# CVEs published 2025-04-07

169 CVEs were published on April 7, 2025: 10 critical, 60 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-3389](https://cve.now/CVE-2025-3389.md): hailey888 oa\_system Backend InformManageController.java testMess cross site scripting (CVSS 5.1, hailey888 oa\_system)
- [CVE-2025-3388](https://cve.now/CVE-2025-3388.md): hailey888 oa\_system Frontend LoginsController.java loginCheck cross site scripting (CVSS 5.3, hailey888 oa\_system)
- [CVE-2025-3387](https://cve.now/CVE-2025-3387.md): renrenio renren-security JSON cross site scripting (CVSS 5.1, renrenio renren-security)
- [CVE-2025-3386](https://cve.now/CVE-2025-3386.md): LinZhaoguan pb-cms Friendship Link admin#links cross site scripting (CVSS 4.8, LinZhaoguan pb-cms)
- [CVE-2025-0942](https://cve.now/CVE-2025-0942.md): Jalios JPlatform 10 SP6 \< 10.0.6 Record Chooser SQL Injection (CVSS 8.6, Jalios JPlatform)
- [CVE-2025-3385](https://cve.now/CVE-2025-3385.md): LinZhaoguan pb-cms Classification Management Page cross site scripting (CVSS 4.8, LinZhaoguan pb-cms)
- [CVE-2025-3384](https://cve.now/CVE-2025-3384.md): 1000 Projects Human Resource Management System employee.php sql injection (CVSS 6.9, 1000 Projects Human Resource Management System)
- [CVE-2025-32034](https://cve.now/CVE-2025-32034.md): Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion (CVSS 7.5, apollographql router · apollo-router)
- [CVE-2025-32033](https://cve.now/CVE-2025-32033.md): Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow (CVSS 7.5, apollographql router · apollo-router)
- [CVE-2025-32032](https://cve.now/CVE-2025-32032.md): Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass (CVSS 7.5, apollographql router · apollo-router)
- [CVE-2025-32031](https://cve.now/CVE-2025-32031.md): Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass (CVSS 7.5, apollographql federation · @apollo/gateway)
- [CVE-2025-32030](https://cve.now/CVE-2025-32030.md): Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion (CVSS 7.5, apollographql federation · @apollo/gateway)
- [CVE-2025-31496](https://cve.now/CVE-2025-31496.md): apollo-compiler Named Fragment Processing Vulnerability (CVSS 7.5, apollographql apollo-rs · apollo-compiler)
- [CVE-2025-3383](https://cve.now/CVE-2025-3383.md): SourceCodester Web-based Pharmacy Product Management System search\_sales.php sql injection (CVSS 6.9, SourceCodester Web-based Pharmacy Product Management System)
- [CVE-2025-32029](https://cve.now/CVE-2025-32029.md): ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation (CVSS 6.9, ApelegHQ ts-asn1-der · @apeleghq/asn1-der)
- [CVE-2025-29769](https://cve.now/CVE-2025-29769.md): libvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF output (CVSS 8.5, libvips)
- [CVE-2025-3382](https://cve.now/CVE-2025-3382.md): joey-zhou xiaozhi-esp32-server-java update sql injection (CVSS 5.3, joey-zhou xiaozhi-esp32-server-java)
- [CVE-2025-3381](https://cve.now/CVE-2025-3381.md): zhangyanbo2007 youkefu File Upload WebIMController.java path traversal (CVSS 5.3, zhangyanbo2007 youkefu)
- [CVE-2025-3380](https://cve.now/CVE-2025-3380.md): PCMan FTP Server FEAT Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3379](https://cve.now/CVE-2025-3379.md): PCMan FTP Server EPSV Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3378](https://cve.now/CVE-2025-3378.md): PCMan FTP Server EPRT Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3377](https://cve.now/CVE-2025-3377.md): PCMan FTP Server ENC Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2024-38797](https://cve.now/CVE-2024-38797.md): Out-of-bounds Read in HashPeImageByType() (CVSS 4.6, TianoCore EDK2)
- [CVE-2025-3376](https://cve.now/CVE-2025-3376.md): PCMan FTP Server CONF Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3375](https://cve.now/CVE-2025-3375.md): PCMan FTP Server CDUP Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3426](https://cve.now/CVE-2025-3426.md): Use of default hardcoded credentials (CVSS 7.2, Philips IntelliSpace Portal · Philips Advanced Visualizatio…)
- [CVE-2025-3425](https://cve.now/CVE-2025-3425.md): Unauthenticated Remote Code Execution via .NET Deserialization (CVSS 7.3, Philips IntelliSpace Portal)
- [CVE-2025-3374](https://cve.now/CVE-2025-3374.md): PCMan FTP Server CCC Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3424](https://cve.now/CVE-2025-3424.md): 3.2.1 Arbitrary File Read in insecure .NET Remoting TCP Channel (CVSS 7.7, Philips IntelliSpace Portal)
- [CVE-2025-3373](https://cve.now/CVE-2025-3373.md): PCMan FTP Server SITE CHMOD Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3372](https://cve.now/CVE-2025-3372.md): PCMan FTP Server MKDIR Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-32014](https://cve.now/CVE-2025-32014.md): estree-util-value-to-estree allows prototype pollution in generated ESTree (CVSS 6.9, remcohaszing estree-util-value-to-estree · estree-util-valu…)
- [CVE-2025-31476](https://cve.now/CVE-2025-31476.md): tarteaucitron.js allows url scheme injection via unfiltered inputs (CVSS 4.8, AmauriC tarteaucitron.js · tarteaucitronjs +1)
- [CVE-2025-31475](https://cve.now/CVE-2025-31475.md): tarteaucitron.js allows prototype pollution via custom text injection (CVSS 5.5, AmauriC tarteaucitron.js · tarteaucitronjs)
- [CVE-2025-31138](https://cve.now/CVE-2025-31138.md): tarteaucitron.js allows UI manipulation via unrestricted CSS injection (CVSS 5.5, AmauriC tarteaucitron.js · tarteaucitronjs)
- [CVE-2025-30373](https://cve.now/CVE-2025-30373.md): Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value (CVSS 6.5, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2025-3371](https://cve.now/CVE-2025-3371.md): PCMan FTP Server DELETE Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3248](https://cve.now/CVE-2025-3248.md): Langflow \< 1.3.0 Unauthenticated RCE via /api/v1/validate/code (CVSS 9.8, KEV, langflow-ai langflow · langflow +1)
- [CVE-2025-2251](https://cve.now/CVE-2025-2251.md): Org.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code execution (CVSS 6.2, wildfly · Red Hat JBoss Enterprise Application Platform)
- [CVE-2025-3370](https://cve.now/CVE-2025-3370.md): PHPGurukul Men Salon Management System admin-profile.php sql injection (CVSS 6.9, PHPGurukul Men Salon Management System)
- [CVE-2025-3369](https://cve.now/CVE-2025-3369.md): xxyopen Novel-Plus list sql injection (CVSS 5.3, xxyopen Novel-Plus)
- [CVE-2025-30195](https://cve.now/CVE-2025-30195.md): A crafted zone can lead to an illegal memory access in the PowerDNS Recursor (CVSS 7.5, PowerDNS Recursor)
- [CVE-2025-27686](https://cve.now/CVE-2025-27686.md): Dell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to PowerMax 9.2.4.15, contain an Improper Neutraliza (CVSS 2.7, Dell Unisphere for PowerMax)
- [CVE-2025-3353](https://cve.now/CVE-2025-3353.md): PHPGurukul Men Salon Management System add-services.php sql injection (CVSS 6.9, PHPGurukul Men Salon Management System)
- [CVE-2025-3360](https://cve.now/CVE-2025-3360.md): Glibc: glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid iso 8601 timestamp with g\_date\_time\_new\_from\_iso8601(). (CVSS 3.7, glib · Red Hat Enterprise Linux)
- [CVE-2025-3359](https://cve.now/CVE-2025-3359.md): Gnuplot: segmentation fault via io\_str\_init\_static\_internal function (CVSS 6.2, gnuplot · Red Hat Enterprise Linux)
- [CVE-2025-3352](https://cve.now/CVE-2025-3352.md): PHPGurukul Old Age Home Management System edit-scdetails.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2025-0050](https://cve.now/CVE-2025-0050.md): Mali GPU Userspace Driver allows an Out-of-Bounds access (CVSS 5.9, Arm Valhall GPU Userspace Driver · Arm 5th Gen GPU Arch… +1)
- [CVE-2025-3351](https://cve.now/CVE-2025-3351.md): PHPGurukul Old Age Home Management System login.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2025-3350](https://cve.now/CVE-2025-3350.md): PHPGurukul Old Age Home Management System view-enquiry.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2025-3349](https://cve.now/CVE-2025-3349.md): PCMan FTP Server SYST Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-3348](https://cve.now/CVE-2025-3348.md): code-projects Patient Record Management System edit\_dpatient.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-21448](https://cve.now/CVE-2025-21448.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-21447](https://cve.now/CVE-2025-21447.md): Improper Validation of Array Index in Computer Vision (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21443](https://cve.now/CVE-2025-21443.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Automotive Vehicle Networks (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21442](https://cve.now/CVE-2025-21442.md): Integer Overflow to Buffer Overflow in Automotive Vehicle Networks (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21441](https://cve.now/CVE-2025-21441.md): Out-of-bounds Read in Windows WLAN Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21440](https://cve.now/CVE-2025-21440.md): Out-of-bounds Read in Windows WLAN Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21439](https://cve.now/CVE-2025-21439.md): Out-of-bounds Read in Windows WLAN Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21438](https://cve.now/CVE-2025-21438.md): Out-of-bounds Read in Windows WLAN Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21437](https://cve.now/CVE-2025-21437.md): Use After Free in Automotive Linux OS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21436](https://cve.now/CVE-2025-21436.md): Use After Free in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21435](https://cve.now/CVE-2025-21435.md): Buffer Over-read in WLAN Host Communication (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-21434](https://cve.now/CVE-2025-21434.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-21431](https://cve.now/CVE-2025-21431.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2025-21430](https://cve.now/CVE-2025-21430.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-21429](https://cve.now/CVE-2025-21429.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-21428](https://cve.now/CVE-2025-21428.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-21425](https://cve.now/CVE-2025-21425.md): Improper Access Control in Automotive Linux OS (CVSS 7.3, Qualcomm Snapdragon)
- [CVE-2025-21423](https://cve.now/CVE-2025-21423.md): Improper Validation of Array Index in Display (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21421](https://cve.now/CVE-2025-21421.md): Buffer Over-read in Display (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-49848](https://cve.now/CVE-2024-49848.md): Use After Free in DSP Service (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-45557](https://cve.now/CVE-2024-45557.md): Use of Out-of-range Pointer Offset in Trust Management Engine (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45556](https://cve.now/CVE-2024-45556.md): Improper Access Control for Register Interface in TZ Firmware (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2024-45552](https://cve.now/CVE-2024-45552.md): Buffer Over-read in Data Network Stack & Connectivity (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2024-45551](https://cve.now/CVE-2024-45551.md): Weak Authentication in HLOS (CVSS 6.2, Qualcomm Snapdragon)
- [CVE-2024-45549](https://cve.now/CVE-2024-45549.md): Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL (CVSS 7.7, Qualcomm Snapdragon)
- [CVE-2024-45544](https://cve.now/CVE-2024-45544.md): Use After Free in Data Network Stack & Connectivity (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-45543](https://cve.now/CVE-2024-45543.md): Out-of-bounds Write in Audio (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-45540](https://cve.now/CVE-2024-45540.md): Use After Free in HLOS (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-43067](https://cve.now/CVE-2024-43067.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43066](https://cve.now/CVE-2024-43066.md): Use After Free in HLOS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43065](https://cve.now/CVE-2024-43065.md): Exposed Dangerous Method or Function in HLOS (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2024-43058](https://cve.now/CVE-2024-43058.md): Incorrect Type Conversion or Cast in Multimedia Frameworks (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43046](https://cve.now/CVE-2024-43046.md): Information Exposure in TZ Secure OS (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2024-33058](https://cve.now/CVE-2024-33058.md): Insufficient Granularity of Access Control in Core (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-3347](https://cve.now/CVE-2025-3347.md): code-projects Patient Record Management System dental\_pending.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-3346](https://cve.now/CVE-2025-3346.md): Tenda AC7 SetPptpServerCfg formSetPPTPServer buffer overflow (CVSS 8.7, Tenda AC7)
- [CVE-2025-3345](https://cve.now/CVE-2025-3345.md): codeprojects Online Restaurant Management System combo.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-30473](https://cve.now/CVE-2025-30473.md): Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection (CVSS 8.8, Apache Software Foundation Apache Airflow Common SQL Provid…)
- [CVE-2025-3344](https://cve.now/CVE-2025-3344.md): codeprojects Online Restaurant Management System assign\_save.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2024-11859](https://cve.now/CVE-2024-11859.md): DLL Search Order Hijacking in ESET products for Windows (CVSS 8.4, ESET, spol. s r.o. ESET NOD32 Antivirus · ESET, spol. s… +9)
- [CVE-2025-3343](https://cve.now/CVE-2025-3343.md): codeprojects Online Restaurant Management System reservation\_update.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-3342](https://cve.now/CVE-2025-3342.md): codeprojects Online Restaurant Management System payment\_save.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-3341](https://cve.now/CVE-2025-3341.md): codeprojects Online Restaurant Management System reservation\_view.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-3340](https://cve.now/CVE-2025-3340.md): codeprojects Online Restaurant Management System combo\_update.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2024-11071](https://cve.now/CVE-2024-11071.md): Improper Access Control In DestinyECM (CVSS 7.7, Cyberdigm DestinyECM)
- [CVE-2025-3339](https://cve.now/CVE-2025-3339.md): codeprojects Online Restaurant Management System user\_update.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-3338](https://cve.now/CVE-2025-3338.md): codeprojects Online Restaurant Management System user\_save.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-3337](https://cve.now/CVE-2025-3337.md): codeprojects Online Restaurant Management System member\_update.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-3336](https://cve.now/CVE-2025-3336.md): codeprojects Online Restaurant Management System member\_save.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-3335](https://cve.now/CVE-2025-3335.md): codeprojects Online Restaurant Management System category\_update.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-31175](https://cve.now/CVE-2025-31175.md): Deserialization mismatch vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect service integ (CVSS 8.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-31174](https://cve.now/CVE-2025-31174.md): Path traversal vulnerability in the DFS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. (CVSS 6.8, Huawei HarmonyOS)
- [CVE-2025-31173](https://cve.now/CVE-2025-31173.md): Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect ser (CVSS 8.8, Huawei HarmonyOS)
- [CVE-2025-31172](https://cve.now/CVE-2025-31172.md): Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect ser (CVSS 7.8, Huawei HarmonyOS)
- [CVE-2025-31171](https://cve.now/CVE-2025-31171.md): File read permission bypass vulnerability in the kernel file system module Impact: Successful exploitation of this vulnerability may affect (CVSS 6.8, Huawei HarmonyOS)
- [CVE-2025-31170](https://cve.now/CVE-2025-31170.md): Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity (CVSS 8.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-58127](https://cve.now/CVE-2024-58127.md): Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity (CVSS 8.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-58126](https://cve.now/CVE-2024-58126.md): Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity (CVSS 8.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-58125](https://cve.now/CVE-2024-58125.md): Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity (CVSS 8.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-58124](https://cve.now/CVE-2024-58124.md): Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity (CVSS 8.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-58116](https://cve.now/CVE-2024-58116.md): Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may aff (CVSS 4.0, Huawei HarmonyOS)
- [CVE-2024-58115](https://cve.now/CVE-2024-58115.md): Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may aff (CVSS 4.0, Huawei HarmonyOS)
- [CVE-2024-58113](https://cve.now/CVE-2024-58113.md): Vulnerability of improper resource management in the memory management module Impact: Successful exploitation of this vulnerability may affe (CVSS 5.3, Huawei HarmonyOS)
- [CVE-2024-58112](https://cve.now/CVE-2024-58112.md): Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerabili (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2024-58111](https://cve.now/CVE-2024-58111.md): Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerabili (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2024-58110](https://cve.now/CVE-2024-58110.md): Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 4.6, Huawei HarmonyOS)
- [CVE-2024-58109](https://cve.now/CVE-2024-58109.md): Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 4.6, Huawei HarmonyOS)
- [CVE-2024-58108](https://cve.now/CVE-2024-58108.md): Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 4.6, Huawei HarmonyOS)
- [CVE-2024-58107](https://cve.now/CVE-2024-58107.md): Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2024-58106](https://cve.now/CVE-2024-58106.md): Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 4.6, Huawei HarmonyOS)
- [CVE-2025-3334](https://cve.now/CVE-2025-3334.md): codeprojects Online Restaurant Management System category\_save.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-20664](https://cve.now/CVE-2025-20664.md): In wlan AP driver, there is a possible information disclosure due to an uncaught exception. (CVSS 7.5, MediaTek MT7915, MT7916, MT7981, MT7986, MT7990, MT7992)
- [CVE-2025-20663](https://cve.now/CVE-2025-20663.md): In wlan AP driver, there is a possible information disclosure due to an uncaught exception. (CVSS 7.5, MediaTek MT7915, MT7916, MT7981, MT7986)
- [CVE-2025-20662](https://cve.now/CVE-2025-20662.md): In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.7, MediaTek MT9972)
- [CVE-2025-20661](https://cve.now/CVE-2025-20661.md): In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.7, MediaTek MT9972)
- [CVE-2025-20660](https://cve.now/CVE-2025-20660.md): In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.7, MediaTek MT9972)
- [CVE-2025-20659](https://cve.now/CVE-2025-20659.md): In Modem, there is a possible system crash due to improper input validation. (CVSS 6.5, MediaTek MT2735, MT2737, MT6739, MT6761, MT6762, MT6762D, M…)
- [CVE-2025-20658](https://cve.now/CVE-2025-20658.md): In DA, there is a possible permission bypass due to a logic error. (CVSS 6.0, MediaTek MT2718, MT6781, MT6789, MT6835, MT6855, MT6878, MT…)
- [CVE-2025-20657](https://cve.now/CVE-2025-20657.md): In vdec, there is a possible permission bypass due to improper input validation. (CVSS 6.7, MediaTek MT6765, MT6768, MT6781, MT6789, MT6833, MT6853, MT…)
- [CVE-2025-20656](https://cve.now/CVE-2025-20656.md): In DA, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.8, MediaTek MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT…)
- [CVE-2025-20655](https://cve.now/CVE-2025-20655.md): In keymaster, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.3, MediaTek MT9972)
- [CVE-2025-20654](https://cve.now/CVE-2025-20654.md): In wlan service, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 9.8, MediaTek MT6890, MT7622, MT7915, MT7916, MT7981, MT7986)
- [CVE-2025-3333](https://cve.now/CVE-2025-3333.md): codeprojects Online Restaurant Management System menu\_update.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-27534](https://cve.now/CVE-2025-27534.md): arkcompiler\_ets\_runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-25057](https://cve.now/CVE-2025-25057.md): third\_party\_NuttX has a memory leak vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-24304](https://cve.now/CVE-2025-24304.md): arkcompiler\_ets\_runtime has an out-of-bounds write vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22851](https://cve.now/CVE-2025-22851.md): Liteos\_A has an integer overflow vulnerability (CVSS 6.5, OpenHarmony)
- [CVE-2025-22842](https://cve.now/CVE-2025-22842.md): arkcompiler\_ets\_runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22452](https://cve.now/CVE-2025-22452.md): arkcompiler\_ets\_runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-20102](https://cve.now/CVE-2025-20102.md): arkcompiler\_ets\_runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-3332](https://cve.now/CVE-2025-3332.md): codeprojects Online Restaurant Management System menu\_save.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-3331](https://cve.now/CVE-2025-3331.md): codeprojects Online Restaurant Management System payment\_save.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-3330](https://cve.now/CVE-2025-3330.md): codeprojects Online Restaurant Management System reservation\_save.php sql injection (CVSS 6.9, codeprojects Online Restaurant Management System)
- [CVE-2025-3329](https://cve.now/CVE-2025-3329.md): Consumer Comanda Mobile Restaurant Order cleartext transmission (CVSS 2.3, Consumer Comanda Mobile)
- [CVE-2025-3328](https://cve.now/CVE-2025-3328.md): Tenda AC1206 fast\_setting\_wifi\_set form\_fast\_setting\_wifi\_set buffer overflow (CVSS 8.7, Tenda AC1206)
- [CVE-2025-3327](https://cve.now/CVE-2025-3327.md): iteaj iboot 物联网网关 File Upload batch cross site scripting (CVSS 5.1, iteaj iboot 物联网网关)
- [CVE-2024-46494](https://cve.now/CVE-2024-46494.md): A cross-site scripting (XSS) vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 5.4)
- [CVE-2025-28400](https://cve.now/CVE-2025-28400.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method (CVSS 6.7)
- [CVE-2025-28401](https://cve.now/CVE-2025-28401.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter (CVSS 6.7)
- [CVE-2025-28402](https://cve.now/CVE-2025-28402.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter (CVSS 9.8)
- [CVE-2025-28403](https://cve.now/CVE-2025-28403.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the req (CVSS 7.2)
- [CVE-2025-28405](https://cve.now/CVE-2025-28405.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method (CVSS 9.8)
- [CVE-2025-28406](https://cve.now/CVE-2025-28406.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter (CVSS 9.8)
- [CVE-2025-28407](https://cve.now/CVE-2025-28407.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not proper (CVSS 8.8)
- [CVE-2025-28408](https://cve.now/CVE-2025-28408.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endp (CVSS 9.8)
- [CVE-2025-28409](https://cve.now/CVE-2025-28409.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not proper (CVSS 8.8)
- [CVE-2025-28410](https://cve.now/CVE-2025-28410.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whethe (CVSS 9.8)
- [CVE-2025-28411](https://cve.now/CVE-2025-28411.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave (CVSS 9.8)
- [CVE-2025-28412](https://cve.now/CVE-2025-28412.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController (CVSS 9.8)
- [CVE-2025-28413](https://cve.now/CVE-2025-28413.md): An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component (CVSS 9.8)
- [CVE-2025-29087](https://cve.now/CVE-2025-29087.md): In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat\_ws() SQL function can cause memory to be written beyond the end of a malloc-alloca (CVSS 3.2, SQLite)
- [CVE-2025-29478](https://cve.now/CVE-2025-29478.md): An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl\_list\_size in cfl\_list.h:165. (CVSS 5.5)
- [CVE-2025-29480](https://cve.now/CVE-2025-29480.md): Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialReference::Release funct (CVSS 5.5, gdal)
- [CVE-2025-29481](https://cve.now/CVE-2025-29481.md): Buffer Overflow vulnerability in libbpf 1.5.0 allows a local attacker to execute arbitrary code via the bpf\_object\_\_init\_prog\` function of l (CVSS 6.2)
- [CVE-2025-29482](https://cve.now/CVE-2025-29482.md): Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Adaptive Offset) proce (CVSS 6.2)
- [CVE-2025-29594](https://cve.now/CVE-2025-29594.md): A vulnerability exists in the errorpage.php file of the CS2-WeaponPaints-Website v2.1.7 where user-controlled input is not adequately valida (CVSS 6.1)
- [CVE-2025-32409](https://cve.now/CVE-2025-32409.md): Ratta SuperNote A6 X2 Nomad before December 2024 allows remote code execution because an arbitrary firmware image (signed with debug keys) c (CVSS 8.1, Ratta SuperNote A6 X2 Nomad)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.