Skip to content
OpenAdvisories

Archive

1 April 2025

Vulnerabilities first published on this day (UTC), newest first.

← March 2025 2025 / April /1 May 2025 →
  1. 1429
  2. 2110
  3. 3177
  4. 4232
  5. 532
  6. 629
  7. 7172
  8. 8349
  9. 9196
  10. 10111
  11. 11127
  12. 1216
  13. 1315
  14. 1486
  15. 15264
  16. 16373
  17. 17314
  18. 18102
  19. 1936
  20. 2025
  21. 2145
  22. 22113
  23. 2379
  24. 24174
  25. 2579
  26. 2622
  27. 2760
  28. 2889
  29. 2993
  30. 30111
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 9.3
    CVE-2025-3096 Public exploit

    Clinics Patient Management System SQL Injection

    Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page.

    SourceCodester Clinic's Patient Management System
  • High 7.5
    CVE-2025-31137 Public exploit

    Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

    React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows …

    remix-run react-router @react-router/express @remix-run/express npm
  • High 8.6
    CVE-2025-31131 Public exploit Scanner template

    Path Traversal allowing arbitrary read of files in Yeswiki

    YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.

    YesWiki yeswiki yeswiki/yeswiki Packagist
  • Medium 5.9
    CVE-2025-31864 Public exploit

    WordPress Beam me up Scotty – Back to Top Button plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Out the Box Beam me up Scotty beam-me-up-scotty allows Stored XSS.This issue affects Beam me up Scotty: from n/a through <= 1.0.23.

    Out the Box Beam me up Scotty
  • Critical 10.0
    CVE-2025-30065 Public exploit EPSS 44%

    Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata

    Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.

    Apache Software Foundation Apache Parquet Java druid druid-compat Wolfi Maven
  • Critical 9.9
    CVE-2025-30911 Public exploit

    WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Command Injection.This issue affects RTMKit: from n/a through <= 1.5.4.

    rometheme RTMKit
  • Medium 6.7
    CVE-2023-46988 Public exploit

    Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary fil…

  • Medium 5.4
    CVE-2025-26056 Public exploit

    A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality…

  • Medium 6.5
    CVE-2025-26055 Public exploit

    An OS Command Injection vulnerability exists in the Infinxt iEdge 100 2.1.32 Troubleshoot module, specifically in the t…

  • Medium 5.4
    CVE-2025-26054 Public exploit

    Infinxt iEdge 100 2.1.32 is vulnerable to Cross Site Scripting (XSS) via the "Description" field during LAN configurati…

  • Medium 5.6
    CVE-2003-20001 Public exploit

    An issue was discovered on Mitel ICP VoIP 3100 devices. When a remote user attempts to log in via TELNET during the log…