# CVEs published 2025-03-04

146 CVEs were published on March 4, 2025: 16 critical, 36 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2025-23410](https://cve.now/CVE-2025-23410.md): GMOD Apollo Relative Path Traversal (CVSS 9.3, GMOD Apollo)
- [CVE-2025-21092](https://cve.now/CVE-2025-21092.md): GMOD Apollo Incorrect Privilege Assignment (CVSS 7.1, GMOD Apollo)
- [CVE-2025-1316](https://cve.now/CVE-2025-1316.md): Edimax IC-7100 IP Camera OS Command Injection (CVSS 9.3, KEV, Edimax IC-7100 IP Camera)
- [CVE-2025-1962](https://cve.now/CVE-2025-1962.md): projectworlds Online Hotel Booking addroom.php sql injection (CVSS 6.9, projectworlds Online Hotel Booking)
- [CVE-2025-1961](https://cve.now/CVE-2025-1961.md): SourceCodester Best Church Management Software web\_crud.php sql injection (CVSS 5.3, SourceCodester Best Church Management Software)
- [CVE-2025-1959](https://cve.now/CVE-2025-1959.md): Codezips Gym Management System change\_s\_pwd.php sql injection (CVSS 6.9, Codezips Gym Management System)
- [CVE-2025-1958](https://cve.now/CVE-2025-1958.md): aaluoxiang oa\_system address-mapper.xml sql injection (CVSS 5.3, aaluoxiang oa\_system)
- [CVE-2025-1957](https://cve.now/CVE-2025-1957.md): code-projects Blood Bank System o+.php cross site scripting (CVSS 5.1, code-projects Blood Bank System)
- [CVE-2025-27510](https://cve.now/CVE-2025-27510.md): RCE in the package conda-forge-metadata (CVSS 9.3, conda-forge-metadata)
- [CVE-2025-1956](https://cve.now/CVE-2025-1956.md): code-projects Shopping Portal Login index.php sql injection (CVSS 6.9, code-projects Shopping Portal)
- [CVE-2025-1955](https://cve.now/CVE-2025-1955.md): code-projects Online Class and Exam Scheduling System profile.php cross site scripting (CVSS 5.1, code-projects Online Class and Exam Scheduling System)
- [CVE-2025-1954](https://cve.now/CVE-2025-1954.md): PHPGurukul Human Metapneumovirus Testing Management System login.php sql injection (CVSS 6.9, PHPGurukul Human Metapneumovirus Testing Management System)
- [CVE-2024-8000](https://cve.now/CVE-2024-8000.md): On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA… (CVSS 5.3, Arista Networks EOS)
- [CVE-2024-9135](https://cve.now/CVE-2024-9135.md): On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may… (CVSS 5.3, Arista Networks EOS)
- [CVE-2025-1080](https://cve.now/CVE-2025-1080.md): Macro URL arbitrary script execution (CVSS 7.2, The Document Foundation LibreOffice)
- [CVE-2025-1953](https://cve.now/CVE-2025-1953.md): vLLM AIBrix Prefix Caching hash.go random values (CVSS 2.1, vLLM AIBrix)
- [CVE-2025-1260](https://cve.now/CVE-2025-1260.md): On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. (CVSS 9.1, Arista Networks EOS)
- [CVE-2025-1259](https://cve.now/CVE-2025-1259.md): On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. (CVSS 7.7, Arista Networks EOS)
- [CVE-2025-1952](https://cve.now/CVE-2025-1952.md): PHPGurukul Restaurant Table Booking System password-recovery.php sql injection (CVSS 6.9, PHPGurukul Restaurant Table Booking System)
- [CVE-2025-1949](https://cve.now/CVE-2025-1949.md): ZZCMS URL register\_nodb.php cross site scripting (CVSS 5.3, ZZCMS)
- [CVE-2025-1969](https://cve.now/CVE-2025-1969.md): Request approval spoofing in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center (CVSS 4.3, Temporary Elevated Access Management (TEAM) for AWS IAM Ide…)
- [CVE-2025-1947](https://cve.now/CVE-2025-1947.md): hzmanyun Education and Training System UploadImageController.java scorm command injection (CVSS 5.3, hzmanyun Education and Training System)
- [CVE-2025-1946](https://cve.now/CVE-2025-1946.md): hzmanyun Education and Training System exportPDF command injection (CVSS 5.3, hzmanyun Education and Training System)
- [CVE-2020-3122](https://cve.now/CVE-2020-3122.md): Cisco Content Security Management Appliance Information Disclosure Vulnerability (CVSS 5.3, Cisco IronPort Security Management Appliance · Cisco Secure…)
- [CVE-2019-1815](https://cve.now/CVE-2019-1815.md): Cisco Meraki MX67 and MX68 Sensitive Information Disclosure Vulnerability (CVSS 7.5, Cisco Meraki MX Firmware)
- [CVE-2024-10930](https://cve.now/CVE-2024-10930.md): Carrier Block Load Privilege Escalation (CVSS 7.1, Carrier Block Load)
- [CVE-2024-41147](https://cve.now/CVE-2024-41147.md): An out-of-bounds write vulnerability exists in the ma\_dr\_flac\_\_decode\_samples\_\_lpc functionality of Miniaudio miniaudio v0.11.21. (CVSS 7.7, Miniaudio)
- [CVE-2025-27402](https://cve.now/CVE-2025-27402.md): Tuleap is missing CSRF protections on tracker fields administrative operations (CVSS 4.6, Enalean tuleap)
- [CVE-2025-27401](https://cve.now/CVE-2025-27401.md): In Tuleap, deleting a report can delete criteria filters in other reports (CVSS 4.6, Enalean tuleap)
- [CVE-2025-27156](https://cve.now/CVE-2025-27156.md): Tuleap allows content injection via emails sent by the mass emailing features (CVSS 4.1, Enalean tuleap)
- [CVE-2025-27150](https://cve.now/CVE-2025-27150.md): Tuleap dumps the Redis password into the generated troubleshooting archives (CVSS 5.3, Enalean tuleap)
- [CVE-2025-27507](https://cve.now/CVE-2025-27507.md): IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations (CVSS 9.0, zitadel · github.com/zitadel/zitadel +1)
- [CVE-2025-27155](https://cve.now/CVE-2025-27155.md): In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim (CVSS 6.1, matrix-org pinecone · github.com/matrix-org/pinecone)
- [CVE-2024-11957](https://cve.now/CVE-2024-11957.md): Arbitrary Code Execution in WPS Office (CVSS 9.3, Kingsoft WPS Office)
- [CVE-2025-27111](https://cve.now/CVE-2025-27111.md): Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection (CVSS 6.9, rack)
- [CVE-2025-1424](https://cve.now/CVE-2025-1424.md): Privilege Escalation Through SUID Binary and Developer Mode (CVSS 8.6, PocketBook InkPad Color)
- [CVE-2025-1425](https://cve.now/CVE-2025-1425.md): File Read Through Improper Sudo Privilege Management (CVSS 4.7, PocketBook InkPad Color)
- [CVE-2025-23368](https://cve.now/CVE-2025-23368.md): Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli (CVSS 8.1, wildfly-core · Red Hat JBoss Enterprise Application Pla… +11)
- [CVE-2024-9149](https://cve.now/CVE-2024-9149.md): SQLi in Wind Media's E-Commerce Website Template (CVSS 8.6, Wind Media E-Commerce Website Template)
- [CVE-2025-27425](https://cve.now/CVE-2025-27425.md): QR code user confirmation bypass with invalid protocol (CVSS 4.3, Mozilla Firefox for iOS)
- [CVE-2025-27424](https://cve.now/CVE-2025-27424.md): Firefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http Scheme (CVSS 4.3, Mozilla Firefox for iOS)
- [CVE-2025-27426](https://cve.now/CVE-2025-27426.md): Firefox Mobile iOS Full Address Bar Spoof Using Server-Side Redirect to internal error page (CVSS 5.4, Mozilla Firefox for iOS)
- [CVE-2025-1943](https://cve.now/CVE-2025-1943.md): Memory safety bugs fixed in Firefox 136 and Thunderbird 136 (CVSS 8.2, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1938](https://cve.now/CVE-2025-1938.md): Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8 (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1937](https://cve.now/CVE-2025-1937.md): Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1936](https://cve.now/CVE-2025-1936.md): Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1935](https://cve.now/CVE-2025-1935.md): Clickjacking the registerProtocolHandler info-bar (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1942](https://cve.now/CVE-2025-1942.md): Disclosure of uninitialized memory when .toUpperCase() causes string to get longer (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1941](https://cve.now/CVE-2025-1941.md): Lock screen setting bypass in Firefox Focus for Android (CVSS 9.1, Mozilla Firefox)
- [CVE-2025-1934](https://cve.now/CVE-2025-1934.md): Unexpected GC during RegExp bailout processing (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1940](https://cve.now/CVE-2025-1940.md): Android Intent confirmation prompt tapjacking using Select options (CVSS 7.1, Mozilla Firefox)
- [CVE-2025-1933](https://cve.now/CVE-2025-1933.md): JIT corruption of WASM i32 return values on 64-bit CPUs (CVSS 7.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1932](https://cve.now/CVE-2025-1932.md): Inconsistent comparator in XSLT sorting led to out-of-bounds access (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1931](https://cve.now/CVE-2025-1931.md): Use-after-free in WebTransportChild (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1939](https://cve.now/CVE-2025-1939.md): Tapjacking in Android Custom Tabs using transition animations (CVSS 3.9, Mozilla Firefox)
- [CVE-2025-1930](https://cve.now/CVE-2025-1930.md): AudioIPC StreamData could trigger a use-after-free in the Browser process (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1925](https://cve.now/CVE-2025-1925.md): Open5GS AMF nsmf-handler.c amf\_nsmf\_pdusession\_handle\_update\_sm\_context denial of service (CVSS 6.9, Open5GS)
- [CVE-2025-22226](https://cve.now/CVE-2025-22226.md): VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. (CVSS 7.1, KEV, ESXi · VMware Workstation +4)
- [CVE-2025-22225](https://cve.now/CVE-2025-22225.md): VMware ESXi contains an arbitrary write vulnerability. (CVSS 8.2, KEV, VMware ESXi · VMware Cloud Foundation +2)
- [CVE-2025-22224](https://cve.now/CVE-2025-22224.md): VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. (CVSS 9.3, KEV, VMware ESXi · VMware Workstation +3)
- [CVE-2025-0370](https://cve.now/CVE-2025-0370.md): WP Shortcodes Plugin — Shortcodes Ultimate \<= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter (CVSS 6.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2025-0958](https://cve.now/CVE-2025-0958.md): Ultimate WordPress Auction Plugin \<= 4.2.9 - Missing Authorization to Arbitrary Post Deletion (CVSS 5.4, nitesh\_singh Ultimate WordPress Auction Plugin)
- [CVE-2025-0433](https://cve.now/CVE-2025-0433.md): Master Addons \<= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2024-13724](https://cve.now/CVE-2024-13724.md): Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction \<= 2.6.2 - Missing Authorization (CVSS 4.3, wpswings Wallet System for WooCommerce – Digital Wallet, Bu…)
- [CVE-2024-9618](https://cve.now/CVE-2024-9618.md): Master Addons \<= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2025-0512](https://cve.now/CVE-2025-0512.md): Structured Content (JSON-LD) #wpsc \<= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc\_fs\_local\_business Shortcode (CVSS 6.4, gorbo Structured Content (JSON-LD) #wpsc)
- [CVE-2024-13682](https://cve.now/CVE-2024-13682.md): Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction \<= 2.6.2 - Cross-Site Request Forgery (CVSS 4.3, wpswings Wallet System for WooCommerce – Digital Wallet, Bu…)
- [CVE-2024-58050](https://cve.now/CVE-2024-58050.md): Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service… (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-58049](https://cve.now/CVE-2024-58049.md): Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service… (CVSS 5.0, Huawei HarmonyOS)
- [CVE-2024-58048](https://cve.now/CVE-2024-58048.md): Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect… (CVSS 6.7, Huawei HarmonyOS)
- [CVE-2024-58047](https://cve.now/CVE-2024-58047.md): Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service… (CVSS 5.0, Huawei HarmonyOS)
- [CVE-2024-58046](https://cve.now/CVE-2024-58046.md): Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service… (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-58045](https://cve.now/CVE-2024-58045.md): Multi-concurrency vulnerability in the media digital copyright protection module Impact: Successful exploitation of this vulnerability may… (CVSS 8.6, Huawei HarmonyOS)
- [CVE-2025-27521](https://cve.now/CVE-2025-27521.md): Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may… (CVSS 6.8, Huawei HarmonyOS)
- [CVE-2024-58044](https://cve.now/CVE-2024-58044.md): Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect… (CVSS 8.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-58043](https://cve.now/CVE-2024-58043.md): Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service… (CVSS 7.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-13685](https://cve.now/CVE-2024-13685.md): Admin and Site Enhancements (ASE) \< 7.6.10 - Limit Login Attempt Bypass via IP Spoofing (CVSS 5.3, Admin and Site Enhancements)
- [CVE-2025-0360](https://cve.now/CVE-2025-0360.md): During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration… (CVSS 7.8, Axis Communications AB AXIS OS)
- [CVE-2025-0359](https://cve.now/CVE-2025-0359.md): During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework… (CVSS 8.5, Axis Communications AB AXIS OS)
- [CVE-2024-47262](https://cve.now/CVE-2024-47262.md): Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition… (CVSS 5.3, Axis Communications AB AXIS OS)
- [CVE-2024-47260](https://cve.now/CVE-2024-47260.md): 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation… (CVSS 6.5, Axis Communications AB AXIS OS)
- [CVE-2024-47259](https://cve.now/CVE-2024-47259.md): Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input… (CVSS 3.5, Axis Communications AB AXIS OS)
- [CVE-2025-1906](https://cve.now/CVE-2025-1906.md): PHPGurukul Restaurant Table Booking System profile.php sql injection (CVSS 5.1, PHPGurukul Restaurant Table Booking System)
- [CVE-2025-1905](https://cve.now/CVE-2025-1905.md): SourceCodester Employee Management System employee.php cross site scripting (CVSS 5.1, SourceCodester Employee Management System)
- [CVE-2025-1904](https://cve.now/CVE-2025-1904.md): code-projects Blood Bank System A+.php cross site scripting (CVSS 5.1, code-projects Blood Bank System)
- [CVE-2025-1307](https://cve.now/CVE-2025-1307.md): Newscrunch \<= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 9.8, spicethemes Newscrunch)
- [CVE-2025-1306](https://cve.now/CVE-2025-1306.md): Newscrunch \<= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, spicethemes Newscrunch)
- [CVE-2025-1903](https://cve.now/CVE-2025-1903.md): Codezips Online Shopping Website cart\_add.php sql injection (CVSS 6.9, Codezips Online Shopping Website)
- [CVE-2025-1902](https://cve.now/CVE-2025-1902.md): PHPGurukul Student Record System password-recovery.php sql injection (CVSS 6.9, PHPGurukul Student Record System)
- [CVE-2025-24309](https://cve.now/CVE-2025-24309.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-24301](https://cve.now/CVE-2025-24301.md): Arkcompiler Ets Runtime has an UAF vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-23420](https://cve.now/CVE-2025-23420.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-23418](https://cve.now/CVE-2025-23418.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-23414](https://cve.now/CVE-2025-23414.md): Arkcompiler Ets Runtime has an UAF vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-23409](https://cve.now/CVE-2025-23409.md): Communication Dsoftbus has an UAF vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-23240](https://cve.now/CVE-2025-23240.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-23234](https://cve.now/CVE-2025-23234.md): Arkcompiler Ets Runtime has a buffer overflow vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22897](https://cve.now/CVE-2025-22897.md): Arkcompiler Ets Runtime has a buffer overflow vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22847](https://cve.now/CVE-2025-22847.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22841](https://cve.now/CVE-2025-22841.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22837](https://cve.now/CVE-2025-22837.md): Arkcompiler Ets Runtime has a NULL pointer dereference vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22835](https://cve.now/CVE-2025-22835.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-22443](https://cve.now/CVE-2025-22443.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-21098](https://cve.now/CVE-2025-21098.md): Liteos-A has an insecure storage of sensitive information vulnerability (CVSS 5.5, OpenHarmony)
- [CVE-2025-21097](https://cve.now/CVE-2025-21097.md): Arkcompiler Ets Runtime has a NULL pointer dereference vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-21089](https://cve.now/CVE-2025-21089.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-21084](https://cve.now/CVE-2025-21084.md): Arkcompiler Ets Runtime has an NULL pointer dereference vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-20626](https://cve.now/CVE-2025-20626.md): Arkcompiler Ets Runtime has an UAF vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-20091](https://cve.now/CVE-2025-20091.md): Communication Dsoftbus has an UAF vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-20081](https://cve.now/CVE-2025-20081.md): Communication Dsoftbus has an UAF vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-20042](https://cve.now/CVE-2025-20042.md): Liteos-A has an out of bounds read vulnerability (CVSS 5.5, OpenHarmony)
- [CVE-2025-20024](https://cve.now/CVE-2025-20024.md): Arkcompiler Ets Runtime has an integer overflow vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-20021](https://cve.now/CVE-2025-20021.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-20011](https://cve.now/CVE-2025-20011.md): Communication Dsoftbus has a memory leak vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-0587](https://cve.now/CVE-2025-0587.md): Arkcompiler Ets Runtime has an integer overflow vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-1639](https://cve.now/CVE-2025-1639.md): Animation Addons for Elementor Pro \<= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation (CVSS 8.8, crowdyTheme Animation Addons for Elementor Pro)
- [CVE-2025-1321](https://cve.now/CVE-2025-1321.md): teachPress \<= 9.0.7 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, winkm89 teachPress)
- [CVE-2025-0912](https://cve.now/CVE-2025-0912.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.19.4 - Unauthenticated PHP Object Injection (CVSS 9.8, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-13686](https://cve.now/CVE-2024-13686.md): VW Storefront \<= 0.9.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset (CVSS 4.3, vowelweb VW Storefront)
- [CVE-2025-1901](https://cve.now/CVE-2025-1901.md): PHPGurukul Restaurant Table Booking System check\_availability.php sql injection (CVSS 6.9, PHPGurukul Restaurant Table Booking System)
- [CVE-2025-1900](https://cve.now/CVE-2025-1900.md): PHPGurukul Restaurant Table Booking System add-table.php sql injection (CVSS 6.9, PHPGurukul Restaurant Table Booking System)
- [CVE-2025-1899](https://cve.now/CVE-2025-1899.md): Tenda TX3 setPptpUserList buffer overflow (CVSS 7.1, Tenda TX3)
- [CVE-2025-1898](https://cve.now/CVE-2025-1898.md): Tenda TX3 openSchedWifi buffer overflow (CVSS 7.1, Tenda TX3)
- [CVE-2025-1897](https://cve.now/CVE-2025-1897.md): Tenda TX3 SetNetControlList buffer overflow (CVSS 7.1, Tenda TX3)
- [CVE-2025-1896](https://cve.now/CVE-2025-1896.md): Tenda TX3 SetStaticRouteCfg buffer overflow (CVSS 7.1, Tenda TX3)
- [CVE-2025-1895](https://cve.now/CVE-2025-1895.md): Tenda TX3 setMacFilterCfg buffer overflow (CVSS 7.1, Tenda TX3)
- [CVE-2025-1894](https://cve.now/CVE-2025-1894.md): PHPGurukul Restaurant Table Booking System search-result.php sql injection (CVSS 6.9, PHPGurukul Restaurant Table Booking System)
- [CVE-2025-1695](https://cve.now/CVE-2025-1695.md): NGINX Unit Java Vulnerability (CVSS 5.3, F5 NGINX Unit)
- [CVE-2025-1893](https://cve.now/CVE-2025-1893.md): Open5GS AMF gmm-sm.c gmm\_state\_authentication denial of service (CVSS 5.3, Open5GS)
- [CVE-2025-1892](https://cve.now/CVE-2025-1892.md): shishuocms Directory Deletion Page add.json cross site scripting (CVSS 4.8, shishuocms)
- [CVE-2020-23438](https://cve.now/CVE-2020-23438.md): Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation. (CVSS 7.8)
- [CVE-2021-41719](https://cve.now/CVE-2021-41719.md): Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates… (CVSS 7.5)
- [CVE-2024-48248](https://cve.now/CVE-2024-48248.md): NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may l (CVSS 8.6, KEV, NAKIVO Backup & Replication Director)
- [CVE-2024-50704](https://cve.now/CVE-2024-50704.md): Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code… (CVSS 10.0)
- [CVE-2024-50705](https://cve.now/CVE-2024-50705.md): Unauthenticated reflected cross-site scripting (XSS) vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute… (CVSS 7.1)
- [CVE-2024-50706](https://cve.now/CVE-2024-50706.md): Unauthenticated SQL injection vulnerability in Uniguest Tripleplay version 23.1+ allows remote attackers to execute arbitrary SQL queries… (CVSS 9.8)
- [CVE-2024-50707](https://cve.now/CVE-2024-50707.md): Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code… (CVSS 10.0)
- [CVE-2025-25426](https://cve.now/CVE-2025-25426.md): yshopmall \<=v1.9.0 is vulnerable to SQL Injection in the image listing interface. (CVSS 7.2)
- [CVE-2025-26091](https://cve.now/CVE-2025-26091.md): A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to… (CVSS 4.6)
- [CVE-2025-26136](https://cve.now/CVE-2025-26136.md): A SQL injection vulnerability exists in mysiteforme versions prior to 2025.01.1. (CVSS 9.8)
- [CVE-2025-26182](https://cve.now/CVE-2025-26182.md): An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file (CVSS 6.5)
- [CVE-2025-26202](https://cve.now/CVE-2025-26202.md): Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands)… (CVSS 4.3)
- [CVE-2025-26318](https://cve.now/CVE-2025-26318.md): hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently… (CVSS 5.8, TSplus Remote Access)
- [CVE-2025-26319](https://cve.now/CVE-2025-26319.md): FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments. (CVSS 9.8, flowise)
- [CVE-2025-26320](https://cve.now/CVE-2025-26320.md): t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address parameter at /device/ping. (CVSS 6.5)
- [CVE-2025-26849](https://cve.now/CVE-2025-26849.md): There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. (CVSS 4.3, Docusnap)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2025-03-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.