# CVEs published 2025-03-03

349 CVEs were published on March 3, 2025: 24 critical, 209 high. Days are UTC.

- [CVE-2025-1891](https://cve.now/CVE-2025-1891.md): shishuocms cross-site request forgery (CVSS 5.3, shishuocms)
- [CVE-2025-1890](https://cve.now/CVE-2025-1890.md): shishuocms ManageUpLoadAction.java handleRequest unrestricted upload (CVSS 5.3, shishuocms)
- [CVE-2025-1882](https://cve.now/CVE-2025-1882.md): i-Drive i11/i12 Device Setting improper access control for register interface (CVSS 2.3, i-Drive i11 · i-Drive i12)
- [CVE-2025-1881](https://cve.now/CVE-2025-1881.md): i-Drive i11/i12 Video Footage/Live Video Stream access control (CVSS 5.3, i-Drive i11 · i-Drive i12)
- [CVE-2025-1880](https://cve.now/CVE-2025-1880.md): i-Drive i11/i12 Device Pairing authentication bypass (CVSS 1.0, i-Drive i11 · i-Drive i12)
- [CVE-2024-51966](https://cve.now/CVE-2024-51966.md): Directory traversal vulnerability in ArcGIS Server (CVSS 4.9, Esri ArcGIS Server)
- [CVE-2024-51963](https://cve.now/CVE-2024-51963.md): Stored XSS in ArcGIS Server Manager (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51962](https://cve.now/CVE-2024-51962.md): SQL injection vulnerability in ArcGIS Server (CVSS 8.7, Esri ArcGIS Server)
- [CVE-2024-51961](https://cve.now/CVE-2024-51961.md): Local file inclusion (LFI) vulnerability in ArcGIS Server (CVSS 7.5, Esri ArcGIS Server)
- [CVE-2024-51960](https://cve.now/CVE-2024-51960.md): Stored XSS in ArcGIS Server Administrator Directory (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51959](https://cve.now/CVE-2024-51959.md): Stored XSS issue in Server Admin API (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51958](https://cve.now/CVE-2024-51958.md): Directory traversal vulnerability in the admin api for service thumbnails (CVSS 4.9, Esri ArcGIS Server)
- [CVE-2024-51957](https://cve.now/CVE-2024-51957.md): Stored XSS vulnerability in ArcGIS Rest Services Directory (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51956](https://cve.now/CVE-2024-51956.md): Stored XSS vulnerability in ArcGIS Server Administrator Directory (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51954](https://cve.now/CVE-2024-51954.md): Unauthorized access to secure services in ArcGIS Server (CVSS 8.5, Esri ArcGIS Server)
- [CVE-2024-51953](https://cve.now/CVE-2024-51953.md): Stored XSS in ArcGIS Server Rest services (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51952](https://cve.now/CVE-2024-51952.md): Stored XSS issue in ArcGIS Server (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51951](https://cve.now/CVE-2024-51951.md): Stored XSS in Server Admin API (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51950](https://cve.now/CVE-2024-51950.md): Stored XSS in Server Admin under Services \> lifecycleinfos (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51949](https://cve.now/CVE-2024-51949.md): Stored XSS vulnerability in Rest Services under OGCFeature Service and Map Service (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51948](https://cve.now/CVE-2024-51948.md): Stored XSS vulnerability in Rest Services under Job ID (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51947](https://cve.now/CVE-2024-51947.md): Stored XSS vulnerability in Rest Services under Layer name (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51946](https://cve.now/CVE-2024-51946.md): Stored XSS in Rest Services Directory under Identify operation (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51945](https://cve.now/CVE-2024-51945.md): Stored XSS issues in Server Admin API (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51944](https://cve.now/CVE-2024-51944.md): Stored XSS in Rest Services Directory (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-51942](https://cve.now/CVE-2024-51942.md): Stored XSS vulnerability in Rest Admin API under Hosted Feature Services page (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-10904](https://cve.now/CVE-2024-10904.md): Stored XSS in Server Admin API (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2024-5888](https://cve.now/CVE-2024-5888.md): Stored XSS in Rest Services API for a Toolbox published as GP Service (CVSS 4.8, Esri ArcGIS Server)
- [CVE-2025-1879](https://cve.now/CVE-2025-1879.md): i-Drive i11/i12 APK hard-coded credentials (CVSS 2.4, i-Drive i11 · i-Drive i12)
- [CVE-2025-1878](https://cve.now/CVE-2025-1878.md): i-Drive i11/i12 WiFi default password (CVSS 2.3, i-Drive i11 · i-Drive i12)
- [CVE-2025-1889](https://cve.now/CVE-2025-1889.md): picklescan - Security scanning bypass via non-standard file extensions (CVSS 5.3, mmaitre314 picklescan · picklescan)
- [CVE-2025-27501](https://cve.now/CVE-2025-27501.md): Server Side Request Forgery in Ziti Console (CVSS 8.6, openziti ziti-console)
- [CVE-2025-1877](https://cve.now/CVE-2025-1877.md): D-Link DAP-1562 HTTP POST Request pure\_auth\_check null pointer dereference (CVSS 7.1, D-Link DAP-1562)
- [CVE-2025-27500](https://cve.now/CVE-2025-27500.md): Cross Site Scripting potential in Ziti Console (CVSS 8.2, openziti ziti-console)
- [CVE-2025-27499](https://cve.now/CVE-2025-27499.md): WeGIA has a stored Cross-Site Scripting (XSS) in 'processa\_edicao\_socio.php' via the 'socio\_nome' parameter (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2024-30154](https://cve.now/CVE-2024-30154.md): HCL SX is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.3, HCL Software HCL SX)
- [CVE-2025-0686](https://cve.now/CVE-2025-0686.md): Grub2: romfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading dat (CVSS 6.4, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2025-0685](https://cve.now/CVE-2025-0685.md): Grub2: jfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (CVSS 6.4, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2025-0684](https://cve.now/CVE-2025-0684.md): Grub2: reiserfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (CVSS 6.4, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2025-0678](https://cve.now/CVE-2025-0678.md): Grub2: squash4: integer overflow may lead to heap based out-of-bounds write when reading data (CVSS 7.8, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2024-45782](https://cve.now/CVE-2024-45782.md): Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382) (CVSS 7.8, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2024-45778](https://cve.now/CVE-2024-45778.md): Grub2: fs/bfs: integer overflow in the bfs parser. (CVSS 4.1, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2025-1876](https://cve.now/CVE-2025-1876.md): D-Link DAP-1562 HTTP Header http\_request\_parse stack-based overflow (CVSS 6.9, D-Link DAP-1562)
- [CVE-2025-27498](https://cve.now/CVE-2025-27498.md): AEADs/ascon-aead: Plaintext exposed in decrypt\_in\_place\_detached even on tag verification failure (CVSS 5.6, RustCrypto AEADs · ascon\_aead)
- [CVE-2025-25303](https://cve.now/CVE-2025-25303.md): Server-Side Request Forgery (SSRF) in MouseTooltipTranslator (CVSS 6.9, ttop32 MouseTooltipTranslator)
- [CVE-2025-25302](https://cve.now/CVE-2025-25302.md): Rembg CORS misconfiguration (CVSS 8.7, danielgatis rembg · rembg)
- [CVE-2025-25301](https://cve.now/CVE-2025-25301.md): Rembg allows SSRF via /api/remove (CVSS 6.9, danielgatis rembg · rembg)
- [CVE-2025-27423](https://cve.now/CVE-2025-27423.md): Improper Input Validation in Vim (CVSS 7.1, vim)
- [CVE-2025-27422](https://cve.now/CVE-2025-27422.md): FACTION Allows Authentication Bypass via User Creation (CVSS 7.5, factionsecurity faction)
- [CVE-2025-0285](https://cve.now/CVE-2025-0285.md): CVE-2025-0285 (CVSS 7.8, Paragon Software Migrate OS to SSD · Paragon Software Di… +4)
- [CVE-2025-0286](https://cve.now/CVE-2025-0286.md): CVE-2025-0286 (CVSS 8.4, Paragon Software Partition Manager · Paragon Software Ha… +4)
- [CVE-2025-0287](https://cve.now/CVE-2025-0287.md): CVE-2025-0287 (CVSS 5.1, Paragon Software Migrate OS to SSD · Paragon Software Di… +4)
- [CVE-2025-0288](https://cve.now/CVE-2025-0288.md): CVE-2025-0288 (CVSS 7.8, Paragon Software Migrate OS to SSD · Paragon Software Di… +4)
- [CVE-2025-0289](https://cve.now/CVE-2025-0289.md): CVE-2025-0289 (CVSS 7.8, Paragon Software Migrate OS to SSD · Paragon Software Di… +4)
- [CVE-2025-27421](https://cve.now/CVE-2025-27421.md): Goroutine Leak in Abacus SSE Implementation (CVSS 7.5, JasonLovesDoggo abacus · github.com/jasonlovesdoggo/abacus)
- [CVE-2025-27419](https://cve.now/CVE-2025-27419.md): Denial of Service (DoS) in WeGIA due to Recursive Crawling of Dynamic URLs (CVSS 9.2, LabRedesCefetRJ WeGIA)
- [CVE-2025-27420](https://cve.now/CVE-2025-27420.md): WeGIA contains a Stored Cross-Site Scripting (XSS) in 'atendido\_parentesco\_adicionar.php' via the 'descricao' parameter (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2024-55532](https://cve.now/CVE-2024-55532.md): Apache Ranger: Improper Neutralization of Formula Elements in a CSV File (CVSS 9.8, Apache Software Foundation Apache Ranger · org.apache.range…)
- [CVE-2025-27418](https://cve.now/CVE-2025-27418.md): WeGIA contains a Stored Cross-Site Scripting (XSS) in 'adicionar\_tipo\_atendido.php' via the 'tipo' parameter (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-0555](https://cve.now/CVE-2025-0555.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 7.7, GitLab)
- [CVE-2025-27417](https://cve.now/CVE-2025-27417.md): WeGIA Contains a Stored Cross-Site Scripting (XSS) in 'adicionar\_status\_atendido.php' via the 'status' parameter (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-27099](https://cve.now/CVE-2025-27099.md): Tuleap allows XSS via the tracker names used in the semantic timeframe deletion message (CVSS 4.8, Enalean tuleap)
- [CVE-2025-27094](https://cve.now/CVE-2025-27094.md): Tuleap allows default values to be cleared from field configuration (CVSS 5.4, Enalean tuleap)
- [CVE-2025-25185](https://cve.now/CVE-2025-25185.md): GPT Academic allows arbitary file read by tarfile uncompress within softlink (CVSS 7.5, binary-husky gpt\_academic)
- [CVE-2024-41771](https://cve.now/CVE-2024-41771.md): IBM Engineering Requirements Management DOORS Next information disclosure (CVSS 7.5, IBM Engineering Requirements Management DOORS Next)
- [CVE-2024-41770](https://cve.now/CVE-2024-41770.md): IBM Engineering Requirements Management DOORS Next information disclosure (CVSS 7.5, IBM Engineering Requirements Management DOORS Next)
- [CVE-2024-43169](https://cve.now/CVE-2024-43169.md): IBM Engineering Requirements Management DOORS Next file download (CVSS 8.8, IBM Engineering Requirements Management DOORS Next)
- [CVE-2025-24023](https://cve.now/CVE-2025-24023.md): Observable Response Discrepancy in flask-appbuilder (CVSS 3.7, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2025-1801](https://cve.now/CVE-2025-1801.md): Aap-gateway: aap-gateway privilege escalation (CVSS 8.1, automation-gateway · Red Hat Ansible Automation Platform 2.…)
- [CVE-2024-8262](https://cve.now/CVE-2024-8262.md): Path Traversal in Proliz Software's OBS (CVSS 9.8, Proliz Software OBS)
- [CVE-2024-45779](https://cve.now/CVE-2024-45779.md): Grub2: fs/bfs: integer overflow leads to heap oob read in the bfs parser (CVSS 6.0, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2024-8261](https://cve.now/CVE-2024-8261.md): IDOR in Proliz Software's OBS (CVSS 7.5, Proliz Software OBS)
- [CVE-2024-45780](https://cve.now/CVE-2024-45780.md): Grub2: fs/tar: integer overflow causes heap oob write (CVSS 6.7, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2025-0689](https://cve.now/CVE-2025-0689.md): Grub2: udf: heap based buffer overflow in grub\_udf\_read\_block() may lead to arbitrary code execution (CVSS 7.8, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2025-1125](https://cve.now/CVE-2025-1125.md): Grub2: fs/hfs: integer overflow may lead to heap based out-of-bounds write (CVSS 7.8, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2024-54179](https://cve.now/CVE-2024-54179.md): IBM Business Automation Workflow cross-site scripting (CVSS 5.4, IBM Business Automation Workflow)
- [CVE-2024-47092](https://cve.now/CVE-2024-47092.md): Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api (CVSS 7.7, check-mk-api)
- [CVE-2025-26994](https://cve.now/CVE-2025-26994.md): WordPress Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin \<= 7.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, softdiscover Zigaform – Price Calculator & Cost Estimation…)
- [CVE-2025-26989](https://cve.now/CVE-2025-26989.md): WordPress Zigaform – Form Builder Lite plugin \<= 7.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, softdiscover Zigaform)
- [CVE-2025-26988](https://cve.now/CVE-2025-26988.md): WordPress SMS Alert Order Notifications – WooCommerce plugin \<= 3.7.8 - SQL Injection vulnerability (CVSS 9.3, Cozy Vision SMS Alert Order Notifications)
- [CVE-2025-26984](https://cve.now/CVE-2025-26984.md): WordPress SMS Alert Order Notifications – WooCommerce plugin \<= 3.7.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cozy Vision SMS Alert Order Notifications)
- [CVE-2025-26970](https://cve.now/CVE-2025-26970.md): WordPress Ark Theme Core plugin \< 1.71.0 - Unauthenticated Remote Code Execution (RCE) vulnerability (CVSS 10.0, FRESHFACE Ark Theme Core)
- [CVE-2025-26967](https://cve.now/CVE-2025-26967.md): WordPress Events Calendar for GeoDirectory plugin \<= 2.3.14 - PHP Object Injection vulnerability (CVSS 8.8, Stiofan Events Calendar for GeoDirectory)
- [CVE-2025-26918](https://cve.now/CVE-2025-26918.md): WordPress Small Package Quotes – Unishippers Edition plugin \<= 2.4.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, enituretechnology Small Package Quotes – Unishippers Edition)
- [CVE-2025-26917](https://cve.now/CVE-2025-26917.md): WordPress WP Templata plugin \<= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, HasThemes WP Templata)
- [CVE-2025-26914](https://cve.now/CVE-2025-26914.md): WordPress Variable Inspector plugin \<= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bowo Variable Inspector)
- [CVE-2025-26885](https://cve.now/CVE-2025-26885.md): WordPress Assistant Plugin \<= 1.5.1 - PHP Object Injection vulnerability (CVSS 7.2, Beaver Builder WordPress Assistant)
- [CVE-2025-26879](https://cve.now/CVE-2025-26879.md): WordPress s2Member Plugin \<= 241216 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cristián Lávaque s2Member)
- [CVE-2025-27279](https://cve.now/CVE-2025-27279.md): WordPress Flashfader Plugin \<= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, lynk Flashfader)
- [CVE-2025-27278](https://cve.now/CVE-2025-27278.md): WordPress AcuGIS Leaflet Maps Plugin \<= 5.1.1.0 - Multiple Cross Site Scripting (XSS) vulnerabilities (CVSS 7.1, David Ghedini AcuGIS Leaflet Maps)
- [CVE-2025-27275](https://cve.now/CVE-2025-27275.md): WordPress WOO Codice Fiscale plugin \<= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, andrew\_fisher WOO Codice Fiscale)
- [CVE-2025-27274](https://cve.now/CVE-2025-27274.md): WordPress GPX Viewer plugin \<= 2.2.11 - Path Traversal vulnerability (CVSS 4.9, axelkeller GPX Viewer)
- [CVE-2025-27273](https://cve.now/CVE-2025-27273.md): WordPress Affiliate Links Manager Plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 5.8, winking Affiliate Links Manager)
- [CVE-2025-27271](https://cve.now/CVE-2025-27271.md): WordPress DB Tables Import/Export Plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Alberto Cocchiara DB Tables Import/Export)
- [CVE-2025-27270](https://cve.now/CVE-2025-27270.md): WordPress Residential Address Detection Plugin \<= 2.5.4 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 9.8, enituretechnology Residential Address Detection)
- [CVE-2025-27269](https://cve.now/CVE-2025-27269.md): WordPress .htaccess Login block Plugin \<= 0.9a - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Anton Aleksandrov .htaccess Login block)
- [CVE-2025-27268](https://cve.now/CVE-2025-27268.md): WordPress Small Package Quotes – Worldwide Express Edition Plugin \<= 5.2.18 - SQL Injection vulnerability (CVSS 9.3, enituretechnology Small Package Quotes – Worldwide Express…)
- [CVE-2025-27264](https://cve.now/CVE-2025-27264.md): WordPress Doctor Appointment Booking Plugin \<= 1.0.0 - Local File Inclusion vulnerability (CVSS 7.5, Creativeitem Doctor Appointment Booking)
- [CVE-2025-27263](https://cve.now/CVE-2025-27263.md): WordPress Doctor Appointment Booking Plugin \<= 1.0.0 - SQL Injection vulnerability (CVSS 8.5, Creativeitem Doctor Appointment Booking)
- [CVE-2025-26589](https://cve.now/CVE-2025-26589.md): WordPress IE CSS3 Support Plugin \<= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cristopher Dino IE CSS3 Support)
- [CVE-2025-26588](https://cve.now/CVE-2025-26588.md): WordPress TTT Crop Plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, gabrielperezs TTT Crop)
- [CVE-2025-26587](https://cve.now/CVE-2025-26587.md): WordPress sidebarTabs Plugin \<= 3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, nghorta sidebarTabs)
- [CVE-2025-26586](https://cve.now/CVE-2025-26586.md): WordPress Events Planner Plugin \<= 1.3.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, abelony Events Planner)
- [CVE-2025-26585](https://cve.now/CVE-2025-26585.md): WordPress DL Leadback Plugin \<= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DyadyaLesha DL Leadback)
- [CVE-2025-26563](https://cve.now/CVE-2025-26563.md): WordPress Rocket Mobile Plugin \<= 0.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Muneeb Mobile)
- [CVE-2025-26557](https://cve.now/CVE-2025-26557.md): WordPress ViperBar Plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, viperchill ViperBar)
- [CVE-2025-26540](https://cve.now/CVE-2025-26540.md): WordPress Helloprint Plugin \<= 2.0.7 - Arbitrary File Deletion vulnerability (CVSS 7.7, Helloprint)
- [CVE-2025-26535](https://cve.now/CVE-2025-26535.md): WordPress Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop plugin \<= 1.7.6 - SQL Injection vulnerability (CVSS 9.3, CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce)
- [CVE-2025-26534](https://cve.now/CVE-2025-26534.md): WordPress Helloprint Plugin \<= 2.0.7 - Arbitrary File Deletion vulnerability (CVSS 8.6, Helloprint)
- [CVE-2025-25170](https://cve.now/CVE-2025-25170.md): WordPress Migrate Posts Plugin \<=1.0 - Post Based Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DotsquaresLtd Migrate Posts)
- [CVE-2025-25169](https://cve.now/CVE-2025-25169.md): WordPress Authors Autocomplete Meta Box plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rachel Cherry Authors Autocomplete Meta Box)
- [CVE-2025-25165](https://cve.now/CVE-2025-25165.md): WordPress Staff Directory Plugin: Company Directory Plugin \<= 4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, richardgabriel Staff Directory Plugin: Company Directory)
- [CVE-2025-25164](https://cve.now/CVE-2025-25164.md): WordPress Meta Accelerator plugin \<= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Yuichiro ABE Meta Accelerator)
- [CVE-2025-25162](https://cve.now/CVE-2025-25162.md): WordPress Sports Rankings and Lists plugin \<= 2.3 - Arbitrary File Download vulnerability (CVSS 7.1, kutu62 Sports Rankings and Lists)
- [CVE-2025-25161](https://cve.now/CVE-2025-25161.md): WordPress WP Find Your Nearest Plugin \<= 0.3.1 - CSRF to Settings Change vulnerability (CVSS 7.1, SocialEvolution WP Find Your Nearest)
- [CVE-2025-25158](https://cve.now/CVE-2025-25158.md): WordPress Uncomplicated SEO plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Antonio Sanchez Uncomplicated SEO)
- [CVE-2025-25157](https://cve.now/CVE-2025-25157.md): WordPress WP Church Center Plugin \<= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpchurchteam WP Church Center)
- [CVE-2025-25150](https://cve.now/CVE-2025-25150.md): WordPress uListing plugin \<= 2.1.6 - SQL Injection vulnerability (CVSS 9.3, Stylemix uListing)
- [CVE-2025-25142](https://cve.now/CVE-2025-25142.md): WordPress WP Less Compiler plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, The Jake Group WP Less Compiler)
- [CVE-2025-25137](https://cve.now/CVE-2025-25137.md): WordPress Social Links plugin \<= 1.0.11 - Stored Cross-Site Scripting vulnerability (CVSS 6.5, kareemsultan Social Links)
- [CVE-2025-25133](https://cve.now/CVE-2025-25133.md): WordPress WP Frontend Submit Plugin \<= 1.1.0 - Reflected Cross-Site Scripting vulnerability (CVSS 7.1, newbiesup WP Frontend Submit)
- [CVE-2025-25132](https://cve.now/CVE-2025-25132.md): WordPress Visitor Details plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ravi Singh Visitor Details)
- [CVE-2025-25131](https://cve.now/CVE-2025-25131.md): WordPress RJ Quickcharts plugin \<= 0.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, randyjensen RJ Quickcharts)
- [CVE-2025-25130](https://cve.now/CVE-2025-25130.md): WordPress Delete Comments By Status plugin \<= 1.5.3 - Local File Inclusion vulnerability (CVSS 7.5, Shah Alom Delete Comments By Status)
- [CVE-2025-25129](https://cve.now/CVE-2025-25129.md): WordPress Callback Request plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NotFound Callback Request)
- [CVE-2025-25127](https://cve.now/CVE-2025-25127.md): WordPress Contact Us By Lord Linus Plugin \<= 2.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rohitashv Singhal Contact Us By Lord Linus)
- [CVE-2025-25124](https://cve.now/CVE-2025-25124.md): WordPress Status Updater Plugin \<= 9.21 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, devu Status Updater)
- [CVE-2025-25122](https://cve.now/CVE-2025-25122.md): WordPress WizShop Plugin \<= 3.0.2 - Local File Inclusion vulnerability (CVSS 8.1, hashshop WizShop)
- [CVE-2025-25121](https://cve.now/CVE-2025-25121.md): WordPress Theme Options Z Plugin \<= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, shyammakwana Theme Options Z)
- [CVE-2025-25119](https://cve.now/CVE-2025-25119.md): WordPress Woocommerce osCommerce Sync plugin \<= 2.0.20 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Alejandro Aranda Woocommerce osCommerce Sync)
- [CVE-2025-25118](https://cve.now/CVE-2025-25118.md): WordPress WPOptin plugin \<= 2.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Danish Ali Malik Top Bar – PopUps – by WPOptin)
- [CVE-2025-25115](https://cve.now/CVE-2025-25115.md): WordPress Like dislike plus counter plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Zeshan Abdullah Like dislike plus counter)
- [CVE-2025-25114](https://cve.now/CVE-2025-25114.md): WordPress User Role plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ehabstar User Role)
- [CVE-2025-25113](https://cve.now/CVE-2025-25113.md): WordPress Implied Cookie Consent plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Senktec Implied Cookie Consent)
- [CVE-2025-25112](https://cve.now/CVE-2025-25112.md): WordPress Social Links plugin \<= 1.2 - SQL Injection vulnerability (CVSS 7.6, kareemsultan Social Links)
- [CVE-2025-25109](https://cve.now/CVE-2025-25109.md): WordPress Vehicle Manager plugin \<= 3.1 - Local File Inclusion vulnerability (CVSS 8.1, JoomSky WP Vehicle Manager)
- [CVE-2025-25108](https://cve.now/CVE-2025-25108.md): WordPress SW Plus Plugin \<= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, shalomworld SW Plus)
- [CVE-2025-25102](https://cve.now/CVE-2025-25102.md): WordPress Yahoo BOSS Plugin \<= 0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Josh Harrison Yahoo BOSS)
- [CVE-2025-25099](https://cve.now/CVE-2025-25099.md): WordPress Appointment Buddy Widget By Accrete plugin \<= 1.2. - Reflected Cross-Site Scripting vulnerability (CVSS 7.1, accreteinfosolution Appointment Buddy Widget)
- [CVE-2025-25092](https://cve.now/CVE-2025-25092.md): WordPress All push notification for WP plugin \<= 1.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, gtlwpdev All push notification for WP)
- [CVE-2025-25090](https://cve.now/CVE-2025-25090.md): WordPress Dreamstime Stock Photos plugin \<= 4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dreamstime Stock Photos)
- [CVE-2025-25089](https://cve.now/CVE-2025-25089.md): WordPress Image Rotator plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, appten Image Rotator)
- [CVE-2025-25087](https://cve.now/CVE-2025-25087.md): WordPress seekXL Snapr plugin \<= 2.0.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tim seekXL Snapr)
- [CVE-2025-25084](https://cve.now/CVE-2025-25084.md): WordPress UniTimetable plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, antrouss UniTimetable)
- [CVE-2025-25083](https://cve.now/CVE-2025-25083.md): WordPress EP4 More Embeds Plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dave Lavoie EP4 More Embeds)
- [CVE-2025-25070](https://cve.now/CVE-2025-25070.md): WordPress Album Reviewer plugin \<= 2.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ed atrero Album Reviewer)
- [CVE-2025-24758](https://cve.now/CVE-2025-24758.md): WordPress CM Map Locations plugin \<= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CreativeMindsSolutions CM Map Locations)
- [CVE-2025-24694](https://cve.now/CVE-2025-24694.md): WordPress CM Pop-Up Banners plugin \<= 1.7.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CreativeMindsSolutions CM Pop-Up banners)
- [CVE-2025-23956](https://cve.now/CVE-2025-23956.md): WordPress WP Easy Post Mailer Plugin \<= 0.64 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Richard Leishman WP Easy Post Mailer)
- [CVE-2025-23945](https://cve.now/CVE-2025-23945.md): WordPress Popliup Plugin \<= 1.1.1 - Local File Inclusion vulnerability (CVSS 7.5, Webliup Popliup)
- [CVE-2025-23904](https://cve.now/CVE-2025-23904.md): WordPress Rebrand Fluent Forms Plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rebrandpress Rebrand Fluent Forms)
- [CVE-2025-23903](https://cve.now/CVE-2025-23903.md): WordPress Local Shipping Labels for WooCommerce Plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, woofx Local Shipping Labels for WooCommerce)
- [CVE-2025-23883](https://cve.now/CVE-2025-23883.md): WordPress Stray Random Quotes Plugin \<= 1.9.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, unalignedcoder Stray Random Quotes)
- [CVE-2025-23881](https://cve.now/CVE-2025-23881.md): WordPress LJ Custom Menu Links Plugin \<= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, littlejon LJ Custom Menu Links)
- [CVE-2025-23879](https://cve.now/CVE-2025-23879.md): WordPress Easy Automatic Newsletter Lite Plugin \<= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PillarDev Easy Automatic Newsletter Lite)
- [CVE-2025-23852](https://cve.now/CVE-2025-23852.md): WordPress First Comment Redirect plugin \<= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, robin90 First Comment Redirect)
- [CVE-2025-23850](https://cve.now/CVE-2025-23850.md): WordPress Mojo Under Construction Plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mojowill Mojo Under Construction)
- [CVE-2025-23847](https://cve.now/CVE-2025-23847.md): WordPress Site Launcher Plugin \<= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, saill Site Launcher)
- [CVE-2025-23843](https://cve.now/CVE-2025-23843.md): WordPress WP-HR Manager plugin \<= 3.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wphrmanager WP-HR Manager: The Human Resources Plugin for W…)
- [CVE-2025-23829](https://cve.now/CVE-2025-23829.md): WordPress Woo Update Variations In Cart plugin \<= 0.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, codingkart Woo Update Variations In Cart)
- [CVE-2025-23814](https://cve.now/CVE-2025-23814.md): WordPress CRUDLab Like Box Plugin \<= 2.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CRUDLab Like Box)
- [CVE-2025-23813](https://cve.now/CVE-2025-23813.md): WordPress Guten Free Options Plugin \<= 0.9.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tony Hayes Guten Free Options)
- [CVE-2025-23763](https://cve.now/CVE-2025-23763.md): WordPress WAH Forms plugin \<= 1.0 - Sensitive Data Exposure vulnerability (CVSS 6.5, Alex Volkov WAH Forms)
- [CVE-2025-23762](https://cve.now/CVE-2025-23762.md): WordPress DsgnWrks Twitter Importer plugin \<= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Justin Sternberg DsgnWrks Twitter Importer)
- [CVE-2025-23753](https://cve.now/CVE-2025-23753.md): WordPress DN Sitemap Control plugin \<= 1.0.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, digireturn DN Sitemap Control)
- [CVE-2025-23741](https://cve.now/CVE-2025-23741.md): WordPress Notifications Center plugin \<= 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Florian Chaillou Notifications Center)
- [CVE-2025-23740](https://cve.now/CVE-2025-23740.md): WordPress Easy School Registration plugin \<= 3.9.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Zbynek Nedoma Easy School Registration)
- [CVE-2025-23739](https://cve.now/CVE-2025-23739.md): WordPress WP Ultimate Reviews FREE plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jtibbles WP Ultimate Reviews FREE)
- [CVE-2025-23738](https://cve.now/CVE-2025-23738.md): WordPress Ps Ads Pro plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Padam Shankhadev Ps Ads Pro)
- [CVE-2025-23736](https://cve.now/CVE-2025-23736.md): WordPress Form To JSON plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, webgdawg Form To JSON)
- [CVE-2025-23731](https://cve.now/CVE-2025-23731.md): WordPress Tax Report for WooCommerce plugin \<= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, infosoftplugin Tax Report for WooCommerce)
- [CVE-2025-23726](https://cve.now/CVE-2025-23726.md): WordPress ComparePress plugin \<= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, thebloghouse ComparePress)
- [CVE-2025-23721](https://cve.now/CVE-2025-23721.md): WordPress Mobigate plugin \<= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, cloudvn Mobigate)
- [CVE-2025-23718](https://cve.now/CVE-2025-23718.md): WordPress Mancx AskMe Widget plugin \<= 0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mancx AskMe Widget)
- [CVE-2025-23716](https://cve.now/CVE-2025-23716.md): WordPress Login Watchdog plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, JkmAS Login Watchdog)
- [CVE-2025-23688](https://cve.now/CVE-2025-23688.md): WordPress Cobwebo URL Plugin plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, editionskezzal Cobwebo URL Plugin)
- [CVE-2025-23670](https://cve.now/CVE-2025-23670.md): WordPress 4 author cheer up donate plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, montashov 4 author cheer up donate)
- [CVE-2025-23668](https://cve.now/CVE-2025-23668.md): WordPress ChatGPT Open AI Images & Content for WooCommerce plugin \<= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mauricio Urrego ChatGPT Open AI Images & Content for WooCom…)
- [CVE-2025-23663](https://cve.now/CVE-2025-23663.md): WordPress Contexto plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Adrian Vaquez Contexto)
- [CVE-2025-23637](https://cve.now/CVE-2025-23637.md): WordPress 新淘客WordPress插件 plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fxy060608 新淘客WordPress插件)
- [CVE-2025-23635](https://cve.now/CVE-2025-23635.md): WordPress ePermissions plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mobde3net ePermissions)
- [CVE-2025-23619](https://cve.now/CVE-2025-23619.md): WordPress Catch Duplicate Switcher plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Catch Themes Catch Duplicate Switcher)
- [CVE-2025-23616](https://cve.now/CVE-2025-23616.md): WordPress Canalplan plugin \<= 5.31 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Steve Canalplan)
- [CVE-2025-23615](https://cve.now/CVE-2025-23615.md): WordPress Interactive Page Hierarchy plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 6.5, gtekelis Interactive Page Hierarchy)
- [CVE-2025-23613](https://cve.now/CVE-2025-23613.md): WordPress WP Journal plugin \<= 1.1 - Broken Access Control vulnerability (CVSS 6.5, mediabeta WP Journal)
- [CVE-2025-23600](https://cve.now/CVE-2025-23600.md): WordPress Send to a Friend Addon plugin \<= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, pinal.shah Send to a Friend Addon)
- [CVE-2025-23595](https://cve.now/CVE-2025-23595.md): WordPress Page Health-O-Meter plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, brainpulse Page Health-O-Meter)
- [CVE-2025-23587](https://cve.now/CVE-2025-23587.md): WordPress all-in-one-box-login plugin \<= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ashek Al Mahmud all-in-one-box-login)
- [CVE-2025-23586](https://cve.now/CVE-2025-23586.md): WordPress WP Post Category Notifications plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, MAL73049 WP Post Category Notifications)
- [CVE-2025-23585](https://cve.now/CVE-2025-23585.md): WordPress Goo.gl Url Shorter plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CantonBolo Goo.gl Url Shorter)
- [CVE-2025-23584](https://cve.now/CVE-2025-23584.md): WordPress Pin Locations on Map plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, arsh91 Pin Locations on Map)
- [CVE-2025-23579](https://cve.now/CVE-2025-23579.md): WordPress DZS Ajaxer Lite plugin \<= 1.04 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, digitalzoomstudio DZS Ajaxer Lite)
- [CVE-2025-23576](https://cve.now/CVE-2025-23576.md): WordPress WP Intro.JS Plugin plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, cfuze WP Intro.JS)
- [CVE-2025-23575](https://cve.now/CVE-2025-23575.md): WordPress DX Sales CRM plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DevriX DX Sales CRM)
- [CVE-2025-23570](https://cve.now/CVE-2025-23570.md): WordPress WP Social Links plugin \<= 0.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mitchell Bundy WP Social Links)
- [CVE-2025-23565](https://cve.now/CVE-2025-23565.md): WordPress Wibstats plugin \<= 0.5.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Chris Taylor Wibstats)
- [CVE-2025-23564](https://cve.now/CVE-2025-23564.md): WordPress WP FixTag plugin \<= v2.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mohsenshahbazi WP FixTag)
- [CVE-2025-23563](https://cve.now/CVE-2025-23563.md): WordPress Explore pages plugin \<= 1.01 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mbyte Explore pages)
- [CVE-2025-23556](https://cve.now/CVE-2025-23556.md): WordPress Push Envoy Notifications plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, netbitsolutions Push Envoy Notifications)
- [CVE-2025-23555](https://cve.now/CVE-2025-23555.md): WordPress Ui Slider Filter By Price plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, chenyenming Ui Slider Filter By Price)
- [CVE-2025-23553](https://cve.now/CVE-2025-23553.md): WordPress Userbase Access Control plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, David Cramer Userbase Access Control)
- [CVE-2025-23552](https://cve.now/CVE-2025-23552.md): WordPress Texteller plugin \<= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Yashar Texteller)
- [CVE-2025-23549](https://cve.now/CVE-2025-23549.md): WordPress Maniac SEO plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, agora32 Maniac SEO)
- [CVE-2025-23539](https://cve.now/CVE-2025-23539.md): WordPress Awesome Hooks plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, surror Awesome Hooks)
- [CVE-2025-23538](https://cve.now/CVE-2025-23538.md): WordPress WP Contest plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sophia M Williams WP Contest)
- [CVE-2025-23536](https://cve.now/CVE-2025-23536.md): WordPress Track Page Scroll plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mndpsingh287 Track Page Scroll)
- [CVE-2025-23526](https://cve.now/CVE-2025-23526.md): WordPress Swift Calendar Online Appointment Scheduling plugin \<= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SwiftCloud Swift Calendar Online Appointment Scheduling)
- [CVE-2025-23524](https://cve.now/CVE-2025-23524.md): WordPress ClickBank Storefront WordPress Plugin plugin \<= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dactum ClickBank Storefront)
- [CVE-2025-23521](https://cve.now/CVE-2025-23521.md): WordPress Goodlayers Blocks plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Goodlayers Blocks)
- [CVE-2025-23520](https://cve.now/CVE-2025-23520.md): WordPress Heartland Management Terminal plugin \<= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SecureSubmit Heartland Management Terminal)
- [CVE-2025-23519](https://cve.now/CVE-2025-23519.md): WordPress G Web Pro Store Locator plugin \<= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jas Saran G Web Pro Store Locator)
- [CVE-2025-23518](https://cve.now/CVE-2025-23518.md): WordPress GoogleMapper plugin \<= 2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mrsaucier GoogleMapper)
- [CVE-2025-23517](https://cve.now/CVE-2025-23517.md): WordPress Google Map on Post/Page plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sunil chaulagain Google Map on Post/Page)
- [CVE-2025-23516](https://cve.now/CVE-2025-23516.md): WordPress Sale with Razorpay plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, brainvireinfo Sale with Razorpay)
- [CVE-2025-23515](https://cve.now/CVE-2025-23515.md): WordPress ts-tree plugin \<= 0.1.1 - Arbitrary Content Deletion vulnerability (CVSS 6.5, tsecher ts-tree)
- [CVE-2025-23505](https://cve.now/CVE-2025-23505.md): WordPress Pit Login Welcome plugin \<= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pantho Bihosh Pit Login Welcome)
- [CVE-2025-23502](https://cve.now/CVE-2025-23502.md): WordPress Curated Search plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ned Curated Search)
- [CVE-2025-23496](https://cve.now/CVE-2025-23496.md): WordPress WP FPO plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, husani WP FPO)
- [CVE-2025-23494](https://cve.now/CVE-2025-23494.md): WordPress Quizzin plugin \<= 1.01.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, binnyva Quizzin)
- [CVE-2025-23493](https://cve.now/CVE-2025-23493.md): WordPress Google Transliteration plugin \<= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, moallemi Google Transliteration)
- [CVE-2025-23490](https://cve.now/CVE-2025-23490.md): WordPress Browser-Update-Notify plugin \<= 0.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Michael Stursberg Browser-Update-Notify)
- [CVE-2025-23488](https://cve.now/CVE-2025-23488.md): WordPress rng-refresh plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Abolfazl Sabagh rng-refresh)
- [CVE-2025-23487](https://cve.now/CVE-2025-23487.md): WordPress Easy Gallery plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, odihost Easy Gallery)
- [CVE-2025-23485](https://cve.now/CVE-2025-23485.md): WordPress RS Survey plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, richestsoft RS Survey)
- [CVE-2025-23484](https://cve.now/CVE-2025-23484.md): WordPress Predict When plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cojecto Predict When)
- [CVE-2025-23482](https://cve.now/CVE-2025-23482.md): WordPress azurecurve Floating Featured Image plugin \<= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, azurecurve Floating Featured Image)
- [CVE-2025-23481](https://cve.now/CVE-2025-23481.md): WordPress Ni WooCommerce Sales Report Email plugin \<= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Anzar Ahmed Ni WooCommerce Sales Report Email)
- [CVE-2025-23480](https://cve.now/CVE-2025-23480.md): WordPress RSVP ME plugin \<= 1.9.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MicahBlu RSVP ME)
- [CVE-2025-23479](https://cve.now/CVE-2025-23479.md): WordPress melascrivi plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, melascrivi)
- [CVE-2025-23478](https://cve.now/CVE-2025-23478.md): WordPress Photo Video Store plugin \<= 21.07 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, cmsaccount Photo Video Store)
- [CVE-2025-23473](https://cve.now/CVE-2025-23473.md): WordPress Killer Theme Options plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Punit Bhalodiya Killer Theme Options)
- [CVE-2025-23472](https://cve.now/CVE-2025-23472.md): WordPress Flexo Slider plugin \<= 1.0013 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, flexostudio Flexo Slider)
- [CVE-2025-23468](https://cve.now/CVE-2025-23468.md): WordPress Essay Wizard (wpCRES) plugin \<= 1.0.6.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wrenchpilot Essay Wizard)
- [CVE-2025-23465](https://cve.now/CVE-2025-23465.md): WordPress Vampire Character Manager plugin \<= 2.13 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, magent Vampire Character Manager)
- [CVE-2025-23464](https://cve.now/CVE-2025-23464.md): WordPress Twitter News Feed plugin \<= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Keir Whitaker Twitter News Feed)
- [CVE-2025-23451](https://cve.now/CVE-2025-23451.md): WordPress Awesome Twitter Feeds plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, titodevera Awesome Twitter Feeds)
- [CVE-2025-23450](https://cve.now/CVE-2025-23450.md): WordPress AW WooCommerce Kode Pembayaran plugin \<= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, agenwebsite AW WooCommerce Kode Pembayaran)
- [CVE-2025-23447](https://cve.now/CVE-2025-23447.md): WordPress Smooth Dynamic Slider plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kundan Yevale Smooth Dynamic Slider)
- [CVE-2025-23446](https://cve.now/CVE-2025-23446.md): WordPress WP SpaceContent plugin \<= 0.4.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, KokoenDE WP SpaceContent)
- [CVE-2025-23441](https://cve.now/CVE-2025-23441.md): WordPress Attach Gallery Posts plugin \<= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dkukral Attach Gallery Posts)
- [CVE-2025-23440](https://cve.now/CVE-2025-23440.md): WordPress radSLIDE plugin \<= 2.1 - Broken Access Control to Stored Cross-Site Scripting vulnerability (CVSS 6.3, radicaldesigns radSLIDE)
- [CVE-2025-23439](https://cve.now/CVE-2025-23439.md): WordPress TinyMCE Extended Config plugin \<= 0.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, willshouse TinyMCE Extended Config)
- [CVE-2025-23437](https://cve.now/CVE-2025-23437.md): WordPress ntp-header-images plugin \<=1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, nord\_tramper ntp-header-images)
- [CVE-2025-23433](https://cve.now/CVE-2025-23433.md): WordPress vcOS plugin \<=1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jnwry vcOS)
- [CVE-2025-23425](https://cve.now/CVE-2025-23425.md): WordPress Marekkis Watermark plugin \<= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Marekkis Watermark)
- [CVE-2025-26999](https://cve.now/CVE-2025-26999.md): WordPress ProfileGrid Plugin \<= 5.9.4.3 - PHP Object Injection vulnerability (CVSS 8.8, Metagauss ProfileGrid)
- [CVE-2025-1875](https://cve.now/CVE-2025-1875.md): SQL injection vulnerability in 101news (CVSS 9.3, Mayuri K 101news)
- [CVE-2025-1874](https://cve.now/CVE-2025-1874.md): SQL injection vulnerability in 101news (CVSS 9.3, Mayuri K 101news)
- [CVE-2025-1873](https://cve.now/CVE-2025-1873.md): SQL injection vulnerability in 101news (CVSS 9.3, Mayuri K 101news)
- [CVE-2025-1872](https://cve.now/CVE-2025-1872.md): SQL injection vulnerability in 101news (CVSS 9.3, Mayuri K 101news)
- [CVE-2025-1871](https://cve.now/CVE-2025-1871.md): SQL injection vulnerability in 101news (CVSS 9.3, Mayuri K 101news)
- [CVE-2025-1870](https://cve.now/CVE-2025-1870.md): SQL injection vulnerability in 101news (CVSS 9.3, Mayuri K 101news)
- [CVE-2025-1869](https://cve.now/CVE-2025-1869.md): SQL injection vulnerability in 101news (CVSS 9.3, Mayuri K 101news)
- [CVE-2024-10925](https://cve.now/CVE-2024-10925.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 5.3, GitLab)
- [CVE-2025-1868](https://cve.now/CVE-2025-1868.md): Information display on multiple products from Famatech Corp (CVSS 6.9, Famatech Advanced IP Scanner · Famatech Advanced Port Scann…)
- [CVE-2024-24778](https://cve.now/CVE-2024-24778.md): Apache StreamPipes: Resources Permission Escalation (CVSS 6.5, Apache Software Foundation Apache StreamPipes · org.apac… +1)
- [CVE-2025-0475](https://cve.now/CVE-2025-0475.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-21424](https://cve.now/CVE-2025-21424.md): Use After Free in NPU (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53034](https://cve.now/CVE-2024-53034.md): Untrusted Pointer Dereference in DSP\_Services (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53033](https://cve.now/CVE-2024-53033.md): Untrusted Pointer Dereference in DSP\_Services (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53032](https://cve.now/CVE-2024-53032.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53031](https://cve.now/CVE-2024-53031.md): Improper Input Validation in Automotive OS Platform (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53030](https://cve.now/CVE-2024-53030.md): Improper Input Validation in Automotive OS Platform (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53029](https://cve.now/CVE-2024-53029.md): Improper Input Validation in Automotive OS Platform (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53028](https://cve.now/CVE-2024-53028.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Vehicle Networks (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53027](https://cve.now/CVE-2024-53027.md): Buffer Copy Without Checking Size of Input in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-53025](https://cve.now/CVE-2024-53025.md): Integer Overflow or Wraparound in BT Controller (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2024-53024](https://cve.now/CVE-2024-53024.md): NULL Pointer Dereference in Display (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53023](https://cve.now/CVE-2024-53023.md): Use After Free in Automotive Android OS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53022](https://cve.now/CVE-2024-53022.md): Improper Input Validation in Automotive OS Platform (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53014](https://cve.now/CVE-2024-53014.md): Improper Validation of Array Index in Audio (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53012](https://cve.now/CVE-2024-53012.md): Improper Input Validation in Automotive OS Platform (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53011](https://cve.now/CVE-2024-53011.md): Permissions, Privileges, and Access Controls in Video Analytics and Processing (CVSS 7.9, Qualcomm Snapdragon)
- [CVE-2024-49836](https://cve.now/CVE-2024-49836.md): Improper Validation of Array Index in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45580](https://cve.now/CVE-2024-45580.md): Use After Free in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43062](https://cve.now/CVE-2024-43062.md): Use After Free in Camera Linux (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43061](https://cve.now/CVE-2024-43061.md): Use After Free in Audio (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43060](https://cve.now/CVE-2024-43060.md): Use of Out-of-range Pointer Offset in Automotive Audio (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43059](https://cve.now/CVE-2024-43059.md): Use After Free in Automotive Multimedia (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43057](https://cve.now/CVE-2024-43057.md): Use After Free in MProc (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43056](https://cve.now/CVE-2024-43056.md): Buffer Over-read in Hypervisor (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2024-43055](https://cve.now/CVE-2024-43055.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Camera\_Linux (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43051](https://cve.now/CVE-2024-43051.md): Improper Authorization in SPS-HLOS (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2024-38426](https://cve.now/CVE-2024-38426.md): Improper Authentication in Modem (CVSS 5.4, Qualcomm Snapdragon)
- [CVE-2024-8186](https://cve.now/CVE-2024-8186.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 5.4, GitLab)
- [CVE-2025-1859](https://cve.now/CVE-2025-1859.md): PHPGurukul News Portal login.php sql injection (CVSS 6.9, PHPGurukul News Portal)
- [CVE-2025-24654](https://cve.now/CVE-2025-24654.md): WordPress Squirrly SEO plugin \<= 12.4.07 - Broken Access Control vulnerability (CVSS 7.1, SEO Squirrly SEO Plugin by Squirrly SEO)
- [CVE-2025-1867](https://cve.now/CVE-2025-1867.md): HTTP Response Smuggling Vulnerability in libhv (CVSS 10.0, ithewei libhv)
- [CVE-2025-1866](https://cve.now/CVE-2025-1866.md): Undefined Behavior Due to Out-of-Bounds Pointer Arithmetic in libwebsockets (CVSS 10.0, warmcat libwebsockets)
- [CVE-2025-1858](https://cve.now/CVE-2025-1858.md): Codezips Online Shopping Website success.php sql injection (CVSS 6.9, Codezips Online Shopping Website)
- [CVE-2025-25280](https://cve.now/CVE-2025-25280.md): Buffer overflow vulnerability exists in FutureNet AS series (Industrial Routers) and FA series (Protocol Conversion Machine) provided by Cen (CVSS 5.3, Century Systems Co. FutureNet AS-250/S · Century System… +12)
- [CVE-2025-24846](https://cve.now/CVE-2025-24846.md): Authentication bypass vulnerability exists in FutureNet AS series (Industrial Routers) provided by Century Systems Co., Ltd. (CVSS 7.5, Century Systems Co. FutureNet AS-250/S · Century System… +10)
- [CVE-2025-1864](https://cve.now/CVE-2025-1864.md): Buffer Overflow and Potential Code Execution in Radare2 (CVSS 10.0, radareorg radare2)
- [CVE-2025-1857](https://cve.now/CVE-2025-1857.md): PHPGurukul Nipah Virus Testing Management System check\_availability.php sql injection (CVSS 6.9, PHPGurukul Nipah Virus Testing Management System)
- [CVE-2025-1723](https://cve.now/CVE-2025-1723.md): Account takeover (CVSS 8.1, ManageEngine ADSelfService Plus)
- [CVE-2025-1856](https://cve.now/CVE-2025-1856.md): Codezips Gym Management System gen\_invoice.php sql injection (CVSS 6.9, Codezips Gym Management System)
- [CVE-2025-1855](https://cve.now/CVE-2025-1855.md): PHPGurukul Online Shopping Portal product-details.php sql injection (CVSS 5.3, PHPGurukul Online Shopping Portal)
- [CVE-2025-1854](https://cve.now/CVE-2025-1854.md): Codezips Gym Management System del\_member.php sql injection (CVSS 5.3, Codezips Gym Management System)
- [CVE-2025-1853](https://cve.now/CVE-2025-1853.md): Tenda AC8 Parameter SetIpMacBind sub\_49E098 stack-based overflow (CVSS 8.7, Tenda AC8)
- [CVE-2025-1852](https://cve.now/CVE-2025-1852.md): Totolink EX1800T cstecgi.cgi loginAuth buffer overflow (CVSS 8.7, Totolink EX1800T)
- [CVE-2025-1851](https://cve.now/CVE-2025-1851.md): Tenda AC7 SetFirewallCfg formSetFirewallCfg stack-based overflow (CVSS 8.7, Tenda AC7)
- [CVE-2025-1850](https://cve.now/CVE-2025-1850.md): Codezips College Management System university.php sql injection (CVSS 6.9, Codezips College Management System)
- [CVE-2025-1849](https://cve.now/CVE-2025-1849.md): zj1983 zz import\_data\_todb server-side request forgery (CVSS 5.3, zj1983 zz)
- [CVE-2025-1848](https://cve.now/CVE-2025-1848.md): zj1983 zz import\_data\_check server-side request forgery (CVSS 5.3, zj1983 zz)
- [CVE-2025-1847](https://cve.now/CVE-2025-1847.md): zj1983 zz improper authorization (CVSS 5.3, zj1983 zz)
- [CVE-2025-1846](https://cve.now/CVE-2025-1846.md): zj1983 zz File ZfileAction.java deleteLocalFile denial of service (CVSS 5.3, zj1983 zz)
- [CVE-2025-20653](https://cve.now/CVE-2025-20653.md): In da, there is a possible out of bounds read due to an integer overflow. (CVSS 6.5, MediaTek MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT…)
- [CVE-2025-20652](https://cve.now/CVE-2025-20652.md): In V5 DA, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.6, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6771, MT…)
- [CVE-2025-20651](https://cve.now/CVE-2025-20651.md): In da, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.1, MediaTek MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT…)
- [CVE-2025-20650](https://cve.now/CVE-2025-20650.md): In da, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.8, MediaTek MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT…)
- [CVE-2025-20649](https://cve.now/CVE-2025-20649.md): In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check. (CVSS 6.5, MediaTek MT6880, MT6890, MT6980, MT6990, MT7663, MT7902, MT…)
- [CVE-2025-20648](https://cve.now/CVE-2025-20648.md): In apu, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, MediaTek MT2718, MT6879, MT6989, MT8196, MT8370, MT8390, MT…)
- [CVE-2025-20647](https://cve.now/CVE-2025-20647.md): In Modem, there is a possible system crash due to a missing bounds check. (CVSS 6.5, MediaTek MT2735, MT2737, MT6739, MT6761, MT6762, MT6762D, M…)
- [CVE-2025-20646](https://cve.now/CVE-2025-20646.md): In wlan AP FW, there is a possible out of bounds write due to improper input validation. (CVSS 9.8, MediaTek MT6890, MT7915, MT7916, MT7981, MT7986)
- [CVE-2025-20645](https://cve.now/CVE-2025-20645.md): In KeyInstall, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, MediaTek MT6765, MT6768, MT6833, MT6835, MT6853, MT6855, MT…)
- [CVE-2025-20644](https://cve.now/CVE-2025-20644.md): In Modem, there is a possible memory corruption due to incorrect error handling. (CVSS 6.5, MediaTek MT2735, MT2737, MT6833, MT6833P, MT6853, MT6853T,…)
- [CVE-2025-1845](https://cve.now/CVE-2025-1845.md): ESAFENET DSM examExportPDF command injection (CVSS 5.3, ESAFENET DSM)
- [CVE-2025-1844](https://cve.now/CVE-2025-1844.md): ESAFENET CDG backupLogDetail.jsp sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2025-1843](https://cve.now/CVE-2025-1843.md): Mini-Tmall ProductMapper.java select sql injection (CVSS 5.3, Mini-Tmall)
- [CVE-2025-1842](https://cve.now/CVE-2025-1842.md): FITSTATS Technologies AthleteMonitoring login.php cross site scripting (CVSS 5.3, FITSTATS Technologies AthleteMonitoring)
- [CVE-2025-1841](https://cve.now/CVE-2025-1841.md): ESAFENET CDG ClientSortLog.jsp sql injection (CVSS 6.9, ESAFENET CDG)
- [CVE-2023-49031](https://cve.now/CVE-2023-49031.md): Directory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing platform 6.8.3.0 allows a remote attacker to rea (CVSS 5.1)
- [CVE-2024-51091](https://cve.now/CVE-2024-51091.md): Cross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs package (CVSS 5.4, seajs)
- [CVE-2024-53382](https://cve.now/CVE-2024-53382.md): Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly co (CVSS 4.9, PrismJS Prism · prismjs)
- [CVE-2024-53384](https://cve.now/CVE-2024-53384.md): A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to docu (CVSS 5.1, tsup)
- [CVE-2024-53386](https://cve.now/CVE-2024-53386.md): Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaS (CVSS 4.9, Piqnt Stage.js · stage-js)
- [CVE-2024-53387](https://cve.now/CVE-2024-53387.md): A DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTML element. (CVSS 8.8)
- [CVE-2024-53388](https://cve.now/CVE-2024-53388.md): A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element. (CVSS 8.8, mavo)
- [CVE-2024-55064](https://cve.now/CVE-2024-55064.md): Multiple cross-site scripting (XSS) vulnerabilities in EasyVirt DC NetScope \<= 8.6.4 allow remote attackers to inject arbitrary JavaScript o (CVSS 5.4)
- [CVE-2024-55570](https://cve.now/CVE-2024-55570.md): /api/user/users in the web GUI for the Cubro EXA48200 network packet broker (build 20231025055018) fixed in V5.0R14.5P4-V3.3R1 allows remote (CVSS 5.4)
- [CVE-2024-57240](https://cve.now/CVE-2024-57240.md): A Cross-Site Scripting (XSS) vulnerability in the Rendering Engine component in Apryse WebViewer v11.1 and earlier allows attackers to execu (CVSS 5.4)
- [CVE-2025-25939](https://cve.now/CVE-2025-25939.md): Reprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform/activate\_process via the akey parameter. (CVSS 6.1)
- [CVE-2025-25948](https://cve.now/CVE-2025-25948.md): Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) (CVSS 9.1)
- [CVE-2025-25949](https://cve.now/CVE-2025-25949.md): A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al (CVSS 5.4)
- [CVE-2025-25950](https://cve.now/CVE-2025-25950.md): Incorrect access control in the component /rest/staffResource/update of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) (CVSS 8.1)
- [CVE-2025-25951](https://cve.now/CVE-2025-25951.md): An information disclosure vulnerability in the component /rest/cb/executeBasicSearch of Serosoft Solutions Pvt Ltd Academia Student Informat (CVSS 7.5)
- [CVE-2025-25952](https://cve.now/CVE-2025-25952.md): An Insecure Direct Object References (IDOR) in the component /getStudemtAllDetailsById?studentId=XX of Serosoft Solutions Pvt Ltd Academia S (CVSS 6.5)
- [CVE-2025-25953](https://cve.now/CVE-2025-25953.md): Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token exp (CVSS 6.5)
- [CVE-2025-25967](https://cve.now/CVE-2025-25967.md): Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). (CVSS 6.8)
- [CVE-2025-26206](https://cve.now/CVE-2025-26206.md): Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html co (CVSS 9.0)
- [CVE-2025-27219](https://cve.now/CVE-2025-27219.md): In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerabi (CVSS 5.8, ruby-lang CGI · cgi)
- [CVE-2025-27220](https://cve.now/CVE-2025-27220.md): In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method. (CVSS 4.0, ruby-lang CGI · cgi)
- [CVE-2025-27221](https://cve.now/CVE-2025-27221.md): In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication cr (CVSS 3.2, ruby-lang URI · uri)
- [CVE-2025-27370](https://cve.now/CVE-2025-27370.md): OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. (CVSS 6.9, OpenID Connect)
- [CVE-2025-27371](https://cve.now/CVE-2025-27371.md): In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, the (CVSS 6.9, IETF RFC)
- [CVE-2025-27583](https://cve.now/CVE-2025-27583.md): Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Informati (CVSS 9.1)
- [CVE-2025-27584](https://cve.now/CVE-2025-27584.md): A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al (CVSS 5.4)
- [CVE-2025-27585](https://cve.now/CVE-2025-27585.md): A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al (CVSS 5.4)
- [CVE-2025-27590](https://cve.now/CVE-2025-27590.md): In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux us (CVSS 9.0, Oxidized Web project Oxidized Web · oxidized-web)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.