CVEs published April 5, 2025
32 CVEs were published on April 5, 2025: 2 critical, 4 high.
- Published
- 32
- Critical
- 2
- High
- 4
- Medium
- 26
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Zammad
- 4
- SourceCodester Online Eyewear Shop
- 3
- code-projects Patient Record Management System
- 2
- freedesktop Poppler
- 2
- ZendTo
- 2
- ZoomIt ZoomSounds - WordPress Wave Audio Player with Playli…
- 2
- 1902756969 IKUN_Library · code-projects IKUN_Library
- 1
- adamwillhoeft AI Content Pipelines: Content Engine + Analyt…
- 1
- AlThemist Lafka Plugin
- 1
- aweos Email Notifications for Updates
- 1
Critical 2
- CVE-2025-2941Drag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File Moveglenwpcoder Drag and Drop Multiple File Upload for WooComme…
- CVE-2021-47667An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackeZendTo
High 4
- CVE-2024-13776ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings ManipulationZoomIt ZoomSounds - WordPress Wave Audio Player with Playli…
- CVE-2025-2933Email Notifications for Updates <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Updateaweos Email Notifications for Updates
- CVE-2024-13604KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin <= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directorylogoninc KB Support – Customer Support Ticket & Helpdesk Pl…
- CVE-2025-0810Read More & Accordion <= 3.4.7 - Cross-Site Request Forgery to Local File Inclusionedmonparker Read More & Accordion
Medium, low and unrated 26
- CVE-2025-33051902756969/code-projects IKUN_Library Borrow MvcConfig.java addInterceptors access control1902756969 IKUN_Library · code-projects IKUN_Library
- CVE-2025-3304code-projects Patient Record Management System dental_not.php sql injectioncode-projects Patient Record Management System
- CVE-2025-3303code-projects Patient Record Management System birthing_record.php sql injectioncode-projects Patient Record Management System
- CVE-2024-56370Net::Xero 0.044 and earlier for Perl uses insecure rand() function for cryptographic functionsELLIOTT Net::Xero
- CVE-2024-52322WebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functionsLOCALSHOP WebService::Xero
- CVE-2024-57835Amon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functionsTANIGUCHI Amon2::Auth::Site::LINE
- CVE-2024-58036Net::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functionsNORBU Net::Dropbox::API
- CVE-2024-57868Web::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functionsLEV Web::API
- CVE-2025-30401A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file Facebook WhatsApp Desktop for Windows
- CVE-2025-3299PHPGurukul Men Salon Management System appointment.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3298SourceCodester Online Eyewear Shop Registration Master.php access controlSourceCodester Online Eyewear Shop
- CVE-2025-3297SourceCodester Online Eyewear Shop Master.php cross site scriptingSourceCodester Online Eyewear Shop
- CVE-2025-3296SourceCodester Online Eyewear Shop Users.php sql injectionSourceCodester Online Eyewear Shop
- CVE-2025-2789MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletionwcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…
- CVE-2025-1233Lafka Plugin <= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option UpdateAlThemist Lafka Plugin
- CVE-2025-0839ZoomSounds <= 6.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeZoomIt ZoomSounds - WordPress Wave Audio Player with Playli…
- CVE-2025-2544AI Content Pipelines <= 1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadadamwillhoeft AI Content Pipelines: Content Engine + Analyt…
- CVE-2025-1500IBM Maximo Application Suite file uploadIBM Maximo Application Suite
- CVE-2025-32352A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for useZendTo
- CVE-2025-32357In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base Zammad
- CVE-2025-32358In Zammad 6.4.x before 6.4.2, SSRF can occur.Zammad
- CVE-2025-32359In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security.Zammad
- CVE-2025-32360In Zammad 6.4.x before 6.4.2, there is information exposure.Zammad
- CVE-2025-32364A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformedfreedesktop Poppler
- CVE-2025-32365Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc becafreedesktop Poppler
- CVE-2025-32366In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and ConnMan