# CVEs published 2025-04-13

15 CVEs were published on April 13, 2025: 0 critical, 7 high. Days are UTC.

- [CVE-2025-3542](https://cve.now/CVE-2025-3542.md): H3C Magic NX15/Magic NX400/Magic R3010 HTTP POST Request getsyncpppoecfg FCGI\_WizardProtoProcess command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX400 +1)
- [CVE-2025-3541](https://cve.now/CVE-2025-3541.md): H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getSpecs FCGI\_WizardProtoProcess command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +2)
- [CVE-2025-3540](https://cve.now/CVE-2025-3540.md): H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI\_WizardProtoProcess command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +2)
- [CVE-2025-3445](https://cve.now/CVE-2025-3445.md): A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. (CVSS 8.1, github.com/mholt/archiver/v3 · github.com/mholt/archiver)
- [CVE-2025-3539](https://cve.now/CVE-2025-3539.md): H3C Magic BE18000 HTTP POST Request getBasicInfo FCGI\_CheckStringIfContainsSemicolon command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +3)
- [CVE-2025-3538](https://cve.now/CVE-2025-3538.md): D-Link DI-8100 jhttpd auth.asp auth\_asp stack-based overflow (CVSS 8.7, D-Link DI-8100)
- [CVE-2024-56406](https://cve.now/CVE-2024-56406.md): Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes (CVSS 8.4, perl)
- [CVE-2025-3537](https://cve.now/CVE-2025-3537.md): Tutorials-Website Employee Management System update-user.php improper authorization (CVSS 6.9, Tutorials-Website Employee Management System)
- [CVE-2025-3423](https://cve.now/CVE-2025-3423.md): IBM Aspera Faspex 5 cross-site scripting (CVSS 5.4, IBM Aspera Faspex)
- [CVE-2025-3536](https://cve.now/CVE-2025-3536.md): Tutorials-Website Employee Management System delete-user.php improper authorization (CVSS 6.9, Tutorials-Website Employee Management System)
- [CVE-2025-3535](https://cve.now/CVE-2025-3535.md): shuanx BurpAPIFinder BurpApiFinder.db denial of service (CVSS 5.3, shuanx BurpAPIFinder)
- [CVE-2025-3534](https://cve.now/CVE-2025-3534.md): PowerCreator CMS OpenPublicCourse.aspx sql injection (CVSS 5.3, PowerCreator CMS)
- [CVE-2025-3533](https://cve.now/CVE-2025-3533.md): YouDianCMS index.html.Attackers cross site scripting (CVSS 5.3, YouDianCMS)
- [CVE-2025-3532](https://cve.now/CVE-2025-3532.md): YouDianCMS index.html.Attackers cross site scripting (CVSS 5.3, YouDianCMS)
- [CVE-2025-3531](https://cve.now/CVE-2025-3531.md): YouDianCMS index.html cross site scripting (CVSS 5.3, YouDianCMS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.