# CVEs published 2025-04-19

36 CVEs were published on April 19, 2025: 3 critical, 10 high. Days are UTC.

- [CVE-2025-3820](https://cve.now/CVE-2025-3820.md): Tenda W12/i24 httpd cgiSysUplinkCheckSet stack-based overflow (CVSS 8.7, Tenda W12 · Tenda i24)
- [CVE-2025-3819](https://cve.now/CVE-2025-3819.md): PHPGurukul Men Salon Management System search-appointment.php sql injection (CVSS 6.9, PHPGurukul Men Salon Management System)
- [CVE-2025-3818](https://cve.now/CVE-2025-3818.md): webpy web.py db.py PostgresDB.\_process\_insert\_query sql injection (CVSS 5.3, webpy web.py)
- [CVE-2025-3817](https://cve.now/CVE-2025-3817.md): SourceCodester Online Eyewear Shop Master.php sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2025-3816](https://cve.now/CVE-2025-3816.md): westboy CicadasCMS Scheduled Task save os command injection (CVSS 5.1, westboy CicadasCMS)
- [CVE-2025-3808](https://cve.now/CVE-2025-3808.md): zhenfeng13 My-BBS cross-site request forgery (CVSS 5.3, zhenfeng13 My-BBS)
- [CVE-2025-3807](https://cve.now/CVE-2025-3807.md): zhenfeng13 My-BBS Endpoint UploadController.java upload unrestricted upload (CVSS 5.3, zhenfeng13 My-BBS)
- [CVE-2025-3806](https://cve.now/CVE-2025-3806.md): dazhouda lecms Edit Profile admin cross site scripting (CVSS 4.8, dazhouda lecms)
- [CVE-2025-3805](https://cve.now/CVE-2025-3805.md): sarrionandia tournatrack Jinja2 Template check\_id.py injection (CVSS 4.8, sarrionandia tournatrack)
- [CVE-2025-3804](https://cve.now/CVE-2025-3804.md): thautwarm vscode-diana Jinja2 Template Gen.py injection (CVSS 4.8, thautwarm vscode-diana)
- [CVE-2025-3803](https://cve.now/CVE-2025-3803.md): Tenda W12/i24 httpd cgiSysScheduleRebootSet stack-based overflow (CVSS 8.7, Tenda W12 · Tenda i24)
- [CVE-2025-3802](https://cve.now/CVE-2025-3802.md): Tenda W12/i24 httpd cgiPingSet stack-based overflow (CVSS 8.7, Tenda W12 · Tenda i24)
- [CVE-2025-3801](https://cve.now/CVE-2025-3801.md): songquanpeng one-api System Setting cross site scripting (CVSS 4.8, songquanpeng one-api · github.com/songquanpeng/one-api)
- [CVE-2025-3800](https://cve.now/CVE-2025-3800.md): WCMS AnonymousController.php sql injection (CVSS 6.9, WCMS)
- [CVE-2025-3799](https://cve.now/CVE-2025-3799.md): WCMS AnonymousController.php sql injection (CVSS 6.9, WCMS)
- [CVE-2025-3798](https://cve.now/CVE-2025-3798.md): WCMS Advertisement Image AdvadminController.php sub unrestricted upload (CVSS 5.1, WCMS)
- [CVE-2025-3661](https://cve.now/CVE-2025-3661.md): SB Chart block \<= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter (CVSS 6.4, bobbingwide SB Chart block)
- [CVE-2025-3404](https://cve.now/CVE-2025-3404.md): Download Manager \<= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion (CVSS 8.8, codename065 Download Manager)
- [CVE-2021-4455](https://cve.now/CVE-2021-4455.md): Wordpress Plugin Smart Product Review \<= 1.0.4 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Codeflist Wordpress Plugin Smart Product Review)
- [CVE-2025-3797](https://cve.now/CVE-2025-3797.md): SeaCMS admin\_topic.php sql injection (CVSS 5.1, SeaCMS)
- [CVE-2024-13926](https://cve.now/CVE-2024-13926.md): WP-Syntax \<= 1.2 - Author+ Potential ReDoS (CVSS 7.5, WP-Syntax)
- [CVE-2025-3809](https://cve.now/CVE-2025-3809.md): Debug Log Manager \<= 2.3.4 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, qriouslad Debug Log Manager – Conveniently Monitor and Insp…)
- [CVE-2025-2111](https://cve.now/CVE-2025-2111.md): WP Headers And Footers \<= 3.1.1 - Cross-Site Request Forgery to Arbitrary Options Update (CVSS 7.5, hiddenpearls Insert Headers And Footers)
- [CVE-2025-3103](https://cve.now/CVE-2025-3103.md): CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon \<= 2.4 - Unauthenticated Arbitrary File Read (CVSS 7.5, LambertGroup CLEVER - HTML5 Radio Player With History - Sho…)
- [CVE-2025-1457](https://cve.now/CVE-2025-1457.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) \<= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2025-3275](https://cve.now/CVE-2025-3275.md): Themesflat Addons For Elementor \<= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Themesflat Addons For Elementor)
- [CVE-2025-1093](https://cve.now/CVE-2025-1093.md): AIHub \<= 1.3.7 - Unauthenticated Arbitrary File Upload in generate\_image (CVSS 9.8, LiquidThemes AI Hub - Startup & Technology WordPress Theme)
- [CVE-2025-2010](https://cve.now/CVE-2025-2010.md): JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin \<= 2.3.9 - Unauthenticated SQL Injection (CVSS 7.5, mhmrajib JobWP – Job Board, Job Listing, Career Page and Re…)
- [CVE-2025-3278](https://cve.now/CVE-2025-3278.md): UrbanGo Membership \<= 1.0.4 - Unauthenticated Privilege Escalation (CVSS 9.8, Edge-Themes UrbanGo Membership)
- [CVE-2025-3284](https://cve.now/CVE-2025-3284.md): User Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile \<= 5.1.3 - Cross-Site Request Forgery to User Deletion (CVSS 4.3, WPEverest User Registration PRO – Custom Registration Form,…)
- [CVE-2022-47111](https://cve.now/CVE-2022-47111.md): 7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. (CVSS 2.5, 7-Zip)
- [CVE-2022-47112](https://cve.now/CVE-2022-47112.md): 7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. (CVSS 2.5, 7-Zip)
- [CVE-2023-26819](https://cve.now/CVE-2023-26819.md): cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": \[ null,99999999999999999999999999999999999 (CVSS 2.9, cJSON Project cJSON)
- [CVE-2023-30421](https://cve.now/CVE-2023-30421.md): mystrtod in mjson 1.2.7 requires more than a billion iterations during processing of certain digit strings such as 8891110122900e91301393575 (CVSS 2.9, mjson project mjson)
- [CVE-2025-43917](https://cve.now/CVE-2025-43917.md): In Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate privileges after uninstalling the product. (CVSS 8.2, Pritunl-Client)
- [CVE-2025-43918](https://cve.now/CVE-2025-43918.md): SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certific (CVSS 6.4, SSL.com)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.