CVEs published April 19, 2025
36 CVEs were published on April 19, 2025: 3 critical, 10 high.
- Published
- 36
- Critical
- 3
- High
- 10
- Medium
- 19
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Tenda W12 · Tenda i24
- 3
- WCMS
- 3
- 7-Zip
- 2
- zhenfeng13 My-BBS
- 2
- bdthemes Element Pack – Widgets, Templates & Addons for Ele…
- 1
- bobbingwide SB Chart block
- 1
- cJSON Project cJSON
- 1
- Codeflist Wordpress Plugin Smart Product Review
- 1
- codename065 Download Manager
- 1
- dazhouda lecms
- 1
Critical 3
- CVE-2021-4455Wordpress Plugin Smart Product Review <= 1.0.4 - Unauthenticated Arbitrary File UploadCodeflist Wordpress Plugin Smart Product Review
- CVE-2025-1093AIHub <= 1.3.7 - Unauthenticated Arbitrary File Upload in generate_imageLiquidThemes AI Hub - Startup & Technology WordPress Theme
- CVE-2025-3278UrbanGo Membership <= 1.0.4 - Unauthenticated Privilege EscalationEdge-Themes UrbanGo Membership
High 10
- CVE-2025-3820Tenda W12/i24 httpd cgiSysUplinkCheckSet stack-based overflowTenda W12 · Tenda i24
- CVE-2025-3803Tenda W12/i24 httpd cgiSysScheduleRebootSet stack-based overflowTenda W12 · Tenda i24
- CVE-2025-3802Tenda W12/i24 httpd cgiPingSet stack-based overflowTenda W12 · Tenda i24
- CVE-2025-3404Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletioncodename065 Download Manager
- CVE-2024-13926WP-Syntax <= 1.2 - Author+ Potential ReDoSWP-Syntax
- CVE-2025-3809Debug Log Manager <= 2.3.4 - Unauthenticated Stored Cross-Site Scriptingqriouslad Debug Log Manager – Conveniently Monitor and Insp…
- CVE-2025-2111WP Headers And Footers <= 3.1.1 - Cross-Site Request Forgery to Arbitrary Options Updatehiddenpearls Insert Headers And Footers
- CVE-2025-3103CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon <= 2.4 - Unauthenticated Arbitrary File ReadLambertGroup CLEVER - HTML5 Radio Player With History - Sho…
- CVE-2025-2010JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin <= 2.3.9 - Unauthenticated SQL Injectionmhmrajib JobWP – Job Board, Job Listing, Career Page and Re…
- CVE-2025-43917In Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate privileges after uninstalling the product.Pritunl-Client
Medium, low and unrated 23
- CVE-2025-3819PHPGurukul Men Salon Management System search-appointment.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3818webpy web.py db.py PostgresDB._process_insert_query sql injectionwebpy web.py
- CVE-2025-3817SourceCodester Online Eyewear Shop Master.php sql injectionSourceCodester Online Eyewear Shop
- CVE-2025-3816westboy CicadasCMS Scheduled Task save os command injectionwestboy CicadasCMS
- CVE-2025-3808zhenfeng13 My-BBS cross-site request forgeryzhenfeng13 My-BBS
- CVE-2025-3807zhenfeng13 My-BBS Endpoint UploadController.java upload unrestricted uploadzhenfeng13 My-BBS
- CVE-2025-3806dazhouda lecms Edit Profile admin cross site scriptingdazhouda lecms
- CVE-2025-3805sarrionandia tournatrack Jinja2 Template check_id.py injectionsarrionandia tournatrack
- CVE-2025-3804thautwarm vscode-diana Jinja2 Template Gen.py injectionthautwarm vscode-diana
- CVE-2025-3801songquanpeng one-api System Setting cross site scriptingsongquanpeng one-api · github.com/songquanpeng/one-api
- CVE-2025-3800WCMS AnonymousController.php sql injectionWCMS
- CVE-2025-3799WCMS AnonymousController.php sql injectionWCMS
- CVE-2025-3798WCMS Advertisement Image AdvadminController.php sub unrestricted uploadWCMS
- CVE-2025-3661SB Chart block <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameterbobbingwide SB Chart block
- CVE-2025-3797SeaCMS admin_topic.php sql injectionSeaCMS
- CVE-2025-1457Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2025-3275Themesflat Addons For Elementor <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingThemesflat Addons For Elementor
- CVE-2025-3284User Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User DeletionWPEverest User Registration PRO – Custom Registration Form,…
- CVE-2022-471117-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits.7-Zip
- CVE-2022-471127-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits.7-Zip
- CVE-2023-26819cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,99999999999999999999999999999999999cJSON Project cJSON
- CVE-2023-30421mystrtod in mjson 1.2.7 requires more than a billion iterations during processing of certain digit strings such as 8891110122900e91301393575mjson project mjson
- CVE-2025-43918SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificSSL.com