CVEs published April 6, 2025
29 CVEs were published on April 6, 2025: 1 critical, 3 high.
- Published
- 29
- Critical
- 1
- High
- 3
- Medium
- 25
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- code-projects Blood Bank Management System
- 5
- PHPGurukul Men Salon Management System
- 4
- Eclipse Foundation ThreadX
- 3
- chainmaker-go
- 2
- godcheese Nimrod · code-projects Nimrod
- 2
- iteaj iboot 物联网网关
- 2
- Kentico Xperience
- 2
- SourceCodester Apartment Visitor Management System
- 2
- Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal…
- 1
- FISCO-BCOS
- 1
Critical 1
High 3
- CVE-2025-31492mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected datamod_auth_openidc
- CVE-2025-2260Eclipse ThreadX NetX Duo HTTP component server denial of serviceEclipse Foundation ThreadX
- CVE-2025-32370Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, becausKentico Xperience
Medium, low and unrated 25
- CVE-2025-3326iteaj iboot 物联网网关 File Upload upload cross site scriptingiteaj iboot 物联网网关
- CVE-2025-3325iteaj iboot 物联网网关 Admin Password pwd access controliteaj iboot 物联网网关
- CVE-2025-3324godcheese/code-projects Nimrod FileRestController.java unrestricted uploadgodcheese Nimrod · code-projects Nimrod
- CVE-2025-3323godcheese/code-projects Nimrod ViewMenuCategoryRestController.java searchAllByName sql injectiongodcheese Nimrod · code-projects Nimrod
- CVE-2025-31488Plain Craft Launcher's custom homepage can use Internet Explorer to load web pages with the help of controls such as WebBrowserHex-Dragon PCL2
- CVE-2025-2259Eclipse ThreadX NetX Duo component HTTP server single PUT request integer underflowEclipse Foundation ThreadX
- CVE-2025-2258Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflowEclipse Foundation ThreadX
- CVE-2025-3318Kenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 ShangpinleixingController.java page sql injectionKenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统
- CVE-2025-3317fumiao opencms dataPage.jsp path traversalfumiao opencms
- CVE-2025-3316PHPGurukul Men Salon Management System search-invoices.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3315SourceCodester Apartment Visitor Management System view-report.php sql injectionSourceCodester Apartment Visitor Management System
- CVE-2025-3314SourceCodester Apartment Visitor Management System forgotpw.php sql injectionSourceCodester Apartment Visitor Management System
- CVE-2025-3313PHPGurukul Men Salon Management System add-customer.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3312PHPGurukul Men Salon Management System add-customer-services.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3311PHPGurukul Men Salon Management System about-us.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3310code-projects Blood Bank Management System delete.php sql injectioncode-projects Blood Bank Management System
- CVE-2025-3309code-projects Blood Bank Management System campsdetails.php sql injectioncode-projects Blood Bank Management System
- CVE-2025-1264Broken Link Checker by AIOSEO <= 1.2.3 - Authenticated (Contributor+) SQL InjectionBroken Link Checker by AIOSEO – Easily Fix/Monitor Internal…
- CVE-2025-3308code-projects Blood Bank Management System viewrequest.php sql injectioncode-projects Blood Bank Management System
- CVE-2025-3307code-projects Blood Bank Management System reset.php sql injectioncode-projects Blood Bank Management System
- CVE-2025-3306code-projects Blood Bank Management System don.php sql injectioncode-projects Blood Bank Management System
- CVE-2024-58131FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a malicious node (that hFISCO-BCOS
- CVE-2024-58132In chainmaker-go (aka ChainMaker) before 2.3.6, multiple updates to a single node's configuration can cause other normal nodes to perform cochainmaker-go
- CVE-2024-58133In chainmaker-go (aka ChainMaker) before 2.4.0, when making frequent updates to a node's configuration file and restarting this node, concurchainmaker-go
- CVE-2025-32369Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with Kentico Xperience