# CVEs published 2025-04-05

32 CVEs were published on April 5, 2025: 2 critical, 4 high. Days are UTC.

- [CVE-2025-3305](https://cve.now/CVE-2025-3305.md): 1902756969/code-projects IKUN\_Library Borrow MvcConfig.java addInterceptors access control (CVSS 5.3, 1902756969 IKUN\_Library · code-projects IKUN\_Library)
- [CVE-2025-3304](https://cve.now/CVE-2025-3304.md): code-projects Patient Record Management System dental\_not.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-3303](https://cve.now/CVE-2025-3303.md): code-projects Patient Record Management System birthing\_record.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2024-56370](https://cve.now/CVE-2024-56370.md): Net::Xero 0.044 and earlier for Perl uses insecure rand() function for cryptographic functions (CVSS 6.5, ELLIOTT Net::Xero)
- [CVE-2024-52322](https://cve.now/CVE-2024-52322.md): WebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functions (CVSS 5.5, LOCALSHOP WebService::Xero)
- [CVE-2024-57835](https://cve.now/CVE-2024-57835.md): Amon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functions (CVSS 5.5, TANIGUCHI Amon2::Auth::Site::LINE)
- [CVE-2024-58036](https://cve.now/CVE-2024-58036.md): Net::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functions (CVSS 5.5, NORBU Net::Dropbox::API)
- [CVE-2024-57868](https://cve.now/CVE-2024-57868.md): Web::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functions (CVSS 5.5, LEV Web::API)
- [CVE-2025-30401](https://cve.now/CVE-2025-30401.md): A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file (CVSS 6.7, Facebook WhatsApp Desktop for Windows)
- [CVE-2025-3299](https://cve.now/CVE-2025-3299.md): PHPGurukul Men Salon Management System appointment.php sql injection (CVSS 6.9, PHPGurukul Men Salon Management System)
- [CVE-2025-3298](https://cve.now/CVE-2025-3298.md): SourceCodester Online Eyewear Shop Registration Master.php access control (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2025-3297](https://cve.now/CVE-2025-3297.md): SourceCodester Online Eyewear Shop Master.php cross site scripting (CVSS 5.1, SourceCodester Online Eyewear Shop)
- [CVE-2025-3296](https://cve.now/CVE-2025-3296.md): SourceCodester Online Eyewear Shop Users.php sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2025-2941](https://cve.now/CVE-2025-2941.md): Drag and Drop Multiple File Upload for WooCommerce \<= 1.1.4 - Unauthenticated Arbitrary File Move (CVSS 9.8, glenwpcoder Drag and Drop Multiple File Upload for WooComme…)
- [CVE-2025-2789](https://cve.now/CVE-2025-2789.md): MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution \<= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion (CVSS 5.3, wcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…)
- [CVE-2025-1233](https://cve.now/CVE-2025-1233.md): Lafka Plugin \<= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update (CVSS 4.3, AlThemist Lafka Plugin)
- [CVE-2025-0839](https://cve.now/CVE-2025-0839.md): ZoomSounds \<= 6.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ZoomIt ZoomSounds - WordPress Wave Audio Player with Playli…)
- [CVE-2024-13776](https://cve.now/CVE-2024-13776.md): ZoomSounds - WordPress Wave Audio Player with Playlist \<= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation (CVSS 8.1, ZoomIt ZoomSounds - WordPress Wave Audio Player with Playli…)
- [CVE-2025-2933](https://cve.now/CVE-2025-2933.md): Email Notifications for Updates \<= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, aweos Email Notifications for Updates)
- [CVE-2025-2544](https://cve.now/CVE-2025-2544.md): AI Content Pipelines \<= 1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, adamwillhoeft AI Content Pipelines: Content Engine + Analyt…)
- [CVE-2024-13604](https://cve.now/CVE-2024-13604.md): KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin \<= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 7.5, logoninc KB Support – Customer Support Ticket & Helpdesk Pl…)
- [CVE-2025-0810](https://cve.now/CVE-2025-0810.md): Read More & Accordion \<= 3.4.7 - Cross-Site Request Forgery to Local File Inclusion (CVSS 7.5, edmonparker Read More & Accordion)
- [CVE-2025-1500](https://cve.now/CVE-2025-1500.md): IBM Maximo Application Suite file upload (CVSS 5.5, IBM Maximo Application Suite)
- [CVE-2021-47667](https://cve.now/CVE-2021-47667.md): An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attacke (CVSS 10.0, ZendTo)
- [CVE-2025-32352](https://cve.now/CVE-2025-32352.md): A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for use (CVSS 4.8, ZendTo)
- [CVE-2025-32357](https://cve.now/CVE-2025-32357.md): In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base (CVSS 4.3, Zammad)
- [CVE-2025-32358](https://cve.now/CVE-2025-32358.md): In Zammad 6.4.x before 6.4.2, SSRF can occur. (CVSS 4.0, Zammad)
- [CVE-2025-32359](https://cve.now/CVE-2025-32359.md): In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. (CVSS 4.8, Zammad)
- [CVE-2025-32360](https://cve.now/CVE-2025-32360.md): In Zammad 6.4.x before 6.4.2, there is information exposure. (CVSS 4.2, Zammad)
- [CVE-2025-32364](https://cve.now/CVE-2025-32364.md): A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed (CVSS 4.0, freedesktop Poppler)
- [CVE-2025-32365](https://cve.now/CVE-2025-32365.md): Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc beca (CVSS 4.0, freedesktop Poppler)
- [CVE-2025-32366](https://cve.now/CVE-2025-32366.md): In ConnMan through 1.44, parse\_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., \*rdlen=ntohs(rr-\>rdlen) and (CVSS 4.8, ConnMan)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.