CVEs published March 4, 2025
146 CVEs were published on March 4, 2025: 16 critical, 36 high. 5 are now in CISA KEV.
- Published
- 146
- Critical
- 16
- High
- 36
- Medium
- 67
- Low
- 27
- Unrated
- 0
- Now in CISA KEV
- 5
- Fix available
- 27
Most affected products
- OpenHarmony
- 26
- Mozilla Firefox · Mozilla Thunderbird
- 11
- Huawei HarmonyOS
- 7
- Axis Communications AB AXIS OS
- 5
- PHPGurukul Restaurant Table Booking System
- 5
- Tenda TX3
- 5
- Arista Networks EOS
- 4
- Enalean tuleap
- 4
- Mozilla Firefox
- 3
- Mozilla Firefox for iOS
- 3
Critical 16
- CVE-2025-23410GMOD Apollo Relative Path TraversalGMOD Apollo
- CVE-2025-1316Edimax IC-7100 IP Camera OS Command InjectionEdimax IC-7100 IP Camera
- CVE-2025-27510RCE in the package conda-forge-metadataconda-forge-metadata
- CVE-2025-1260On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.Arista Networks EOS
- CVE-2025-27507IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurationszitadel · github.com/zitadel/zitadel/v2 +1
- CVE-2024-11957Arbitrary Code Execution in WPS OfficeKingsoft WPS Office
- CVE-2025-1942Disclosure of uninitialized memory when .toUpperCase() causes string to get longerMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1941Lock screen setting bypass in Firefox Focus for AndroidMozilla Firefox
- CVE-2025-22224VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.VMware ESXi · VMware Workstation +3
- CVE-2025-1307Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Uploadspicethemes Newscrunch
- CVE-2025-0912GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injectionstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-50704Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code v
- CVE-2024-50706Unauthenticated SQL injection vulnerability in Uniguest Tripleplay version 23.1+ allows remote attackers to execute arbitrary SQL queries on
- CVE-2024-50707Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code v
- CVE-2025-26136A SQL injection vulnerability exists in mysiteforme versions prior to 2025.01.1.
- CVE-2025-26319FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.flowise
High 36
- CVE-2025-21092GMOD Apollo Incorrect Privilege AssignmentGMOD Apollo
- CVE-2025-1080Macro URL arbitrary script executionThe Document Foundation LibreOffice
- CVE-2025-1259On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.Arista Networks EOS
- CVE-2019-1815Cisco Meraki MX67 and MX68 Sensitive Information Disclosure VulnerabilityCisco Meraki MX Firmware
- CVE-2024-10930Carrier Block Load Privilege EscalationCarrier Block Load
- CVE-2024-41147An out-of-bounds write vulnerability exists in the ma_dr_flac__decode_samples__lpc functionality of Miniaudio miniaudio v0.11.21.Miniaudio
- CVE-2025-1424Privilege Escalation Through SUID Binary and Developer ModePocketBook InkPad Color
- CVE-2025-23368Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cliwildfly-core · Red Hat JBoss Enterprise Application Pla… +11
- CVE-2024-9149SQLi in Wind Media's E-Commerce Website TemplateWind Media E-Commerce Website Template
- CVE-2025-1943Memory safety bugs fixed in Firefox 136 and Thunderbird 136Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-1937Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-1936Adding %00 and a fake extension to a jar: URL changed the interpretation of the contentsMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1940Android Intent confirmation prompt tapjacking using Select optionsMozilla Firefox
- CVE-2025-1933JIT corruption of WASM i32 return values on 64-bit CPUsMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1932Inconsistent comparator in XSLT sorting led to out-of-bounds accessMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1931Use-after-free in WebTransportChildMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1930AudioIPC StreamData could trigger a use-after-free in the Browser processMozilla Firefox · Mozilla Thunderbird
- CVE-2025-22226VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS.ESXi · VMware Workstation +4
- CVE-2025-22225VMware ESXi contains an arbitrary write vulnerability.VMware ESXi · VMware Cloud Foundation +2
- CVE-2024-58045Multi-concurrency vulnerability in the media digital copyright protection module Impact: Successful exploitation of this vulnerability may aHuawei HarmonyOS
- CVE-2024-58044Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect avaHuawei HarmonyOS · Huawei EMUI
- CVE-2024-58043Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentialitHuawei HarmonyOS · Huawei EMUI
- CVE-2025-0360During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration fraAxis Communications AB AXIS OS
- CVE-2025-0359During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework thaAxis Communications AB AXIS OS
- CVE-2025-1306Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Uploadspicethemes Newscrunch
- CVE-2025-1639Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/ActivationcrowdyTheme Animation Addons for Elementor Pro
- CVE-2025-1899Tenda TX3 setPptpUserList buffer overflowTenda TX3
- CVE-2025-1898Tenda TX3 openSchedWifi buffer overflowTenda TX3
- CVE-2025-1897Tenda TX3 SetNetControlList buffer overflowTenda TX3
- CVE-2025-1896Tenda TX3 SetStaticRouteCfg buffer overflowTenda TX3
- CVE-2025-1895Tenda TX3 setMacFilterCfg buffer overflowTenda TX3
- CVE-2020-23438Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation.
- CVE-2021-41719Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using
- CVE-2024-48248NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lNAKIVO Backup & Replication Director
- CVE-2024-50705Unauthenticated reflected cross-site scripting (XSS) vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute a
- CVE-2025-25426yshopmall <=v1.9.0 is vulnerable to SQL Injection in the image listing interface.
Medium, low and unrated 94
- CVE-2025-1962projectworlds Online Hotel Booking addroom.php sql injectionprojectworlds Online Hotel Booking
- CVE-2025-1961SourceCodester Best Church Management Software web_crud.php sql injectionSourceCodester Best Church Management Software
- CVE-2025-1959Codezips Gym Management System change_s_pwd.php sql injectionCodezips Gym Management System
- CVE-2025-1958aaluoxiang oa_system address-mapper.xml sql injectionaaluoxiang oa_system
- CVE-2025-1957code-projects Blood Bank System o+.php cross site scriptingcode-projects Blood Bank System
- CVE-2025-1956code-projects Shopping Portal Login index.php sql injectioncode-projects Shopping Portal
- CVE-2025-1955code-projects Online Class and Exam Scheduling System profile.php cross site scriptingcode-projects Online Class and Exam Scheduling System
- CVE-2025-1954PHPGurukul Human Metapneumovirus Testing Management System login.php sql injectionPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2024-8000On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restarArista Networks EOS
- CVE-2024-9135On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing processing being terminated and route flapping.Arista Networks EOS
- CVE-2025-1953vLLM AIBrix Prefix Caching hash.go random valuesvLLM AIBrix
- CVE-2025-1952PHPGurukul Restaurant Table Booking System password-recovery.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2025-1949ZZCMS URL register_nodb.php cross site scriptingZZCMS
- CVE-2025-1969Request approval spoofing in Temporary Elevated Access Management (TEAM) for AWS IAM Identity CenterTemporary Elevated Access Management (TEAM) for AWS IAM Ide…
- CVE-2025-1947hzmanyun Education and Training System UploadImageController.java scorm command injectionhzmanyun Education and Training System
- CVE-2025-1946hzmanyun Education and Training System exportPDF command injectionhzmanyun Education and Training System
- CVE-2020-3122Cisco Content Security Management Appliance Information Disclosure VulnerabilityCisco IronPort Security Management Appliance · Cisco Secure…
- CVE-2025-27402Tuleap is missing CSRF protections on tracker fields administrative operationsEnalean tuleap
- CVE-2025-27401In Tuleap, deleting a report can delete criteria filters in other reportsEnalean tuleap
- CVE-2025-27156Tuleap allows content injection via emails sent by the mass emailing featuresEnalean tuleap
- CVE-2025-27150Tuleap dumps the Redis password into the generated troubleshooting archivesEnalean tuleap
- CVE-2025-27155In-memory stored Cross-site scripting (XSS) vulnerability in pineconesimmatrix-org pinecone · github.com/matrix-org/pinecone
- CVE-2025-27111Escape Sequence Injection vulnerability in Rack lead to Possible Log Injectionrack
- CVE-2025-1425File Read Through Improper Sudo Privilege ManagementPocketBook InkPad Color
- CVE-2025-27425QR code user confirmation bypass with invalid protocolMozilla Firefox for iOS
- CVE-2025-27424Firefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http SchemeMozilla Firefox for iOS
- CVE-2025-27426Firefox Mobile iOS Full Address Bar Spoof Using Server-Side Redirect to internal error pageMozilla Firefox for iOS
- CVE-2025-1938Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-1935Clickjacking the registerProtocolHandler info-barMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1934Unexpected GC during RegExp bailout processingMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1939Tapjacking in Android Custom Tabs using transition animationsMozilla Firefox
- CVE-2025-1925Open5GS AMF nsmf-handler.c amf_nsmf_pdusession_handle_update_sm_context denial of serviceOpen5GS
- CVE-2025-0370WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parametergn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2025-0958Ultimate WordPress Auction Plugin <= 4.2.9 - Missing Authorization to Arbitrary Post Deletionnitesh_singh Ultimate WordPress Auction Plugin
- CVE-2025-0433Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameterlitonice13 Master Addons For Elementor – Widgets, Extension…
- CVE-2024-13724Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorizationwpswings Wallet System for WooCommerce – Digital Wallet, Bu…
- CVE-2024-9618Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetslitonice13 Master Addons For Elementor – Widgets, Extension…
- CVE-2025-0512Structured Content (JSON-LD) #wpsc <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcodegorbo Structured Content (JSON-LD) #wpsc
- CVE-2024-13682Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Cross-Site Request Forgerywpswings Wallet System for WooCommerce – Digital Wallet, Bu…
- CVE-2024-58050Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service confiHuawei HarmonyOS
- CVE-2024-58049Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service cHuawei HarmonyOS
- CVE-2024-58048Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availabHuawei HarmonyOS
- CVE-2024-58047Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service cHuawei HarmonyOS
- CVE-2024-58046Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confiHuawei HarmonyOS
- CVE-2025-27521Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affecHuawei HarmonyOS
- CVE-2024-13685Admin and Site Enhancements (ASE) < 7.6.10 - Limit Login Attempt Bypass via IP SpoofingAdmin and Site Enhancements
- CVE-2024-47262Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attaAxis Communications AB AXIS OS
- CVE-2024-4726051l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allAxis Communications AB AXIS OS
- CVE-2024-47259Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input valAxis Communications AB AXIS OS
- CVE-2025-1906PHPGurukul Restaurant Table Booking System profile.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2025-1905SourceCodester Employee Management System employee.php cross site scriptingSourceCodester Employee Management System
- CVE-2025-1904code-projects Blood Bank System A+.php cross site scriptingcode-projects Blood Bank System
- CVE-2025-1903Codezips Online Shopping Website cart_add.php sql injectionCodezips Online Shopping Website
- CVE-2025-1902PHPGurukul Student Record System password-recovery.php sql injectionPHPGurukul Student Record System
- CVE-2025-24309Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-24301Arkcompiler Ets Runtime has an UAF vulnerabilityOpenHarmony
- CVE-2025-23420Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-23418Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-23414Arkcompiler Ets Runtime has an UAF vulnerabilityOpenHarmony
- CVE-2025-23409Communication Dsoftbus has an UAF vulnerabilityOpenHarmony
- CVE-2025-23240Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-23234Arkcompiler Ets Runtime has a buffer overflow vulnerabilityOpenHarmony
- CVE-2025-22897Arkcompiler Ets Runtime has a buffer overflow vulnerabilityOpenHarmony
- CVE-2025-22847Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-22841Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-22837Arkcompiler Ets Runtime has a NULL pointer dereference vulnerabilityOpenHarmony
- CVE-2025-22835Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-22443Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-21098Liteos-A has an insecure storage of sensitive information vulnerabilityOpenHarmony
- CVE-2025-21097Arkcompiler Ets Runtime has a NULL pointer dereference vulnerabilityOpenHarmony
- CVE-2025-21089Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-21084Arkcompiler Ets Runtime has an NULL pointer dereference vulnerabilityOpenHarmony
- CVE-2025-20626Arkcompiler Ets Runtime has an UAF vulnerabilityOpenHarmony
- CVE-2025-20091Communication Dsoftbus has an UAF vulnerabilityOpenHarmony
- CVE-2025-20081Communication Dsoftbus has an UAF vulnerabilityOpenHarmony
- CVE-2025-20042Liteos-A has an out of bounds read vulnerabilityOpenHarmony
- CVE-2025-20024Arkcompiler Ets Runtime has an integer overflow vulnerabilityOpenHarmony
- CVE-2025-20021Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-20011Communication Dsoftbus has a memory leak vulnerabilityOpenHarmony
- CVE-2025-0587Arkcompiler Ets Runtime has an integer overflow vulnerabilityOpenHarmony
- CVE-2025-1321teachPress <= 9.0.7 - Authenticated (Contributor+) SQL Injectionwinkm89 teachPress
- CVE-2024-13686VW Storefront <= 0.9.9 - Missing Authorization to Authenticated (Subscriber+) Settings Resetvowelweb VW Storefront
- CVE-2025-1901PHPGurukul Restaurant Table Booking System check_availability.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2025-1900PHPGurukul Restaurant Table Booking System add-table.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2025-1894PHPGurukul Restaurant Table Booking System search-result.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2025-1695NGINX Unit Java VulnerabilityF5 NGINX Unit
- CVE-2025-1893Open5GS AMF gmm-sm.c gmm_state_authentication denial of serviceOpen5GS
- CVE-2025-1892shishuocms Directory Deletion Page add.json cross site scriptingshishuocms
- CVE-2025-26091A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to execut
- CVE-2025-26182An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file
- CVE-2025-26202Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands) in
- CVE-2025-26318hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connectedTSplus Remote Access
- CVE-2025-26320t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address parameter at /device/ping.
- CVE-2025-26849There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions.Docusnap