# CVEs published 2025-04-06

29 CVEs were published on April 6, 2025: 1 critical, 3 high. Days are UTC.

- [CVE-2025-3326](https://cve.now/CVE-2025-3326.md): iteaj iboot 物联网网关 File Upload upload cross site scripting (CVSS 5.1, iteaj iboot 物联网网关)
- [CVE-2025-3325](https://cve.now/CVE-2025-3325.md): iteaj iboot 物联网网关 Admin Password pwd access control (CVSS 5.3, iteaj iboot 物联网网关)
- [CVE-2025-3324](https://cve.now/CVE-2025-3324.md): godcheese/code-projects Nimrod FileRestController.java unrestricted upload (CVSS 5.3, godcheese Nimrod · code-projects Nimrod)
- [CVE-2025-3323](https://cve.now/CVE-2025-3323.md): godcheese/code-projects Nimrod ViewMenuCategoryRestController.java searchAllByName sql injection (CVSS 5.3, godcheese Nimrod · code-projects Nimrod)
- [CVE-2025-32013](https://cve.now/CVE-2025-32013.md): Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System (CVSS 9.3, lnbits)
- [CVE-2025-31492](https://cve.now/CVE-2025-31492.md): mod\_auth\_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVSS 8.2, mod\_auth\_openidc)
- [CVE-2025-31488](https://cve.now/CVE-2025-31488.md): Plain Craft Launcher's custom homepage can use Internet Explorer to load web pages with the help of controls such as WebBrowser (CVSS 4.9, Hex-Dragon PCL2)
- [CVE-2025-2259](https://cve.now/CVE-2025-2259.md): Eclipse ThreadX NetX Duo component HTTP server single PUT request integer underflow (CVSS 5.3, Eclipse Foundation ThreadX)
- [CVE-2025-2260](https://cve.now/CVE-2025-2260.md): Eclipse ThreadX NetX Duo HTTP component server denial of service (CVSS 7.1, Eclipse Foundation ThreadX)
- [CVE-2025-2258](https://cve.now/CVE-2025-2258.md): Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow (CVSS 5.3, Eclipse Foundation ThreadX)
- [CVE-2025-3318](https://cve.now/CVE-2025-3318.md): Kenj\_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 ShangpinleixingController.java page sql injection (CVSS 5.3, Kenj\_Frog 肯尼基蛙 company-financial-management 公司财务管理系统)
- [CVE-2025-3317](https://cve.now/CVE-2025-3317.md): fumiao opencms dataPage.jsp path traversal (CVSS 5.3, fumiao opencms)
- [CVE-2025-3316](https://cve.now/CVE-2025-3316.md): PHPGurukul Men Salon Management System search-invoices.php sql injection (CVSS 6.9, PHPGurukul Men Salon Management System)
- [CVE-2025-3315](https://cve.now/CVE-2025-3315.md): SourceCodester Apartment Visitor Management System view-report.php sql injection (CVSS 6.9, SourceCodester Apartment Visitor Management System)
- [CVE-2025-3314](https://cve.now/CVE-2025-3314.md): SourceCodester Apartment Visitor Management System forgotpw.php sql injection (CVSS 6.9, SourceCodester Apartment Visitor Management System)
- [CVE-2025-3313](https://cve.now/CVE-2025-3313.md): PHPGurukul Men Salon Management System add-customer.php sql injection (CVSS 6.9, PHPGurukul Men Salon Management System)
- [CVE-2025-3312](https://cve.now/CVE-2025-3312.md): PHPGurukul Men Salon Management System add-customer-services.php sql injection (CVSS 6.9, PHPGurukul Men Salon Management System)
- [CVE-2025-3311](https://cve.now/CVE-2025-3311.md): PHPGurukul Men Salon Management System about-us.php sql injection (CVSS 6.9, PHPGurukul Men Salon Management System)
- [CVE-2025-3310](https://cve.now/CVE-2025-3310.md): code-projects Blood Bank Management System delete.php sql injection (CVSS 6.9, code-projects Blood Bank Management System)
- [CVE-2025-3309](https://cve.now/CVE-2025-3309.md): code-projects Blood Bank Management System campsdetails.php sql injection (CVSS 6.9, code-projects Blood Bank Management System)
- [CVE-2025-1264](https://cve.now/CVE-2025-1264.md): Broken Link Checker by AIOSEO \<= 1.2.3 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal…)
- [CVE-2025-3308](https://cve.now/CVE-2025-3308.md): code-projects Blood Bank Management System viewrequest.php sql injection (CVSS 6.9, code-projects Blood Bank Management System)
- [CVE-2025-3307](https://cve.now/CVE-2025-3307.md): code-projects Blood Bank Management System reset.php sql injection (CVSS 6.9, code-projects Blood Bank Management System)
- [CVE-2025-3306](https://cve.now/CVE-2025-3306.md): code-projects Blood Bank Management System don.php sql injection (CVSS 6.9, code-projects Blood Bank Management System)
- [CVE-2024-58131](https://cve.now/CVE-2024-58131.md): FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a malicious node (that h (CVSS 4.0, FISCO-BCOS)
- [CVE-2024-58132](https://cve.now/CVE-2024-58132.md): In chainmaker-go (aka ChainMaker) before 2.3.6, multiple updates to a single node's configuration can cause other normal nodes to perform co (CVSS 4.0, chainmaker-go)
- [CVE-2024-58133](https://cve.now/CVE-2024-58133.md): In chainmaker-go (aka ChainMaker) before 2.4.0, when making frequent updates to a node's configuration file and restarting this node, concur (CVSS 4.0, chainmaker-go)
- [CVE-2025-32369](https://cve.now/CVE-2025-32369.md): Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with (CVSS 6.4, Kentico Xperience)
- [CVE-2025-32370](https://cve.now/CVE-2025-32370.md): Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, becaus (CVSS 7.2, Kentico Xperience)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.