2025-32183](https://cve.now/CVE-2025-32183.md): WordPress Video Playlist For YouTube plugin \<= 6.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Galaxy Weblinks Video Playlist For YouTube)
- [CVE-2025-32182](https://cve.now/CVE-2025-32182.md): WordPress Spider Elements – Addons for Elementor plugin \<= 1.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Spider Themes Spider Elements)
- [CVE-2025-32181](https://cve.now/CVE-2025-32181.md): WordPress Search, Filters & Merchandising for WooCommerce plugin \<= 3.0.58 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Fast Simon Search, Filters & Merchandising for WooCommerce)
- [CVE-2025-32179](https://cve.now/CVE-2025-32179.md): WordPress Maps for WP Plugin \<= 1.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, icopydoc Maps for WP)
- [CVE-2025-32177](https://cve.now/CVE-2025-32177.md): WordPress Embed Chessboard plugin \<= 3.08.00 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, pgn4web Embed Chessboard)
- [CVE-2025-32176](https://cve.now/CVE-2025-32176.md): WordPress Gallery Blocks with Lightbox plugin \<= 3.2.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GalleryCreator SimpLy Gallery)
- [CVE-2025-32175](https://cve.now/CVE-2025-32175.md): WordPress VK Filter Search plugin \<= 2.20.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vektor VK Filter Search)
- [CVE-2025-32174](https://cve.now/CVE-2025-32174.md): WordPress Tockify Events Calendar plugin \<= 2.2.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tockify Events Calendar)
- [CVE-2025-32173](https://cve.now/CVE-2025-32173.md): WordPress B Blocks plugin \<= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins B Blocks)
- [CVE-2025-32172](https://cve.now/CVE-2025-32172.md): WordPress YaMaps for WordPress plugin \<= 0.6.40 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Yuri Baranov YaMaps for WordPress)
- [CVE-2025-32171](https://cve.now/CVE-2025-32171.md): WordPress Table Block by Tableberg plugin \<= 0.6.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Imtiaz Rayhan Table Block by Tableberg)
- [CVE-2025-32170](https://cve.now/CVE-2025-32170.md): WordPress Motors plugin \<= 1.4.71 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Stylemix Motors)
- [CVE-2025-32169](https://cve.now/CVE-2025-32169.md): WordPress Showeblogin Social plugin \<= 7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Suresh Prasad Showeblogin Social)
- [CVE-2025-32168](https://cve.now/CVE-2025-32168.md): WordPress Gutenify plugin \<= 1.5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CodeYatri Gutenify)
- [CVE-2025-32167](https://cve.now/CVE-2025-32167.md): WordPress SurveyJS plugin \<= 1.12.20 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, devsoftbaltic SurveyJS)
- [CVE-2025-32166](https://cve.now/CVE-2025-32166.md): WordPress Emma for WordPress plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, John Housholder Emma for WordPress)
- [CVE-2025-32165](https://cve.now/CVE-2025-32165.md): WordPress Doppler Forms plugin \<= 2.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, fromdoppler Doppler Forms)
- [CVE-2025-32163](https://cve.now/CVE-2025-32163.md): WordPress Xpro Elementor Addons plugin \<= 1.4.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Xpro Elementor Addons)
- [CVE-2025-32162](https://cve.now/CVE-2025-32162.md): WordPress Chamber Dashboard Business Directory plugin \<= 3.3.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Morgan Kay Chamber Dashboard Business Directory)
- [CVE-2025-32161](https://cve.now/CVE-2025-32161.md): WordPress Arkhe Blocks plugin \<= 2.27.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ryo Arkhe Blocks)
- [CVE-2025-32159](https://cve.now/CVE-2025-32159.md): WordPress Radius Blocks plugin \<= 2.2.1 - Local File Inclusion vulnerability (CVSS 7.5, RadiusTheme Radius Blocks)
- [CVE-2025-32157](https://cve.now/CVE-2025-32157.md): WordPress Sparkle Elementor Kit plugin \<= 2.0.9 - Local File Inclusion vulnerability (CVSS 7.5, Jakub Glos Sparkle Elementor Kit)
- [CVE-2025-32156](https://cve.now/CVE-2025-32156.md): WordPress Just Post Preview Widget plugin \<= 1.1.1 - Local File Inclusion vulnerability (CVSS 7.5, Alex Prokopenko / JustCoded Just Post Preview Widget)
- [CVE-2025-32155](https://cve.now/CVE-2025-32155.md): WordPress Beds24 Online Booking plugin \<= 2.0.28 - Local File Inclusion vulnerability (CVSS 7.5, markkinchin Beds24 Online Booking)
- [CVE-2025-32154](https://cve.now/CVE-2025-32154.md): WordPress Catch Dark Mode plugin \<= 2.0.1 - Local File Inclusion vulnerability (CVSS 7.5, Catch Themes Catch Dark Mode)
- [CVE-2025-32153](https://cve.now/CVE-2025-32153.md): WordPress VG WooCarousel plugin \<= 1.3 - Local File Inclusion vulnerability (CVSS 7.5, vinagecko VG WooCarousel)
- [CVE-2025-32152](https://cve.now/CVE-2025-32152.md): WordPress Slider a SlidersPack Plugin \<= 2.3 - Local File Inclusion vulnerability (CVSS 7.5, Essential Plugin Slider a SlidersPack)
- [CVE-2025-32151](https://cve.now/CVE-2025-32151.md): WordPress BuddyForms plugin \<= 2.10.2 - Local File Inclusion vulnerability (CVSS 7.5, Themekraft BuddyForms)
- [CVE-2025-32150](https://cve.now/CVE-2025-32150.md): WordPress Real Estate Manager plugin \<= 7.3 - Local File Inclusion vulnerability (CVSS 7.5, Rameez Iqbal Real Estate Manager)
- [CVE-2025-32149](https://cve.now/CVE-2025-32149.md): WordPress teachPress plugin \<= 9.0.11 - SQL Injection vulnerability (CVSS 8.5, winkm89 teachPress)
- [CVE-2025-32148](https://cve.now/CVE-2025-32148.md): WordPress Daisycon prijsvergelijkers plugin \<= 4.8.4 - SQL Injection vulnerability (CVSS 8.5, Daisycon prijsvergelijkers)
- [CVE-2025-32147](https://cve.now/CVE-2025-32147.md): WordPress Easy WP Optimizer Plugin \<= 1.1.0 - Broken Access Control vulnerability (CVSS 8.8, coothemes Easy WP Optimizer)
- [CVE-2025-32146](https://cve.now/CVE-2025-32146.md): WordPress JS Job Manager plugin \<= 2.0.2 - Local File Inclusion vulnerability (CVSS 8.8, JoomSky JS Job Manager)
- [CVE-2025-32142](https://cve.now/CVE-2025-32142.md): WordPress Motors plugin \<= 1.4.71 - Local File Inclusion vulnerability (CVSS 8.8, Stylemix Motors)
- [CVE-2025-32141](https://cve.now/CVE-2025-32141.md): WordPress MasterStudy LMS plugin \<= 3.5.28 - Local File Inclusion vulnerability (CVSS 8.8, Stylemix MasterStudy LMS)
- [CVE-2025-32138](https://cve.now/CVE-2025-32138.md): WordPress Easy Google Maps plugin \<= 1.11.18 - XML External Entity vulnerability (CVSS 6.6, supsystic Easy Google Maps)
- [CVE-2025-32137](https://cve.now/CVE-2025-32137.md): WordPress s2Member plugin \<= 250419 - Local File Inclusion vulnerability (CVSS 4.9, Cristián Lávaque s2Member)
- [CVE-2025-32136](https://cve.now/CVE-2025-32136.md): WordPress ActiveCampaign Plugin \<= 8.1.16 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ActiveCampaign)
- [CVE-2025-32135](https://cve.now/CVE-2025-32135.md): WordPress Split Test For Elementor plugin \<= 1.8.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, rocketelements Split Test For Elementor)
- [CVE-2025-32134](https://cve.now/CVE-2025-32134.md): WordPress URL Shortify Plugin \<= 1.10.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, KaizenCoders URL Shortify)
- [CVE-2025-32133](https://cve.now/CVE-2025-32133.md): WordPress Secure Copy Content Protection and Content Locking plugin \<= 4.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Ays Pro Secure Copy Content Protection and Content Locking)
- [CVE-2025-32132](https://cve.now/CVE-2025-32132.md): WordPress FunnelCockpit Plugin \<= 1.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, FunnelCockpit)
- [CVE-2025-32131](https://cve.now/CVE-2025-32131.md): WordPress Social Intents plugin \<= 1.6.19 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, socialintents Social Intents)
- [CVE-2025-32130](https://cve.now/CVE-2025-32130.md): WordPress Posts Footer Manager plugin \<= 2.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Data443 Risk Mitigation Posts Footer Manager)
- [CVE-2025-32129](https://cve.now/CVE-2025-32129.md): WordPress Welcome Bar plugin \<= 2.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Data443 Risk Mitigation Welcome Bar)
- [CVE-2025-32127](https://cve.now/CVE-2025-32127.md): WordPress onOffice for WP-Websites plugin \<= 5.7 - SQL Injection vulnerability (CVSS 7.6, onOffice for WP-Websites)
- [CVE-2025-32126](https://cve.now/CVE-2025-32126.md): WordPress Pay with Contact Form 7 Plugin \<= 1.0.4 - SQL Injection vulnerability (CVSS 7.6, cmsMinds Pay with Contact Form)
- [CVE-2025-32125](https://cve.now/CVE-2025-32125.md): WordPress Silvasoft boekhouden plugin \<= 3.0.6 - SQL Injection vulnerability (CVSS 7.6, Silvasoft boekhouden)
- [CVE-2025-32124](https://cve.now/CVE-2025-32124.md): WordPress Behance Portfolio Manager plugin \<= 1.7.5 - SQL Injection vulnerability (CVSS 7.6, eleopard Behance Portfolio Manager)
- [CVE-2025-32122](https://cve.now/CVE-2025-32122.md): WordPress uListing plugin \<= 2.2.0 - SQL Injection vulnerability (CVSS 7.6, Stylemix uListing)
- [CVE-2025-32121](https://cve.now/CVE-2025-32121.md): WordPress Video & Photo Gallery for Ultimate Member plugin \<= 1.1.3 - SQL Injection vulnerability (CVSS 7.6, SuitePlugins Video & Photo Gallery for Ultimate Member)
- [CVE-2025-32120](https://cve.now/CVE-2025-32120.md): WordPress Easy Query – WP Query Builder plugin \<= 2.0.4 - SQL Injection Vulnerability (CVSS 7.6, edanzer Easy Query – WP Query Builder)
- [CVE-2025-32118](https://cve.now/CVE-2025-32118.md): WordPress CMP – Coming Soon & Maintenance plugin \<= 4.1.14 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, NiteoThemes CMP – Coming Soon & Maintenance)
- [CVE-2025-32113](https://cve.now/CVE-2025-32113.md): WordPress Libro de Reclamaciones y Quejas plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Renzo Tejada Libro de Reclamaciones y Quejas)
- [CVE-2025-32112](https://cve.now/CVE-2025-32112.md): WordPress Sidebar Manager Light plugin \<= 1.18 - CSRF to Stored XSS vulnerability (CVSS 7.1, OTWthemes Sidebar Manager Light)
- [CVE-2025-25178](https://cve.now/CVE-2025-25178.md): GPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memory (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2025-0468](https://cve.now/CVE-2025-0468.md): GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA) (CVSS 7.1, Imagination Technologies Graphics DDK)
- [CVE-2025-3253](https://cve.now/CVE-2025-3253.md): xujiangfei admintwo insertTree cross site scripting (CVSS 5.1, xujiangfei admintwo)
- [CVE-2025-3252](https://cve.now/CVE-2025-3252.md): xujiangfei admintwo add cross site scripting (CVSS 5.1, xujiangfei admintwo)
- [CVE-2025-3251](https://cve.now/CVE-2025-3251.md): xujiangfei admintwo updateSet cross site scripting (CVSS 5.1, xujiangfei admintwo)
- [CVE-2025-3250](https://cve.now/CVE-2025-3250.md): elunez eladmin Maintenance Management Module testConnect deserialization (CVSS 5.3, elunez eladmin)
- [CVE-2025-31480](https://cve.now/CVE-2025-31480.md): aiven-extras allows PostgreSQL Privilege Escalation through format function (CVSS 9.1, aiven-extras)
- [CVE-2025-31130](https://cve.now/CVE-2025-31130.md): gitoxide does not detect SHA-1 collision attacks (CVSS 6.8, GitoxideLabs gitoxide · gix-features +26)
- [CVE-2025-27520](https://cve.now/CVE-2025-27520.md): BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization (CVSS 9.8, BentoML)
- [CVE-2025-3249](https://cve.now/CVE-2025-3249.md): TOTOLINK A6000R mtkwifi.lua apcli\_cancel\_wps command injection (CVSS 5.3, TOTOLINK A6000R)
- [CVE-2025-22285](https://cve.now/CVE-2025-22285.md): WordPress Pallet Packaging for WooCommerce Plugin \<= 1.1.15 - Broken Access Control vulnerability (CVSS 6.5, enituretechnology Pallet Packaging for WooCommerce)
- [CVE-2025-22281](https://cve.now/CVE-2025-22281.md): WordPress Simplish theme \<= 2.6.4 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, joshix Simplish)
- [CVE-2024-51800](https://cve.now/CVE-2024-51800.md): WordPress Homey theme \<= 2.4.1 - Privilege Escalation vulnerability (CVSS 9.8, Favethemes Homey)
- [CVE-2025-31381](https://cve.now/CVE-2025-31381.md): WordPress Booking Calendar and Notification plugin \<= 4.0.3 - Broken Authentication vulnerability (CVSS 6.5, shiptrack Booking Calendar and Notification)
- [CVE-2025-2798](https://cve.now/CVE-2025-2798.md): Woffice \<= 5.4.21 - Authentication Bypass via Registration Role (CVSS 9.8, XTENDIFY Woffice CRM)
- [CVE-2025-31384](https://cve.now/CVE-2025-31384.md): WordPress Videos plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Aviplugins Videos)
- [CVE-2025-31389](https://cve.now/CVE-2025-31389.md): WordPress Sequel plugin \<= 1.0.11 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Introvoke Inc. dba Sequel.io Sequel)
- [CVE-2025-31403](https://cve.now/CVE-2025-31403.md): WordPress Booking Calendar and Notification plugin \<= 4.0.3 - SQL Injection vulnerability (CVSS 9.3, shiptrack Booking Calendar and Notification)
- [CVE-2025-31405](https://cve.now/CVE-2025-31405.md): WordPress Fami WooCommerce Compare plugin \<= 1.0.5 - Local File Inclusion vulnerability (CVSS 7.5, zankover Fami WooCommerce Compare)
- [CVE-2025-31407](https://cve.now/CVE-2025-31407.md): WordPress Tiger theme \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, hutsixdigital Tiger)
- [CVE-2025-31416](https://cve.now/CVE-2025-31416.md): WordPress Awesome Event Booking plugin \<= 2.8.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AwesomeTOGI Awesome Event Booking)
- [CVE-2025-31418](https://cve.now/CVE-2025-31418.md): WordPress Gravel theme \<= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, noonnoo Gravel)
- [CVE-2025-31420](https://cve.now/CVE-2025-31420.md): WordPress wpForo Forum plugin \<= 2.4.2 - Privilege Escalation vulnerability (CVSS 7.6, Tomdever wpForo Forum)
- [CVE-2025-31421](https://cve.now/CVE-2025-31421.md): WordPress Srbtranslatin plugin \<= 3.2.0 - Sensitive Data Exposure vulnerability (CVSS 5.8, Oblak Studio Srbtranslatin)
- [CVE-2025-3189](https://cve.now/CVE-2025-3189.md): Stored Cross-Site Scripting (XSS) in DoWISP (CVSS 4.8, DoWISP)
- [CVE-2025-3245](https://cve.now/CVE-2025-3245.md): itsourcecode Library Management System Forgot.java search sql injection (CVSS 5.3, itsourcecode Library Management System)
- [CVE-2025-3244](https://cve.now/CVE-2025-3244.md): SourceCodester Web-based Pharmacy Product Management System Create User Page add-admin.php unrestricted upload (CVSS 5.3, SourceCodester Web-based Pharmacy Product Management System)
- [CVE-2025-3243](https://cve.now/CVE-2025-3243.md): code-projects Patient Record Management System dental\_form.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-3242](https://cve.now/CVE-2025-3242.md): PHPGurukul e-Diary Management System search-result.php sql injection (CVSS 5.3, PHPGurukul e-Diary Management System)
- [CVE-2025-3241](https://cve.now/CVE-2025-3241.md): zhangyanbo2007 youkefu XML Document CallCenterRouterController.java xml external entity reference (CVSS 5.3, zhangyanbo2007 youkefu)
- [CVE-2025-22282](https://cve.now/CVE-2025-22282.md): WordPress ez Form Calculator Premouium plugin \<= 2.14.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, keksdieb ez Form Calculator Premium)
- [CVE-2025-3240](https://cve.now/CVE-2025-3240.md): PHPGurukul Online Fire Reporting System search.php sql injection (CVSS 6.9, PHPGurukul Online Fire Reporting System)
- [CVE-2025-3239](https://cve.now/CVE-2025-3239.md): PHPGurukul Online Fire Reporting System edit-guard-detail.php sql injection (CVSS 6.9, PHPGurukul Online Fire Reporting System)
- [CVE-2025-3238](https://cve.now/CVE-2025-3238.md): PHPGurukul Online Fire Reporting System search-request.php sql injection (CVSS 6.9, PHPGurukul Online Fire Reporting System)
- [CVE-2025-3237](https://cve.now/CVE-2025-3237.md): Tenda FH1202 wrlwpsset access control (CVSS 6.9, Tenda FH1202)
- [CVE-2025-2245](https://cve.now/CVE-2025-2245.md): Server Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646) (CVSS 6.9, Bitdefender GravityZone Update Server)
- [CVE-2025-2243](https://cve.now/CVE-2025-2243.md): SSRF in GravityZone Console via DNS Truncation (VA-12634) (CVSS 6.9, Bitdefender GravityZone Console)
- [CVE-2025-1865](https://cve.now/CVE-2025-1865.md): Local Privilege Escalation in Virtual CloneDrive Kernel Driver (CVSS 8.5, Elaborate Bytes AG Virtual CloneDrive)
- [CVE-2025-2244](https://cve.now/CVE-2025-2244.md): Insecure PHP deserialization issue in GravityZone Console (VA-12634) (CVSS 9.5, Bitdefender GravityZone Console)
- [CVE-2025-3236](https://cve.now/CVE-2025-3236.md): Tenda FH1202 Web Management Interface VirSerDMZ access control (CVSS 6.9, Tenda FH1202)
- [CVE-2025-3235](https://cve.now/CVE-2025-3235.md): PHPGurukul Old Age Home Management System profile.php sql injection (CVSS 5.3, PHPGurukul Old Age Home Management System)
- [CVE-2025-3231](https://cve.now/CVE-2025-3231.md): PHPGurukul Zoo Management System aboutus.php sql injection (CVSS 6.9, PHPGurukul Zoo Management System)
- [CVE-2025-3229](https://cve.now/CVE-2025-3229.md): PHPGurukul Restaurant Table Booking System edit-subadmin.php sql injection (CVSS 5.1, PHPGurukul Restaurant Table Booking System)
- [CVE-2025-3220](https://cve.now/CVE-2025-3220.md): PHPGurukul e-Diary Management System dashboard.php sql injection (CVSS 6.9, PHPGurukul e-Diary Management System)
- [CVE-2025-3219](https://cve.now/CVE-2025-3219.md): CodeCanyon Perfex CRM Project Discussions Module 2 cross site scripting (CVSS 5.1, CodeCanyon Perfex CRM)
- [CVE-2025-3105](https://cve.now/CVE-2025-3105.md): Vehica Core \<= 1.0.97 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, TangibleWP Vehica Core)
- [CVE-2025-3217](https://cve.now/CVE-2025-3217.md): PHPGurukul e-Diary Management System registration.php sql injection (CVSS 6.9, PHPGurukul e-Diary Management System)
- [CVE-2025-2780](https://cve.now/CVE-2025-2780.md): Woffice Core \<= 5.4.21 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, WofficeIO Woffice Core)
- [CVE-2025-2797](https://cve.now/CVE-2025-2797.md): Woffice Core \<= 5.4.21 - Cross-Site Request Forgery to User Registration Approval (CVSS 5.4, WofficeIO Woffice Core)
- [CVE-2025-3087](https://cve.now/CVE-2025-3087.md): Stored XSS Vulnerability in M-Files Web (CVSS 5.1, M-Files Web)
- [CVE-2025-3086](https://cve.now/CVE-2025-3086.md): User in anonymous role could create and delete views (CVSS 6.3, M-Files Server)
- [CVE-2025-3216](https://cve.now/CVE-2025-3216.md): PHPGurukul e-Diary Management System password-recovery.php sql injection (CVSS 6.9, PHPGurukul e-Diary Management System)
- [CVE-2025-3215](https://cve.now/CVE-2025-3215.md): PHPGurukul Restaurant Table Booking System add-subadmin.php sql injection (CVSS 5.3, PHPGurukul Restaurant Table Booking System)
- [CVE-2025-2159](https://cve.now/CVE-2025-2159.md): Stored XSS in M-Files Admin user interface (CVSS 5.1, M-Files Admin)
- [CVE-2025-3214](https://cve.now/CVE-2025-3214.md): JFinal CMS readTemplate engine.getTemplate path traversal (CVSS 5.3, JFinal CMS)
- [CVE-2025-2279](https://cve.now/CVE-2025-2279.md): Maps - Google Maps \<= 1.0.6 - Contributor+ Stored XSS (CVSS 5.9, Maps)
- [CVE-2025-3213](https://cve.now/CVE-2025-3213.md): PHPGurukul e-Diary Management System view-note.php sql injection (CVSS 6.9, PHPGurukul e-Diary Management System)
- [CVE-2025-3211](https://cve.now/CVE-2025-3211.md): code-projects Patient Record Management System birthing\_print.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2024-42208](https://cve.now/CVE-2024-42208.md): HCL Connections is vulnerable to an information disclosure vulnerability (CVSS 3.5, HCL Software HCL Connections)
- [CVE-2024-13708](https://cve.now/CVE-2024-13708.md): Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, pluggabl Booster for WooCommerce)
- [CVE-2025-2270](https://cve.now/CVE-2025-2270.md): Countdown, Coming Soon, Maintenance – Countdown & Clock \<= 2.8.9.1 - Unauthenticated Limited Local File Inclusion (CVSS 8.1, adamskaat Countdown, Coming Soon, Maintenance – Countdown &…)
- [CVE-2025-2836](https://cve.now/CVE-2025-2836.md): RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \<= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2024-13898](https://cve.now/CVE-2024-13898.md): Simple Banner \<= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, rpetersen29 Simple Banner – Easily add multiple Banners/Bar…)
- [CVE-2024-13645](https://cve.now/CVE-2024-13645.md): TagDiv Composer \<= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation (CVSS 9.8, tagDiv Composer)
- [CVE-2025-2317](https://cve.now/CVE-2025-2317.md): Product Filter by WBW \<= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend Parameter (CVSS 7.5, woobewoo Product Filter for WooCommerce by WBW)
- [CVE-2025-3210](https://cve.now/CVE-2025-3210.md): code-projects Patient Record Management System birthing\_pending.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-3192](https://cve.now/CVE-2025-3192.md): Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a (CVSS 8.8, spatie/browsershot)
- [CVE-2025-3209](https://cve.now/CVE-2025-3209.md): code-projects Patient Record Management System add\_patient.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-3191](https://cve.now/CVE-2025-3191.md): All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result (CVSS 5.1, react-draft-wysiwyg)
- [CVE-2025-3197](https://cve.now/CVE-2025-3197.md): Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. (CVSS 6.9, expand-object)
- [CVE-2025-3194](https://cve.now/CVE-2025-3194.md): Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE() function. (CVSS 8.7, bigint-buffer)
- [CVE-2025-3208](https://cve.now/CVE-2025-3208.md): code-projects Patient Record Management System xray\_print.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2024-13744](https://cve.now/CVE-2024-13744.md): Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload (CVSS 8.1, pluggabl Booster for WooCommerce)
- [CVE-2025-2075](https://cve.now/CVE-2025-2075.md): Uncanny Automator \<= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, uncannyowl Uncanny Automator – Easy Automation, Integration…)
- [CVE-2025-3207](https://cve.now/CVE-2025-3207.md): code-projects Patient Record Management System birthing\_form.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-3206](https://cve.now/CVE-2025-3206.md): code-projects Hospital Management System doctor-specilization.php sql injection (CVSS 5.3, code-projects Hospital Management System)
- [CVE-2025-3205](https://cve.now/CVE-2025-3205.md): CodeAstro Student Grading System studentsubject.php sql injection (CVSS 5.3, CodeAstro Student Grading System)
- [CVE-2025-3204](https://cve.now/CVE-2025-3204.md): CodeAstro Car Rental System returncar.php sql injection (CVSS 5.3, CodeAstro Car Rental System)
- [CVE-2025-3203](https://cve.now/CVE-2025-3203.md): Tenda W18E setModules formSetAccountList stack-based overflow (CVSS 5.3, Tenda W18E)
- [CVE-2025-3202](https://cve.now/CVE-2025-3202.md): ageerle ruoyi-ai SysNoticeController.java improper authorization (CVSS 6.9, ageerle ruoyi-ai)
- [CVE-2025-26401](https://cve.now/CVE-2025-26401.md): Weak encoding for password vulnerability exists in HMI ViewJet C-more series. (CVSS 6.5, JTEKT ELECTRONICS HMI ViewJet C-more series)
- [CVE-2025-25061](https://cve.now/CVE-2025-25061.md): Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remot (CVSS 5.8, JTEKT ELECTRONICS HMI ViewJet C-more series · JTEKT ELECTRO…)
- [CVE-2025-24317](https://cve.now/CVE-2025-24317.md): Allocation of resources without limits or throttling issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remot (CVSS 5.3, JTEKT ELECTRONICS HMI ViewJet C-more series · JTEKT ELECTRO…)
- [CVE-2025-24310](https://cve.now/CVE-2025-24310.md): Improper restriction of rendered UI layers or frames issue exists in HMI ViewJet C-more series, which may allow a remote unauthenticated att (CVSS 4.3, JTEKT ELECTRONICS HMI ViewJet C-more series)
- [CVE-2025-3199](https://cve.now/CVE-2025-3199.md): ageerle ruoyi-ai API Interface SysModelController.java improper authorization (CVSS 6.9, ageerle ruoyi-ai)
- [CVE-2025-3198](https://cve.now/CVE-2025-3198.md): GNU Binutils objdump bucomm.c display\_info memory leak (CVSS 4.8, GNU Binutils)
- [CVE-2025-3196](https://cve.now/CVE-2025-3196.md): Open Asset Import Library Assimp Malformed File MD2Loader.cpp InternReadFile stack-based overflow (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-3195](https://cve.now/CVE-2025-3195.md): itsourcecode Online Blood Bank Management System bbms.php sql injection (CVSS 6.9, itsourcecode Online Blood Bank Management System)
- [CVE-2025-3188](https://cve.now/CVE-2025-3188.md): PHPGurukul e-Diary Management System add-notes.php sql injection (CVSS 6.9, PHPGurukul e-Diary Management System)
- [CVE-2025-3187](https://cve.now/CVE-2025-3187.md): PHPGurukul e-Diary Management System login.php sql injection (CVSS 6.9, PHPGurukul e-Diary Management System)
- [CVE-2025-29796](https://cve.now/CVE-2025-29796.md): Microsoft Edge for iOS Spoofing Vulnerability (CVSS 4.7, Microsoft Edge for iOS)
- [CVE-2025-29815](https://cve.now/CVE-2025-29815.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.6, Microsoft Edge)
- [CVE-2025-25001](https://cve.now/CVE-2025-25001.md): Microsoft Edge for iOS Spoofing Vulnerability (CVSS 4.3, Microsoft Edge for iOS)
- [CVE-2025-28146](https://cve.now/CVE-2025-28146.md): Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota\_url i (CVSS 9.8)
- [CVE-2025-29476](https://cve.now/CVE-2025-29476.md): Buffer Overflow vulnerability in compress\_chunk\_fuzzer with oss-fuzz on commit 16450518afddcb3139de627157208e49bfef6987 in c-blosc2 v.2.17.0 (CVSS 5.5)
- [CVE-2025-29477](https://cve.now/CVE-2025-29477.md): An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume\_event. (CVSS 5.5)
- [CVE-2025-32111](https://cve.now/CVE-2025-32111.md): The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for (CVSS 8.7, acme.sh project acme.sh)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.