CVEs published April 27, 2025
60 CVEs were published on April 27, 2025: 0 critical, 8 high.
- Published
- 60
- Critical
- 0
- High
- 8
- Medium
- 46
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- withstars Books-Management-System
- 7
- ZTE GoldenDB
- 7
- PHPGurukul COVID19 Testing Management System
- 5
- TOTOLINK N150RT
- 5
- NASA CryptoLib
- 4
- itwanger paicoding
- 3
- SIOS Technology Quick Agent
- 3
- Apereo CAS · org.apereo.cas:cas-management-webapp-support
- 2
- checkpoint Check Point Mobile Access
- 2
- codeprojects News Publishing Site Dashboard
- 2
High 8
- CVE-2025-26692Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal').SIOS Technology Quick Agent
- CVE-2025-3991TOTOLINK N150RT formWdsEncrypt buffer overflowTOTOLINK N150RT
- CVE-2025-3990TOTOLINK N150RT formVlan buffer overflowTOTOLINK N150RT
- CVE-2025-3989TOTOLINK N150RT formStaticDHCP buffer overflowTOTOLINK N150RT
- CVE-2025-3988TOTOLINK N150RT formPortFw buffer overflowTOTOLINK N150RT
- CVE-2025-46580ZTE GoldenDB Database product has a code-related vulnerabilityZTE GoldenDB
- CVE-2025-46579ZTE GoldenDB Database product has a DDE injection vulnerabilityZTE GoldenDB
- CVE-2025-46657Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI.Karazal
Medium, low and unrated 52
- CVE-2025-31144Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints.SIOS Technology Quick Agent
- CVE-2025-27937Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal').SIOS Technology Quick Agent
- CVE-2025-3987TOTOLINK N150RT formWsc command injectionTOTOLINK N150RT
- CVE-2025-3986Apereo CAS CasConfigurationMetadataServerController.java redosApereo CAS · org.apereo.cas:cas-server-core-configuration-m…
- CVE-2025-3985Apereo CAS ResponseEntity redosApereo CAS · org.apereo.cas:cas-management-webapp-support
- CVE-2025-3984Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injectionApereo CAS · org.apereo.cas:cas-management-webapp-support
- CVE-2025-3983AMTT Hotel Broadband Operation System nlog_down.php command injectionAMTT Hotel Broadband Operation System
- CVE-2025-2866PDF signature forgery with adbe.pkcs7.sha1 SubFilterThe Document Foundation LibreOffice
- CVE-2025-3982nortikin Sverchok Set Property Mk2 Node getsetprop_mk2.py SvSetPropNodeMK2 prototype pollutionnortikin Sverchok
- CVE-2025-3981wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System details improper authorizationwowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System
- CVE-2025-3980wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System list improper authorizationwowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System
- CVE-2025-3979dazhouda lecms Password Change index.php cross-site request forgerydazhouda lecms
- CVE-2025-3978dazhouda lecms user_set.htm information disclosuredazhouda lecms
- CVE-2025-3977iteachyou Dreamer CMS Attachment download improper authorizationiteachyou Dreamer CMS
- CVE-2025-3976PHPGurukul COVID19 Testing Management System new-user-testing.php sql injectionPHPGurukul COVID19 Testing Management System
- CVE-2025-3975ScriptAndTools eCommerce-website-in-PHP subscriber-csv.php information disclosureScriptAndTools eCommerce-website-in-PHP
- CVE-2025-3974PHPGurukul COVID19 Testing Management System edit-phlebotomist.php sql injectionPHPGurukul COVID19 Testing Management System
- CVE-2025-3973PHPGurukul COVID19 Testing Management System check_availability.php sql injectionPHPGurukul COVID19 Testing Management System
- CVE-2025-3972PHPGurukul COVID19 Testing Management System bwdates-report-result.php sql injectionPHPGurukul COVID19 Testing Management System
- CVE-2025-3971PHPGurukul COVID19 Testing Management System add-phlebotomist.php sql injectionPHPGurukul COVID19 Testing Management System
- CVE-2025-3970baseweb JSite save cross site scriptingbaseweb JSite
- CVE-2025-3969codeprojects News Publishing Site Dashboard Edit Category Page edit-category.php unrestricted uploadcodeprojects News Publishing Site Dashboard
- CVE-2025-3968codeprojects News Publishing Site Dashboard api.php sql injectioncodeprojects News Publishing Site Dashboard
- CVE-2025-3886CatoNetworks CatoClient up to 5.8 PrivilegedHelperTool Race ConditionCato Networks SDP Client
- CVE-2025-3967itwanger paicoding Article post improper authorizationitwanger paicoding
- CVE-2025-3966itwanger paicoding Browsing History home information disclosureitwanger paicoding
- CVE-2025-3965itwanger paicoding post cross site scriptingitwanger paicoding
- CVE-2025-3964withstars Books-Management-System Article del cross-site request forgerywithstars Books-Management-System
- CVE-2024-52888Stored-XSScheckpoint Check Point Mobile Access
- CVE-2024-52887Self-XSScheckpoint Check Point Mobile Access
- CVE-2025-3963withstars Books-Management-System Background Interface list authorizationwithstars Books-Management-System
- CVE-2025-3962withstars Books-Management-System Comment add cross site scriptingwithstars Books-Management-System
- CVE-2025-3961withstars Books-Management-System do cross site scriptingwithstars Books-Management-System
- CVE-2025-3960withstars Books-Management-System Background Interface allreaders.html authorizationwithstars Books-Management-System
- CVE-2025-3959withstars Books-Management-System reader_delete.html cross-site request forgerywithstars Books-Management-System
- CVE-2025-3958withstars Books-Management-System Book Edit Page book_edit_do.html cross site scriptingwithstars Books-Management-System
- CVE-2025-3957opplus springboot-admin SysLogDao.xml sql injectionopplus springboot-admin
- CVE-2025-3956201206030 novel-cloud BookInfoMapper.xml RestResp sql injection201206030 novel-cloud
- CVE-2025-46578ZTE GoldenDB Database product has SQL injection vulnerabilities in multiple interfacesZTE GoldenDB
- CVE-2025-46577ZTE GoldenDB Database product has an SQL injection vulnerabilityZTE GoldenDB
- CVE-2025-46576ZTE GoldenDB Database product has a privilege escalation vulnerabilityZTE GoldenDB
- CVE-2025-46575ZTE GoldenDB Database product has an information disclosure vulnerabilityZTE GoldenDB
- CVE-2025-46574ZTE GoldenDB Database product has an input validation vulnerabilityZTE GoldenDB
- CVE-2025-3955codeprojects Patient Record Management System edit_rpatient.php.php sql injectioncodeprojects Patient Record Management System
- CVE-2025-46672NASA CryptoLib before 1.3.2 does not check the OTAR crypto function returned status, potentially leading to spacecraft hijacking.NASA CryptoLib
- CVE-2025-46673NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space DNASA CryptoLib
- CVE-2025-46674NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended for use during flight), potentially leading tNASA CryptoLib
- CVE-2025-46675In NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking.NASA CryptoLib
- CVE-2025-46687quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow.QuickJS Project QuickJS
- CVE-2025-46688quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow.QuickJS Project QuickJS
- CVE-2025-46689Ververica Platform 2.14.0 contain an Reflected XSS vulnerability via a namespaces/default/formats URI.Ververica Platform
- CVE-2025-46690Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request.Ververica Platform