CVEs published March 4, 2025
146 CVEs were published on March 4, 2025: 16 critical, 36 high. 5 are now in CISA KEV.
- Published
- 146
- Critical
- 16
- High
- 36
- Medium
- 67
- Low
- 27
- Unrated
- 0
- Now in CISA KEV
- 5
- Fix available
- 27
Most affected products
- OpenHarmony
- 26
- Mozilla Firefox · Mozilla Thunderbird
- 11
- Huawei HarmonyOS
- 7
- Axis Communications AB AXIS OS
- 5
- PHPGurukul Restaurant Table Booking System
- 5
- Tenda TX3
- 5
- Arista Networks EOS
- 4
- Enalean tuleap
- 4
- Mozilla Firefox
- 3
- Mozilla Firefox for iOS
- 3
Critical 16
- CVE-2025-23410GMOD Apollo Relative Path TraversalGMOD Apollo
- CVE-2025-1316Edimax IC-7100 IP Camera OS Command InjectionEdimax IC-7100 IP Camera
- CVE-2025-27510RCE in the package conda-forge-metadataconda-forge-metadata
- CVE-2025-1260On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.Arista Networks EOS
- CVE-2025-27507IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurationszitadel · github.com/zitadel/zitadel +1
- CVE-2024-11957Arbitrary Code Execution in WPS OfficeKingsoft WPS Office
- CVE-2025-1942Disclosure of uninitialized memory when .toUpperCase() causes string to get longerMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1941Lock screen setting bypass in Firefox Focus for AndroidMozilla Firefox
- CVE-2025-22224VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.VMware ESXi · VMware Workstation +3
- CVE-2025-1307Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Uploadspicethemes Newscrunch
- CVE-2025-0912GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injectionstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-50704Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code…
- CVE-2024-50706Unauthenticated SQL injection vulnerability in Uniguest Tripleplay version 23.1+ allows remote attackers to execute arbitrary SQL queries…
- CVE-2024-50707Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code…
- CVE-2025-26136A SQL injection vulnerability exists in mysiteforme versions prior to 2025.01.1.
- CVE-2025-26319FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.flowise
High 36
- CVE-2025-21092GMOD Apollo Incorrect Privilege AssignmentGMOD Apollo
- CVE-2025-1080Macro URL arbitrary script executionThe Document Foundation LibreOffice
- CVE-2025-1259On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.Arista Networks EOS
- CVE-2019-1815Cisco Meraki MX67 and MX68 Sensitive Information Disclosure VulnerabilityCisco Meraki MX Firmware
- CVE-2024-10930Carrier Block Load Privilege EscalationCarrier Block Load
- CVE-2024-41147An out-of-bounds write vulnerability exists in the ma_dr_flac__decode_samples__lpc functionality of Miniaudio miniaudio v0.11.21.Miniaudio
- CVE-2025-1424Privilege Escalation Through SUID Binary and Developer ModePocketBook InkPad Color
- CVE-2025-23368Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cliwildfly-core · Red Hat JBoss Enterprise Application Pla… +11
- CVE-2024-9149SQLi in Wind Media's E-Commerce Website TemplateWind Media E-Commerce Website Template
- CVE-2025-1943Memory safety bugs fixed in Firefox 136 and Thunderbird 136Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-1937Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-1936Adding %00 and a fake extension to a jar: URL changed the interpretation of the contentsMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1940Android Intent confirmation prompt tapjacking using Select optionsMozilla Firefox
- CVE-2025-1933JIT corruption of WASM i32 return values on 64-bit CPUsMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1932Inconsistent comparator in XSLT sorting led to out-of-bounds accessMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1931Use-after-free in WebTransportChildMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1930AudioIPC StreamData could trigger a use-after-free in the Browser processMozilla Firefox · Mozilla Thunderbird
- CVE-2025-22226VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS.ESXi · VMware Workstation +4
- CVE-2025-22225VMware ESXi contains an arbitrary write vulnerability.VMware ESXi · VMware Cloud Foundation +2
- CVE-2024-58045Multi-concurrency vulnerability in the media digital copyright protection module Impact: Successful exploitation of this vulnerability may…Huawei HarmonyOS
- CVE-2024-58044Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect…Huawei HarmonyOS · Huawei EMUI
- CVE-2024-58043Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service…Huawei HarmonyOS · Huawei EMUI
- CVE-2025-0360During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration…Axis Communications AB AXIS OS
- CVE-2025-0359During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework…Axis Communications AB AXIS OS
- CVE-2025-1306Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Uploadspicethemes Newscrunch
Show all 36 entriesShow fewer entries
- CVE-2025-1639Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/ActivationcrowdyTheme Animation Addons for Elementor Pro
- CVE-2025-1899Tenda TX3 setPptpUserList buffer overflowTenda TX3
- CVE-2025-1898Tenda TX3 openSchedWifi buffer overflowTenda TX3
- CVE-2025-1897Tenda TX3 SetNetControlList buffer overflowTenda TX3
- CVE-2025-1896Tenda TX3 SetStaticRouteCfg buffer overflowTenda TX3
- CVE-2025-1895Tenda TX3 setMacFilterCfg buffer overflowTenda TX3
- CVE-2020-23438Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation.
- CVE-2021-41719Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates…
- CVE-2024-48248NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lNAKIVO Backup & Replication Director
- CVE-2024-50705Unauthenticated reflected cross-site scripting (XSS) vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute…
- CVE-2025-25426yshopmall <=v1.9.0 is vulnerable to SQL Injection in the image listing interface.
Medium, low and unrated 94
- CVE-2025-1962projectworlds Online Hotel Booking addroom.php sql injectionprojectworlds Online Hotel Booking
- CVE-2025-1961SourceCodester Best Church Management Software web_crud.php sql injectionSourceCodester Best Church Management Software
- CVE-2025-1959Codezips Gym Management System change_s_pwd.php sql injectionCodezips Gym Management System
- CVE-2025-1958aaluoxiang oa_system address-mapper.xml sql injectionaaluoxiang oa_system
- CVE-2025-1957code-projects Blood Bank System o+.php cross site scriptingcode-projects Blood Bank System
- CVE-2025-1956code-projects Shopping Portal Login index.php sql injectioncode-projects Shopping Portal
- CVE-2025-1955code-projects Online Class and Exam Scheduling System profile.php cross site scriptingcode-projects Online Class and Exam Scheduling System
- CVE-2025-1954PHPGurukul Human Metapneumovirus Testing Management System login.php sql injectionPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2024-8000On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA…Arista Networks EOS
- CVE-2024-9135On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may…Arista Networks EOS
- CVE-2025-1953vLLM AIBrix Prefix Caching hash.go random valuesvLLM AIBrix
- CVE-2025-1952PHPGurukul Restaurant Table Booking System password-recovery.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2025-1949ZZCMS URL register_nodb.php cross site scriptingZZCMS
- CVE-2025-1969Request approval spoofing in Temporary Elevated Access Management (TEAM) for AWS IAM Identity CenterTemporary Elevated Access Management (TEAM) for AWS IAM Ide…
- CVE-2025-1947hzmanyun Education and Training System UploadImageController.java scorm command injectionhzmanyun Education and Training System
- CVE-2025-1946hzmanyun Education and Training System exportPDF command injectionhzmanyun Education and Training System
- CVE-2020-3122Cisco Content Security Management Appliance Information Disclosure VulnerabilityCisco IronPort Security Management Appliance · Cisco Secure…
- CVE-2025-27402Tuleap is missing CSRF protections on tracker fields administrative operationsEnalean tuleap
- CVE-2025-27401In Tuleap, deleting a report can delete criteria filters in other reportsEnalean tuleap
- CVE-2025-27156Tuleap allows content injection via emails sent by the mass emailing featuresEnalean tuleap
- CVE-2025-27150Tuleap dumps the Redis password into the generated troubleshooting archivesEnalean tuleap
- CVE-2025-27155In-memory stored Cross-site scripting (XSS) vulnerability in pineconesimmatrix-org pinecone · github.com/matrix-org/pinecone
- CVE-2025-27111Escape Sequence Injection vulnerability in Rack lead to Possible Log Injectionrack
- CVE-2025-1425File Read Through Improper Sudo Privilege ManagementPocketBook InkPad Color
- CVE-2025-27425QR code user confirmation bypass with invalid protocolMozilla Firefox for iOS
Show all 94 entriesShow fewer entries
- CVE-2025-27424Firefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http SchemeMozilla Firefox for iOS
- CVE-2025-27426Firefox Mobile iOS Full Address Bar Spoof Using Server-Side Redirect to internal error pageMozilla Firefox for iOS
- CVE-2025-1938Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-1935Clickjacking the registerProtocolHandler info-barMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1934Unexpected GC during RegExp bailout processingMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1939Tapjacking in Android Custom Tabs using transition animationsMozilla Firefox
- CVE-2025-1925Open5GS AMF nsmf-handler.c amf_nsmf_pdusession_handle_update_sm_context denial of serviceOpen5GS
- CVE-2025-0370WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parametergn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2025-0958Ultimate WordPress Auction Plugin <= 4.2.9 - Missing Authorization to Arbitrary Post Deletionnitesh_singh Ultimate WordPress Auction Plugin
- CVE-2025-0433Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameterlitonice13 Master Addons For Elementor – Widgets, Extension…
- CVE-2024-13724Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorizationwpswings Wallet System for WooCommerce – Digital Wallet, Bu…
- CVE-2024-9618Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetslitonice13 Master Addons For Elementor – Widgets, Extension…
- CVE-2025-0512Structured Content (JSON-LD) #wpsc <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcodegorbo Structured Content (JSON-LD) #wpsc
- CVE-2024-13682Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Cross-Site Request Forgerywpswings Wallet System for WooCommerce – Digital Wallet, Bu…
- CVE-2024-58050Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service…Huawei HarmonyOS
- CVE-2024-58049Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service…Huawei HarmonyOS
- CVE-2024-58048Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect…Huawei HarmonyOS
- CVE-2024-58047Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service…Huawei HarmonyOS
- CVE-2024-58046Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service…Huawei HarmonyOS
- CVE-2025-27521Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may…Huawei HarmonyOS
- CVE-2024-13685Admin and Site Enhancements (ASE) < 7.6.10 - Limit Login Attempt Bypass via IP SpoofingAdmin and Site Enhancements
- CVE-2024-47262Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition…Axis Communications AB AXIS OS
- CVE-2024-4726051l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation…Axis Communications AB AXIS OS
- CVE-2024-47259Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input…Axis Communications AB AXIS OS
- CVE-2025-1906PHPGurukul Restaurant Table Booking System profile.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2025-1905SourceCodester Employee Management System employee.php cross site scriptingSourceCodester Employee Management System
- CVE-2025-1904code-projects Blood Bank System A+.php cross site scriptingcode-projects Blood Bank System
- CVE-2025-1903Codezips Online Shopping Website cart_add.php sql injectionCodezips Online Shopping Website
- CVE-2025-1902PHPGurukul Student Record System password-recovery.php sql injectionPHPGurukul Student Record System
- CVE-2025-24309Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-24301Arkcompiler Ets Runtime has an UAF vulnerabilityOpenHarmony
- CVE-2025-23420Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-23418Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-23414Arkcompiler Ets Runtime has an UAF vulnerabilityOpenHarmony
- CVE-2025-23409Communication Dsoftbus has an UAF vulnerabilityOpenHarmony
- CVE-2025-23240Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-23234Arkcompiler Ets Runtime has a buffer overflow vulnerabilityOpenHarmony
- CVE-2025-22897Arkcompiler Ets Runtime has a buffer overflow vulnerabilityOpenHarmony
- CVE-2025-22847Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-22841Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-22837Arkcompiler Ets Runtime has a NULL pointer dereference vulnerabilityOpenHarmony
- CVE-2025-22835Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-22443Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-21098Liteos-A has an insecure storage of sensitive information vulnerabilityOpenHarmony
- CVE-2025-21097Arkcompiler Ets Runtime has a NULL pointer dereference vulnerabilityOpenHarmony
- CVE-2025-21089Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-21084Arkcompiler Ets Runtime has an NULL pointer dereference vulnerabilityOpenHarmony
- CVE-2025-20626Arkcompiler Ets Runtime has an UAF vulnerabilityOpenHarmony
- CVE-2025-20091Communication Dsoftbus has an UAF vulnerabilityOpenHarmony
- CVE-2025-20081Communication Dsoftbus has an UAF vulnerabilityOpenHarmony
- CVE-2025-20042Liteos-A has an out of bounds read vulnerabilityOpenHarmony
- CVE-2025-20024Arkcompiler Ets Runtime has an integer overflow vulnerabilityOpenHarmony
- CVE-2025-20021Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-20011Communication Dsoftbus has a memory leak vulnerabilityOpenHarmony
- CVE-2025-0587Arkcompiler Ets Runtime has an integer overflow vulnerabilityOpenHarmony
- CVE-2025-1321teachPress <= 9.0.7 - Authenticated (Contributor+) SQL Injectionwinkm89 teachPress
- CVE-2024-13686VW Storefront <= 0.9.9 - Missing Authorization to Authenticated (Subscriber+) Settings Resetvowelweb VW Storefront
- CVE-2025-1901PHPGurukul Restaurant Table Booking System check_availability.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2025-1900PHPGurukul Restaurant Table Booking System add-table.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2025-1894PHPGurukul Restaurant Table Booking System search-result.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2025-1695NGINX Unit Java VulnerabilityF5 NGINX Unit
- CVE-2025-1893Open5GS AMF gmm-sm.c gmm_state_authentication denial of serviceOpen5GS
- CVE-2025-1892shishuocms Directory Deletion Page add.json cross site scriptingshishuocms
- CVE-2025-26091A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to…
- CVE-2025-26182An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file
- CVE-2025-26202Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands)…
- CVE-2025-26318hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently…TSplus Remote Access
- CVE-2025-26320t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address parameter at /device/ping.
- CVE-2025-26849There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions.Docusnap