İçeriğe atla
Noroxi

Yayın tarihine göre

Nisan 2025: sömürülen ve yeni ciddi CVE kayıtları

187 kayıt · 16 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2025-32583
    45Planlayın

    WordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerability

    KritikCVSS 9,9Kavram kanıtıEPSS %20

    termel · pdf 2 post17 Nis 2025

  • CVE-2025-32682
    39İzleyin

    WordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload Vulnerability

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    romancode · mapsvg17 Nis 2025

  • CVE-2025-39436
    36İzleyin

    WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    aidraw · i draw17 Nis 2025

  • CVE-2025-39588
    39İzleyin

    WordPress Ultimate Store Kit Elementor Addons plugin <= 2.4.0 - Deserialization of untrusted data Vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    bdthemes · ultimate store kit elementor addons17 Nis 2025

  • CVE-2025-39596
    39İzleyin

    WordPress Quentn WP plugin <= 1.2.8 - Privilege Escalation Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    quentn.com gmbh · quentn wp17 Nis 2025

  • CVE-2024-53924
    39İzleyin

    Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginni

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    dgorissen · pycel17 Nis 2025

  • CVE-2024-55211
    33İzleyin

    An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie.

    YüksekCVSS 8,4Kavram kanıtıEPSS %0

    think · tk-rt-wr135g firmware17 Nis 2025

  • CVE-2025-28009
    39İzleyin

    A SQL Injection vulnerability exists in the `u` parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    appventure · dietiqa17 Nis 2025

  • CVE-2025-29722
    25İzleyin

    A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users.

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    yassmittal · commercify17 Nis 2025

  • CVE-2025-42599
    70Bu hafta

    Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %3

    qualitia · active\! mail18 Nis 2025

  • CVE-2025-2492
    36İzleyin

    An improper authentication control vulnerability exists in AiCloud.

    KritikCVSS 9,2Kavram kanıtıEPSS %1

    asus · router18 Nis 2025

  • CVE-2025-3785
    38İzleyin

    D-Link DWR-M961 Authorization Interface formStaticDHCP stack-based overflow

    YüksekCVSS 8,7İstismar yokEPSS %12

    dlink · dwr-m961 firmware18 Nis 2025

  • CVE-2025-28228
    31İzleyin

    A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    electrolink · fm\/dab\/tv transmitter web management system18 Nis 2025

  • CVE-2025-32434
    38İzleyin

    PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

    KritikCVSS 9,3Kavram kanıtıEPSS %2

    linuxfoundation · pytorch18 Nis 2025

  • CVE-2025-28242
    40Planlayın

    Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    18 Nis 2025

  • CVE-2025-29513
    37İzleyin

    Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access

    OrtaCVSS 6,1İstismar yokEPSS %42

    nodebb · nodebb18 Nis 2025

  • CVE-2025-28355
    18İzleyin

    Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery (CSRF) allowing attackers to execute arbitrary code an

    OrtaCVSS 4,7Kavram kanıtıEPSS %0

    personal-management-system · personal management system18 Nis 2025

  • CVE-2024-53591
    39İzleyin

    An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    seclore · seclore18 Nis 2025

  • CVE-2025-2010
    31İzleyin

    JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin <= 2.3.9 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    mhmrajib · jobwp – job board, job listing, career page and recruitment plugin18 Nis 2025

  • CVE-2025-3820
    38İzleyin

    Tenda W12/i24 httpd cgiSysUplinkCheckSet stack-based overflow

    YüksekCVSS 8,7İstismar yokEPSS %12

    tenda · w12 firmware19 Nis 2025

  • CVE-2025-43919
    30İzleyin

    GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    gnu · mailman19 Nis 2025

  • CVE-2025-43920
    32İzleyin

    GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    gnu · mailman19 Nis 2025

  • CVE-2025-43921
    21İzleyin

    GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint.

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    gnu · mailman19 Nis 2025

  • CVE-2025-43929
    31İzleyin

    open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked f

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    kovidgoyal · kitty19 Nis 2025

  • CVE-2025-43963
    36İzleyin

    In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values a

    KritikCVSS 9,1İstismar yokEPSS %0

    libraw · libraw20 Nis 2025

  • CVE-2025-28121
    24İzleyin

    code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" parameter allowing re

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    code-projects · online exam mastering system21 Nis 2025

  • CVE-2025-28367
    27İzleyin

    mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action.

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    mojoportal · mojoportal21 Nis 2025

  • CVE-2024-57394
    35İzleyin

    The quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0 allows user to restore a malicious file to

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    qianxin · tianqing endpoint security management system21 Nis 2025

  • CVE-2025-32958
    39İzleyin

    Adept exposed the GITHUB_TOKEN in workflow run artifact

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    adeptlanguage · adept21 Nis 2025

  • CVE-2025-3855
    21İzleyin

    CodeCanyon RISE Ultimate Project Manager Profile Picture save_profile_image resource injection

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    fairsketch · rise ultimate project manager21 Nis 2025

  • CVE-2025-3856
    21İzleyin

    xxyopen Novel-Plus searchByPage sql injection

    OrtaCVSS 5,3İstismar yokEPSS %0

    xxyopen · novel-plus21 Nis 2025

  • CVE-2025-1731
    31İzleyin

    An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    zyxel · uos21 Nis 2025

  • CVE-2025-3577
    23İzleyin

    **UNSUPPORTED WHEN ASSIGNED** A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00

    OrtaCVSS 4,9İstismar yokEPSS %12

    zyxel · amg1302-t10b firmware21 Nis 2025

  • CVE-2025-3616
    36İzleyin

    Greenshift 11.4 - 11.4.5 - Authenticated (Subscriber+) Arbitrary File Upload

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    greenshiftwp · greenshift - animation and page builder blocks22 Nis 2025

  • CVE-2024-13569
    28İzleyin

    Front End Users <= 3.2.32 - Reflected XSS

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    etoilewebdesign · front end users22 Nis 2025

  • CVE-2025-2594
    35İzleyin

    User Registration & Membership < 4.1.3 - Authentication Bypass

    YüksekCVSS 8,1Kavram kanıtıEPSS %9

    wpeverest · user registration \& membership22 Nis 2025

  • CVE-2025-3472
    40Planlayın

    Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    oceanwp · ocean extra22 Nis 2025

  • CVE-2024-40445
    29İzleyin

    A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    ctan · mimetex22 Nis 2025

  • CVE-2024-33452
    30İzleyin

    An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD re

    YüksekCVSS 7,7İstismar yokEPSS %0

    openresty · lua-nginx-module22 Nis 2025

  • CVE-2025-34028
    96Hemen

    Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %97

    commvault · commvault22 Nis 2025

  • CVE-2025-26159
    24İzleyin

    Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    22 Nis 2025

  • CVE-2025-32965
    37İzleyin

    Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    xrplf · xrpl.js22 Nis 2025

  • CVE-2025-2703
    32İzleyin

    The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability.

    OrtaCVSS 6,8İstismar yokEPSS %16

    grafana · grafana23 Nis 2025

  • CVE-2025-32966
    33İzleyin

    Dataease H2 JDBC Connection Remote Code Execution

    YüksekCVSS 8,2Kavram kanıtıEPSS %4

    dataease · dataease23 Nis 2025

  • CVE-2025-32969
    61Bu hafta

    org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

    KritikCVSS 9,3Kavram kanıtıEPSS %80

    xwiki · xwiki23 Nis 2025

  • CVE-2025-2760
    36İzleyin

    GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %17

    gimp · gimp23 Nis 2025

  • CVE-2025-27580
    30İzleyin

    NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, ti

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    nih · brics23 Nis 2025

  • CVE-2025-27581
    17İzleyin

    NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET mo

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    nih · brics23 Nis 2025

  • CVE-2025-1976
    64Bu hafta

    Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6

    YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %0

    broadcom · fabric operating system23 Nis 2025

  • CVE-2025-2558
    35İzleyin

    The Wound <= 0.0.1 - Unauthenticated LFI

    YüksekCVSS 8,6Kavram kanıtıEPSS %2

    the wound project · the wound24 Nis 2025

  • CVE-2025-3604
    39İzleyin

    Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    flynax · flynax bridge24 Nis 2025

  • CVE-2025-3776
    33İzleyin

    Verification SMS with TargetSMS <= 1.5 - Unauthenticated Limited Remote Code Execution

    YüksekCVSS 8,3Kavram kanıtıEPSS %0

    cajka · verification sms with targetsms24 Nis 2025

  • CVE-2025-31324
    99Hemen

    Missing Authorization check in SAP NetWeaver (Visual Composer development server)

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    sap · netweaver24 Nis 2025

  • CVE-2025-29529
    26İzleyin

    ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component Forgotpa

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    24 Nis 2025

  • CVE-2025-46271
    38İzleyin

    Planet Technology Network Products OS Command Injection

    KritikCVSS 9,3Kavram kanıtıEPSS %1

    planet technology · uni-nms-lite24 Nis 2025

  • CVE-2025-43864
    36İzleyin

    React Router allows a DoS via cache poisoning by forcing SPA mode

    YüksekCVSS 7,5Kavram kanıtıEPSS %20

    remix-run · react-router24 Nis 2025

  • CVE-2025-43865
    32İzleyin

    React Router allows pre-render data spoofing on React-Router framework mode

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    remix-run · react-router24 Nis 2025

  • CVE-2025-32044
    30İzleyin

    Moodle: unauthenticated rest api user data exposure

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    moodle · moodle25 Nis 2025

  • CVE-2025-32432
    100Hemen

    Craft CMS Allows Remote Code Execution

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %99

    craftcms · craft cms25 Nis 2025

  • CVE-2025-46618
    43Planlayın

    In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab

    OrtaCVSS 6,1İstismar yokEPSS %63

    jetbrains · teamcity25 Nis 2025

  • CVE-2025-3935
    59Planlayın

    ScreenConnect Exposure to ASP.NET ViewState Code Injection

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %3

    connectwise · screenconnect25 Nis 2025

  • CVE-2025-3928
    65Bu hafta

    Commvault Web Server unspecified vulnerability

    YüksekCVSS 8,7KEVSilahlaştırılmışEPSS %2

    commvault · commvault25 Nis 2025

  • CVE-2025-2907
    39İzleyin

    Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    tychesoftwares · order delivery date pro for woocommerce26 Nis 2025

  • CVE-2025-3914
    40Planlayın

    Aeropage Sync for Airtable <= 3.2.0 - Authenticated (Subscriber+) Arbitrary File Upload

    YüksekCVSS 8,8Kavram kanıtıEPSS %17

    aeropage · aeropage sync for airtable26 Nis 2025

  • CVE-2025-3969
    21İzleyin

    codeprojects News Publishing Site Dashboard Edit Category Page edit-category.php unrestricted upload

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    code-projects · news publishing site dashboard27 Nis 2025

  • CVE-2025-3983
    25İzleyin

    AMTT Hotel Broadband Operation System nlog_down.php command injection

    OrtaCVSS 5,1İstismar yokEPSS %17

    amttgroup · hibos27 Nis 2025

  • CVE-2025-3987
    24İzleyin

    TOTOLINK N150RT formWsc command injection

    OrtaCVSS 5,3İstismar yokEPSS %11

    totolink · n150rt firmware27 Nis 2025

  • CVE-2025-22235
    29İzleyin

    Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    spring · spring boot28 Nis 2025

  • CVE-2025-4028
    27İzleyin

    PHPGurukul COVID19 Testing Management System profile.php sql injection

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    phpgurukul · covid19 testing management system28 Nis 2025

  • CVE-2025-31650
    48Planlayın

    Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

    YüksekCVSS 7,5Kavram kanıtıEPSS %61

    apache · tomcat28 Nis 2025

  • CVE-2025-31651
    40Planlayın

    Apache Tomcat: Bypass of rules in Rewrite Valve

    KritikCVSS 9,8Kavram kanıtıEPSS %4

    apache · tomcat28 Nis 2025

  • CVE-2025-24252
    35İzleyin

    A use-after-free issue was addressed with improved memory management.

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    apple · ipados28 Nis 2025

  • CVE-2025-24271
    21İzleyin

    An access issue was addressed with improved access restrictions.

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    apple · ipados28 Nis 2025

  • CVE-2025-46349
    24İzleyin

    YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    yeswiki · yeswiki29 Nis 2025

  • CVE-2025-4076
    27İzleyin

    LB-LINK BL-AC3600 Password lighttpd.cgi easy_uci_set_option_string_0 command injection

    OrtaCVSS 5,3İstismar yokEPSS %19

    lb-link · bl-ac360029 Nis 2025

  • CVE-2024-57698
    30İzleyin

    An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication,

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    modernwms · modernwms29 Nis 2025

  • CVE-2025-4078
    21İzleyin

    Wangshen SecGate 3600 g=log_export_file path traversal

    OrtaCVSS 5,3Kavram kanıtıEPSS %1

    wangshen · secgate 360029 Nis 2025

  • CVE-2025-3501
    32İzleyin

    Org.keycloak.protocol.services: keycloak hostname verification

    YüksekCVSS 8,2İstismar yokEPSS %0

    red hat · red hat build of keycloak29 Nis 2025

  • CVE-2025-46549
    24İzleyin

    Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    yeswiki · yeswiki29 Nis 2025

  • CVE-2025-46550
    24İzleyin

    Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    yeswiki · yeswiki29 Nis 2025

  • CVE-2025-0520
    38İzleyin

    ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution

    KritikCVSS 9,4Kavram kanıtıEPSS %2

    showdoc · showdoc29 Nis 2025

  • CVE-2025-27134
    36İzleyin

    Privilege escalation in Joplin server via user patch endpoint

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    joplin project · joplin30 Nis 2025

  • CVE-2025-32970
    24İzleyin

    org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    xwiki · xwiki30 Nis 2025

  • CVE-2025-24091
    22İzleyin

    An app could impersonate system notifications.

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    apple · ipados30 Nis 2025

  • CVE-2025-46554
    21İzleyin

    XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

    OrtaCVSS 5,3Kavram kanıtıEPSS %1

    xwiki · xwiki30 Nis 2025

  • CVE-2025-2082
    30İzleyin

    Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    tesla · model 3 firmware30 Nis 2025

  • CVE-2025-24132
    27İzleyin

    The issue was addressed with improved memory handling.

    OrtaCVSS 6,5Kavram kanıtıEPSS %3

    apple · airplay audio software development kit30 Nis 2025