# CVEs published 2025-04-27

60 CVEs were published on April 27, 2025: 0 critical, 8 high. Days are UTC.

- [CVE-2025-31144](https://cve.now/CVE-2025-31144.md): Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. (CVSS 5.8, SIOS Technology Quick Agent)
- [CVE-2025-27937](https://cve.now/CVE-2025-27937.md): Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). (CVSS 6.5, SIOS Technology Quick Agent)
- [CVE-2025-26692](https://cve.now/CVE-2025-26692.md): Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). (CVSS 8.1, SIOS Technology Quick Agent)
- [CVE-2025-3991](https://cve.now/CVE-2025-3991.md): TOTOLINK N150RT formWdsEncrypt buffer overflow (CVSS 8.7, TOTOLINK N150RT)
- [CVE-2025-3990](https://cve.now/CVE-2025-3990.md): TOTOLINK N150RT formVlan buffer overflow (CVSS 8.7, TOTOLINK N150RT)
- [CVE-2025-3989](https://cve.now/CVE-2025-3989.md): TOTOLINK N150RT formStaticDHCP buffer overflow (CVSS 8.7, TOTOLINK N150RT)
- [CVE-2025-3988](https://cve.now/CVE-2025-3988.md): TOTOLINK N150RT formPortFw buffer overflow (CVSS 8.7, TOTOLINK N150RT)
- [CVE-2025-3987](https://cve.now/CVE-2025-3987.md): TOTOLINK N150RT formWsc command injection (CVSS 5.3, TOTOLINK N150RT)
- [CVE-2025-3986](https://cve.now/CVE-2025-3986.md): Apereo CAS CasConfigurationMetadataServerController.java redos (CVSS 5.3, Apereo CAS · org.apereo.cas:cas-server-core-configuration-m…)
- [CVE-2025-3985](https://cve.now/CVE-2025-3985.md): Apereo CAS ResponseEntity redos (CVSS 5.1, Apereo CAS · org.apereo.cas:cas-management-webapp-support)
- [CVE-2025-3984](https://cve.now/CVE-2025-3984.md): Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injection (CVSS 2.3, Apereo CAS · org.apereo.cas:cas-management-webapp-support)
- [CVE-2025-3983](https://cve.now/CVE-2025-3983.md): AMTT Hotel Broadband Operation System nlog\_down.php command injection (CVSS 5.1, AMTT Hotel Broadband Operation System)
- [CVE-2025-2866](https://cve.now/CVE-2025-2866.md): PDF signature forgery with adbe.pkcs7.sha1 SubFilter (CVSS 2.4, The Document Foundation LibreOffice)
- [CVE-2025-3982](https://cve.now/CVE-2025-3982.md): nortikin Sverchok Set Property Mk2 Node getsetprop\_mk2.py SvSetPropNodeMK2 prototype pollution (CVSS 5.3, nortikin Sverchok)
- [CVE-2025-3981](https://cve.now/CVE-2025-3981.md): wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System details improper authorization (CVSS 5.3, wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System)
- [CVE-2025-3980](https://cve.now/CVE-2025-3980.md): wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System list improper authorization (CVSS 5.3, wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System)
- [CVE-2025-3979](https://cve.now/CVE-2025-3979.md): dazhouda lecms Password Change index.php cross-site request forgery (CVSS 5.3, dazhouda lecms)
- [CVE-2025-3978](https://cve.now/CVE-2025-3978.md): dazhouda lecms user\_set.htm information disclosure (CVSS 5.3, dazhouda lecms)
- [CVE-2025-3977](https://cve.now/CVE-2025-3977.md): iteachyou Dreamer CMS Attachment download improper authorization (CVSS 5.3, iteachyou Dreamer CMS)
- [CVE-2025-3976](https://cve.now/CVE-2025-3976.md): PHPGurukul COVID19 Testing Management System new-user-testing.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-3975](https://cve.now/CVE-2025-3975.md): ScriptAndTools eCommerce-website-in-PHP subscriber-csv.php information disclosure (CVSS 6.9, ScriptAndTools eCommerce-website-in-PHP)
- [CVE-2025-3974](https://cve.now/CVE-2025-3974.md): PHPGurukul COVID19 Testing Management System edit-phlebotomist.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-3973](https://cve.now/CVE-2025-3973.md): PHPGurukul COVID19 Testing Management System check\_availability.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-3972](https://cve.now/CVE-2025-3972.md): PHPGurukul COVID19 Testing Management System bwdates-report-result.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-3971](https://cve.now/CVE-2025-3971.md): PHPGurukul COVID19 Testing Management System add-phlebotomist.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-3970](https://cve.now/CVE-2025-3970.md): baseweb JSite save cross site scripting (CVSS 5.1, baseweb JSite)
- [CVE-2025-3969](https://cve.now/CVE-2025-3969.md): codeprojects News Publishing Site Dashboard Edit Category Page edit-category.php unrestricted upload (CVSS 5.3, codeprojects News Publishing Site Dashboard)
- [CVE-2025-3968](https://cve.now/CVE-2025-3968.md): codeprojects News Publishing Site Dashboard api.php sql injection (CVSS 5.3, codeprojects News Publishing Site Dashboard)
- [CVE-2025-3886](https://cve.now/CVE-2025-3886.md): CatoNetworks CatoClient up to 5.8 PrivilegedHelperTool Race Condition (CVSS 5.7, Cato Networks SDP Client)
- [CVE-2025-3967](https://cve.now/CVE-2025-3967.md): itwanger paicoding Article post improper authorization (CVSS 5.3, itwanger paicoding)
- [CVE-2025-3966](https://cve.now/CVE-2025-3966.md): itwanger paicoding Browsing History home information disclosure (CVSS 5.3, itwanger paicoding)
- [CVE-2025-3965](https://cve.now/CVE-2025-3965.md): itwanger paicoding post cross site scripting (CVSS 5.1, itwanger paicoding)
- [CVE-2025-3964](https://cve.now/CVE-2025-3964.md): withstars Books-Management-System Article del cross-site request forgery (CVSS 5.3, withstars Books-Management-System)
- [CVE-2024-52888](https://cve.now/CVE-2024-52888.md): Stored-XSS (CVSS 5.4, checkpoint Check Point Mobile Access)
- [CVE-2024-52887](https://cve.now/CVE-2024-52887.md): Self-XSS (CVSS 3.5, checkpoint Check Point Mobile Access)
- [CVE-2025-3963](https://cve.now/CVE-2025-3963.md): withstars Books-Management-System Background Interface list authorization (CVSS 6.9, withstars Books-Management-System)
- [CVE-2025-3962](https://cve.now/CVE-2025-3962.md): withstars Books-Management-System Comment add cross site scripting (CVSS 5.1, withstars Books-Management-System)
- [CVE-2025-3961](https://cve.now/CVE-2025-3961.md): withstars Books-Management-System do cross site scripting (CVSS 5.1, withstars Books-Management-System)
- [CVE-2025-3960](https://cve.now/CVE-2025-3960.md): withstars Books-Management-System Background Interface allreaders.html authorization (CVSS 6.9, withstars Books-Management-System)
- [CVE-2025-3959](https://cve.now/CVE-2025-3959.md): withstars Books-Management-System reader\_delete.html cross-site request forgery (CVSS 5.3, withstars Books-Management-System)
- [CVE-2025-3958](https://cve.now/CVE-2025-3958.md): withstars Books-Management-System Book Edit Page book\_edit\_do.html cross site scripting (CVSS 5.1, withstars Books-Management-System)
- [CVE-2025-3957](https://cve.now/CVE-2025-3957.md): opplus springboot-admin SysLogDao.xml sql injection (CVSS 5.3, opplus springboot-admin)
- [CVE-2025-3956](https://cve.now/CVE-2025-3956.md): 201206030 novel-cloud BookInfoMapper.xml RestResp sql injection (CVSS 5.3, 201206030 novel-cloud)
- [CVE-2025-46580](https://cve.now/CVE-2025-46580.md): ZTE GoldenDB Database product has a code-related vulnerability (CVSS 7.7, ZTE GoldenDB)
- [CVE-2025-46579](https://cve.now/CVE-2025-46579.md): ZTE GoldenDB Database product has a DDE injection vulnerability (CVSS 8.4, ZTE GoldenDB)
- [CVE-2025-46578](https://cve.now/CVE-2025-46578.md): ZTE GoldenDB Database product has SQL injection vulnerabilities in multiple interfaces (CVSS 6.5, ZTE GoldenDB)
- [CVE-2025-46577](https://cve.now/CVE-2025-46577.md): ZTE GoldenDB Database product has an SQL injection vulnerability (CVSS 6.5, ZTE GoldenDB)
- [CVE-2025-46576](https://cve.now/CVE-2025-46576.md): ZTE GoldenDB Database product has a privilege escalation vulnerability (CVSS 5.4, ZTE GoldenDB)
- [CVE-2025-46575](https://cve.now/CVE-2025-46575.md): ZTE GoldenDB Database product has an information disclosure vulnerability (CVSS 4.9, ZTE GoldenDB)
- [CVE-2025-46574](https://cve.now/CVE-2025-46574.md): ZTE GoldenDB Database product has an input validation vulnerability (CVSS 4.1, ZTE GoldenDB)
- [CVE-2025-3955](https://cve.now/CVE-2025-3955.md): codeprojects Patient Record Management System edit\_rpatient.php.php sql injection (CVSS 5.3, codeprojects Patient Record Management System)
- [CVE-2025-46657](https://cve.now/CVE-2025-46657.md): Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI. (CVSS 7.2, Karazal)
- [CVE-2025-46672](https://cve.now/CVE-2025-46672.md): NASA CryptoLib before 1.3.2 does not check the OTAR crypto function returned status, potentially leading to spacecraft hijacking. (CVSS 3.5, NASA CryptoLib)
- [CVE-2025-46673](https://cve.now/CVE-2025-46673.md): NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space D (CVSS 4.9, NASA CryptoLib)
- [CVE-2025-46674](https://cve.now/CVE-2025-46674.md): NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended for use during flight), potentially leading t (CVSS 3.5, NASA CryptoLib)
- [CVE-2025-46675](https://cve.now/CVE-2025-46675.md): In NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking. (CVSS 3.5, NASA CryptoLib)
- [CVE-2025-46687](https://cve.now/CVE-2025-46687.md): quickjs-ng through 0.9.0 has a missing length check in JS\_ReadString for a string, leading to a heap-based buffer overflow. (CVSS 5.6, QuickJS Project QuickJS)
- [CVE-2025-46688](https://cve.now/CVE-2025-46688.md): quickjs-ng through 0.9.0 has an incorrect size calculation in JS\_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. (CVSS 5.6, QuickJS Project QuickJS)
- [CVE-2025-46689](https://cve.now/CVE-2025-46689.md): Ververica Platform 2.14.0 contain an Reflected XSS vulnerability via a namespaces/default/formats URI. (CVSS 5.4, Ververica Platform)
- [CVE-2025-46690](https://cve.now/CVE-2025-46690.md): Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request. (CVSS 5.0, Ververica Platform)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.