# CVEs published 2025-03-04

146 CVEs were published on March 4, 2025: 16 critical, 36 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2025-23410](https://cve.now/CVE-2025-23410.md): GMOD Apollo Relative Path Traversal (CVSS 9.3, GMOD Apollo)
- [CVE-2025-21092](https://cve.now/CVE-2025-21092.md): GMOD Apollo Incorrect Privilege Assignment (CVSS 7.1, GMOD Apollo)
- [CVE-2025-1316](https://cve.now/CVE-2025-1316.md): Edimax IC-7100 IP Camera OS Command Injection (CVSS 9.3, KEV, Edimax IC-7100 IP Camera)
- [CVE-2025-1962](https://cve.now/CVE-2025-1962.md): projectworlds Online Hotel Booking addroom.php sql injection (CVSS 6.9, projectworlds Online Hotel Booking)
- [CVE-2025-1961](https://cve.now/CVE-2025-1961.md): SourceCodester Best Church Management Software web\_crud.php sql injection (CVSS 5.3, SourceCodester Best Church Management Software)
- [CVE-2025-1959](https://cve.now/CVE-2025-1959.md): Codezips Gym Management System change\_s\_pwd.php sql injection (CVSS 6.9, Codezips Gym Management System)
- [CVE-2025-1958](https://cve.now/CVE-2025-1958.md): aaluoxiang oa\_system address-mapper.xml sql injection (CVSS 5.3, aaluoxiang oa\_system)
- [CVE-2025-1957](https://cve.now/CVE-2025-1957.md): code-projects Blood Bank System o+.php cross site scripting (CVSS 5.1, code-projects Blood Bank System)
- [CVE-2025-27510](https://cve.now/CVE-2025-27510.md): RCE in the package conda-forge-metadata (CVSS 9.3, conda-forge-metadata)
- [CVE-2025-1956](https://cve.now/CVE-2025-1956.md): code-projects Shopping Portal Login index.php sql injection (CVSS 6.9, code-projects Shopping Portal)
- [CVE-2025-1955](https://cve.now/CVE-2025-1955.md): code-projects Online Class and Exam Scheduling System profile.php cross site scripting (CVSS 5.1, code-projects Online Class and Exam Scheduling System)
- [CVE-2025-1954](https://cve.now/CVE-2025-1954.md): PHPGurukul Human Metapneumovirus Testing Management System login.php sql injection (CVSS 6.9, PHPGurukul Human Metapneumovirus Testing Management System)
- [CVE-2024-8000](https://cve.now/CVE-2024-8000.md): On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restar (CVSS 5.3, Arista Networks EOS)
- [CVE-2024-9135](https://cve.now/CVE-2024-9135.md): On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing processing being terminated and route flapping. (CVSS 5.3, Arista Networks EOS)
- [CVE-2025-1080](https://cve.now/CVE-2025-1080.md): Macro URL arbitrary script execution (CVSS 7.2, The Document Foundation LibreOffice)
- [CVE-2025-1953](https://cve.now/CVE-2025-1953.md): vLLM AIBrix Prefix Caching hash.go random values (CVSS 2.1, vLLM AIBrix)
- [CVE-2025-1260](https://cve.now/CVE-2025-1260.md): On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. (CVSS 9.1, Arista Networks EOS)
- [CVE-2025-1259](https://cve.now/CVE-2025-1259.md): On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. (CVSS 7.7, Arista Networks EOS)
- [CVE-2025-1952](https://cve.now/CVE-2025-1952.md): PHPGurukul Restaurant Table Booking System password-recovery.php sql injection (CVSS 6.9, PHPGurukul Restaurant Table Booking System)
- [CVE-2025-1949](https://cve.now/CVE-2025-1949.md): ZZCMS URL register\_nodb.php cross site scripting (CVSS 5.3, ZZCMS)
- [CVE-2025-1969](https://cve.now/CVE-2025-1969.md): Request approval spoofing in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center (CVSS 4.3, Temporary Elevated Access Management (TEAM) for AWS IAM Ide…)
- [CVE-2025-1947](https://cve.now/CVE-2025-1947.md): hzmanyun Education and Training System UploadImageController.java scorm command injection (CVSS 5.3, hzmanyun Education and Training System)
- [CVE-2025-1946](https://cve.now/CVE-2025-1946.md): hzmanyun Education and Training System exportPDF command injection (CVSS 5.3, hzmanyun Education and Training System)
- [CVE-2020-3122](https://cve.now/CVE-2020-3122.md): Cisco Content Security Management Appliance Information Disclosure Vulnerability (CVSS 5.3, Cisco IronPort Security Management Appliance · Cisco Secure…)
- [CVE-2019-1815](https://cve.now/CVE-2019-1815.md): Cisco Meraki MX67 and MX68 Sensitive Information Disclosure Vulnerability (CVSS 7.5, Cisco Meraki MX Firmware)
- [CVE-2024-10930](https://cve.now/CVE-2024-10930.md): Carrier Block Load Privilege Escalation (CVSS 7.1, Carrier Block Load)
- [CVE-2024-41147](https://cve.now/CVE-2024-41147.md): An out-of-bounds write vulnerability exists in the ma\_dr\_flac\_\_decode\_samples\_\_lpc functionality of Miniaudio miniaudio v0.11.21. (CVSS 7.7, Miniaudio)
- [CVE-2025-27402](https://cve.now/CVE-2025-27402.md): Tuleap is missing CSRF protections on tracker fields administrative operations (CVSS 4.6, Enalean tuleap)
- [CVE-2025-27401](https://cve.now/CVE-2025-27401.md): In Tuleap, deleting a report can delete criteria filters in other reports (CVSS 4.6, Enalean tuleap)
- [CVE-2025-27156](https://cve.now/CVE-2025-27156.md): Tuleap allows content injection via emails sent by the mass emailing features (CVSS 4.1, Enalean tuleap)
- [CVE-2025-27150](https://cve.now/CVE-2025-27150.md): Tuleap dumps the Redis password into the generated troubleshooting archives (CVSS 5.3, Enalean tuleap)
- [CVE-2025-27507](https://cve.now/CVE-2025-27507.md): IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations (CVSS 9.0, zitadel · github.com/zitadel/zitadel/v2 +1)
- [CVE-2025-27155](https://cve.now/CVE-2025-27155.md): In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim (CVSS 6.1, matrix-org pinecone · github.com/matrix-org/pinecone)
- [CVE-2024-11957](https://cve.now/CVE-2024-11957.md): Arbitrary Code Execution in WPS Office (CVSS 9.3, Kingsoft WPS Office)
- [CVE-2025-27111](https://cve.now/CVE-2025-27111.md): Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection (CVSS 6.9, rack)
- [CVE-2025-1424](https://cve.now/CVE-2025-1424.md): Privilege Escalation Through SUID Binary and Developer Mode (CVSS 8.6, PocketBook InkPad Color)
- [CVE-2025-1425](https://cve.now/CVE-2025-1425.md): File Read Through Improper Sudo Privilege Management (CVSS 4.7, PocketBook InkPad Color)
- [CVE-2025-23368](https://cve.now/CVE-2025-23368.md): Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli (CVSS 8.1, wildfly-core · Red Hat JBoss Enterprise Application Pla… +11)
- [CVE-2024-9149](https://cve.now/CVE-2024-9149.md): SQLi in Wind Media's E-Commerce Website Template (CVSS 8.6, Wind Media E-Commerce Website Template)
- [CVE-2025-27425](https://cve.now/CVE-2025-27425.md): QR code user confirmation bypass with invalid protocol (CVSS 4.3, Mozilla Firefox for iOS)
- [CVE-2025-27424](https://cve.now/CVE-2025-27424.md): Firefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http Scheme (CVSS 4.3, Mozilla Firefox for iOS)
- [CVE-2025-27426](https://cve.now/CVE-2025-27426.md): Firefox Mobile iOS Full Address Bar Spoof Using Server-Side Redirect to internal error page (CVSS 5.4, Mozilla Firefox for iOS)
- [CVE-2025-1943](https://cve.now/CVE-2025-1943.md): Memory safety bugs fixed in Firefox 136 and Thunderbird 136 (CVSS 8.2, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1938](https://cve.now/CVE-2025-1938.md): Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8 (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1937](https://cve.now/CVE-2025-1937.md): Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1936](https://cve.now/CVE-2025-1936.md): Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1935](https://cve.now/CVE-2025-1935.md): Clickjacking the registerProtocolHandler info-bar (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1942](https://cve.now/CVE-2025-1942.md): Disclosure of uninitialized memory when .toUpperCase() causes string to get longer (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1941](https://cve.now/CVE-2025-1941.md): Lock screen setting bypass in Firefox Focus for Android (CVSS 9.1, Mozilla Firefox)
- [CVE-2025-1934](https://cve.now/CVE-2025-1934.md): Unexpected GC during RegExp bailout processing (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1940](https://cve.now/CVE-2025-1940.md): Android Intent confirmation prompt tapjacking using Select options (CVSS 7.1, Mozilla Firefox)
- [CVE-2025-1933](https://cve.now/CVE-2025-1933.md): JIT corruption of WASM i32 return values on 64-bit CPUs (CVSS 7.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1932](https://cve.now/CVE-2025-1932.md): Inconsistent comparator in XSLT sorting led to out-of-bounds access (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1931](https://cve.now/CVE-2025-1931.md): Use-after-free in WebTransportChild (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1939](https://cve.now/CVE-2025-1939.md): Tapjacking in Android Custom Tabs using transition animations (CVSS 3.9, Mozilla Firefox)
- [CVE-2025-1930](https://cve.now/CVE-2025-1930.md): AudioIPC StreamData could trigger a use-after-free in the Browser process (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-1925](https://cve.now/CVE-2025-1925.md): Open5GS AMF nsmf-handler.c amf\_nsmf\_pdusession\_handle\_update\_sm\_context denial of service (CVSS 6.9, Open5GS)
- [CVE-2025-22226](https://cve.now/CVE-2025-22226.md): VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. (CVSS 7.1, KEV, ESXi · VMware Workstation +4)
- [CVE-2025-22225](https://cve.now/CVE-2025-22225.md): VMware ESXi contains an arbitrary write vulnerability. (CVSS 8.2, KEV, VMware ESXi · VMware Cloud Foundation +2)
- [CVE-2025-22224](https://cve.now/CVE-2025-22224.md): VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. (CVSS 9.3, KEV, VMware ESXi · VMware Workstation +3)
- [CVE-2025-0370](https://cve.now/CVE-2025-0370.md): WP Shortcodes Plugin — Shortcodes Ultimate \<= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter (CVSS 6.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2025-0958](https://cve.now/CVE-2025-0958.md): Ultimate WordPress Auction Plugin \<= 4.2.9 - Missing Authorization to Arbitrary Post Deletion (CVSS 5.4, nitesh\_singh Ultimate WordPress Auction Plugin)
- [CVE-2025-0433](https://cve.now/CVE-2025-0433.md): Master Addons \<= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2024-13724](https://cve.now/CVE-2024-13724.md): Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction \<= 2.6.2 - Missing Authorization (CVSS 4.3, wpswings Wallet System for WooCommerce – Digital Wallet, Bu…)
- [CVE-2024-9618](https://cve.now/CVE-2024-9618.md): Master Addons \<= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2025-0512](https://cve.now/CVE-2025-0512.md): Structured Content (JSON-LD) #wpsc \<= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc\_fs\_local\_business Shortcode (CVSS 6.4, gorbo Structured Content (JSON-LD) #wpsc)
- [CVE-2024-13682](https://cve.now/CVE-2024-13682.md): Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction \<= 2.6.2 - Cross-Site Request Forgery (CVSS 4.3, wpswings Wallet System for WooCommerce – Digital Wallet, Bu…)
- [CVE-2024-58050](https://cve.now/CVE-2024-58050.md): Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service confi (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-58049](https://cve.now/CVE-2024-58049.md): Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service c (CVSS 5.0, Huawei HarmonyOS)
- [CVE-2024-58048](https://cve.now/CVE-2024-58048.md): Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availab (CVSS 6.7, Huawei HarmonyOS)
- [CVE-2024-58047](https://cve.now/CVE-2024-58047.md): Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service c (CVSS 5.0, Huawei HarmonyOS)
- [CVE-2024-58046](https://cve.now/CVE-2024-58046.md): Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confi (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-58045](https://cve.now/CVE-2024-58045.md): Multi-concurrency vulnerability in the media digital copyright protection module Impact: Successful exploitation of this vulnerability may a (CVSS 8.6, Huawei HarmonyOS)
- [CVE-2025-27521](https://cve.now/CVE-2025-27521.md): Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affec (CVSS 6.8, Huawei HarmonyOS)
- [CVE-2024-58044](https://cve.now/CVE-2024-58044.md): Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect ava (CVSS 8.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-58043](https://cve.now/CVE-2024-58043.md): Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentialit (CVSS 7.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-13685](https://cve.now/CVE-2024-13685.md): Admin and Site Enhancements (ASE) \< 7.6.10 - Limit Login Attempt Bypass via IP Spoofing (CVSS 5.3, Admin and Site Enhancements)
- [CVE-2025-0360](https://cve.now/CVE-2025-0360.md): During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration fra (CVSS 7.8, Axis Communications AB AXIS OS)
- [CVE-2025-0359](https://cve.now/CVE-2025-0359.md): During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework tha (CVSS 8.5, Axis Communications AB AXIS OS)
- [CVE-2024-47262](https://cve.now/CVE-2024-47262.md): Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition atta (CVSS 5.3, Axis Communications AB AXIS OS)
- [CVE-2024-47260](https://cve.now/CVE-2024-47260.md): 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation all (CVSS 6.5, Axis Communications AB AXIS OS)
- [CVE-2024-47259](https://cve.now/CVE-2024-47259.md): Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input val (CVSS 3.5, Axis Communications AB AXIS OS)
- [CVE-2025-1906](https://cve.now/CVE-2025-1906.md): PHPGurukul Restaurant Table Booking System profile.php sql injection (CVSS 5.1, PHPGurukul Restaurant Table Booking System)
- [CVE-2025-1905](https://cve.now/CVE-2025-1905.md): SourceCodester Employee Management System employee.php cross site scripting (CVSS 5.1, SourceCodester Employee Management System)
- [CVE-2025-1904](https://cve.now/CVE-2025-1904.md): code-projects Blood Bank System A+.php cross site scripting (CVSS 5.1, code-projects Blood Bank System)
- [CVE-2025-1307](https://cve.now/CVE-2025-1307.md): Newscrunch \<= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 9.8, spicethemes Newscrunch)
- [CVE-2025-1306](https://cve.now/CVE-2025-1306.md): Newscrunch \<= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, spicethemes Newscrunch)
- [CVE-2025-1903](https://cve.now/CVE-2025-1903.md): Codezips Online Shopping Website cart\_add.php sql injection (CVSS 6.9, Codezips Online Shopping Website)
- [CVE-2025-1902](https://cve.now/CVE-2025-1902.md): PHPGurukul Student Record System password-recovery.php sql injection (CVSS 6.9, PHPGurukul Student Record System)
- [CVE-2025-24309](https://cve.now/CVE-2025-24309.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-24301](https://cve.now/CVE-2025-24301.md): Arkcompiler Ets Runtime has an UAF vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-23420](https://cve.now/CVE-2025-23420.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-23418](https://cve.now/CVE-2025-23418.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-23414](https://cve.now/CVE-2025-23414.md): Arkcompiler Ets Runtime has an UAF vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-23409](https://cve.now/CVE-2025-23409.md): Communication Dsoftbus has an UAF vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-23240](https://cve.now/CVE-2025-23240.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-23234](https://cve.now/CVE-2025-23234.md): Arkcompiler Ets Runtime has a buffer overflow vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22897](https://cve.now/CVE-2025-22897.md): Arkcompiler Ets Runtime has a buffer overflow vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22847](https://cve.now/CVE-2025-22847.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22841](https://cve.now/CVE-2025-22841.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22837](https://cve.now/CVE-2025-22837.md): Arkcompiler Ets Runtime has a NULL pointer dereference vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-22835](https://cve.now/CVE-2025-22835.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-22443](https://cve.now/CVE-2025-22443.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-21098](https://cve.now/CVE-2025-21098.md): Liteos-A has an insecure storage of sensitive information vulnerability (CVSS 5.5, OpenHarmony)
- [CVE-2025-21097](https://cve.now/CVE-2025-21097.md): Arkcompiler Ets Runtime has a NULL pointer dereference vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-21089](https://cve.now/CVE-2025-21089.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-21084](https://cve.now/CVE-2025-21084.md): Arkcompiler Ets Runtime has an NULL pointer dereference vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-20626](https://cve.now/CVE-2025-20626.md): Arkcompiler Ets Runtime has an UAF vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-20091](https://cve.now/CVE-2025-20091.md): Communication Dsoftbus has an UAF vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-20081](https://cve.now/CVE-2025-20081.md): Communication Dsoftbus has an UAF vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-20042](https://cve.now/CVE-2025-20042.md): Liteos-A has an out of bounds read vulnerability (CVSS 5.5, OpenHarmony)
- [CVE-2025-20024](https://cve.now/CVE-2025-20024.md): Arkcompiler Ets Runtime has an integer overflow vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-20021](https://cve.now/CVE-2025-20021.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-20011](https://cve.now/CVE-2025-20011.md): Communication Dsoftbus has a memory leak vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2025-0587](https://cve.now/CVE-2025-0587.md): Arkcompiler Ets Runtime has an integer overflow vulnerability (CVSS 3.8, OpenHarmony)
- [CVE-2025-1639](https://cve.now/CVE-2025-1639.md): Animation Addons for Elementor Pro \<= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation (CVSS 8.8, crowdyTheme Animation Addons for Elementor Pro)
- [CVE-2025-1321](https://cve.now/CVE-2025-1321.md): teachPress \<= 9.0.7 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, winkm89 teachPress)
- [CVE-2025-0912](https://cve.now/CVE-2025-0912.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.19.4 - Unauthenticated PHP Object Injection (CVSS 9.8, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-13686](https://cve.now/CVE-2024-13686.md): VW Storefront \<= 0.9.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset (CVSS 4.3, vowelweb VW Storefront)
- [CVE-2025-1901](https://cve.now/CVE-2025-1901.md): PHPGurukul Restaurant Table Booking System check\_availability.php sql injection (CVSS 6.9, PHPGurukul Restaurant Table Booking System)
- [CVE-2025-1900](https://cve.now/CVE-2025-1900.md): PHPGurukul Restaurant Table Booking System add-table.php sql injection (CVSS 6.9, PHPGurukul Restaurant Table Booking System)
- [CVE-2025-1899](https://cve.now/CVE-2025-1899.md): Tenda TX3 setPptpUserList buffer overflow (CVSS 7.1, Tenda TX3)
- [CVE-2025-1898](https://cve.now/CVE-2025-1898.md): Tenda TX3 openSchedWifi buffer overflow (CVSS 7.1, Tenda TX3)
- [CVE-2025-1897](https://cve.now/CVE-2025-1897.md): Tenda TX3 SetNetControlList buffer overflow (CVSS 7.1, Tenda TX3)
- [CVE-2025-1896](https://cve.now/CVE-2025-1896.md): Tenda TX3 SetStaticRouteCfg buffer overflow (CVSS 7.1, Tenda TX3)
- [CVE-2025-1895](https://cve.now/CVE-2025-1895.md): Tenda TX3 setMacFilterCfg buffer overflow (CVSS 7.1, Tenda TX3)
- [CVE-2025-1894](https://cve.now/CVE-2025-1894.md): PHPGurukul Restaurant Table Booking System search-result.php sql injection (CVSS 6.9, PHPGurukul Restaurant Table Booking System)
- [CVE-2025-1695](https://cve.now/CVE-2025-1695.md): NGINX Unit Java Vulnerability (CVSS 5.3, F5 NGINX Unit)
- [CVE-2025-1893](https://cve.now/CVE-2025-1893.md): Open5GS AMF gmm-sm.c gmm\_state\_authentication denial of service (CVSS 5.3, Open5GS)
- [CVE-2025-1892](https://cve.now/CVE-2025-1892.md): shishuocms Directory Deletion Page add.json cross site scripting (CVSS 4.8, shishuocms)
- [CVE-2020-23438](https://cve.now/CVE-2020-23438.md): Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation. (CVSS 7.8)
- [CVE-2021-41719](https://cve.now/CVE-2021-41719.md): Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using (CVSS 7.5)
- [CVE-2024-48248](https://cve.now/CVE-2024-48248.md): NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may l (CVSS 8.6, KEV, NAKIVO Backup & Replication Director)
- [CVE-2024-50704](https://cve.now/CVE-2024-50704.md): Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code v (CVSS 10.0)
- [CVE-2024-50705](https://cve.now/CVE-2024-50705.md): Unauthenticated reflected cross-site scripting (XSS) vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute a (CVSS 7.1)
- [CVE-2024-50706](https://cve.now/CVE-2024-50706.md): Unauthenticated SQL injection vulnerability in Uniguest Tripleplay version 23.1+ allows remote attackers to execute arbitrary SQL queries on (CVSS 9.8)
- [CVE-2024-50707](https://cve.now/CVE-2024-50707.md): Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code v (CVSS 10.0)
- [CVE-2025-25426](https://cve.now/CVE-2025-25426.md): yshopmall \<=v1.9.0 is vulnerable to SQL Injection in the image listing interface. (CVSS 7.2)
- [CVE-2025-26091](https://cve.now/CVE-2025-26091.md): A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to execut (CVSS 4.6)
- [CVE-2025-26136](https://cve.now/CVE-2025-26136.md): A SQL injection vulnerability exists in mysiteforme versions prior to 2025.01.1. (CVSS 9.8)
- [CVE-2025-26182](https://cve.now/CVE-2025-26182.md): An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file (CVSS 6.5)
- [CVE-2025-26202](https://cve.now/CVE-2025-26202.md): Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands) in (CVSS 4.3)
- [CVE-2025-26318](https://cve.now/CVE-2025-26318.md): hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected (CVSS 5.8, TSplus Remote Access)
- [CVE-2025-26319](https://cve.now/CVE-2025-26319.md): FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments. (CVSS 9.8, flowise)
- [CVE-2025-26320](https://cve.now/CVE-2025-26320.md): t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address parameter at /device/ping. (CVSS 6.5)
- [CVE-2025-26849](https://cve.now/CVE-2025-26849.md): There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. (CVSS 4.3, Docusnap)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.