CVEs published April 21, 2025
45 CVEs were published on April 21, 2025: 6 critical, 9 high.
- Published
- 45
- Critical
- 6
- High
- 9
- Medium
- 24
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- GoBGP · github.com/osrg/gobgp +1
- 3
- markparticle WebServer
- 3
- Saviynt OVA based Connect
- 3
- OpenText Content Management
- 2
- org.opencms:opencms-core
- 2
- panhainan DS-Java
- 2
- AdeptLanguage Adept
- 1
- Amazon Ion Dotnet · Amazon.IonDotnet
- 1
- api.sonos.com
- 1
- cilium · github.com/cilium/cilium
- 1
Critical 6
- CVE-2025-32958Adept exposed the GITHUB_TOKEN in workflow run artifactAdeptLanguage Adept
- CVE-2025-0632Local File Inclusion (LFI) leading to sensitive data exposureFormulatrix Rock Maker Web
- CVE-2025-28104Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input.
- CVE-2025-29287An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crnet.mingsoft:ms-mcms
- CVE-2025-29659Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function located in the "cmd" binary.
- CVE-2025-29660A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789.
High 9
- CVE-2025-32956ManageWiki has SQL injection vulnerability in NamespaceMigrationJobmiraheze ManageWiki
- CVE-2025-27086A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication.Hewlett Packard Enterprise HPE Performance Cluster Manager
- CVE-2025-23174Yoel Geva - CWE-200: Exposure of Sensitive Information to an Unauthorized ActorYoel Geva Android App
- CVE-2025-32431Traefik has a possible vulnerability with the path matcherstraefik · github.com/traefik/traefik +2
- CVE-2025-3857Infinite loop condition in Amazon.IonDotnetAmazon Ion Dotnet · Amazon.IonDotnet
- CVE-2025-2298Authenticated API Endpoint Allows Arbitrary File Deletion in Dremio SoftwareDremio Software
- CVE-2024-57394The quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0 allows user to restore a malicious file to
- CVE-2025-43922The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to SFileWave
- CVE-2025-43971An issue was discovered in GoBGP before 3.35.0.GoBGP · github.com/osrg/gobgp/v3 +1
Medium, low and unrated 30
- CVE-2025-3849YXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password changeYXJ2018 SpringBoot-Vue-OnlineExam
- CVE-2025-2987IBM Maximo Asset Management server-side request forgeryIBM Maximo Asset Management
- CVE-2025-3847markparticle WebServer Login httprequest.cpp sql injectionmarkparticle WebServer
- CVE-2025-3846markparticle WebServer Registration httprequest.cpp sql injectionmarkparticle WebServer
- CVE-2025-3845markparticle WebServer buffer.cpp HasWritten buffer overflowmarkparticle WebServer
- CVE-2025-3843panhainan DS-Java cross-site request forgerypanhainan DS-Java
- CVE-2025-32955Harden-Runner Evasion of 'disable-sudo' policystep-security harden-runner
- CVE-2025-3842panhainan DS-Java FileUpload.java uploadUserPic.action code injectionpanhainan DS-Java
- CVE-2025-3841wix-incubator jam Jinja2 Template jam.py special elements used in a template enginewix-incubator jam
- CVE-2025-32793Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusterscilium · github.com/cilium/cilium
- CVE-2024-12543A user enumeration and subsequent data integrity vulnerability affecting barcode functionalityOpenText Content Management
- CVE-2024-12863Stored XSS in Discussions functionalityOpenText Content Management
- CVE-2025-2517Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security ManagerOpenText ArcSight Enterprise Security Manager
- CVE-2024-12862REST API allows users without permissions to remove external collaboratorsOpenText Content Server
- CVE-2025-3840Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Saviynt OVA based Connect
- CVE-2025-3838Improper Authorization in the installer for the EOL OVA based connect componentSaviynt OVA based Connect
- CVE-2025-3837Improper Input Validation vulnerability in the End of Life (EOL) OVA based connect componentSaviynt OVA based Connect
- CVE-2025-25228Extension - virtuemart.net - SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomlavirtuemart.net Virtuemart component for Joomla
- CVE-2024-41446A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a corg.opencms:opencms-core
- CVE-2024-42699Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payorg.opencms:opencms-core
- CVE-2025-28099opencms V2.3 is vulnerable to Arbitrary file read in src/main/webapp/view/admin/document/dataPage.jsp,
- CVE-2025-28102A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo
- CVE-2025-28103Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request.
- CVE-2025-28121code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" parameter allowing re
- CVE-2025-28367mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action.
- CVE-2025-32408In Soffid Console 3.6.31 before 3.6.32, authorization to use the pam service is mishandled.Soffid IAM
- CVE-2025-43916Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authoriapi.sonos.com
- CVE-2025-43970An issue was discovered in GoBGP before 3.35.0.GoBGP · github.com/osrg/gobgp +1
- CVE-2025-43972An issue was discovered in GoBGP before 3.35.0.GoBGP · github.com/osrg/gobgp +1
- CVE-2025-43973An issue was discovered in GoBGP before 3.35.0.GoBGP · github.com/osrg/gobgp +1