CVEs published April 20, 2025
25 CVEs were published on April 20, 2025: 0 critical, 0 high.
- Published
- 25
- Critical
- 0
- High
- 0
- Medium
- 18
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- SourceCodester Web-based Pharmacy Product Management System
- 6
- LibRaw
- 4
- GNU Mailman
- 3
- PHPGurukul Men Salon Management System
- 3
- KnowBe4 Security Awareness Training
- 2
- struktur libheif
- 2
- Convertigo
- 1
- Infodraw Media Relay Service
- 1
- kitty project kitty
- 1
- kuangstudy KuangSimpleBBS
- 1
Medium, low and unrated 25
- CVE-2025-3830kuangstudy KuangSimpleBBS QuestionController.java fileUpload unrestricted uploadkuangstudy KuangSimpleBBS
- CVE-2025-3829PHPGurukul Men Salon Management System sales-reports-detail.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3828PHPGurukul Men Salon Management System view-appointment.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3827PHPGurukul Men Salon Management System forgot-password.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3826SourceCodester Web-based Pharmacy Product Management System add-supplier.php cross site scriptingSourceCodester Web-based Pharmacy Product Management System
- CVE-2025-3825SourceCodester Web-based Pharmacy Product Management System add-category.php cross site scriptingSourceCodester Web-based Pharmacy Product Management System
- CVE-2025-3824SourceCodester Web-based Pharmacy Product Management System add-product.php cross site scriptingSourceCodester Web-based Pharmacy Product Management System
- CVE-2025-3823SourceCodester Web-based Pharmacy Product Management System add-stock.php cross site scriptingSourceCodester Web-based Pharmacy Product Management System
- CVE-2025-3822SourceCodester Web-based Pharmacy Product Management System changepassword.php cross site scriptingSourceCodester Web-based Pharmacy Product Management System
- CVE-2025-3821SourceCodester Web-based Pharmacy Product Management System add-admin.php cross site scriptingSourceCodester Web-based Pharmacy Product Management System
- CVE-2020-36844The KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS.KnowBe4 Security Awareness Training
- CVE-2020-36845The KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect function that does not validate the destination URKnowBe4 Security Awareness Training
- CVE-2025-43919GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at GNU Mailman
- CVE-2025-43920GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to executeGNU Mailman
- CVE-2025-43921GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint.GNU Mailman
- CVE-2025-43928In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversalInfodraw Media Relay Service
- CVE-2025-43929open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked fkitty project kitty
- CVE-2025-43954QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set.Quasar QMarkdown · @quasar/quasar-ui-qmarkdown
- CVE-2025-43955TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in Convertigo
- CVE-2025-43961In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.LibRaw
- CVE-2025-43962In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large wLibRaw
- CVE-2025-43963In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values aLibRaw
- CVE-2025-43964In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.LibRaw
- CVE-2025-43966libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc.struktur libheif
- CVE-2025-43967libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can referencstruktur libheif