Skip to content
OpenAdvisories

Archive

8 April 2025

Vulnerabilities first published on this day (UTC), newest first.

← March 2025 2025 / April /8 May 2025 →
  1. 1429
  2. 2110
  3. 3177
  4. 4232
  5. 532
  6. 629
  7. 7172
  8. 8349
  9. 9196
  10. 10111
  11. 11127
  12. 1216
  13. 1315
  14. 1486
  15. 15264
  16. 16373
  17. 17314
  18. 18102
  19. 1936
  20. 2025
  21. 2145
  22. 22113
  23. 2379
  24. 24174
  25. 2579
  26. 2622
  27. 2760
  28. 2889
  29. 2993
  30. 30111
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Low 2.7
    CVE-2025-27192

    Adobe Commerce | Insufficiently Protected Credentials (CWE-522)

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnera…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Low 3.7
    CVE-2025-3416

    Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`

    A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • Low 2.6
    CVE-2025-32035

    DNN does not check the contents of a file when uploading files

    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it's an allowed file type but the actual …

    dnnsoftware Dnn.Platform
  • Low 2.8
    CVE-2025-27443

    Zoom Workplace Apps for Windows - Insecure Default Variable Initialization

    Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access.

    Zoom Communications Zoom Workplace Apps for Windows Windows
  • Low 3.8
    CVE-2025-32026

    Element Web could load a malicious instance of Element Call leaking media encryption keys

    Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get acce…

    element-hq element-web
  • Low 3.0
    CVE-2024-50565

    A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS versi…

    Fortinet FortiOS FortiAnalyzer FortiWeb Network devices
  • Low 2.1
    CVE-2024-32122

    A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS …

    Fortinet FortiOS Network devices
  • Low 2.6
    CVE-2025-22855

    An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Forti…

    Fortinet FortiClientEMS Network devices
  • Low 1.8
    CVE-2025-30166

    Pimcore's Admin Classic Bundle allows HTML Injection

    Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie…

    pimcore admin-ui-classic-bundle pimcore/admin-ui-classic-bundle Packagist
  • Low 2.7
    CVE-2025-3403

    Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source

    A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sens…

    Vivotek NVR ND8422P NVR ND9541P NVR ND9525P
  • Low 3.5
    CVE-2025-3393

    mrcen springboot-ucan-admin Personal Settings Interface index cross site scripting

    A vulnerability was found in mrcen springboot-ucan-admin up to 5f35162032cbe9288a04e429ef35301545143509. It has been classified as problematic. This affects an unknown part of the file /ucan-admin/index of the component Personal Settings Interface. The manipu…

    mrcen springboot-ucan-admin
  • Low 3.5
    CVE-2025-3392

    hailey888 oa_system Backend MailController.java save cross site scripting

    A vulnerability was found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this issue is the function Save of the file cn/gson/oasys/controller/mail/MailController.java of the component Backend. The manipulation of the argume…

    hailey888 oa_system
  • Low 3.5
    CVE-2025-3391

    hailey888 oa_system Backend AddrController. java outAddress cross site scripting

    A vulnerability has been found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this vulnerability is the function outAddress of the file cn/gson/oass/controller/address/AddrController. java of the component Backend. The mani…

    hailey888 oa_system
  • Low 3.5
    CVE-2025-3390

    hailey888 oa_system Backend DaymanageController.java addandchangeday cross site scripting

    A vulnerability, which was classified as problematic, was found in hailey888 oa_system up to 2025.01.01. Affected is the function addandchangeday of the file cn/gson/oass/controller/daymanager/DaymanageController.java of the component Backend. The manipulatio…

    hailey888 oa_system