# CVEs published 2025-03-02

30 CVEs were published on March 2, 2025: 0 critical, 2 high. Days are UTC.

- [CVE-2025-1840](https://cve.now/CVE-2025-1840.md): ESAFENET CDG updateorg.jsp sql injection (CVSS 6.9, ESAFENET CDG)
- [CVE-2025-1836](https://cve.now/CVE-2025-1836.md): Incorta Edit Insight csv injection (CVSS 5.3, Incorta)
- [CVE-2025-1835](https://cve.now/CVE-2025-1835.md): osuuu LightPicture Api.php upload unrestricted upload (CVSS 5.3, osuuu LightPicture)
- [CVE-2025-1834](https://cve.now/CVE-2025-1834.md): zj1983 zz resolve unrestricted upload (CVSS 5.3, zj1983 zz)
- [CVE-2025-1833](https://cve.now/CVE-2025-1833.md): zj1983 zz HTTP Request Customer\_noticeAction.java sendNotice server-side request forgery (CVSS 5.3, zj1983 zz)
- [CVE-2025-1832](https://cve.now/CVE-2025-1832.md): zj1983 zz ZroleAction.java getUserList sql injection (CVSS 5.3, zj1983 zz)
- [CVE-2025-1831](https://cve.now/CVE-2025-1831.md): zj1983 zz ZorgAction.java GetDBUser sql injection (CVSS 5.3, zj1983 zz)
- [CVE-2025-1830](https://cve.now/CVE-2025-1830.md): zj1983 zz Customer Information cross site scripting (CVSS 4.8, zj1983 zz)
- [CVE-2025-1829](https://cve.now/CVE-2025-1829.md): TOTOLINK X18 cstecgi.cgi setMtknatCfg os command injection (CVSS 5.3, TOTOLINK X18)
- [CVE-2025-1821](https://cve.now/CVE-2025-1821.md): zj1983 zz ZorgAction.java getUserOrgForUserId sql injection (CVSS 5.3, zj1983 zz)
- [CVE-2024-36353](https://cve.now/CVE-2024-36353.md): Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potential (CVSS 6.5, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +24)
- [CVE-2025-1820](https://cve.now/CVE-2025-1820.md): zj1983 zz ZworkflowAction.java getOaWid sql injection (CVSS 5.3, zj1983 zz)
- [CVE-2025-1819](https://cve.now/CVE-2025-1819.md): Tenda AC7 1200M telnet TendaTelnet os command injection (CVSS 5.3, Tenda AC7)
- [CVE-2025-1818](https://cve.now/CVE-2025-1818.md): zj1983 zz ZfileAction.upload unrestricted upload (CVSS 5.3, zj1983 zz)
- [CVE-2024-55907](https://cve.now/CVE-2024-55907.md): IBM Cognos Mobile information disclosure (CVSS 2.0, IBM Cognos Analytics Mobile)
- [CVE-2025-0895](https://cve.now/CVE-2025-0895.md): IBM Cognos Mobile information disclosure (CVSS 2.4, IBM Cognos Analytics Mobile)
- [CVE-2025-1817](https://cve.now/CVE-2025-1817.md): Mini-Tmall Admin Name admin cross site scripting (CVSS 4.8, Mini-Tmall)
- [CVE-2022-49733](https://cve.now/CVE-2022-49733.md): ALSA: pcm: oss: Fix race at SNDCTL\_DSP\_SYNC (CVSS 7.8, Linux)
- [CVE-2025-1816](https://cve.now/CVE-2025-1816.md): FFmpeg IAMF File iamf\_parse.c audio\_element\_obu memory leak (CVSS 5.3, FFmpeg)
- [CVE-2025-1815](https://cve.now/CVE-2025-1815.md): pbrong hrms resource.go HrmsDB improper authorization (CVSS 6.9, pbrong hrms)
- [CVE-2025-1814](https://cve.now/CVE-2025-1814.md): Tenda AC6 WifiExtraSet stack-based overflow (CVSS 8.7, Tenda AC6)
- [CVE-2025-1813](https://cve.now/CVE-2025-1813.md): zj1983 zz cross-site request forgery (CVSS 5.3, zj1983 zz)
- [CVE-2025-1812](https://cve.now/CVE-2025-1812.md): zj1983 zz SuperZ.java GetUserOrg sql injection (CVSS 5.3, zj1983 zz)
- [CVE-2025-1811](https://cve.now/CVE-2025-1811.md): AT Software Solutions ATSVD Login Endpoint login.aspx sql injection (CVSS 6.9, AT Software Solutions ATSVD)
- [CVE-2025-1810](https://cve.now/CVE-2025-1810.md): Pixsoft Vivaz Login Endpoint servlet cross site scripting (CVSS 5.3, Pixsoft Vivaz)
- [CVE-2025-1809](https://cve.now/CVE-2025-1809.md): Pixsoft Sol Login Endpoint servlet sql injection (CVSS 6.9, Pixsoft Sol)
- [CVE-2025-1808](https://cve.now/CVE-2025-1808.md): Pixsoft E-Saphira Login Endpoint servlet sql injection (CVSS 6.9, Pixsoft E-Saphira)
- [CVE-2025-1807](https://cve.now/CVE-2025-1807.md): Eastnets PaymentSafe Edit Manual Reply directRouter.rfc cross site scripting (CVSS 5.1, Eastnets PaymentSafe)
- [CVE-2025-25724](https://cve.now/CVE-2025-25724.md): list\_item\_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service o (CVSS 4.0, libarchive)
- [CVE-2025-27579](https://cve.now/CVE-2025-27579.md): In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bit (CVSS 5.4, Bitaxe ESP-MIner)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.