---
title: "Security digest: April 29, 2025"
url: https://erroneo.us/security/2025-04-29/
description: "April 29, 2025 vulnerability digest: 1 CISA KEV addition (SAP); 5 critical advisories (Maven, Composer (PHP), PyPI). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-04-29
date_modified: 2025-04-29
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 29, 2025

1 known exploited (cisa kev) addition and 5 critical advisories.

## Take stock

- Do you run any of these? SAP NetWeaver. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-05-20.
- Maven: 2 critical advisories ( org.xwiki.platform:xwiki-platform-component-wiki , org.xwiki.platform:xwiki-platform-security-requiredrights-default ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- Composer (PHP): 2 critical advisories ( yeswiki/yeswiki , showdoc/showdoc ). Check with composer audit .
- PyPI: 1 critical advisory ( vllm ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2025-31324](https://erroneo.us/security/cve/CVE-2025-31324/index.md) SAP NetWeaver: SAP NetWeaver Unrestricted File Upload Vulnerability (CISA due 2025-05-20)

## Critical advisories

- [CVE-2025-32973](https://erroneo.us/security/cve/CVE-2025-32973/index.md) org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right — Maven org.xwiki.platform:xwiki-platform-component-wiki >= 15.9-rc-1, < 15.10.12 → 15.10.12; Maven org.xwiki.platform:xwiki-platform-component-wiki >= 16.0.0-rc-1, < 16.4.3 → 16.4.3; Maven org.xwiki.platform:xwiki-platform-component-wiki >= 16.5.0-rc-1, < 16.8.0-rc-1 → 16.8.0-rc-1
- [CVE-2025-46348](https://erroneo.us/security/cve/CVE-2025-46348/index.md) YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download — Composer (PHP) yeswiki/yeswiki <= 4.5.3 → 4.5.4
- [CVE-2025-32974](https://erroneo.us/security/cve/CVE-2025-32974/index.md) org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type — Maven org.xwiki.platform:xwiki-platform-security-requiredrights-default >= 15.9-rc-1, < 15.10.8 → 15.10.8; Maven org.xwiki.platform:xwiki-platform-security-requiredrights-default >= 16.0.0-rc-1, < 16.2.0 → 16.2.0
- [CVE-2025-32444](https://erroneo.us/security/cve/CVE-2025-32444/index.md) vLLM Vulnerable to Remote Code Execution via Mooncake Integration — PyPI vllm >= 0.6.5, < 0.8.5 → 0.8.5
- [CVE-2025-0520](https://erroneo.us/security/cve/CVE-2025-0520/index.md) ShowDoc unrestricted file upload vulnerability — Composer (PHP) showdoc/showdoc < 2.8.7 → 2.8.7

---
Source page: https://erroneo.us/security/2025-04-29/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt