# CVEs published 2025-04-28

88 CVEs were published on April 28, 2025: 7 critical, 12 high. Days are UTC.

- [CVE-2025-46328](https://cve.now/CVE-2025-46328.md): NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file (CVSS 3.3, snowflakedb snowflake-connector-nodejs · snowflake-sdk)
- [CVE-2025-46327](https://cve.now/CVE-2025-46327.md): Go Snowflake Driver has race condition when checking access to Easy Logging configuration file (CVSS 3.3, snowflakedb gosnowflake · github.com/snowflakedb/gosnowflake)
- [CVE-2025-46326](https://cve.now/CVE-2025-46326.md): Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration file (CVSS 3.3, snowflakedb snowflake-connector-net · Snowflake.Data)
- [CVE-2025-4039](https://cve.now/CVE-2025-4039.md): PHPGurukul Rail Pass Management System search-pass.php sql injection (CVSS 6.9, PHPGurukul Rail Pass Management System)
- [CVE-2025-4038](https://cve.now/CVE-2025-4038.md): code-projects Train Ticket Reservation System reservation stack-based overflow (CVSS 4.8, code-projects Train Ticket Reservation System)
- [CVE-2024-11922](https://cve.now/CVE-2024-11922.md): Input Validation vulnerability in Web Client emails that do not go through Secure Mail (CVSS 6.3, Fortra GoAnywhere MFT)
- [CVE-2025-0049](https://cve.now/CVE-2025-0049.md): Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0 (CVSS 3.5, Fortra GoAnywhere)
- [CVE-2024-10635](https://cve.now/CVE-2024-10635.md): Enterprise Protection S/MIME Opaque Signature Attachment Scanning Bypass (CVSS 6.1, Proofpoint Enterprise Protection)
- [CVE-2025-4037](https://cve.now/CVE-2025-4037.md): code-projects ATM Banking moneyWithdraw logic error (CVSS 4.8, code-projects ATM Banking)
- [CVE-2025-4036](https://cve.now/CVE-2025-4036.md): 201206030 Novel Chapter AuthorController.java updateBookChapter access control (CVSS 5.3, 201206030 Novel)
- [CVE-2025-4034](https://cve.now/CVE-2025-4034.md): projectworlds Online Examination System inser\_doc\_process.php sql injection (CVSS 6.9, projectworlds Online Examination System)
- [CVE-2025-3224](https://cve.now/CVE-2025-3224.md): Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion (CVSS 7.3, Docker Desktop)
- [CVE-2025-34491](https://cve.now/CVE-2025-34491.md): GFI MailEssentials \< 21.8 MultiNode Insecure Deserialization (CVSS 8.8, GFI MailEssentials)
- [CVE-2025-31651](https://cve.now/CVE-2025-31651.md): Apache Tomcat: Bypass of rules in Rewrite Valve (CVSS 9.8, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2025-31650](https://cve.now/CVE-2025-31650.md): Apache Tomcat: DoS via malformed HTTP/2 PRIORITY\_UPDATE frame (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2025-34490](https://cve.now/CVE-2025-34490.md): GFI MailEssentials \< 21.8 XXE Arbitrary File Read (CVSS 6.5, GFI MailEssentials)
- [CVE-2025-4033](https://cve.now/CVE-2025-4033.md): PHPGurukul Nipah Virus Testing Management System patient-search-report.php sql injection (CVSS 6.9, PHPGurukul Nipah Virus Testing Management System)
- [CVE-2025-34489](https://cve.now/CVE-2025-34489.md): GFI MailEssentials \< 21.8 Local Privilege Escalation (CVSS 7.8, GFI MailEssentials)
- [CVE-2025-4032](https://cve.now/CVE-2025-4032.md): inclusionAI AWorld shell\_tool.py subprocess.Popen os command injection (CVSS 2.3, inclusionAI AWorld · aworld)
- [CVE-2025-4031](https://cve.now/CVE-2025-4031.md): PHPGurukul Pre-School Enrollment System aboutus.php sql injection (CVSS 6.9, PHPGurukul Pre-School Enrollment System)
- [CVE-2024-12706](https://cve.now/CVE-2024-12706.md): SQL Injection vulnerability discovered in OpenText™ Digital Asset Management. (CVSS 2.1, OpenText™ Digital Asset Management.)
- [CVE-2025-4030](https://cve.now/CVE-2025-4030.md): PHPGurukul COVID19 Testing Management System search-report-result.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-4029](https://cve.now/CVE-2025-4029.md): code-projects Personal Diary Management System New Record addrecord stack-based overflow (CVSS 4.8, code-projects Personal Diary Management System)
- [CVE-2025-4028](https://cve.now/CVE-2025-4028.md): PHPGurukul COVID19 Testing Management System profile.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-43857](https://cve.now/CVE-2025-43857.md): net-imap rubygem vulnerable to possible DoS by memory exhaustion (CVSS 6.0, ruby net-imap · net-imap)
- [CVE-2025-4027](https://cve.now/CVE-2025-4027.md): PHPGurukul Old Age Home Management System rules.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2025-43854](https://cve.now/CVE-2025-43854.md): DIFY vulnerable to Clickjacking Attack (CVSS 2.3, langgenius dify)
- [CVE-2025-4026](https://cve.now/CVE-2025-4026.md): PHPGurukul Nipah Virus Testing Management System profile.php sql injection (CVSS 6.9, PHPGurukul Nipah Virus Testing Management System)
- [CVE-2025-4025](https://cve.now/CVE-2025-4025.md): itsourcecode Placement Management System registration.php sql injection (CVSS 6.9, itsourcecode Placement Management System)
- [CVE-2025-23377](https://cve.now/CVE-2025-23377.md): Dell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability. (CVSS 4.2, Dell PowerProtect Data Manager)
- [CVE-2025-23376](https://cve.now/CVE-2025-23376.md): Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in (CVSS 2.3, Dell PowerProtect Data Manager Reporting)
- [CVE-2025-4024](https://cve.now/CVE-2025-4024.md): itsourcecode Placement Management System add\_drive.php sql injection (CVSS 6.9, itsourcecode Placement Management System)
- [CVE-2025-23375](https://cve.now/CVE-2025-23375.md): Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability. (CVSS 7.8, Dell PowerProtect Data Manager)
- [CVE-2025-4023](https://cve.now/CVE-2025-4023.md): itsourcecode Placement Management System add\_company.php sql injection (CVSS 6.9, itsourcecode Placement Management System)
- [CVE-2025-4022](https://cve.now/CVE-2025-4022.md): web-arena-x webarena evaluators.py HTMLContentEvaluator code injection (CVSS 5.3, web-arena-x webarena)
- [CVE-2025-4021](https://cve.now/CVE-2025-4021.md): code-projects Patient Record Management System edit\_spatient.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-4020](https://cve.now/CVE-2025-4020.md): PHPGurukul Old Age Home Management System contact.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2025-32472](https://cve.now/CVE-2025-32472.md): DoS attack by conducting a slowloris-type attack (CVSS 5.3, SICK AG SICK multiScan1XX · SICK AG SICK picoScan1XX)
- [CVE-2025-4019](https://cve.now/CVE-2025-4019.md): 20120630 Novel-Plus GeneratorController.java genCode missing authentication (CVSS 6.9, 20120630 Novel-Plus)
- [CVE-2025-4018](https://cve.now/CVE-2025-4018.md): 20120630 Novel-Plus CrawlController.java addCrawlSource missing authentication (CVSS 6.9, 20120630 Novel-Plus)
- [CVE-2025-4017](https://cve.now/CVE-2025-4017.md): 20120630 Novel-Plus LogController.java list improper authorization (CVSS 5.3, 20120630 Novel-Plus)
- [CVE-2025-4016](https://cve.now/CVE-2025-4016.md): 20120630 Novel-Plus LogController.java deleteIndex improper authorization (CVSS 5.3, 20120630 Novel-Plus)
- [CVE-2025-4015](https://cve.now/CVE-2025-4015.md): 20120630 Novel-Plus SessionController.java list missing authentication (CVSS 6.9, 20120630 Novel-Plus)
- [CVE-2025-3200](https://cve.now/CVE-2025-3200.md): Com-Server Exposed via Weak TLS (CVSS 9.1, Wiesemann & Theis Com-Server++ · Wiesemann & Theis Com-S… +3)
- [CVE-2025-4014](https://cve.now/CVE-2025-4014.md): PHPGurukul Art Gallery Management System manage-art-medium.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System)
- [CVE-2025-32471](https://cve.now/CVE-2025-32471.md): Reuse of salt (CVSS 3.7, SICK AG SICK FLX3-CPUC200 · SICK AG TDC-X401GL)
- [CVE-2025-39367](https://cve.now/CVE-2025-39367.md): WordPress Kleo theme \< 5.4.4 - Broken Access Control vulnerability (CVSS 5.3, SeventhQueen Kleo)
- [CVE-2025-32470](https://cve.now/CVE-2025-32470.md): Unauthenticated change of IP adress (CVSS 7.5, SICK AG SICK FLX0-GPNT100 · SICK AG SICK FLX3-CPUC200)
- [CVE-2025-4013](https://cve.now/CVE-2025-4013.md): PHPGurukul Art Gallery Management System aboutus.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System)
- [CVE-2025-4012](https://cve.now/CVE-2025-4012.md): playeduxyz PlayEdu 开源培训系统 User Avatar create server-side request forgery (CVSS 5.1, playeduxyz PlayEdu 开源培训系统)
- [CVE-2025-42598](https://cve.now/CVE-2025-42598.md): Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a l (CVSS 7.8, SEIKO EPSON printer drivers for Windows OS)
- [CVE-2025-4011](https://cve.now/CVE-2025-4011.md): Redmine Custom Query cross site scripting (CVSS 5.1, Redmine)
- [CVE-2025-4007](https://cve.now/CVE-2025-4007.md): Tenda W12/i24 httpd modules cgidhcpsCfgSet stack-based overflow (CVSS 8.7, Tenda W12 · Tenda i24)
- [CVE-2025-22235](https://cve.now/CVE-2025-22235.md): Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed (CVSS 7.3, Spring Boot · org.springframework.boot:spring-boot)
- [CVE-2025-4006](https://cve.now/CVE-2025-4006.md): youyiio BeyongCms Document Management Page Upload.html unrestricted upload (CVSS 5.1, youyiio BeyongCms)
- [CVE-2025-4005](https://cve.now/CVE-2025-4005.md): PHPGurukul COVID19 Testing Management System patient-report.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-4004](https://cve.now/CVE-2025-4004.md): PHPGurukul COVID19 Testing Management System password-recovery.php sql injection (CVSS 6.9, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-0627](https://cve.now/CVE-2025-0627.md): AI Autotagger \< 3.30.0 - Admin+ Stored XSS (CVSS 3.5, WordPress Tag, Category, and Taxonomy Manager)
- [CVE-2024-9771](https://cve.now/CVE-2024-9771.md): WP-Recall \< 16.26.12 - Admin+ Stored XSS (CVSS 3.5, WP-Recall)
- [CVE-2024-13688](https://cve.now/CVE-2024-13688.md): Admin and Site Enhancements (ASE) \< 7.6.10 - Password Protection Bypass (CVSS 5.3, Admin and Site Enhancements)
- [CVE-2025-4003](https://cve.now/CVE-2025-4003.md): RefindPlusRepo RefindPlus RP\_ApfsIo.c InternalApfsTranslateBlock null pointer dereference (CVSS 6.8, RefindPlusRepo RefindPlus)
- [CVE-2025-4002](https://cve.now/CVE-2025-4002.md): RefindPlusRepo RefindPlus BootLog.c GetDebugLogFile null pointer dereference (CVSS 6.8, RefindPlusRepo RefindPlus)
- [CVE-2025-4001](https://cve.now/CVE-2025-4001.md): scipopt scip File Descriptor genRandomLOPInstance.c main file descriptor consumption (CVSS 4.8, scipopt scip)
- [CVE-2025-4000](https://cve.now/CVE-2025-4000.md): Seeyon Zhiyuan OA Web Application System ssoproxy.jsp cross site scripting (CVSS 5.1, Seeyon Zhiyuan OA Web Application System)
- [CVE-2025-3999](https://cve.now/CVE-2025-3999.md): Seeyon Zhiyuan OA Web Application System URL Parameter date.jsp cross site scripting (CVSS 5.1, Seeyon Zhiyuan OA Web Application System)
- [CVE-2025-3998](https://cve.now/CVE-2025-3998.md): CodeAstro Membership Management System renew.php sql injection (CVSS 6.9, CodeAstro Membership Management System)
- [CVE-2025-3706](https://cve.now/CVE-2025-3706.md): 104 Corporation eHRMS - Reflected Cross-Site Scripting (CVSS 6.1, 104 eHRMS)
- [CVE-2025-3997](https://cve.now/CVE-2025-3997.md): dazhouda lecms Personal Information Page index.php cross-site request forgery (CVSS 5.3, dazhouda lecms)
- [CVE-2025-3996](https://cve.now/CVE-2025-3996.md): TOTOLINK N150RT MAC Filtering Page home.htm cross site scripting (CVSS 4.8, TOTOLINK N150RT)
- [CVE-2025-3995](https://cve.now/CVE-2025-3995.md): TOTOLINK N150RT LAN Settings Page fromStaticDHCP cross site scripting (CVSS 4.8, TOTOLINK N150RT)
- [CVE-2025-3994](https://cve.now/CVE-2025-3994.md): TOTOLINK N150RT IP Port Filtering home.htm cross site scripting (CVSS 4.8, TOTOLINK N150RT)
- [CVE-2025-3993](https://cve.now/CVE-2025-3993.md): TOTOLINK N150RT formWsc buffer overflow (CVSS 8.7, TOTOLINK N150RT)
- [CVE-2025-3992](https://cve.now/CVE-2025-3992.md): TOTOLINK N150RT formWlwds buffer overflow (CVSS 8.7, TOTOLINK N150RT)
- [CVE-2015-2079](https://cve.now/CVE-2015-2079.md): Usermin 0.980 through 1.x before 1.660 allows uconfig\_save.cgi sig\_file\_free remote code execution because it uses the two argument (not thr (CVSS 9.9, Usermin)
- [CVE-2015-4582](https://cve.now/CVE-2015-4582.md): The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp\_register\_error XSS. (CVSS 7.2, TheCartPress boot-store)
- [CVE-2022-41871](https://cve.now/CVE-2022-41871.md): SEPPmail through 12.1.17 allows command injection within the Admin Portal. (CVSS 6.0, SEPPmail)
- [CVE-2023-35814](https://cve.now/CVE-2023-35814.md): DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms. (CVSS 3.5, DevExpress)
- [CVE-2023-35815](https://cve.now/CVE-2023-35815.md): DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data. (CVSS 3.5, DevExpress)
- [CVE-2023-35816](https://cve.now/CVE-2023-35816.md): DevExpress before 23.1.3 allows arbitrary TypeConverter conversion. (CVSS 3.5, DevExpress)
- [CVE-2023-35817](https://cve.now/CVE-2023-35817.md): DevExpress before 23.1.3 allows AsyncDownloader SSRF. (CVSS 5.0, DevExpress)
- [CVE-2023-42404](https://cve.now/CVE-2023-42404.md): OneVision Workspace before WS23.1 SR1 (build w31.040) allows arbitrary Java EL execution. (CVSS 4.9, OneVision Workspace)
- [CVE-2024-32499](https://cve.now/CVE-2024-32499.md): Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed. (CVSS 4.9, Newforma Project Center Server)
- [CVE-2025-25776](https://cve.now/CVE-2025-25776.md): Cross-Site Scripting (XSS) vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1 (CVSS 5.0)
- [CVE-2025-45947](https://cve.now/CVE-2025-45947.md): An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/change-password.php fil (CVSS 9.8)
- [CVE-2025-45949](https://cve.now/CVE-2025-45949.md): A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-passwo (CVSS 9.8)
- [CVE-2025-45953](https://cve.now/CVE-2025-45953.md): A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Pass (CVSS 9.1)
- [CVE-2025-46614](https://cve.now/CVE-2025-46614.md): In Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL query at the INFO level, aka Insertion of Sens (CVSS 3.3, Snowflake ODBC)
- [CVE-2025-46661](https://cve.now/CVE-2025-46661.md): IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide te (CVSS 10.0, IPW Metazo)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-04-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.