CVEs published April 14, 2025
86 CVEs were published on April 14, 2025: 5 critical, 18 high.
- Published
- 86
- Critical
- 5
- High
- 18
- Medium
- 57
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 47
Most affected products
- SoftCOM iKSORIS
- 11
- libsoup · Red Hat Enterprise Linux
- 7
- IBM Aspera Console
- 6
- ghostxbh uzy-ssm-mall
- 4
- H3C Magic NX15 · H3C Magic NX30 Pro +3
- 3
- ScriptAndTools eCommerce-website-in-PHP
- 3
- SicommNet BASEC
- 3
- Significant-Gravitas AutoGPT
- 3
- ZHENFENG13 My-Blog-layui · code-projects My-Blog-layui
- 3
- huanfenz StudentManager · code-projects StudentManager
- 2
Critical 5
- CVE-2025-32428Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intendedjupyterhub jupyter-remote-desktop-proxy · jupyter-remote-de…
- CVE-2025-24797Meshtastic incorrectly hands malformed packets leads to controlled buffer overflowmeshtastic firmware
- CVE-2025-1782Unsanitized input in language form fieldifax HylaFAX · ifax AvantFAX
- CVE-2025-22371SQL-injection in admin_login_handler allows unauthenticated user to log in as an administrator in SicommNet BASECSicommNet BASEC
- CVE-2025-32931DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands vDevDojo Voyager · tcg/voyager
High 18
- CVE-2025-31491AutoGPT allows leakage of cross-domain cookies and protected headers in requests redirectSignificant-Gravitas AutoGPT
- CVE-2025-31490AutoGPT allows SSRF due to DNS Rebinding in requests wrapperSignificant-Gravitas AutoGPT
- CVE-2025-22373XSS, HTML and Style injection on login pageSicommNet BASEC
- CVE-2025-22372Insecure password storage in SicommNet BASECSicommNet BASEC
- CVE-2025-32914Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of processlibsoup · Red Hat Enterprise Linux
- CVE-2025-2161Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with MashupPegasystems Pega Infinity
- CVE-2025-2160Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with MashupPegasystems Pega Infinity
- CVE-2025-32908Libsoup: denial of service on libsoup through http/2 serverlibsoup · Red Hat Enterprise Linux
- CVE-2025-32906Libsoup: out of bounds reads in soup_headers_parse_request()libsoup · Red Hat Enterprise Linux
- CVE-2025-32913Libsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value…libsoup · Red Hat Enterprise Linux 7 Extended Lifecycle… +1
- CVE-2025-27009WordPress My auctions allegro plugin <= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerabilitywphocus My auctions allegro
- CVE-2025-31344The giflib open-source component has a buffer overflow vulnerabilityopenEuler giflib
- CVE-2025-2563User Registration & Membership < 4.1.2- Unauthenticated Privilege EscalationUser Registration & Membership
- CVE-2025-3572INTUMIT SmartRobot - Server-Side Request ForgeryINTUMIT SmartRobot
- CVE-2025-3546H3C Magic BE18000 HTTP POST Request getLanguage FCGI_CheckStringIfContainsSemicolon command injectionH3C Magic NX15 · H3C Magic NX30 Pro +3
- CVE-2025-3545H3C Magic BE18000 HTTP POST Request setLanguage FCGI_CheckStringIfContainsSemicolon command injectionH3C Magic NX15 · H3C Magic NX30 Pro +3
- CVE-2025-3544H3C Magic BE18000 HTTP POST Request getCapabilityWeb FCGI_CheckStringIfContainsSemicolon command injectionH3C Magic NX15 · H3C Magic NX30 Pro +3
- CVE-2025-3543H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request setsyncpppoecfg FCGI_WizardProtoProcess command injectionH3C Magic NX15 · H3C Magic NX30 Pro +2
Medium, low and unrated 63
- CVE-2025-31494AutoGPT allows cross-user sharing of node execution results through WebSockets APISignificant-Gravitas AutoGPT
- CVE-2025-3593ZHENFENG13/code-projects My-Blog-layui authorImg upload unrestricted uploadZHENFENG13 My-Blog-layui · code-projects My-Blog-layui
- CVE-2025-3592ZHENFENG13/code-projects My-Blog-layui edit cross site scriptingZHENFENG13 My-Blog-layui · code-projects My-Blog-layui
- CVE-2025-3591ZHENFENG13/code-projects My-Blog-layui edit cross site scriptingZHENFENG13 My-Blog-layui · code-projects My-Blog-layui
- CVE-2025-3590Adianti Framework deserializationAdianti Framework
- CVE-2025-3589SourceCodester Music Class Enrollment System manage_class.php sql injectionSourceCodester Music Class Enrollment System
- CVE-2022-43850IBM Aspera Console cross-site scriptingIBM Aspera Console
- CVE-2022-43840IBM Aspera Console XPath injectionIBM Aspera Console
- CVE-2022-43851IBM Aspera Console information disclosureIBM Aspera Console
- CVE-2023-27272IBM Aspera Console weak password requirementsIBM Aspera Console
- CVE-2022-43852IBM Aspera Console information disclosureIBM Aspera Console
- CVE-2025-3588joelittlejohn jsonschema2pojo JSON File SchemaRule.java apply stack-based overflowjoelittlejohn jsonschema2pojo · org.jsonschema2pojo:jsonsch…
- CVE-2022-43847IBM Aspera Console HTTP header injectionIBM Aspera Console
- CVE-2025-3587ZeroWdd/code-projects studentmanager getTeacherList improper authorizationZeroWdd studentmanager · code-projects studentmanager
- CVE-2025-3585westboy CicadasCMS JSP Parser upload unrestricted uploadwestboy CicadasCMS
- CVE-2025-3277An integer overflow can be triggered in SQLite’s `concat_ws()` function.sqlite
- CVE-2025-2572WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerabilityProgress Software WhatsUp Gold
- CVE-2025-3571Fannuo Enterprise Content Management System 凡诺企业网站管理系统 cms_chip.php sql injectionFannuo Enterprise Content Management System 凡诺企业网站管理系统
- CVE-2024-49825IBM Robotic Process Automation session fixationIBM Robotic Process Automation
- CVE-2025-2475Unauthorized Bot Login Using CredentialsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-2424Leaked Metadata of Deleted Files via Bookmark CreationMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-32912Libsoup: null pointer dereference in client when server omits the "nonce" parameter in an unauthorized response with digest authenticationlibsoup · Red Hat Enterprise Linux
- CVE-2025-32910Libsoup: null pointer deference on libsoup via /auth/soup-auth-digest.c through "soup_auth_digest_authenticate" on client when server omits the "realm" parameter in an unauthorized response with digest authenticationlibsoup · Red Hat Enterprise Linux
- CVE-2025-32909Libsoup: null pointer dereference on libsoup through function "sniff_mp4" in soup-content-sniffer.clibsoup · Red Hat Enterprise Linux
- CVE-2025-3570JamesZBL/code-projects db-hospital-drug ContentController.java save cross site scriptingJamesZBL db-hospital-drug · code-projects db-hospital-drug
- CVE-2025-32907Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range headerlibsoup · Red Hat Enterprise Linux
- CVE-2025-3569JamesZBL/code-projects db-hospital-drug ShiroConfig.java improper authorizationJamesZBL db-hospital-drug · code-projects db-hospital-drug
- CVE-2025-3568Webkul Krayin CRM SVG File edit cross site scriptingWebkul Krayin CRM
- CVE-2025-3567veal98 小牛肉 Echo 开源社区系统 Ticket LoginTicketInterceptor.java preHandle improper authorizationveal98 小牛肉 Echo 开源社区系统
- CVE-2025-3566veal98 小牛肉 Echo 开源社区系统 uploadMdPic unrestricted uploadveal98 小牛肉 Echo 开源社区系统
- CVE-2024-49709XSS in iKSORISSoftCOM iKSORIS
- CVE-2024-49708XSS in iKSORISSoftCOM iKSORIS
- CVE-2024-49707XSS in iKSORISSoftCOM iKSORIS
- CVE-2024-49706XSS in iKSORISSoftCOM iKSORIS
- CVE-2024-49705XSS in iKSORISSoftCOM iKSORIS
- CVE-2024-13598XSS in iKSORISSoftCOM iKSORIS
- CVE-2024-13597XSS in iKSORISSoftCOM iKSORIS
- CVE-2024-10090XSS in iKSORISSoftCOM iKSORIS
- CVE-2024-10089XSS in iKSORISSoftCOM iKSORIS
- CVE-2024-10088XSS in iKSORISSoftCOM iKSORIS
- CVE-2024-10087XSS in iKSORISSoftCOM iKSORIS
- CVE-2025-3565huanfenz/code-projects StudentManager Announcement Management Section uploadArticle.do unrestricted uploadhuanfenz StudentManager · code-projects StudentManager
- CVE-2025-3564huanfenz/code-projects StudentManager Teacher String improper authorizationhuanfenz StudentManager · code-projects StudentManager
- CVE-2025-3563WuzhiCMS Setting index.php set code injectionWuzhiCMS
- CVE-2025-3562Yonyou YonBIP userfile FileInputStream path traversalYonyou YonBIP
- CVE-2025-3561ghostxbh uzy-ssm-mall cross-site request forgeryghostxbh uzy-ssm-mall
- CVE-2025-3560ghostxbh uzy-ssm-mall product cross site scriptingghostxbh uzy-ssm-mall
- CVE-2025-3559ghostxbh uzy-ssm-mall 20 ForeProductListController sql injectionghostxbh uzy-ssm-mall
- CVE-2025-3558ghostxbh uzy-ssm-mall uploadUserHeadImage unrestricted uploadghostxbh uzy-ssm-mall
- CVE-2025-24859Apache Roller: Insufficient Session Expiration on Password ChangeApache Software Foundation Apache Roller
- CVE-2025-3557ScriptAndTools eCommerce-website-in-PHP cross-site request forgeryScriptAndTools eCommerce-website-in-PHP
- CVE-2025-3556ScriptAndTools eCommerce-website-in-PHP login.php excessive authenticationScriptAndTools eCommerce-website-in-PHP
- CVE-2025-3555ScriptAndTools eCommerce-website-in-PHP login.php excessive authenticationScriptAndTools eCommerce-website-in-PHP
- CVE-2025-32093Syatem admin profile modification by delegated granular administration roleMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-30516Unauthorized Notification Exposure in Mobile App Under Specific ConditionsMattermost
- CVE-2025-3554phpshe api.php cross site scriptingphpshe
- CVE-2025-3553phpshe admin.php pe_delete sql injectionphpshe
- CVE-2024-9230PowerPress Podcasting < 11.9.18 - Author+ XSS via Podcast URLPowerPress Podcasting plugin by Blubrry
- CVE-2025-3550wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System detail improper authorizationwowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System
- CVE-2025-3549Open Asset Import Library Assimp File MD3Loader.cpp ValidateSurfaceHeaderOffsets heap-based overflowOpen Asset Import Library Assimp · pyassimp
- CVE-2025-3548Open Asset Import Library Assimp File types.h Set heap-based overflowOpen Asset Import Library Assimp
- CVE-2025-3547frdel Agent-Zero get_work_dir_files path traversalfrdel Agent-Zero
- CVE-2025-29720Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUpload