CVEs published March 3, 2025
349 CVEs were published on March 3, 2025: 24 critical, 209 high.
- Published
- 349
- Critical
- 24
- High
- 209
- Medium
- 110
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- Qualcomm Snapdragon
- 27
- Esri ArcGIS Server
- 23
- grub2 · Red Hat Enterprise Linux +1
- 10
- Mayuri K 101news
- 7
- i-Drive i11 · i-Drive i12
- 5
- LabRedesCefetRJ WeGIA
- 5
- GitLab
- 4
- Paragon Software Migrate OS to SSD · Paragon Software Di… +4
- 4
- zj1983 zz
- 4
- IBM Engineering Requirements Management DOORS Next
- 3
Critical 24
- CVE-2025-27419Denial of Service (DoS) in WeGIA due to Recursive Crawling of Dynamic URLsLabRedesCefetRJ WeGIA
- CVE-2024-55532Apache Ranger: Improper Neutralization of Formula Elements in a CSV FileApache Software Foundation Apache Ranger · org.apache.range…
- CVE-2024-8262Path Traversal in Proliz Software's OBSProliz Software OBS
- CVE-2025-26988WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - SQL Injection vulnerabilityCozy Vision SMS Alert Order Notifications
- CVE-2025-26970WordPress Ark Theme Core plugin < 1.71.0 - Unauthenticated Remote Code Execution (RCE) vulnerabilityFRESHFACE Ark Theme Core
- CVE-2025-27270WordPress Residential Address Detection Plugin <= 2.5.4 - Arbitrary Option Update to Privilege Escalation vulnerabilityenituretechnology Residential Address Detection
- CVE-2025-27268WordPress Small Package Quotes – Worldwide Express Edition Plugin <= 5.2.18 - SQL Injection vulnerabilityenituretechnology Small Package Quotes – Worldwide Express…
- CVE-2025-26535WordPress Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop plugin <= 1.7.6 - SQL Injection vulnerabilityCodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce
- CVE-2025-25150WordPress uListing plugin <= 2.1.6 - SQL Injection vulnerabilityStylemix uListing
- CVE-2025-1875SQL injection vulnerability in 101newsMayuri K 101news
- CVE-2025-1874SQL injection vulnerability in 101newsMayuri K 101news
- CVE-2025-1873SQL injection vulnerability in 101newsMayuri K 101news
- CVE-2025-1872SQL injection vulnerability in 101newsMayuri K 101news
- CVE-2025-1871SQL injection vulnerability in 101newsMayuri K 101news
- CVE-2025-1870SQL injection vulnerability in 101newsMayuri K 101news
- CVE-2025-1869SQL injection vulnerability in 101newsMayuri K 101news
- CVE-2025-1867HTTP Response Smuggling Vulnerability in libhvithewei libhv
- CVE-2025-1866Undefined Behavior Due to Out-of-Bounds Pointer Arithmetic in libwebsocketswarmcat libwebsockets
- CVE-2025-1864Buffer Overflow and Potential Code Execution in Radare2radareorg radare2
- CVE-2025-20646In wlan AP FW, there is a possible out of bounds write due to improper input validation.MediaTek MT6890, MT7915, MT7916, MT7981, MT7986
- CVE-2025-25948Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS)
- CVE-2025-26206Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html co
- CVE-2025-27583Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Informati
- CVE-2025-27590In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux usOxidized Web project Oxidized Web · oxidized-web
High 209
- CVE-2024-51962SQL injection vulnerability in ArcGIS ServerEsri ArcGIS Server
- CVE-2024-51961Local file inclusion (LFI) vulnerability in ArcGIS ServerEsri ArcGIS Server
- CVE-2024-51954Unauthorized access to secure services in ArcGIS ServerEsri ArcGIS Server
- CVE-2025-27501Server Side Request Forgery in Ziti Consoleopenziti ziti-console
- CVE-2025-1877D-Link DAP-1562 HTTP POST Request pure_auth_check null pointer dereferenceD-Link DAP-1562
- CVE-2025-27500Cross Site Scripting potential in Ziti Consoleopenziti ziti-console
- CVE-2025-0678Grub2: squash4: integer overflow may lead to heap based out-of-bounds write when reading datagrub2 · Red Hat Enterprise Linux +1
- CVE-2024-45782Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382)grub2 · Red Hat Enterprise Linux +1
- CVE-2025-25302Rembg CORS misconfigurationdanielgatis rembg · rembg
- CVE-2025-27423Improper Input Validation in Vimvim
- CVE-2025-27422FACTION Allows Authentication Bypass via User Creationfactionsecurity faction
- CVE-2025-0285CVE-2025-0285Paragon Software Migrate OS to SSD · Paragon Software Di… +4
- CVE-2025-0286CVE-2025-0286Paragon Software Partition Manager · Paragon Software Ha… +4
- CVE-2025-0288CVE-2025-0288Paragon Software Migrate OS to SSD · Paragon Software Di… +4
- CVE-2025-0289CVE-2025-0289Paragon Software Migrate OS to SSD · Paragon Software Di… +4
- CVE-2025-27421Goroutine Leak in Abacus SSE ImplementationJasonLovesDoggo abacus · github.com/jasonlovesdoggo/abacus
- CVE-2025-0555Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-25185GPT Academic allows arbitary file read by tarfile uncompress within softlinkbinary-husky gpt_academic
- CVE-2024-41771IBM Engineering Requirements Management DOORS Next information disclosureIBM Engineering Requirements Management DOORS Next
- CVE-2024-41770IBM Engineering Requirements Management DOORS Next information disclosureIBM Engineering Requirements Management DOORS Next
- CVE-2024-43169IBM Engineering Requirements Management DOORS Next file downloadIBM Engineering Requirements Management DOORS Next
- CVE-2025-1801Aap-gateway: aap-gateway privilege escalationautomation-gateway · Red Hat Ansible Automation Platform 2.…
- CVE-2024-8261IDOR in Proliz Software's OBSProliz Software OBS
- CVE-2025-0689Grub2: udf: heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code executiongrub2 · Red Hat Enterprise Linux +1
- CVE-2025-1125Grub2: fs/hfs: integer overflow may lead to heap based out-of-bounds writegrub2 · Red Hat Enterprise Linux +1
- CVE-2024-47092Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-apicheck-mk-api
- CVE-2025-26994WordPress Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerabilitysoftdiscover Zigaform – Price Calculator & Cost Estimation…
- CVE-2025-26989WordPress Zigaform – Form Builder Lite plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerabilitysoftdiscover Zigaform
- CVE-2025-26984WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - Reflected Cross Site Scripting (XSS) vulnerabilityCozy Vision SMS Alert Order Notifications
- CVE-2025-26967WordPress Events Calendar for GeoDirectory plugin <= 2.3.14 - PHP Object Injection vulnerabilityStiofan Events Calendar for GeoDirectory
- CVE-2025-26918WordPress Small Package Quotes – Unishippers Edition plugin <= 2.4.9 - Reflected Cross Site Scripting (XSS) vulnerabilityenituretechnology Small Package Quotes – Unishippers Edition
- CVE-2025-26917WordPress WP Templata plugin <= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityHasThemes WP Templata
- CVE-2025-26914WordPress Variable Inspector plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityBowo Variable Inspector
- CVE-2025-26885WordPress Assistant Plugin <= 1.5.1 - PHP Object Injection vulnerabilityBeaver Builder WordPress Assistant
- CVE-2025-26879WordPress s2Member Plugin <= 241216 - Reflected Cross Site Scripting (XSS) vulnerabilityCristián Lávaque s2Member
- CVE-2025-27279WordPress Flashfader Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitylynk Flashfader
- CVE-2025-27278WordPress AcuGIS Leaflet Maps Plugin <= 5.1.1.0 - Multiple Cross Site Scripting (XSS) vulnerabilitiesDavid Ghedini AcuGIS Leaflet Maps
- CVE-2025-27275WordPress WOO Codice Fiscale plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityandrew_fisher WOO Codice Fiscale
- CVE-2025-27271WordPress DB Tables Import/Export Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityAlberto Cocchiara DB Tables Import/Export
- CVE-2025-27269WordPress .htaccess Login block Plugin <= 0.9a - Reflected Cross Site Scripting (XSS) vulnerabilityAnton Aleksandrov .htaccess Login block
- CVE-2025-27264WordPress Doctor Appointment Booking Plugin <= 1.0.0 - Local File Inclusion vulnerabilityCreativeitem Doctor Appointment Booking
- CVE-2025-27263WordPress Doctor Appointment Booking Plugin <= 1.0.0 - SQL Injection vulnerabilityCreativeitem Doctor Appointment Booking
- CVE-2025-26589WordPress IE CSS3 Support Plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityCristopher Dino IE CSS3 Support
- CVE-2025-26588WordPress TTT Crop Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitygabrielperezs TTT Crop
- CVE-2025-26587WordPress sidebarTabs Plugin <= 3.1 - Reflected Cross Site Scripting (XSS) vulnerabilitynghorta sidebarTabs
- CVE-2025-26586WordPress Events Planner Plugin <= 1.3.10 - Reflected Cross Site Scripting (XSS) vulnerabilityabelony Events Planner
- CVE-2025-26585WordPress DL Leadback Plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityDyadyaLesha DL Leadback
- CVE-2025-26563WordPress Rocket Mobile Plugin <= 0.4.2 - Cross Site Scripting (XSS) vulnerabilityMuneeb Mobile
- CVE-2025-26557WordPress ViperBar Plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityviperchill ViperBar
- CVE-2025-26540WordPress Helloprint Plugin <= 2.0.7 - Arbitrary File Deletion vulnerabilityHelloprint
- CVE-2025-26534WordPress Helloprint Plugin <= 2.0.7 - Arbitrary File Deletion vulnerabilityHelloprint
- CVE-2025-25170WordPress Migrate Posts Plugin <=1.0 - Post Based Cross Site Scripting (XSS) vulnerabilityDotsquaresLtd Migrate Posts
- CVE-2025-25169WordPress Authors Autocomplete Meta Box plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityRachel Cherry Authors Autocomplete Meta Box
- CVE-2025-25165WordPress Staff Directory Plugin: Company Directory Plugin <= 4.3 - Cross Site Scripting (XSS) vulnerabilityrichardgabriel Staff Directory Plugin: Company Directory
- CVE-2025-25164WordPress Meta Accelerator plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityYuichiro ABE Meta Accelerator
- CVE-2025-25162WordPress Sports Rankings and Lists plugin <= 2.3 - Arbitrary File Download vulnerabilitykutu62 Sports Rankings and Lists
- CVE-2025-25161WordPress WP Find Your Nearest Plugin <= 0.3.1 - CSRF to Settings Change vulnerabilitySocialEvolution WP Find Your Nearest
- CVE-2025-25158WordPress Uncomplicated SEO plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityAntonio Sanchez Uncomplicated SEO
- CVE-2025-25157WordPress WP Church Center Plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilitywpchurchteam WP Church Center
- CVE-2025-25142WordPress WP Less Compiler plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityThe Jake Group WP Less Compiler
- CVE-2025-25133WordPress WP Frontend Submit Plugin <= 1.1.0 - Reflected Cross-Site Scripting vulnerabilitynewbiesup WP Frontend Submit
- CVE-2025-25132WordPress Visitor Details plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityravi Singh Visitor Details
- CVE-2025-25130WordPress Delete Comments By Status plugin <= 1.5.3 - Local File Inclusion vulnerabilityShah Alom Delete Comments By Status
- CVE-2025-25129WordPress Callback Request plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityNotFound Callback Request
- CVE-2025-25127WordPress Contact Us By Lord Linus Plugin <= 2.6 - Reflected Cross Site Scripting (XSS) vulnerabilityRohitashv Singhal Contact Us By Lord Linus
- CVE-2025-25124WordPress Status Updater Plugin <= 9.21 - Reflected Cross Site Scripting (XSS) vulnerabilitydevu Status Updater
- CVE-2025-25122WordPress WizShop Plugin <= 3.0.2 - Local File Inclusion vulnerabilityhashshop WizShop
- CVE-2025-25119WordPress Woocommerce osCommerce Sync plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerabilityAlejandro Aranda Woocommerce osCommerce Sync
- CVE-2025-25118WordPress WPOptin plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilityDanish Ali Malik Top Bar – PopUps – by WPOptin
- CVE-2025-25114WordPress User Role plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityehabstar User Role
- CVE-2025-25113WordPress Implied Cookie Consent plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitySenktec Implied Cookie Consent
- CVE-2025-25112WordPress Social Links plugin <= 1.2 - SQL Injection vulnerabilitykareemsultan Social Links
- CVE-2025-25109WordPress Vehicle Manager plugin <= 3.1 - Local File Inclusion vulnerabilityJoomSky WP Vehicle Manager
- CVE-2025-25108WordPress SW Plus Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityshalomworld SW Plus
- CVE-2025-25102WordPress Yahoo BOSS Plugin <= 0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityJosh Harrison Yahoo BOSS
- CVE-2025-25099WordPress Appointment Buddy Widget By Accrete plugin <= 1.2. - Reflected Cross-Site Scripting vulnerabilityaccreteinfosolution Appointment Buddy Widget
- CVE-2025-25092WordPress All push notification for WP plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerabilitygtlwpdev All push notification for WP
- CVE-2025-25090WordPress Dreamstime Stock Photos plugin <= 4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityDreamstime Stock Photos
- CVE-2025-25089WordPress Image Rotator plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityappten Image Rotator
- CVE-2025-25087WordPress seekXL Snapr plugin <= 2.0.6 - Reflected Cross Site Scripting (XSS) vulnerabilityTim seekXL Snapr
- CVE-2025-25083WordPress EP4 More Embeds Plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerabilityDave Lavoie EP4 More Embeds
- CVE-2025-25070WordPress Album Reviewer plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityed atrero Album Reviewer
- CVE-2025-24758WordPress CM Map Locations plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityCreativeMindsSolutions CM Map Locations
- CVE-2025-24694WordPress CM Pop-Up Banners plugin <= 1.7.6 - Reflected Cross Site Scripting (XSS) vulnerabilityCreativeMindsSolutions CM Pop-Up banners
- CVE-2025-23956WordPress WP Easy Post Mailer Plugin <= 0.64 - Reflected Cross Site Scripting (XSS) vulnerabilityRichard Leishman WP Easy Post Mailer
- CVE-2025-23945WordPress Popliup Plugin <= 1.1.1 - Local File Inclusion vulnerabilityWebliup Popliup
- CVE-2025-23904WordPress Rebrand Fluent Forms Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityrebrandpress Rebrand Fluent Forms
- CVE-2025-23903WordPress Local Shipping Labels for WooCommerce Plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitywoofx Local Shipping Labels for WooCommerce
- CVE-2025-23883WordPress Stray Random Quotes Plugin <= 1.9.9 - Reflected Cross Site Scripting (XSS) vulnerabilityunalignedcoder Stray Random Quotes
- CVE-2025-23881WordPress LJ Custom Menu Links Plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerabilitylittlejon LJ Custom Menu Links
- CVE-2025-23879WordPress Easy Automatic Newsletter Lite Plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityPillarDev Easy Automatic Newsletter Lite
- CVE-2025-23852WordPress First Comment Redirect plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityrobin90 First Comment Redirect
- CVE-2025-23850WordPress Mojo Under Construction Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilitymojowill Mojo Under Construction
- CVE-2025-23847WordPress Site Launcher Plugin <= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerabilitysaill Site Launcher
- CVE-2025-23843WordPress WP-HR Manager plugin <= 3.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitywphrmanager WP-HR Manager: The Human Resources Plugin for W…
- CVE-2025-23814WordPress CRUDLab Like Box Plugin <= 2.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityCRUDLab Like Box
- CVE-2025-23813WordPress Guten Free Options Plugin <= 0.9.7 - Reflected Cross Site Scripting (XSS) vulnerabilityTony Hayes Guten Free Options
- CVE-2025-23762WordPress DsgnWrks Twitter Importer plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityJustin Sternberg DsgnWrks Twitter Importer
- CVE-2025-23753WordPress DN Sitemap Control plugin <= 1.0.6 - Reflected Cross Site Scripting (XSS) vulnerabilitydigireturn DN Sitemap Control
- CVE-2025-23741WordPress Notifications Center plugin <= 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityFlorian Chaillou Notifications Center
- CVE-2025-23740WordPress Easy School Registration plugin <= 3.9.8 - Reflected Cross Site Scripting (XSS) vulnerabilityZbynek Nedoma Easy School Registration
- CVE-2025-23739WordPress WP Ultimate Reviews FREE plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityjtibbles WP Ultimate Reviews FREE
- CVE-2025-23738WordPress Ps Ads Pro plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityPadam Shankhadev Ps Ads Pro
- CVE-2025-23736WordPress Form To JSON plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitywebgdawg Form To JSON
- CVE-2025-23731WordPress Tax Report for WooCommerce plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityinfosoftplugin Tax Report for WooCommerce
- CVE-2025-23726WordPress ComparePress plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilitythebloghouse ComparePress
- CVE-2025-23721WordPress Mobigate plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilitycloudvn Mobigate
- CVE-2025-23718WordPress Mancx AskMe Widget plugin <= 0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMancx AskMe Widget
- CVE-2025-23716WordPress Login Watchdog plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityJkmAS Login Watchdog
- CVE-2025-23688WordPress Cobwebo URL Plugin plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityeditionskezzal Cobwebo URL Plugin
- CVE-2025-23670WordPress 4 author cheer up donate plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitymontashov 4 author cheer up donate
- CVE-2025-23668WordPress ChatGPT Open AI Images & Content for WooCommerce plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityMauricio Urrego ChatGPT Open AI Images & Content for WooCom…
- CVE-2025-23663WordPress Contexto plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityAdrian Vaquez Contexto
- CVE-2025-23637WordPress 新淘客WordPress插件 plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityfxy060608 新淘客WordPress插件
- CVE-2025-23635WordPress ePermissions plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilitymobde3net ePermissions
- CVE-2025-23619WordPress Catch Duplicate Switcher plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityCatch Themes Catch Duplicate Switcher
- CVE-2025-23616WordPress Canalplan plugin <= 5.31 - Reflected Cross Site Scripting (XSS) vulnerabilitySteve Canalplan
- CVE-2025-23600WordPress Send to a Friend Addon plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilitypinal.shah Send to a Friend Addon
- CVE-2025-23595WordPress Page Health-O-Meter plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilitybrainpulse Page Health-O-Meter
- CVE-2025-23587WordPress all-in-one-box-login plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityAshek Al Mahmud all-in-one-box-login
- CVE-2025-23586WordPress WP Post Category Notifications plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityMAL73049 WP Post Category Notifications
- CVE-2025-23585WordPress Goo.gl Url Shorter plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityCantonBolo Goo.gl Url Shorter
- CVE-2025-23584WordPress Pin Locations on Map plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityarsh91 Pin Locations on Map
- CVE-2025-23576WordPress WP Intro.JS Plugin plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitycfuze WP Intro.JS
- CVE-2025-23575WordPress DX Sales CRM plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityDevriX DX Sales CRM
- CVE-2025-23570WordPress WP Social Links plugin <= 0.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityMitchell Bundy WP Social Links
- CVE-2025-23565WordPress Wibstats plugin <= 0.5.5 - Reflected Cross Site Scripting (XSS) vulnerabilityChris Taylor Wibstats
- CVE-2025-23564WordPress WP FixTag plugin <= v2.0.2 - Cross Site Scripting (XSS) vulnerabilitymohsenshahbazi WP FixTag
- CVE-2025-23563WordPress Explore pages plugin <= 1.01 - Reflected Cross Site Scripting (XSS) vulnerabilitymbyte Explore pages
- CVE-2025-23556WordPress Push Envoy Notifications plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilitynetbitsolutions Push Envoy Notifications
- CVE-2025-23555WordPress Ui Slider Filter By Price plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitychenyenming Ui Slider Filter By Price
- CVE-2025-23553WordPress Userbase Access Control plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityDavid Cramer Userbase Access Control
- CVE-2025-23552WordPress Texteller plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityYashar Texteller
- CVE-2025-23549WordPress Maniac SEO plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityagora32 Maniac SEO
- CVE-2025-23539WordPress Awesome Hooks plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilitysurror Awesome Hooks
- CVE-2025-23538WordPress WP Contest plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySophia M Williams WP Contest
- CVE-2025-23536WordPress Track Page Scroll plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitymndpsingh287 Track Page Scroll
- CVE-2025-23526WordPress Swift Calendar Online Appointment Scheduling plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilitySwiftCloud Swift Calendar Online Appointment Scheduling
- CVE-2025-23524WordPress ClickBank Storefront WordPress Plugin plugin <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerabilitydactum ClickBank Storefront
- CVE-2025-23521WordPress Goodlayers Blocks plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityGoodlayers Blocks
- CVE-2025-23520WordPress Heartland Management Terminal plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySecureSubmit Heartland Management Terminal
- CVE-2025-23519WordPress G Web Pro Store Locator plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityJas Saran G Web Pro Store Locator
- CVE-2025-23518WordPress GoogleMapper plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilitymrsaucier GoogleMapper
- CVE-2025-23517WordPress Google Map on Post/Page plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilitysunil chaulagain Google Map on Post/Page
- CVE-2025-23516WordPress Sale with Razorpay plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitybrainvireinfo Sale with Razorpay
- CVE-2025-23505WordPress Pit Login Welcome plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityPantho Bihosh Pit Login Welcome
- CVE-2025-23502WordPress Curated Search plugin <= 1.2 - CSRF to Stored XSS vulnerabilityNed Curated Search
- CVE-2025-23496WordPress WP FPO plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityhusani WP FPO
- CVE-2025-23494WordPress Quizzin plugin <= 1.01.4 - Reflected Cross Site Scripting (XSS) vulnerabilitybinnyva Quizzin
- CVE-2025-23493WordPress Google Transliteration plugin <= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerabilitymoallemi Google Transliteration
- CVE-2025-23490WordPress Browser-Update-Notify plugin <= 0.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityMichael Stursberg Browser-Update-Notify
- CVE-2025-23488WordPress rng-refresh plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityAbolfazl Sabagh rng-refresh
- CVE-2025-23487WordPress Easy Gallery plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityodihost Easy Gallery
- CVE-2025-23485WordPress RS Survey plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityrichestsoft RS Survey
- CVE-2025-23484WordPress Predict When plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityCojecto Predict When
- CVE-2025-23482WordPress azurecurve Floating Featured Image plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityazurecurve Floating Featured Image
- CVE-2025-23481WordPress Ni WooCommerce Sales Report Email plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityAnzar Ahmed Ni WooCommerce Sales Report Email
- CVE-2025-23479WordPress melascrivi plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilitymelascrivi
- CVE-2025-23478WordPress Photo Video Store plugin <= 21.07 - Reflected Cross Site Scripting (XSS) vulnerabilitycmsaccount Photo Video Store
- CVE-2025-23473WordPress Killer Theme Options plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityPunit Bhalodiya Killer Theme Options
- CVE-2025-23472WordPress Flexo Slider plugin <= 1.0013 - Reflected Cross Site Scripting (XSS) vulnerabilityflexostudio Flexo Slider
- CVE-2025-23468WordPress Essay Wizard (wpCRES) plugin <= 1.0.6.4 - Reflected Cross Site Scripting (XSS) vulnerabilitywrenchpilot Essay Wizard
- CVE-2025-23465WordPress Vampire Character Manager plugin <= 2.13 - Reflected Cross Site Scripting (XSS) vulnerabilitymagent Vampire Character Manager
- CVE-2025-23464WordPress Twitter News Feed plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityKeir Whitaker Twitter News Feed
- CVE-2025-23451WordPress Awesome Twitter Feeds plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitytitodevera Awesome Twitter Feeds
- CVE-2025-23450WordPress AW WooCommerce Kode Pembayaran plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityagenwebsite AW WooCommerce Kode Pembayaran
- CVE-2025-23447WordPress Smooth Dynamic Slider plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityKundan Yevale Smooth Dynamic Slider
- CVE-2025-23446WordPress WP SpaceContent plugin <= 0.4.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityKokoenDE WP SpaceContent
- CVE-2025-23441WordPress Attach Gallery Posts plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerabilitydkukral Attach Gallery Posts
- CVE-2025-23439WordPress TinyMCE Extended Config plugin <= 0.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitywillshouse TinyMCE Extended Config
- CVE-2025-23437WordPress ntp-header-images plugin <=1.2 - Cross Site Scripting (XSS) vulnerabilitynord_tramper ntp-header-images
- CVE-2025-23433WordPress vcOS plugin <=1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityjnwry vcOS
- CVE-2025-23425WordPress Marekkis Watermark plugin <= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerabilityMarekkis Watermark
- CVE-2025-26999WordPress ProfileGrid Plugin <= 5.9.4.3 - PHP Object Injection vulnerabilityMetagauss ProfileGrid
- CVE-2025-0475Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-21424Use After Free in NPUQualcomm Snapdragon
- CVE-2024-53034Untrusted Pointer Dereference in DSP_ServicesQualcomm Snapdragon
- CVE-2024-53033Untrusted Pointer Dereference in DSP_ServicesQualcomm Snapdragon
- CVE-2024-53032Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS PlatformQualcomm Snapdragon
- CVE-2024-53031Improper Input Validation in Automotive OS PlatformQualcomm Snapdragon
- CVE-2024-53030Improper Input Validation in Automotive OS PlatformQualcomm Snapdragon
- CVE-2024-53029Improper Input Validation in Automotive OS PlatformQualcomm Snapdragon
- CVE-2024-53028Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Vehicle NetworksQualcomm Snapdragon
- CVE-2024-53027Buffer Copy Without Checking Size of Input in WLAN HostQualcomm Snapdragon
- CVE-2024-53024NULL Pointer Dereference in DisplayQualcomm Snapdragon
- CVE-2024-53023Use After Free in Automotive Android OSQualcomm Snapdragon
- CVE-2024-53022Improper Input Validation in Automotive OS PlatformQualcomm Snapdragon
- CVE-2024-53014Improper Validation of Array Index in AudioQualcomm Snapdragon
- CVE-2024-53012Improper Input Validation in Automotive OS PlatformQualcomm Snapdragon
- CVE-2024-53011Permissions, Privileges, and Access Controls in Video Analytics and ProcessingQualcomm Snapdragon
- CVE-2024-49836Improper Validation of Array Index in CameraQualcomm Snapdragon
- CVE-2024-45580Use After Free in DSP ServiceQualcomm Snapdragon
- CVE-2024-43062Use After Free in Camera LinuxQualcomm Snapdragon
- CVE-2024-43061Use After Free in AudioQualcomm Snapdragon
- CVE-2024-43060Use of Out-of-range Pointer Offset in Automotive AudioQualcomm Snapdragon
- CVE-2024-43059Use After Free in Automotive MultimediaQualcomm Snapdragon
- CVE-2024-43057Use After Free in MProcQualcomm Snapdragon
- CVE-2024-43055Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Camera_LinuxQualcomm Snapdragon
- CVE-2025-24654WordPress Squirrly SEO plugin <= 12.4.07 - Broken Access Control vulnerabilitySEO Squirrly SEO Plugin by Squirrly SEO
- CVE-2025-24846Authentication bypass vulnerability exists in FutureNet AS series (Industrial Routers) provided by Century Systems Co., Ltd.Century Systems Co. FutureNet AS-250/S · Century System… +10
- CVE-2025-1723Account takeoverManageEngine ADSelfService Plus
- CVE-2025-1853Tenda AC8 Parameter SetIpMacBind sub_49E098 stack-based overflowTenda AC8
- CVE-2025-1852Totolink EX1800T cstecgi.cgi loginAuth buffer overflowTotolink EX1800T
- CVE-2025-1851Tenda AC7 SetFirewallCfg formSetFirewallCfg stack-based overflowTenda AC7
- CVE-2025-20645In KeyInstall, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6765, MT6768, MT6833, MT6835, MT6853, MT6855, MT…
- CVE-2024-53387A DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTML element.
- CVE-2024-53388A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element.mavo
- CVE-2025-25950Incorrect access control in the component /rest/staffResource/update of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS)
- CVE-2025-25951An information disclosure vulnerability in the component /rest/cb/executeBasicSearch of Serosoft Solutions Pvt Ltd Academia Student Informat
Medium, low and unrated 116
- CVE-2025-1891shishuocms cross-site request forgeryshishuocms
- CVE-2025-1890shishuocms ManageUpLoadAction.java handleRequest unrestricted uploadshishuocms
- CVE-2025-1882i-Drive i11/i12 Device Setting improper access control for register interfacei-Drive i11 · i-Drive i12
- CVE-2025-1881i-Drive i11/i12 Video Footage/Live Video Stream access controli-Drive i11 · i-Drive i12
- CVE-2025-1880i-Drive i11/i12 Device Pairing authentication bypassi-Drive i11 · i-Drive i12
- CVE-2024-51966Directory traversal vulnerability in ArcGIS ServerEsri ArcGIS Server
- CVE-2024-51963Stored XSS in ArcGIS Server ManagerEsri ArcGIS Server
- CVE-2024-51960Stored XSS in ArcGIS Server Administrator DirectoryEsri ArcGIS Server
- CVE-2024-51959Stored XSS issue in Server Admin APIEsri ArcGIS Server
- CVE-2024-51958Directory traversal vulnerability in the admin api for service thumbnailsEsri ArcGIS Server
- CVE-2024-51957Stored XSS vulnerability in ArcGIS Rest Services DirectoryEsri ArcGIS Server
- CVE-2024-51956Stored XSS vulnerability in ArcGIS Server Administrator DirectoryEsri ArcGIS Server
- CVE-2024-51953Stored XSS in ArcGIS Server Rest servicesEsri ArcGIS Server
- CVE-2024-51952Stored XSS issue in ArcGIS ServerEsri ArcGIS Server
- CVE-2024-51951Stored XSS in Server Admin APIEsri ArcGIS Server
- CVE-2024-51950Stored XSS in Server Admin under Services > lifecycleinfosEsri ArcGIS Server
- CVE-2024-51949Stored XSS vulnerability in Rest Services under OGCFeature Service and Map ServiceEsri ArcGIS Server
- CVE-2024-51948Stored XSS vulnerability in Rest Services under Job IDEsri ArcGIS Server
- CVE-2024-51947Stored XSS vulnerability in Rest Services under Layer nameEsri ArcGIS Server
- CVE-2024-51946Stored XSS in Rest Services Directory under Identify operationEsri ArcGIS Server
- CVE-2024-51945Stored XSS issues in Server Admin APIEsri ArcGIS Server
- CVE-2024-51944Stored XSS in Rest Services DirectoryEsri ArcGIS Server
- CVE-2024-51942Stored XSS vulnerability in Rest Admin API under Hosted Feature Services pageEsri ArcGIS Server
- CVE-2024-10904Stored XSS in Server Admin APIEsri ArcGIS Server
- CVE-2024-5888Stored XSS in Rest Services API for a Toolbox published as GP ServiceEsri ArcGIS Server
- CVE-2025-1879i-Drive i11/i12 APK hard-coded credentialsi-Drive i11 · i-Drive i12
- CVE-2025-1878i-Drive i11/i12 WiFi default passwordi-Drive i11 · i-Drive i12
- CVE-2025-1889picklescan - Security scanning bypass via non-standard file extensionsmmaitre314 picklescan · picklescan
- CVE-2025-27499WeGIA has a stored Cross-Site Scripting (XSS) in 'processa_edicao_socio.php' via the 'socio_nome' parameterLabRedesCefetRJ WeGIA
- CVE-2024-30154HCL SX is susceptible to a Cross-Site Request Forgery (CSRF) vulnerabilityHCL Software HCL SX
- CVE-2025-0686Grub2: romfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading datgrub2 · Red Hat Enterprise Linux +1
- CVE-2025-0685Grub2: jfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading datagrub2 · Red Hat Enterprise Linux +1
- CVE-2025-0684Grub2: reiserfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading datagrub2 · Red Hat Enterprise Linux +1
- CVE-2024-45778Grub2: fs/bfs: integer overflow in the bfs parser.grub2 · Red Hat Enterprise Linux +1
- CVE-2025-1876D-Link DAP-1562 HTTP Header http_request_parse stack-based overflowD-Link DAP-1562
- CVE-2025-27498AEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failureRustCrypto AEADs · ascon_aead
- CVE-2025-25303Server-Side Request Forgery (SSRF) in MouseTooltipTranslatorttop32 MouseTooltipTranslator
- CVE-2025-25301Rembg allows SSRF via /api/removedanielgatis rembg · rembg
- CVE-2025-0287CVE-2025-0287Paragon Software Migrate OS to SSD · Paragon Software Di… +4
- CVE-2025-27420WeGIA contains a Stored Cross-Site Scripting (XSS) in 'atendido_parentesco_adicionar.php' via the 'descricao' parameterLabRedesCefetRJ WeGIA
- CVE-2025-27418WeGIA contains a Stored Cross-Site Scripting (XSS) in 'adicionar_tipo_atendido.php' via the 'tipo' parameterLabRedesCefetRJ WeGIA
- CVE-2025-27417WeGIA Contains a Stored Cross-Site Scripting (XSS) in 'adicionar_status_atendido.php' via the 'status' parameterLabRedesCefetRJ WeGIA
- CVE-2025-27099Tuleap allows XSS via the tracker names used in the semantic timeframe deletion messageEnalean tuleap
- CVE-2025-27094Tuleap allows default values to be cleared from field configurationEnalean tuleap
- CVE-2025-24023Observable Response Discrepancy in flask-appbuilderdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2024-45779Grub2: fs/bfs: integer overflow leads to heap oob read in the bfs parsergrub2 · Red Hat Enterprise Linux +1
- CVE-2024-45780Grub2: fs/tar: integer overflow causes heap oob writegrub2 · Red Hat Enterprise Linux +1
- CVE-2024-54179IBM Business Automation Workflow cross-site scriptingIBM Business Automation Workflow
- CVE-2025-27274WordPress GPX Viewer plugin <= 2.2.11 - Path Traversal vulnerabilityaxelkeller GPX Viewer
- CVE-2025-27273WordPress Affiliate Links Manager Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitywinking Affiliate Links Manager
- CVE-2025-25137WordPress Social Links plugin <= 1.0.11 - Stored Cross-Site Scripting vulnerabilitykareemsultan Social Links
- CVE-2025-25131WordPress RJ Quickcharts plugin <= 0.6.1 - Cross Site Scripting (XSS) vulnerabilityrandyjensen RJ Quickcharts
- CVE-2025-25121WordPress Theme Options Z Plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabilityshyammakwana Theme Options Z
- CVE-2025-25115WordPress Like dislike plus counter plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityZeshan Abdullah Like dislike plus counter
- CVE-2025-25084WordPress UniTimetable plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityantrouss UniTimetable
- CVE-2025-23829WordPress Woo Update Variations In Cart plugin <= 0.0.9 - Cross Site Scripting (XSS) vulnerabilitycodingkart Woo Update Variations In Cart
- CVE-2025-23763WordPress WAH Forms plugin <= 1.0 - Sensitive Data Exposure vulnerabilityAlex Volkov WAH Forms
- CVE-2025-23615WordPress Interactive Page Hierarchy plugin <= 1.0.1 - Broken Access Control vulnerabilitygtekelis Interactive Page Hierarchy
- CVE-2025-23613WordPress WP Journal plugin <= 1.1 - Broken Access Control vulnerabilitymediabeta WP Journal
- CVE-2025-23579WordPress DZS Ajaxer Lite plugin <= 1.04 - Cross Site Scripting (XSS) vulnerabilitydigitalzoomstudio DZS Ajaxer Lite
- CVE-2025-23515WordPress ts-tree plugin <= 0.1.1 - Arbitrary Content Deletion vulnerabilitytsecher ts-tree
- CVE-2025-23480WordPress RSVP ME plugin <= 1.9.9 - Cross Site Scripting (XSS) vulnerabilityMicahBlu RSVP ME
- CVE-2025-23440WordPress radSLIDE plugin <= 2.1 - Broken Access Control to Stored Cross-Site Scripting vulnerabilityradicaldesigns radSLIDE
- CVE-2024-10925Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2025-1868Information display on multiple products from Famatech CorpFamatech Advanced IP Scanner · Famatech Advanced Port Scann…
- CVE-2024-24778Apache StreamPipes: Resources Permission EscalationApache Software Foundation Apache StreamPipes · org.apac… +1
- CVE-2024-53025Integer Overflow or Wraparound in BT ControllerQualcomm Snapdragon
- CVE-2024-43056Buffer Over-read in HypervisorQualcomm Snapdragon
- CVE-2024-43051Improper Authorization in SPS-HLOSQualcomm Snapdragon
- CVE-2024-38426Improper Authentication in ModemQualcomm Snapdragon
- CVE-2024-8186Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-1859PHPGurukul News Portal login.php sql injectionPHPGurukul News Portal
- CVE-2025-1858Codezips Online Shopping Website success.php sql injectionCodezips Online Shopping Website
- CVE-2025-25280Buffer overflow vulnerability exists in FutureNet AS series (Industrial Routers) and FA series (Protocol Conversion Machine) provided by CenCentury Systems Co. FutureNet AS-250/S · Century System… +12
- CVE-2025-1857PHPGurukul Nipah Virus Testing Management System check_availability.php sql injectionPHPGurukul Nipah Virus Testing Management System
- CVE-2025-1856Codezips Gym Management System gen_invoice.php sql injectionCodezips Gym Management System
- CVE-2025-1855PHPGurukul Online Shopping Portal product-details.php sql injectionPHPGurukul Online Shopping Portal
- CVE-2025-1854Codezips Gym Management System del_member.php sql injectionCodezips Gym Management System
- CVE-2025-1850Codezips College Management System university.php sql injectionCodezips College Management System
- CVE-2025-1849zj1983 zz import_data_todb server-side request forgeryzj1983 zz
- CVE-2025-1848zj1983 zz import_data_check server-side request forgeryzj1983 zz
- CVE-2025-1847zj1983 zz improper authorizationzj1983 zz
- CVE-2025-1846zj1983 zz File ZfileAction.java deleteLocalFile denial of servicezj1983 zz
- CVE-2025-20653In da, there is a possible out of bounds read due to an integer overflow.MediaTek MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT…
- CVE-2025-20652In V5 DA, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6771, MT…
- CVE-2025-20651In da, there is a possible out of bounds read due to a missing bounds check.MediaTek MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT…
- CVE-2025-20650In da, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT…
- CVE-2025-20649In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check.MediaTek MT6880, MT6890, MT6980, MT6990, MT7663, MT7902, MT…
- CVE-2025-20648In apu, there is a possible out of bounds read due to a missing bounds check.MediaTek MT2718, MT6879, MT6989, MT8196, MT8370, MT8390, MT…
- CVE-2025-20647In Modem, there is a possible system crash due to a missing bounds check.MediaTek MT2735, MT2737, MT6739, MT6761, MT6762, MT6762D, M…
- CVE-2025-20644In Modem, there is a possible memory corruption due to incorrect error handling.MediaTek MT2735, MT2737, MT6833, MT6833P, MT6853, MT6853T,…
- CVE-2025-1845ESAFENET DSM examExportPDF command injectionESAFENET DSM
- CVE-2025-1844ESAFENET CDG backupLogDetail.jsp sql injectionESAFENET CDG
- CVE-2025-1843Mini-Tmall ProductMapper.java select sql injectionMini-Tmall
- CVE-2025-1842FITSTATS Technologies AthleteMonitoring login.php cross site scriptingFITSTATS Technologies AthleteMonitoring
- CVE-2025-1841ESAFENET CDG ClientSortLog.jsp sql injectionESAFENET CDG
- CVE-2023-49031Directory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing platform 6.8.3.0 allows a remote attacker to rea
- CVE-2024-51091Cross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs packageseajs
- CVE-2024-53382Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly coPrismJS Prism · prismjs
- CVE-2024-53384A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to docutsup
- CVE-2024-53386Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaSPiqnt Stage.js · stage-js
- CVE-2024-55064Multiple cross-site scripting (XSS) vulnerabilities in EasyVirt DC NetScope <= 8.6.4 allow remote attackers to inject arbitrary JavaScript o
- CVE-2024-55570/api/user/users in the web GUI for the Cubro EXA48200 network packet broker (build 20231025055018) fixed in V5.0R14.5P4-V3.3R1 allows remote
- CVE-2024-57240A Cross-Site Scripting (XSS) vulnerability in the Rendering Engine component in Apryse WebViewer v11.1 and earlier allows attackers to execu
- CVE-2025-25939Reprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform/activate_process via the akey parameter.
- CVE-2025-25949A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al
- CVE-2025-25952An Insecure Direct Object References (IDOR) in the component /getStudemtAllDetailsById?studentId=XX of Serosoft Solutions Pvt Ltd Academia S
- CVE-2025-25953Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token exp
- CVE-2025-25967Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF).
- CVE-2025-27219In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerabiruby-lang CGI · cgi
- CVE-2025-27220In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.ruby-lang CGI · cgi
- CVE-2025-27221In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication crruby-lang URI · uri
- CVE-2025-27370OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations.OpenID Connect
- CVE-2025-27371In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, theIETF RFC
- CVE-2025-27584A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al
- CVE-2025-27585A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al