# CVEs published 2025-04-14

86 CVEs were published on April 14, 2025: 5 critical, 18 high. Days are UTC.

- [CVE-2025-32428](https://cve.now/CVE-2025-32428.md): Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended (CVSS 9.0, jupyterhub jupyter-remote-desktop-proxy · jupyter-remote-de…)
- [CVE-2025-24797](https://cve.now/CVE-2025-24797.md): Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow (CVSS 9.4, meshtastic firmware)
- [CVE-2025-31494](https://cve.now/CVE-2025-31494.md): AutoGPT allows cross-user sharing of node execution results through WebSockets API (CVSS 3.5, Significant-Gravitas AutoGPT)
- [CVE-2025-31491](https://cve.now/CVE-2025-31491.md): AutoGPT allows leakage of cross-domain cookies and protected headers in requests redirect (CVSS 8.6, Significant-Gravitas AutoGPT)
- [CVE-2025-31490](https://cve.now/CVE-2025-31490.md): AutoGPT allows SSRF due to DNS Rebinding in requests wrapper (CVSS 7.5, Significant-Gravitas AutoGPT)
- [CVE-2025-3593](https://cve.now/CVE-2025-3593.md): ZHENFENG13/code-projects My-Blog-layui authorImg upload unrestricted upload (CVSS 5.3, ZHENFENG13 My-Blog-layui · code-projects My-Blog-layui)
- [CVE-2025-3592](https://cve.now/CVE-2025-3592.md): ZHENFENG13/code-projects My-Blog-layui edit cross site scripting (CVSS 5.1, ZHENFENG13 My-Blog-layui · code-projects My-Blog-layui)
- [CVE-2025-3591](https://cve.now/CVE-2025-3591.md): ZHENFENG13/code-projects My-Blog-layui edit cross site scripting (CVSS 5.1, ZHENFENG13 My-Blog-layui · code-projects My-Blog-layui)
- [CVE-2025-3590](https://cve.now/CVE-2025-3590.md): Adianti Framework deserialization (CVSS 5.3, Adianti Framework)
- [CVE-2025-3589](https://cve.now/CVE-2025-3589.md): SourceCodester Music Class Enrollment System manage\_class.php sql injection (CVSS 5.3, SourceCodester Music Class Enrollment System)
- [CVE-2022-43850](https://cve.now/CVE-2022-43850.md): IBM Aspera Console cross-site scripting (CVSS 5.4, IBM Aspera Console)
- [CVE-2022-43840](https://cve.now/CVE-2022-43840.md): IBM Aspera Console XPath injection (CVSS 4.3, IBM Aspera Console)
- [CVE-2022-43851](https://cve.now/CVE-2022-43851.md): IBM Aspera Console information disclosure (CVSS 5.9, IBM Aspera Console)
- [CVE-2023-27272](https://cve.now/CVE-2023-27272.md): IBM Aspera Console weak password requirements (CVSS 3.1, IBM Aspera Console)
- [CVE-2022-43852](https://cve.now/CVE-2022-43852.md): IBM Aspera Console information disclosure (CVSS 5.3, IBM Aspera Console)
- [CVE-2025-3588](https://cve.now/CVE-2025-3588.md): joelittlejohn jsonschema2pojo JSON File SchemaRule.java apply stack-based overflow (CVSS 4.8, joelittlejohn jsonschema2pojo · org.jsonschema2pojo:jsonsch…)
- [CVE-2022-43847](https://cve.now/CVE-2022-43847.md): IBM Aspera Console HTTP header injection (CVSS 5.4, IBM Aspera Console)
- [CVE-2025-3587](https://cve.now/CVE-2025-3587.md): ZeroWdd/code-projects studentmanager getTeacherList improper authorization (CVSS 5.3, ZeroWdd studentmanager · code-projects studentmanager)
- [CVE-2025-1782](https://cve.now/CVE-2025-1782.md): Unsanitized input in language form field (CVSS 9.9, ifax HylaFAX · ifax AvantFAX)
- [CVE-2025-3585](https://cve.now/CVE-2025-3585.md): westboy CicadasCMS JSP Parser upload unrestricted upload (CVSS 5.3, westboy CicadasCMS)
- [CVE-2025-3277](https://cve.now/CVE-2025-3277.md): An integer overflow can be triggered in SQLite’s \`concat\_ws()\` function. (CVSS 6.9, sqlite)
- [CVE-2025-2572](https://cve.now/CVE-2025-2572.md): WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability (CVSS 5.6, Progress Software WhatsUp Gold)
- [CVE-2025-22371](https://cve.now/CVE-2025-22371.md): SQL-injection in admin\_login\_handler allows unauthenticated user to log in as an administrator in SicommNet BASEC (CVSS 9.3, SicommNet BASEC)
- [CVE-2025-22373](https://cve.now/CVE-2025-22373.md): XSS, HTML and Style injection on login page (CVSS 8.7, SicommNet BASEC)
- [CVE-2025-22372](https://cve.now/CVE-2025-22372.md): Insecure password storage in SicommNet BASEC (CVSS 8.4, SicommNet BASEC)
- [CVE-2025-3571](https://cve.now/CVE-2025-3571.md): Fannuo Enterprise Content Management System 凡诺企业网站管理系统 cms\_chip.php sql injection (CVSS 5.3, Fannuo Enterprise Content Management System 凡诺企业网站管理系统)
- [CVE-2024-49825](https://cve.now/CVE-2024-49825.md): IBM Robotic Process Automation session fixation (CVSS 6.3, IBM Robotic Process Automation)
- [CVE-2025-2475](https://cve.now/CVE-2025-2475.md): Unauthorized Bot Login Using Credentials (CVSS 5.4, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-2424](https://cve.now/CVE-2025-2424.md): Leaked Metadata of Deleted Files via Bookmark Creation (CVSS 3.1, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-32914](https://cve.now/CVE-2025-32914.md): Libsoup: oob read on libsoup through function "soup\_multipart\_new\_from\_message" in soup-multipart.c leads to crash or exit of process (CVSS 7.4, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-32912](https://cve.now/CVE-2025-32912.md): Libsoup: null pointer dereference in client when server omits the "nonce" parameter in an unauthorized response with digest authentication (CVSS 6.5, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-32910](https://cve.now/CVE-2025-32910.md): Libsoup: null pointer deference on libsoup via /auth/soup-auth-digest.c through "soup\_auth\_digest\_authenticate" on client when server omits the "realm" parameter in an unauthorized response with digest authentication (CVSS 6.5, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-32909](https://cve.now/CVE-2025-32909.md): Libsoup: null pointer dereference on libsoup through function "sniff\_mp4" in soup-content-sniffer.c (CVSS 5.3, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-3570](https://cve.now/CVE-2025-3570.md): JamesZBL/code-projects db-hospital-drug ContentController.java save cross site scripting (CVSS 5.1, JamesZBL db-hospital-drug · code-projects db-hospital-drug)
- [CVE-2025-2161](https://cve.now/CVE-2025-2161.md): Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup (CVSS 7.1, Pegasystems Pega Infinity)
- [CVE-2025-2160](https://cve.now/CVE-2025-2160.md): Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup (CVSS 8.1, Pegasystems Pega Infinity)
- [CVE-2025-32908](https://cve.now/CVE-2025-32908.md): Libsoup: denial of service on libsoup through http/2 server (CVSS 7.5, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-32907](https://cve.now/CVE-2025-32907.md): Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header (CVSS 5.3, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-3569](https://cve.now/CVE-2025-3569.md): JamesZBL/code-projects db-hospital-drug ShiroConfig.java improper authorization (CVSS 5.3, JamesZBL db-hospital-drug · code-projects db-hospital-drug)
- [CVE-2025-32906](https://cve.now/CVE-2025-32906.md): Libsoup: out of bounds reads in soup\_headers\_parse\_request() (CVSS 7.5, libsoup · Red Hat Enterprise Linux)
- [CVE-2025-32913](https://cve.now/CVE-2025-32913.md): Libsoup: null pointer dereference in soup\_message\_headers\_get\_content\_disposition when "filename" parameter is present, but has no value… (CVSS 7.5, libsoup · Red Hat Enterprise Linux 7 Extended Lifecycle… +1)
- [CVE-2025-3568](https://cve.now/CVE-2025-3568.md): Webkul Krayin CRM SVG File edit cross site scripting (CVSS 5.1, Webkul Krayin CRM)
- [CVE-2025-3567](https://cve.now/CVE-2025-3567.md): veal98 小牛肉 Echo 开源社区系统 Ticket LoginTicketInterceptor.java preHandle improper authorization (CVSS 5.3, veal98 小牛肉 Echo 开源社区系统)
- [CVE-2025-3566](https://cve.now/CVE-2025-3566.md): veal98 小牛肉 Echo 开源社区系统 uploadMdPic unrestricted upload (CVSS 6.9, veal98 小牛肉 Echo 开源社区系统)
- [CVE-2024-49709](https://cve.now/CVE-2024-49709.md): XSS in iKSORIS (CVSS 2.3, SoftCOM iKSORIS)
- [CVE-2024-49708](https://cve.now/CVE-2024-49708.md): XSS in iKSORIS (CVSS 5.1, SoftCOM iKSORIS)
- [CVE-2024-49707](https://cve.now/CVE-2024-49707.md): XSS in iKSORIS (CVSS 5.1, SoftCOM iKSORIS)
- [CVE-2024-49706](https://cve.now/CVE-2024-49706.md): XSS in iKSORIS (CVSS 5.1, SoftCOM iKSORIS)
- [CVE-2024-49705](https://cve.now/CVE-2024-49705.md): XSS in iKSORIS (CVSS 5.3, SoftCOM iKSORIS)
- [CVE-2024-13598](https://cve.now/CVE-2024-13598.md): XSS in iKSORIS (CVSS 5.1, SoftCOM iKSORIS)
- [CVE-2024-13597](https://cve.now/CVE-2024-13597.md): XSS in iKSORIS (CVSS 5.1, SoftCOM iKSORIS)
- [CVE-2024-10090](https://cve.now/CVE-2024-10090.md): XSS in iKSORIS (CVSS 5.1, SoftCOM iKSORIS)
- [CVE-2024-10089](https://cve.now/CVE-2024-10089.md): XSS in iKSORIS (CVSS 5.1, SoftCOM iKSORIS)
- [CVE-2024-10088](https://cve.now/CVE-2024-10088.md): XSS in iKSORIS (CVSS 5.1, SoftCOM iKSORIS)
- [CVE-2024-10087](https://cve.now/CVE-2024-10087.md): XSS in iKSORIS (CVSS 5.3, SoftCOM iKSORIS)
- [CVE-2025-3565](https://cve.now/CVE-2025-3565.md): huanfenz/code-projects StudentManager Announcement Management Section uploadArticle.do unrestricted upload (CVSS 5.1, huanfenz StudentManager · code-projects StudentManager)
- [CVE-2025-3564](https://cve.now/CVE-2025-3564.md): huanfenz/code-projects StudentManager Teacher String improper authorization (CVSS 5.3, huanfenz StudentManager · code-projects StudentManager)
- [CVE-2025-27009](https://cve.now/CVE-2025-27009.md): WordPress My auctions allegro plugin \<= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, wphocus My auctions allegro)
- [CVE-2025-3563](https://cve.now/CVE-2025-3563.md): WuzhiCMS Setting index.php set code injection (CVSS 5.1, WuzhiCMS)
- [CVE-2025-3562](https://cve.now/CVE-2025-3562.md): Yonyou YonBIP userfile FileInputStream path traversal (CVSS 5.3, Yonyou YonBIP)
- [CVE-2025-3561](https://cve.now/CVE-2025-3561.md): ghostxbh uzy-ssm-mall cross-site request forgery (CVSS 5.3, ghostxbh uzy-ssm-mall)
- [CVE-2025-3560](https://cve.now/CVE-2025-3560.md): ghostxbh uzy-ssm-mall product cross site scripting (CVSS 5.1, ghostxbh uzy-ssm-mall)
- [CVE-2025-3559](https://cve.now/CVE-2025-3559.md): ghostxbh uzy-ssm-mall 20 ForeProductListController sql injection (CVSS 5.3, ghostxbh uzy-ssm-mall)
- [CVE-2025-3558](https://cve.now/CVE-2025-3558.md): ghostxbh uzy-ssm-mall uploadUserHeadImage unrestricted upload (CVSS 5.3, ghostxbh uzy-ssm-mall)
- [CVE-2025-24859](https://cve.now/CVE-2025-24859.md): Apache Roller: Insufficient Session Expiration on Password Change (CVSS 2.1, Apache Software Foundation Apache Roller)
- [CVE-2025-3557](https://cve.now/CVE-2025-3557.md): ScriptAndTools eCommerce-website-in-PHP cross-site request forgery (CVSS 5.3, ScriptAndTools eCommerce-website-in-PHP)
- [CVE-2025-31344](https://cve.now/CVE-2025-31344.md): The giflib open-source component has a buffer overflow vulnerability (CVSS 7.3, openEuler giflib)
- [CVE-2025-3556](https://cve.now/CVE-2025-3556.md): ScriptAndTools eCommerce-website-in-PHP login.php excessive authentication (CVSS 6.3, ScriptAndTools eCommerce-website-in-PHP)
- [CVE-2025-3555](https://cve.now/CVE-2025-3555.md): ScriptAndTools eCommerce-website-in-PHP login.php excessive authentication (CVSS 6.3, ScriptAndTools eCommerce-website-in-PHP)
- [CVE-2025-32093](https://cve.now/CVE-2025-32093.md): Syatem admin profile modification by delegated granular administration role (CVSS 4.7, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-30516](https://cve.now/CVE-2025-30516.md): Unauthorized Notification Exposure in Mobile App Under Specific Conditions (CVSS 2.0, Mattermost)
- [CVE-2025-3554](https://cve.now/CVE-2025-3554.md): phpshe api.php cross site scripting (CVSS 5.3, phpshe)
- [CVE-2025-3553](https://cve.now/CVE-2025-3553.md): phpshe admin.php pe\_delete sql injection (CVSS 5.3, phpshe)
- [CVE-2025-2563](https://cve.now/CVE-2025-2563.md): User Registration & Membership \< 4.1.2- Unauthenticated Privilege Escalation (CVSS 8.1, User Registration & Membership)
- [CVE-2024-9230](https://cve.now/CVE-2024-9230.md): PowerPress Podcasting \< 11.9.18 - Author+ XSS via Podcast URL (CVSS 5.9, PowerPress Podcasting plugin by Blubrry)
- [CVE-2025-3550](https://cve.now/CVE-2025-3550.md): wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System detail improper authorization (CVSS 5.3, wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System)
- [CVE-2025-3549](https://cve.now/CVE-2025-3549.md): Open Asset Import Library Assimp File MD3Loader.cpp ValidateSurfaceHeaderOffsets heap-based overflow (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-3548](https://cve.now/CVE-2025-3548.md): Open Asset Import Library Assimp File types.h Set heap-based overflow (CVSS 4.8, Open Asset Import Library Assimp)
- [CVE-2025-3547](https://cve.now/CVE-2025-3547.md): frdel Agent-Zero get\_work\_dir\_files path traversal (CVSS 5.3, frdel Agent-Zero)
- [CVE-2025-3572](https://cve.now/CVE-2025-3572.md): INTUMIT SmartRobot - Server-Side Request Forgery (CVSS 7.5, INTUMIT SmartRobot)
- [CVE-2025-3546](https://cve.now/CVE-2025-3546.md): H3C Magic BE18000 HTTP POST Request getLanguage FCGI\_CheckStringIfContainsSemicolon command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +3)
- [CVE-2025-3545](https://cve.now/CVE-2025-3545.md): H3C Magic BE18000 HTTP POST Request setLanguage FCGI\_CheckStringIfContainsSemicolon command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +3)
- [CVE-2025-3544](https://cve.now/CVE-2025-3544.md): H3C Magic BE18000 HTTP POST Request getCapabilityWeb FCGI\_CheckStringIfContainsSemicolon command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +3)
- [CVE-2025-3543](https://cve.now/CVE-2025-3543.md): H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request setsyncpppoecfg FCGI\_WizardProtoProcess command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +2)
- [CVE-2025-29720](https://cve.now/CVE-2025-29720.md): Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote\_files.RemoteFileUpload (CVSS 4.8)
- [CVE-2025-32931](https://cve.now/CVE-2025-32931.md): DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands v (CVSS 9.1, DevDojo Voyager · tcg/voyager)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.