CVEs published April 28, 2025
88 CVEs were published on April 28, 2025: 7 critical, 12 high.
- Published
- 88
- Critical
- 7
- High
- 12
- Medium
- 54
- Low
- 15
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- 20120630 Novel-Plus
- 5
- TOTOLINK N150RT
- 5
- DevExpress
- 4
- PHPGurukul COVID19 Testing Management System
- 4
- GFI MailEssentials
- 3
- itsourcecode Placement Management System
- 3
- Apache Software Foundation Apache Tomcat · org.apache.to… +1
- 2
- Dell PowerProtect Data Manager
- 2
- PHPGurukul Art Gallery Management System
- 2
- PHPGurukul Nipah Virus Testing Management System
- 2
Critical 7
- CVE-2025-31651Apache Tomcat: Bypass of rules in Rewrite ValveApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2025-3200Com-Server Exposed via Weak TLSWiesemann & Theis Com-Server++ · Wiesemann & Theis Com-S… +3
- CVE-2015-2079Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not thrUsermin
- CVE-2025-45947An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/change-password.php fil
- CVE-2025-45949A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-passwo
- CVE-2025-45953A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Pass
- CVE-2025-46661IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide teIPW Metazo
High 12
- CVE-2025-3224Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory DeletionDocker Desktop
- CVE-2025-34491GFI MailEssentials < 21.8 MultiNode Insecure DeserializationGFI MailEssentials
- CVE-2025-31650Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frameApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2025-34489GFI MailEssentials < 21.8 Local Privilege EscalationGFI MailEssentials
- CVE-2025-23375Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability.Dell PowerProtect Data Manager
- CVE-2025-32470Unauthenticated change of IP adressSICK AG SICK FLX0-GPNT100 · SICK AG SICK FLX3-CPUC200
- CVE-2025-42598Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a lSEIKO EPSON printer drivers for Windows OS
- CVE-2025-4007Tenda W12/i24 httpd modules cgidhcpsCfgSet stack-based overflowTenda W12 · Tenda i24
- CVE-2025-22235Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposedSpring Boot · org.springframework.boot:spring-boot
- CVE-2025-3993TOTOLINK N150RT formWsc buffer overflowTOTOLINK N150RT
- CVE-2025-3992TOTOLINK N150RT formWlwds buffer overflowTOTOLINK N150RT
- CVE-2015-4582The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS.TheCartPress boot-store
Medium, low and unrated 69
- CVE-2025-46328NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration filesnowflakedb snowflake-connector-nodejs · snowflake-sdk
- CVE-2025-46327Go Snowflake Driver has race condition when checking access to Easy Logging configuration filesnowflakedb gosnowflake · github.com/snowflakedb/gosnowflake
- CVE-2025-46326Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration filesnowflakedb snowflake-connector-net · Snowflake.Data
- CVE-2025-4039PHPGurukul Rail Pass Management System search-pass.php sql injectionPHPGurukul Rail Pass Management System
- CVE-2025-4038code-projects Train Ticket Reservation System reservation stack-based overflowcode-projects Train Ticket Reservation System
- CVE-2024-11922Input Validation vulnerability in Web Client emails that do not go through Secure MailFortra GoAnywhere MFT
- CVE-2025-0049Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0Fortra GoAnywhere
- CVE-2024-10635Enterprise Protection S/MIME Opaque Signature Attachment Scanning BypassProofpoint Enterprise Protection
- CVE-2025-4037code-projects ATM Banking moneyWithdraw logic errorcode-projects ATM Banking
- CVE-2025-4036201206030 Novel Chapter AuthorController.java updateBookChapter access control201206030 Novel
- CVE-2025-4034projectworlds Online Examination System inser_doc_process.php sql injectionprojectworlds Online Examination System
- CVE-2025-34490GFI MailEssentials < 21.8 XXE Arbitrary File ReadGFI MailEssentials
- CVE-2025-4033PHPGurukul Nipah Virus Testing Management System patient-search-report.php sql injectionPHPGurukul Nipah Virus Testing Management System
- CVE-2025-4032inclusionAI AWorld shell_tool.py subprocess.Popen os command injectioninclusionAI AWorld · aworld
- CVE-2025-4031PHPGurukul Pre-School Enrollment System aboutus.php sql injectionPHPGurukul Pre-School Enrollment System
- CVE-2024-12706SQL Injection vulnerability discovered in OpenText™ Digital Asset Management.OpenText™ Digital Asset Management.
- CVE-2025-4030PHPGurukul COVID19 Testing Management System search-report-result.php sql injectionPHPGurukul COVID19 Testing Management System
- CVE-2025-4029code-projects Personal Diary Management System New Record addrecord stack-based overflowcode-projects Personal Diary Management System
- CVE-2025-4028PHPGurukul COVID19 Testing Management System profile.php sql injectionPHPGurukul COVID19 Testing Management System
- CVE-2025-43857net-imap rubygem vulnerable to possible DoS by memory exhaustionruby net-imap · net-imap
- CVE-2025-4027PHPGurukul Old Age Home Management System rules.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-43854DIFY vulnerable to Clickjacking Attacklanggenius dify
- CVE-2025-4026PHPGurukul Nipah Virus Testing Management System profile.php sql injectionPHPGurukul Nipah Virus Testing Management System
- CVE-2025-4025itsourcecode Placement Management System registration.php sql injectionitsourcecode Placement Management System
- CVE-2025-23377Dell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability.Dell PowerProtect Data Manager
- CVE-2025-23376Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in Dell PowerProtect Data Manager Reporting
- CVE-2025-4024itsourcecode Placement Management System add_drive.php sql injectionitsourcecode Placement Management System
- CVE-2025-4023itsourcecode Placement Management System add_company.php sql injectionitsourcecode Placement Management System
- CVE-2025-4022web-arena-x webarena evaluators.py HTMLContentEvaluator code injectionweb-arena-x webarena
- CVE-2025-4021code-projects Patient Record Management System edit_spatient.php sql injectioncode-projects Patient Record Management System
- CVE-2025-4020PHPGurukul Old Age Home Management System contact.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-32472DoS attack by conducting a slowloris-type attackSICK AG SICK multiScan1XX · SICK AG SICK picoScan1XX
- CVE-2025-401920120630 Novel-Plus GeneratorController.java genCode missing authentication20120630 Novel-Plus
- CVE-2025-401820120630 Novel-Plus CrawlController.java addCrawlSource missing authentication20120630 Novel-Plus
- CVE-2025-401720120630 Novel-Plus LogController.java list improper authorization20120630 Novel-Plus
- CVE-2025-401620120630 Novel-Plus LogController.java deleteIndex improper authorization20120630 Novel-Plus
- CVE-2025-401520120630 Novel-Plus SessionController.java list missing authentication20120630 Novel-Plus
- CVE-2025-4014PHPGurukul Art Gallery Management System manage-art-medium.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-32471Reuse of saltSICK AG SICK FLX3-CPUC200 · SICK AG TDC-X401GL
- CVE-2025-39367WordPress Kleo theme < 5.4.4 - Broken Access Control vulnerabilitySeventhQueen Kleo
- CVE-2025-4013PHPGurukul Art Gallery Management System aboutus.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-4012playeduxyz PlayEdu 开源培训系统 User Avatar create server-side request forgeryplayeduxyz PlayEdu 开源培训系统
- CVE-2025-4011Redmine Custom Query cross site scriptingRedmine
- CVE-2025-4006youyiio BeyongCms Document Management Page Upload.html unrestricted uploadyouyiio BeyongCms
- CVE-2025-4005PHPGurukul COVID19 Testing Management System patient-report.php sql injectionPHPGurukul COVID19 Testing Management System
- CVE-2025-4004PHPGurukul COVID19 Testing Management System password-recovery.php sql injectionPHPGurukul COVID19 Testing Management System
- CVE-2025-0627AI Autotagger < 3.30.0 - Admin+ Stored XSSWordPress Tag, Category, and Taxonomy Manager
- CVE-2024-9771WP-Recall < 16.26.12 - Admin+ Stored XSSWP-Recall
- CVE-2024-13688Admin and Site Enhancements (ASE) < 7.6.10 - Password Protection BypassAdmin and Site Enhancements
- CVE-2025-4003RefindPlusRepo RefindPlus RP_ApfsIo.c InternalApfsTranslateBlock null pointer dereferenceRefindPlusRepo RefindPlus
- CVE-2025-4002RefindPlusRepo RefindPlus BootLog.c GetDebugLogFile null pointer dereferenceRefindPlusRepo RefindPlus
- CVE-2025-4001scipopt scip File Descriptor genRandomLOPInstance.c main file descriptor consumptionscipopt scip
- CVE-2025-4000Seeyon Zhiyuan OA Web Application System ssoproxy.jsp cross site scriptingSeeyon Zhiyuan OA Web Application System
- CVE-2025-3999Seeyon Zhiyuan OA Web Application System URL Parameter date.jsp cross site scriptingSeeyon Zhiyuan OA Web Application System
- CVE-2025-3998CodeAstro Membership Management System renew.php sql injectionCodeAstro Membership Management System
- CVE-2025-3706104 Corporation eHRMS - Reflected Cross-Site Scripting104 eHRMS
- CVE-2025-3997dazhouda lecms Personal Information Page index.php cross-site request forgerydazhouda lecms
- CVE-2025-3996TOTOLINK N150RT MAC Filtering Page home.htm cross site scriptingTOTOLINK N150RT
- CVE-2025-3995TOTOLINK N150RT LAN Settings Page fromStaticDHCP cross site scriptingTOTOLINK N150RT
- CVE-2025-3994TOTOLINK N150RT IP Port Filtering home.htm cross site scriptingTOTOLINK N150RT
- CVE-2022-41871SEPPmail through 12.1.17 allows command injection within the Admin Portal.SEPPmail
- CVE-2023-35814DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.DevExpress
- CVE-2023-35815DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.DevExpress
- CVE-2023-35816DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.DevExpress
- CVE-2023-35817DevExpress before 23.1.3 allows AsyncDownloader SSRF.DevExpress
- CVE-2023-42404OneVision Workspace before WS23.1 SR1 (build w31.040) allows arbitrary Java EL execution.OneVision Workspace
- CVE-2024-32499Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed.Newforma Project Center Server
- CVE-2025-25776Cross-Site Scripting (XSS) vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1
- CVE-2025-46614In Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL query at the INFO level, aka Insertion of SensSnowflake ODBC