# CVEs published 2025-03-01

46 CVEs were published on March 1, 2025: 7 critical, 9 high. Days are UTC.

- [CVE-2025-1806](https://cve.now/CVE-2025-1806.md): Eastnets PaymentSafe URL Default.aspx improper authorization (CVSS 5.3, Eastnets PaymentSafe)
- [CVE-2025-1804](https://cve.now/CVE-2025-1804.md): Blizzard Battle.Net profapi.dll uncontrolled search path (CVSS 7.3, Blizzard Battle.Net)
- [CVE-2025-1800](https://cve.now/CVE-2025-1800.md): D-Link DAR-7000 HTTP POST Request sxh\_vpnlic.php get\_ip\_addr\_details command injection (CVSS 5.3, D-Link DAR-7000)
- [CVE-2025-1799](https://cve.now/CVE-2025-1799.md): Zorlan SkyCaiji Tool.php previewAction server-side request forgery (CVSS 5.3, Zorlan SkyCaiji)
- [CVE-2025-1797](https://cve.now/CVE-2025-1797.md): Hunan Zhonghe Baiyi Information Technology Baiyiyun Asset Management and Operations System anyUserBoundHouse.php sql injection (CVSS 5.3, Hunan Zhonghe Baiyi Information Technology Baiyiyun Asset M…)
- [CVE-2024-41778](https://cve.now/CVE-2024-41778.md): IBM Controller information disclosure (CVSS 5.3, IBM Controller)
- [CVE-2025-1791](https://cve.now/CVE-2025-1791.md): Zorlan SkyCaiji Tool.php fileAction unrestricted upload (CVSS 5.3, Zorlan SkyCaiji)
- [CVE-2025-1788](https://cve.now/CVE-2025-1788.md): rizinorg rizin utf8.c rz\_utf8\_encode heap-based overflow (CVSS 4.8, rizinorg rizin)
- [CVE-2025-1491](https://cve.now/CVE-2025-1491.md): WP Posts Carousel \<= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto\_play\_timeout Parameter (CVSS 6.4, teastudiopl WP Posts Carousel)
- [CVE-2024-13833](https://cve.now/CVE-2024-13833.md): Album Gallery – WordPress Gallery \<= 1.6.3 - Authenticated (Editor+) PHP Object Injection via Gallery Meta (CVSS 7.2, awordpresslife Album Gallery)
- [CVE-2025-1404](https://cve.now/CVE-2025-1404.md): Secure Copy Content Protection and Content Locking \<= 4.4.7 - Missing Authorization to Unauthenticated User Email Retrieval via ays\_sccp\_reports\_user\_search Function (CVSS 5.3, ays-pro Secure Copy Content Protection and Content Locking)
- [CVE-2025-1786](https://cve.now/CVE-2025-1786.md): rizinorg rizin pdb.c msf\_stream\_directory\_free buffer overflow (CVSS 4.8, rizinorg rizin)
- [CVE-2024-13546](https://cve.now/CVE-2024-13546.md): GenerateBlocks \<= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get\_image\_description' (CVSS 4.3, edge22 GenerateBlocks)
- [CVE-2024-13910](https://cve.now/CVE-2024-13910.md): Database Backup and check Tables Automated With Scheduler 2024 \<= 2.36 - Authenticated (Administrator+) Arbitrary File Deletion (CVSS 7.2, sminozzi Database Backup and Table Integrity Check with Aut…)
- [CVE-2024-13697](https://cve.now/CVE-2024-13697.md): Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss \<= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice\_links (CVSS 4.8, wordplus Better Messages – Live Chat, Chat Rooms, Real-Time…)
- [CVE-2025-1291](https://cve.now/CVE-2025-1291.md): Gutenberg Blocks by Kadence Blocks \<= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2024-13611](https://cve.now/CVE-2024-13611.md): Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss \<= 2.6.9 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 7.5, wordplus Better Messages – Live Chat, Chat Rooms, Real-Time…)
- [CVE-2024-12544](https://cve.now/CVE-2024-12544.md): SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity \<= 1.12.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion via SurveyJS\_DeleteFile (CVSS 8.8, devsoftbaltic SurveyJS: Drag & Drop Form Builder)
- [CVE-2024-13806](https://cve.now/CVE-2024-13806.md): Authors List \<= 2.0.6 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, wpkube Authors List)
- [CVE-2024-13911](https://cve.now/CVE-2024-13911.md): Database Backup and check Tables Automated With Scheduler 2024 \<= 2.35 - Authenticated (Administrator+) Sensitive Information Exposure (CVSS 7.2, sminozzi Database Backup and Table Integrity Check with Aut…)
- [CVE-2025-1564](https://cve.now/CVE-2025-1564.md): SetSail Membership \<= 1.0.3 - Authentication Bypass via Account Takeover (CVSS 9.8, Select-Themes SetSail Membership)
- [CVE-2025-1671](https://cve.now/CVE-2025-1671.md): Academist Membership \<= 1.1.6 - Authentication Bypass via Account Takeover (CVSS 9.8, Elated-Themes Academist Membership)
- [CVE-2025-1638](https://cve.now/CVE-2025-1638.md): Alloggio Membership \<= 1.1 - Authentication Bypass via Social Login Account Takeover (CVSS 9.8, Edge-Themes Alloggio Membership)
- [CVE-2025-1459](https://cve.now/CVE-2025-1459.md): Page Builder by SiteOrigin \<= 2.31.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gpriday Page Builder by SiteOrigin)
- [CVE-2025-1730](https://cve.now/CVE-2025-1730.md): Simple Download Counter \<= 2.0 - Authenticated (Author+) Arbitrary File Read (CVSS 6.5, specialk Simple Download Counter)
- [CVE-2025-1502](https://cve.now/CVE-2025-1502.md): IP2Location Redirection \<= 1.33.3 - Missing Authorization to Unauthenticated Settings Export (CVSS 5.3, IP2Location Redirection)
- [CVE-2024-13373](https://cve.now/CVE-2024-13373.md): Exertio Framework \<= 1.3.1 - Unauthenticated Arbitrary User Password Update (CVSS 8.1, scriptsbundle Exertio Framework)
- [CVE-2024-12824](https://cve.now/CVE-2024-12824.md): Nokri – Job Board WordPress Theme \<= 1.6.2 - Unauthenticated Arbitrary Password Change (CVSS 9.8, scriptsbundle Nokri – Job Board WordPress Theme)
- [CVE-2024-13901](https://cve.now/CVE-2024-13901.md): Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site \<= 2.0.6 - Authenticated (Administrator+) DOM-Based Stored Cross-Site Scripting (CVSS 4.4, wpcalc Counter Box – Add Countdowns, Timers & Dynamic Count…)
- [CVE-2024-9212](https://cve.now/CVE-2024-9212.md): SKU Generator for WooCommerce \<= 1.6.2 - Reflected Cross-Site Scripting (CVSS 6.1, wpwham SKU Generator for WooCommerce)
- [CVE-2024-13559](https://cve.now/CVE-2024-13559.md): TemplatesNext ToolKit \<= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, marsian TemplatesNext ToolKit)
- [CVE-2024-13518](https://cve.now/CVE-2024-13518.md): Simple:Press \<= 6.10.12 - Cross-Site Request Forgery to Unauthorized Post Editing (CVSS 4.3, simplepress Simple:Press Forum)
- [CVE-2024-13750](https://cve.now/CVE-2024-13750.md): Multilevel Referral Affiliate Plugin for WooCommerce \<= 2.28 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, prismitsystems Multilevel Referral Plugin for WooCommerce)
- [CVE-2024-13746](https://cve.now/CVE-2024-13746.md): Booking Calendar and Notification \<= 4.0.3 - Missing Authorization via wpcb\_all\_bookings, wpcb\_update\_booking\_post, and wpcb\_delete\_posts Functions (CVSS 6.5, imznarf Booking Calendar and Notification)
- [CVE-2024-9217](https://cve.now/CVE-2024-9217.md): Currency Switcher for WooCommerce \<= 2.16.2 - Reflected Cross-Site Scripting (CVSS 6.1, wpwham Currency Switcher for WooCommerce)
- [CVE-2025-0820](https://cve.now/CVE-2025-0820.md): Clicface Trombi \<= 2.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via nom Parameter (CVSS 6.4, Clicface Trombi)
- [CVE-2024-13568](https://cve.now/CVE-2024-13568.md): Fluent Support – Helpdesk & Customer Support Ticket System \<= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 7.5, techjewel Fluent Support – Helpdesk & Customer Support Tick…)
- [CVE-2025-1780](https://cve.now/CVE-2025-1780.md): BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages \<= 3.4.25 - Cross-Site Request Forgery to Limited Settings Update (CVSS 4.3, themekraft BuddyPress WooCommerce My Account Integration. C…)
- [CVE-2024-13358](https://cve.now/CVE-2024-13358.md): BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages \<= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update (CVSS 4.3, themekraft BuddyPress WooCommerce My Account Integration. C…)
- [CVE-2025-23119](https://cve.now/CVE-2025-23119.md): An Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Execution (RCE) by a ma (CVSS 7.5, Ubiquiti UniFi Protect Cameras)
- [CVE-2025-23116](https://cve.now/CVE-2025-23116.md): An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor wit (CVSS 9.6, Ubiquiti UniFi Protect Application)
- [CVE-2025-23115](https://cve.now/CVE-2025-23115.md): A Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi (CVSS 9.0, Ubiquiti UniFi Protect Cameras)
- [CVE-2025-23117](https://cve.now/CVE-2025-23117.md): An Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras a (CVSS 6.8, Ubiquiti UniFi Protect Cameras)
- [CVE-2025-23118](https://cve.now/CVE-2025-23118.md): An Improper Certificate Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent (CVSS 6.4, Ubiquiti UniFi Protect Cameras)
- [CVE-2025-27416](https://cve.now/CVE-2025-27416.md): Asking For Scratch Username And Password (CVSS 5.9, Scratch-Coding-Hut.github.io)
- [CVE-2025-27554](https://cve.now/CVE-2025-27554.md): ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary comman (CVSS 9.9, ToDesktop)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.