CVEs published March 1, 2025
46 CVEs were published on March 1, 2025: 7 critical, 9 high.
- Published
- 46
- Critical
- 7
- High
- 9
- Medium
- 30
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Ubiquiti UniFi Protect Cameras
- 4
- rizinorg rizin
- 2
- sminozzi Database Backup and Table Integrity Check with Aut…
- 2
- themekraft BuddyPress WooCommerce My Account Integration. C…
- 2
- wordplus Better Messages – Live Chat, Chat Rooms, Real-Time…
- 2
- Zorlan SkyCaiji
- 2
- awordpresslife Album Gallery
- 1
- ays-pro Secure Copy Content Protection and Content Locking
- 1
- Blizzard Battle.Net
- 1
- Clicface Trombi
- 1
Critical 7
- CVE-2025-1564SetSail Membership <= 1.0.3 - Authentication Bypass via Account TakeoverSelect-Themes SetSail Membership
- CVE-2025-1671Academist Membership <= 1.1.6 - Authentication Bypass via Account TakeoverElated-Themes Academist Membership
- CVE-2025-1638Alloggio Membership <= 1.1 - Authentication Bypass via Social Login Account TakeoverEdge-Themes Alloggio Membership
- CVE-2024-12824Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Changescriptsbundle Nokri – Job Board WordPress Theme
- CVE-2025-23116An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor witUbiquiti UniFi Protect Application
- CVE-2025-23115A Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi Ubiquiti UniFi Protect Cameras
- CVE-2025-27554ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commanToDesktop
High 9
- CVE-2025-1804Blizzard Battle.Net profapi.dll uncontrolled search pathBlizzard Battle.Net
- CVE-2024-13833Album Gallery – WordPress Gallery <= 1.6.3 - Authenticated (Editor+) PHP Object Injection via Gallery Metaawordpresslife Album Gallery
- CVE-2024-13910Database Backup and check Tables Automated With Scheduler 2024 <= 2.36 - Authenticated (Administrator+) Arbitrary File Deletionsminozzi Database Backup and Table Integrity Check with Aut…
- CVE-2024-13611Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Unauthenticated Sensitive Information Exposure Through Unprotected Directorywordplus Better Messages – Live Chat, Chat Rooms, Real-Time…
- CVE-2024-12544SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 1.12.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion via SurveyJS_DeleteFiledevsoftbaltic SurveyJS: Drag & Drop Form Builder
- CVE-2024-13911Database Backup and check Tables Automated With Scheduler 2024 <= 2.35 - Authenticated (Administrator+) Sensitive Information Exposuresminozzi Database Backup and Table Integrity Check with Aut…
- CVE-2024-13373Exertio Framework <= 1.3.1 - Unauthenticated Arbitrary User Password Updatescriptsbundle Exertio Framework
- CVE-2024-13568Fluent Support – Helpdesk & Customer Support Ticket System <= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directorytechjewel Fluent Support – Helpdesk & Customer Support Tick…
- CVE-2025-23119An Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Execution (RCE) by a maUbiquiti UniFi Protect Cameras
Medium, low and unrated 30
- CVE-2025-1806Eastnets PaymentSafe URL Default.aspx improper authorizationEastnets PaymentSafe
- CVE-2025-1800D-Link DAR-7000 HTTP POST Request sxh_vpnlic.php get_ip_addr_details command injectionD-Link DAR-7000
- CVE-2025-1799Zorlan SkyCaiji Tool.php previewAction server-side request forgeryZorlan SkyCaiji
- CVE-2025-1797Hunan Zhonghe Baiyi Information Technology Baiyiyun Asset Management and Operations System anyUserBoundHouse.php sql injectionHunan Zhonghe Baiyi Information Technology Baiyiyun Asset M…
- CVE-2024-41778IBM Controller information disclosureIBM Controller
- CVE-2025-1791Zorlan SkyCaiji Tool.php fileAction unrestricted uploadZorlan SkyCaiji
- CVE-2025-1788rizinorg rizin utf8.c rz_utf8_encode heap-based overflowrizinorg rizin
- CVE-2025-1491WP Posts Carousel <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play_timeout Parameterteastudiopl WP Posts Carousel
- CVE-2025-1404Secure Copy Content Protection and Content Locking <= 4.4.7 - Missing Authorization to Unauthenticated User Email Retrieval via ays_sccp_reports_user_search Functionays-pro Secure Copy Content Protection and Content Locking
- CVE-2025-1786rizinorg rizin pdb.c msf_stream_directory_free buffer overflowrizinorg rizin
- CVE-2024-13546GenerateBlocks <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description'edge22 GenerateBlocks
- CVE-2024-13697Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_linkswordplus Better Messages – Live Chat, Chat Rooms, Real-Time…
- CVE-2025-1291Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2024-13806Authors List <= 2.0.6 - Unauthenticated Arbitrary Shortcode Executionwpkube Authors List
- CVE-2025-1459Page Builder by SiteOrigin <= 2.31.4 - Authenticated (Contributor+) Stored Cross-Site Scriptinggpriday Page Builder by SiteOrigin
- CVE-2025-1730Simple Download Counter <= 2.0 - Authenticated (Author+) Arbitrary File Readspecialk Simple Download Counter
- CVE-2025-1502IP2Location Redirection <= 1.33.3 - Missing Authorization to Unauthenticated Settings ExportIP2Location Redirection
- CVE-2024-13901Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site <= 2.0.6 - Authenticated (Administrator+) DOM-Based Stored Cross-Site Scriptingwpcalc Counter Box – Add Countdowns, Timers & Dynamic Count…
- CVE-2024-9212SKU Generator for WooCommerce <= 1.6.2 - Reflected Cross-Site Scriptingwpwham SKU Generator for WooCommerce
- CVE-2024-13559TemplatesNext ToolKit <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodemarsian TemplatesNext ToolKit
- CVE-2024-13518Simple:Press <= 6.10.12 - Cross-Site Request Forgery to Unauthorized Post Editingsimplepress Simple:Press Forum
- CVE-2024-13750Multilevel Referral Affiliate Plugin for WooCommerce <= 2.28 - Authenticated (Subscriber+) SQL Injectionprismitsystems Multilevel Referral Plugin for WooCommerce
- CVE-2024-13746Booking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functionsimznarf Booking Calendar and Notification
- CVE-2024-9217Currency Switcher for WooCommerce <= 2.16.2 - Reflected Cross-Site Scriptingwpwham Currency Switcher for WooCommerce
- CVE-2025-0820Clicface Trombi <= 2.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via nom ParameterClicface Trombi
- CVE-2025-1780BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.25 - Cross-Site Request Forgery to Limited Settings Updatethemekraft BuddyPress WooCommerce My Account Integration. C…
- CVE-2024-13358BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Updatethemekraft BuddyPress WooCommerce My Account Integration. C…
- CVE-2025-23117An Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras aUbiquiti UniFi Protect Cameras
- CVE-2025-23118An Improper Certificate Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent Ubiquiti UniFi Protect Cameras
- CVE-2025-27416Asking For Scratch Username And PasswordScratch-Coding-Hut.github.io