# CVEs published 2025-04-25

78 CVEs were published on April 25, 2025: 6 critical, 25 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2025-46333](https://cve.now/CVE-2025-46333.md): z2d OOB composition could lead to invalid memory access and corruption (CVSS 7.3, vancluever z2d)
- [CVE-2025-3935](https://cve.now/CVE-2025-3935.md): ScreenConnect Exposure to ASP.NET ViewState Code Injection (CVSS 8.1, KEV, ConnectWise ScreenConnect)
- [CVE-2024-30152](https://cve.now/CVE-2024-30152.md): HCL SX is affected by usage of a weak cryptographic algorithm (CVSS 6.5, HCL Software HCL SX)
- [CVE-2025-3928](https://cve.now/CVE-2025-3928.md): Commvault Web Server unspecified vulnerability (CVSS 8.8, KEV, Commvault Web Server)
- [CVE-2025-2070](https://cve.now/CVE-2025-2070.md): An improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary file reads on the system if a crafted url (CVSS 5.1, FileZ Client)
- [CVE-2025-2069](https://cve.now/CVE-2025-2069.md): A cross-site scripting vulnerability was reported in the FileZ client that could allow execution of code if a crafted url is visited by a lo (CVSS 5.1, FileZ Client)
- [CVE-2025-2068](https://cve.now/CVE-2025-2068.md): An open redirect vulnerability was reported in the FileZ client that could allow information disclosure if a crafted url is visited by a loc (CVSS 5.1, FileZ Client)
- [CVE-2024-56156](https://cve.now/CVE-2024-56156.md): Halo Vulnerable to Stored XSS and RCE via File Upload Bypass (CVSS 5.5, halo-dev halo)
- [CVE-2025-43862](https://cve.now/CVE-2025-43862.md): Dify Allows Unauthorized Access and Modification of APP Orchestration (CVSS 7.6, langgenius dify)
- [CVE-2025-32432](https://cve.now/CVE-2025-32432.md): Craft CMS Allows Remote Code Execution (CVSS 10.0, KEV, craftcms cms · craftcms/cms)
- [CVE-2025-32045](https://cve.now/CVE-2025-32045.md): Moodle: hidden grades shown to users without permission on some grade reports (CVSS 5.3, moodle · moodle/moodle)
- [CVE-2025-32044](https://cve.now/CVE-2025-32044.md): Moodle: unauthenticated rest api user data exposure (CVSS 7.5, moodle · moodle/moodle)
- [CVE-2025-3647](https://cve.now/CVE-2025-3647.md): Moodle: idor when accessing the cohorts report (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2025-3645](https://cve.now/CVE-2025-3645.md): Moodle: idor in messaging web service allows access to some user details (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2025-3644](https://cve.now/CVE-2025-3644.md): Moodle: ajax section delete does not respect course\_can\_delete\_section() (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2025-3643](https://cve.now/CVE-2025-3643.md): Moodle: reflected xss risk in policy tool (CVSS 5.4, moodle · moodle/moodle)
- [CVE-2025-3642](https://cve.now/CVE-2025-3642.md): Moodle: authenticated remote code execution risk in the moodle lms equella repository (CVSS 8.8, moodle · moodle/moodle)
- [CVE-2025-3641](https://cve.now/CVE-2025-3641.md): Moodle: authenticated remote code execution risk in the moodle lms dropbox repository (CVSS 8.8, moodle · moodle/moodle)
- [CVE-2025-3640](https://cve.now/CVE-2025-3640.md): Moodle: idor in web service allows users enrolled in a course to access some details of other users (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2025-3638](https://cve.now/CVE-2025-3638.md): Moodle: csrf risk in brickfield tool's analysis request action (CVSS 8.8, moodle · moodle/moodle)
- [CVE-2025-3637](https://cve.now/CVE-2025-3637.md): Moodle: csrf token exposure via url in moodle mod\_data module (CVSS 3.1, moodle · moodle/moodle)
- [CVE-2025-3636](https://cve.now/CVE-2025-3636.md): Moodle: idor in moodle rss block allows unauthorized access to rss feeds (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2025-3635](https://cve.now/CVE-2025-3635.md): Moodle: csrf risk in moodle user tours manager allows tour duplication (CVSS 3.5, moodle · moodle/moodle)
- [CVE-2025-3628](https://cve.now/CVE-2025-3628.md): Moodle: moodle assignment submission search leaks anonymous student identities (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2025-3627](https://cve.now/CVE-2025-3627.md): Moodle: partial data exposure in moodle before completing multi-factor authentication (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2025-3625](https://cve.now/CVE-2025-3625.md): Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action (CVSS 7.1, moodle)
- [CVE-2025-46618](https://cve.now/CVE-2025-46618.md): In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab (CVSS 3.5, JetBrains TeamCity)
- [CVE-2025-46433](https://cve.now/CVE-2025-46433.md): In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible (CVSS 4.9, JetBrains TeamCity)
- [CVE-2025-46432](https://cve.now/CVE-2025-46432.md): In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs (CVSS 4.3, JetBrains TeamCity)
- [CVE-2025-43016](https://cve.now/CVE-2025-43016.md): In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session (CVSS 5.4, JetBrains Rider)
- [CVE-2025-3634](https://cve.now/CVE-2025-3634.md): Moodle: moodle allows course self-enrolment before completing mfa (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2024-6199](https://cve.now/CVE-2024-6199.md): Unauthenticated Remote Code Execution (CVSS 7.7, ViaSat RM5110 · ViaSat RM5111 +3)
- [CVE-2024-6198](https://cve.now/CVE-2024-6198.md): SNORE Interface Unauthenticated Remote Code Execution (CVSS 7.7, ViaSat RM4100 · Viasat RM4200 +7)
- [CVE-2025-2470](https://cve.now/CVE-2025-2470.md): Service Finder Bookings \<= 5.1 - Unauthenticated Privilege Escalation via 'nsl\_registration\_store\_extra\_input' (CVSS 9.8, aonetheme Service Finder Bookings)
- [CVE-2024-11917](https://cve.now/CVE-2024-11917.md): JobSearch WP Job Board \<= 2.9.2 - Authentication Bypass via Social Logins (CVSS 8.1, eyecix JobSearch WP Job Board)
- [CVE-2025-3912](https://cve.now/CVE-2025-3912.md): WS Form LITE – Drag & Drop Contact Form Builder for WordPress \<= 1.10.35 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 5.3, westguard WS Form LITE – Drag & Drop Contact Form Builder)
- [CVE-2025-2986](https://cve.now/CVE-2025-2986.md): IBM Maximo Asset Management cross-site scripting (CVSS 5.5, IBM Maximo Asset Management)
- [CVE-2025-1565](https://cve.now/CVE-2025-1565.md): Mayosis Core \<= 5.4.1 - Unauthenticated Arbitrary File Read (CVSS 7.5, TeconceTheme Mayosis Core)
- [CVE-2025-1279](https://cve.now/CVE-2025-1279.md): BM Content Builder \<= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, SeaTheme BM Content Builder)
- [CVE-2025-3870](https://cve.now/CVE-2025-3870.md): 1 Decembrie 1918 \<= 1.dec.2012 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, olarmarius 1 Decembrie)
- [CVE-2025-46535](https://cve.now/CVE-2025-46535.md): WordPress Custom Login and Registration plugin \<= 1.0.0 - Broken Access Control vulnerability (CVSS 5.4, AlphaEfficiencyTeam Custom Login and Registration)
- [CVE-2025-46482](https://cve.now/CVE-2025-46482.md): WordPress WP Quiz plugin \<= 2.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MyThemeShop WP Quiz)
- [CVE-2025-3743](https://cve.now/CVE-2025-3743.md): Upsell Funnel Builder for WooCommerce \<= 3.0.0 - Unauthenticated Order Manipulation (CVSS 5.3, wpswings Upsell Funnel Builder for WooCommerce – Create Ups…)
- [CVE-2025-2238](https://cve.now/CVE-2025-2238.md): Vikinger \<= 1.9.30 - Authenticated (Subscriber+) Privilege Escalation via 'vikinger\_user\_meta\_update\_ajax' (CVSS 8.8, Odin\_Design Vikinger)
- [CVE-2025-3868](https://cve.now/CVE-2025-3868.md): Custom Admin-Bar Favorites \<= 0.1 - Reflected Cross-Site Scripting (CVSS 6.1, codeandreload Custom Admin-Bar Favorites)
- [CVE-2025-3867](https://cve.now/CVE-2025-3867.md): Ajax Comment Form CST \<= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, rafe007 Ajax Comment Form CST)
- [CVE-2025-3866](https://cve.now/CVE-2025-3866.md): Add Google +1 (Plus one) social share Button \<= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, rohanpawale Add Google +1 (Plus one) social share Button)
- [CVE-2025-0671](https://cve.now/CVE-2025-0671.md): Email Subscribers \< 5.7.50 - Admin+ Stored XSS in Template (CVSS 6.1, Icegram Express)
- [CVE-2025-3923](https://cve.now/CVE-2025-3923.md): Prevent Direct Access – Protect WordPress Files \<= 2.8.8 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, buildwps Prevent Direct Access – Protect WordPress Files)
- [CVE-2025-3861](https://cve.now/CVE-2025-3861.md): Prevent Direct Access 2.8.6 - 2.8.8.2 - Incorrect Authorization to Authenticated (Contributor+) Multiple Media Actions (CVSS 5.4, buildwps Prevent Direct Access – Protect WordPress Files)
- [CVE-2025-2580](https://cve.now/CVE-2025-2580.md): Contact Form by Bit Form \<= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 4.9, bitpressadmin Bit Form – Custom Contact Form, Multi Step, C…)
- [CVE-2025-3511](https://cve.now/CVE-2025-3511.md): Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-Lin (CVSS 7.5, Mitsubishi Electric CC-Link IE TSN Remote I/O module NZ… +47)
- [CVE-2025-3752](https://cve.now/CVE-2025-3752.md): Able Player, accessible HTML5 media player \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload Parameter (CVSS 6.4, joedolson Able Player, accessible HTML5 media player)
- [CVE-2025-3775](https://cve.now/CVE-2025-3775.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) \<= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter (CVSS 6.5, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2025-43865](https://cve.now/CVE-2025-43865.md): React Router allows pre-render data spoofing on React-Router framework mode (CVSS 8.2, remix-run react-router · react-router)
- [CVE-2025-43864](https://cve.now/CVE-2025-43864.md): React Router allows a DoS via cache poisoning by forcing SPA mode (CVSS 7.5, remix-run react-router · react-router)
- [CVE-2024-57375](https://cve.now/CVE-2024-57375.md): Andamiro Pump It Up 20th Anniversary (aka Double X or XX/2019) 1.00.0-2.08.3 allows a physically proximate attacker to cause a denial of ser (CVSS 2.4, Andamiro Pump It Up)
- [CVE-2025-25775](https://cve.now/CVE-2025-25775.md): Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder. (CVSS 9.8)
- [CVE-2025-28076](https://cve.now/CVE-2025-28076.md): Multiple SQL injection vulnerabilities in EasyVirt DCScope \<= 8.6.4 and CO2Scope \<= 1.3.4 allows remote authenticated attackers to execute a (CVSS 6.5)
- [CVE-2025-28128](https://cve.now/CVE-2025-28128.md): An issue in Mytel Telecom Online Account System v1.0 allows attackers to bypass the OTP verification process via a crafted request. (CVSS 7.0)
- [CVE-2025-28354](https://cve.now/CVE-2025-28354.md): An issue in the Printer Manager Systm of Entrust Corp Printer Manager D3.18.4-3 and below allows attackers to execute a directory traversal (CVSS 6.5)
- [CVE-2025-32979](https://cve.now/CVE-2025-32979.md): NETSCOUT nGeniusONE before 6.4.0 b2350 allows Arbitrary File Creation by authenticated users. (CVSS 6.5)
- [CVE-2025-32980](https://cve.now/CVE-2025-32980.md): NETSCOUT nGeniusONE before 6.4.0 P11 b3245 has a Weak Sudo Configuration. (CVSS 9.8)
- [CVE-2025-32981](https://cve.now/CVE-2025-32981.md): NETSCOUT nGeniusONE before 6.4.0 b2350 allows local users to leverage Insecure Permissions for the nGeniusCLI File. (CVSS 7.1)
- [CVE-2025-32982](https://cve.now/CVE-2025-32982.md): NETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module. (CVSS 7.5)
- [CVE-2025-32983](https://cve.now/CVE-2025-32983.md): NETSCOUT nGeniusONE before 6.4.0 b2350 allows Technical Information Disclosure via a Stack Trace. (CVSS 7.5)
- [CVE-2025-32984](https://cve.now/CVE-2025-32984.md): NETSCOUT nGeniusONE before 6.4.0 b2350 allows Stored Cross-Site Scripting (XSS) via a certain POST parameter. (CVSS 6.1)
- [CVE-2025-32985](https://cve.now/CVE-2025-32985.md): NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files. (CVSS 9.8)
- [CVE-2025-32986](https://cve.now/CVE-2025-32986.md): NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint. (CVSS 7.5)
- [CVE-2025-46544](https://cve.now/CVE-2025-46544.md): In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles. (CVSS 6.4, Sherpa Orchestrator)
- [CVE-2025-46545](https://cve.now/CVE-2025-46545.md): In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through t (CVSS 4.4, Sherpa Orchestrator)
- [CVE-2025-46546](https://cve.now/CVE-2025-46546.md): In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. (CVSS 3.5, Sherpa Orchestrator)
- [CVE-2025-46547](https://cve.now/CVE-2025-46547.md): In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting X (CVSS 5.4, Sherpa Orchestrator)
- [CVE-2025-46595](https://cve.now/CVE-2025-46595.md): An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. (CVSS 6.4, backdropcms Flag)
- [CVE-2025-46599](https://cve.now/CVE-2025-46599.md): CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, (CVSS 6.8, K3s · github.com/k3s-io/k3s)
- [CVE-2025-46613](https://cve.now/CVE-2025-46613.md): OpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after the parent stack fr (CVSS 7.5, openplcproject OpenPLC)
- [CVE-2025-46616](https://cve.now/CVE-2025-46616.md): Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file. (CVSS 9.9, Quantum StorNext)
- [CVE-2025-46617](https://cve.now/CVE-2025-46617.md): Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software co (CVSS 7.2, Quantum StorNext)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.