# CVEs published 2025-04-21 45 CVEs were published on April 21, 2025: 6 critical, 9 high. Days are UTC. - [CVE-2025-3849](https://cve.now/CVE-2025-3849.md): YXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password change (CVSS 5.3, YXJ2018 SpringBoot-Vue-OnlineExam) - [CVE-2025-2987](https://cve.now/CVE-2025-2987.md): IBM Maximo Asset Management server-side request forgery (CVSS 3.8, IBM Maximo Asset Management) - [CVE-2025-3847](https://cve.now/CVE-2025-3847.md): markparticle WebServer Login httprequest.cpp sql injection (CVSS 6.9, markparticle WebServer) - [CVE-2025-3846](https://cve.now/CVE-2025-3846.md): markparticle WebServer Registration httprequest.cpp sql injection (CVSS 6.9, markparticle WebServer) - [CVE-2025-3845](https://cve.now/CVE-2025-3845.md): markparticle WebServer buffer.cpp HasWritten buffer overflow (CVSS 6.9, markparticle WebServer) - [CVE-2025-3843](https://cve.now/CVE-2025-3843.md): panhainan DS-Java cross-site request forgery (CVSS 5.3, panhainan DS-Java) - [CVE-2025-32955](https://cve.now/CVE-2025-32955.md): Harden-Runner Evasion of 'disable-sudo' policy (CVSS 6.0, step-security harden-runner) - [CVE-2025-32956](https://cve.now/CVE-2025-32956.md): ManageWiki has SQL injection vulnerability in NamespaceMigrationJob (CVSS 8.0, miraheze ManageWiki) - [CVE-2025-32958](https://cve.now/CVE-2025-32958.md): Adept exposed the GITHUB\_TOKEN in workflow run artifact (CVSS 9.8, AdeptLanguage Adept) - [CVE-2025-3842](https://cve.now/CVE-2025-3842.md): panhainan DS-Java FileUpload.java uploadUserPic.action code injection (CVSS 5.3, panhainan DS-Java) - [CVE-2025-3841](https://cve.now/CVE-2025-3841.md): wix-incubator jam Jinja2 Template jam.py special elements used in a template engine (CVSS 4.8, wix-incubator jam) - [CVE-2025-27086](https://cve.now/CVE-2025-27086.md): A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication. (CVSS 8.1, Hewlett Packard Enterprise HPE Performance Cluster Manager) - [CVE-2025-23174](https://cve.now/CVE-2025-23174.md): Yoel Geva - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 7.5, Yoel Geva Android App) - [CVE-2025-32793](https://cve.now/CVE-2025-32793.md): Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters (CVSS 4.0, cilium · github.com/cilium/cilium) - [CVE-2025-32431](https://cve.now/CVE-2025-32431.md): Traefik has a possible vulnerability with the path matchers (CVSS 8.8, traefik · github.com/traefik/traefik +2) - [CVE-2024-12543](https://cve.now/CVE-2024-12543.md): A user enumeration and subsequent data integrity vulnerability affecting barcode functionality (CVSS 5.9, OpenText Content Management) - [CVE-2025-3857](https://cve.now/CVE-2025-3857.md): Infinite loop condition in Amazon.IonDotnet (CVSS 8.7, Amazon Ion Dotnet · Amazon.IonDotnet) - [CVE-2024-12863](https://cve.now/CVE-2024-12863.md): Stored XSS in Discussions functionality (CVSS 5.6, OpenText Content Management) - [CVE-2025-2298](https://cve.now/CVE-2025-2298.md): Authenticated API Endpoint Allows Arbitrary File Deletion in Dremio Software (CVSS 8.4, Dremio Software) - [CVE-2025-2517](https://cve.now/CVE-2025-2517.md): Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager (CVSS 2.3, OpenText ArcSight Enterprise Security Manager) - [CVE-2024-12862](https://cve.now/CVE-2024-12862.md): REST API allows users without permissions to remove external collaborators (CVSS 5.5, OpenText Content Server) - [CVE-2025-3840](https://cve.now/CVE-2025-3840.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 2.1, Saviynt OVA based Connect) - [CVE-2025-3838](https://cve.now/CVE-2025-3838.md): Improper Authorization in the installer for the EOL OVA based connect component (CVSS 6.1, Saviynt OVA based Connect) - [CVE-2025-3837](https://cve.now/CVE-2025-3837.md): Improper Input Validation vulnerability in the End of Life (EOL) OVA based connect component (CVSS 6.1, Saviynt OVA based Connect) - [CVE-2025-25228](https://cve.now/CVE-2025-25228.md): Extension - virtuemart.net - SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla (CVSS 3.8, virtuemart.net Virtuemart component for Joomla) - [CVE-2025-0632](https://cve.now/CVE-2025-0632.md): Local File Inclusion (LFI) leading to sensitive data exposure (CVSS 9.2, Formulatrix Rock Maker Web) - [CVE-2024-41446](https://cve.now/CVE-2024-41446.md): A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a c (CVSS 5.4, org.opencms:opencms-core) - [CVE-2024-42699](https://cve.now/CVE-2024-42699.md): Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript pay (CVSS 6.5, org.opencms:opencms-core) - [CVE-2024-57394](https://cve.now/CVE-2024-57394.md): The quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0 allows user to restore a malicious file to (CVSS 8.8) - [CVE-2025-28099](https://cve.now/CVE-2025-28099.md): opencms V2.3 is vulnerable to Arbitrary file read in src/main/webapp/view/admin/document/dataPage.jsp, (CVSS 4.3) - [CVE-2025-28102](https://cve.now/CVE-2025-28102.md): A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo (CVSS 6.1) - [CVE-2025-28103](https://cve.now/CVE-2025-28103.md): Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request. (CVSS 6.4) - [CVE-2025-28104](https://cve.now/CVE-2025-28104.md): Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input. (CVSS 9.1) - [CVE-2025-28121](https://cve.now/CVE-2025-28121.md): code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" parameter allowing re (CVSS 6.1) - [CVE-2025-28367](https://cve.now/CVE-2025-28367.md): mojoPortal \<=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. (CVSS 6.5) - [CVE-2025-29287](https://cve.now/CVE-2025-29287.md): An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a cr (CVSS 9.8, net.mingsoft:ms-mcms) - [CVE-2025-29659](https://cve.now/CVE-2025-29659.md): Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd\_listen" function located in the "cmd" binary. (CVSS 9.8) - [CVE-2025-29660](https://cve.now/CVE-2025-29660.md): A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789. (CVSS 9.8) - [CVE-2025-32408](https://cve.now/CVE-2025-32408.md): In Soffid Console 3.6.31 before 3.6.32, authorization to use the pam service is mishandled. (CVSS 2.5, Soffid IAM) - [CVE-2025-43916](https://cve.now/CVE-2025-43916.md): Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect\_uri containing userinfo in the authori (CVSS 3.4, api.sonos.com) - [CVE-2025-43922](https://cve.now/CVE-2025-43922.md): The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to S (CVSS 8.1, FileWave) - [CVE-2025-43970](https://cve.now/CVE-2025-43970.md): An issue was discovered in GoBGP before 3.35.0. (CVSS 4.3, GoBGP · github.com/osrg/gobgp +1) - [CVE-2025-43971](https://cve.now/CVE-2025-43971.md): An issue was discovered in GoBGP before 3.35.0. (CVSS 8.6, GoBGP · github.com/osrg/gobgp/v3 +1) - [CVE-2025-43972](https://cve.now/CVE-2025-43972.md): An issue was discovered in GoBGP before 3.35.0. (CVSS 6.8, GoBGP · github.com/osrg/gobgp +1) - [CVE-2025-43973](https://cve.now/CVE-2025-43973.md): An issue was discovered in GoBGP before 3.35.0. (CVSS 6.8, GoBGP · github.com/osrg/gobgp +1) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-04-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.